Overview

overview

7

Static

static

3

2026-09-29...uk.exe

windows10-2004-x64

7

2026-09-29...uk.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/09/2026, 17:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_c4a79e9f3206263e26586625690b2e76_icedid_mespinoza_ryuk.exe
  • Size 1.5MB
  • Sample260929-vk94wabe89
  • SHA256 bad897167d47ed5aeed887ee61892578fde95a2b3e71f795c71bc3ab51b0f45d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
persistencespywarestealerupx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 20 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_c4a79e9f3206263e26586625690b2e76_icedid_mespinoza_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_c4a79e9f3206263e26586625690b2e76_icedid_mespinoza_ryuk.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4948
  • C:\Program Files\VMware\vmtoolsd.exe
    "C:\Program Files\VMware\vmtoolsd.exe" kernel32.dll,Sleep
    1⤵
    • Executes dropped EXE
    PID:2592
  • C:\Users\Admin\AppData\Local\Temp\msiexec.exe
    C:\Users\Admin\AppData\Local\Temp\msiexec.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:5048

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 ad8bc752d3c75bdfb5d7457e5aa011b47e227149431d44b34f21f58f87e9c4f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1021KB
        • SHA256 417b16602cb51b1eb000982dba6dbbd923d95e6168c5c9a16b3d8497263fb892
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 1001KB
        • SHA256 7b57997d4bc0ada157188b0367a979a9ca4e3a12c3adf9a11aab307d94d8467b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 627dcefd1a67f6fc903c9ed1fff87d613fdccda007c0b4763befdf289a2d0435
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vmtoolsd.exe
        • Path C:\Program Files\VMware\vmtoolsd.exe
        • Size 88KB
        • SHA256 4b84dc6750937eb47b19cde0d23debd4d2f2211300171b36d13ef5ad11dd60f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 634a5fd2cea8df8939db48b1f0c2e0574a8e64b319c9e1afece33195e98a500c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 99e3664b9a94cc3832b2ab51b97f2113179573f1a2e1a44b7c71d69317bd6c6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 77403d3685af5a5f81ed1d073884be5e194f3333b24a3dfd7e510e352ed4491b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Users\Admin\AppData\Local\Temp\msiexec.exe
        • Size 176KB
        • SHA256 5872fe75e96a1c653972421c5874e19ea6181a08bed623c269fd3576c2bb707e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 782KB
        • SHA256 e47c2d80940fc21b29182cd2d667b896a5a25657ebb9f38bef734784c75f5c9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 c68385923c2a0dd9aea8ca403ecfc48be8233d54a4802d4d3d83c0304335356c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 04767fb570a91b3bcfc8ec32dade1582e7dbae1a44cd533e2998918c3c804604
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 836KB
        • SHA256 d1201d033b5cdb12ba033386920a3e88cae4ff4dd1eed13d323622edc0c3094f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 800KB
        • SHA256 d148e9616ed69920ae5b83c634baa538fbfd45fbee26e6a640f34c0c2910611f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 81433cb331fb9e362911b92f77f266ecba41883678126f30f5100c17d53e73d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 1004KB
        • SHA256 d21906d02f6938fe2b75ae9ab3e146927fe78ea6570d62b62aa356430ca30cae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 4e7d1276979feda6ccd89da3b76a4fab4238d7070860cf2a1944f4ddd3aa9684
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 78e7694414976d08f0bfa1df825d2efe8f750eb02bdbd3ca7a2e73d51c6e7047
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 79e5a6b4e30c21aa8bdae398e257964c418d1d3647fe3c3c0320ed99433d97d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 bd7016267687323e03136dad60fc2889c8f3df49f9c16c3eb4f8a7783627f618
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 da1443381c4b1a6a40ada1e4b057cf35941fd6368f2b928b5e53be1c021fc086
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.2MB
        • SHA256 1e5402444a9cf6fbcd6691bae23846eb25364ae3287c240e6b156c463a48a26d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 952KB
        • SHA256 f784ca143fbbfcd7a8aff3cae6c4ad426d5201ee7a868bd60f2e0d64c39364d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 936KB
        • SHA256 1d86b2ca5c423f55888014e2a4fab217b8209739de60dd1c564569cf0b6a6ba8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 944KB
        • SHA256 88419f7d9520715212096a1213c43ec057bf2734f4cb1e78fa9435da2f0f56da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 808KB
        • SHA256 c454daddd3df23cba0dedde7ddd5ff1c0b04179aa2ec7b11910a37e3772c993a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 e2f20ca0f3e359906c69090b601470b5a74c16325762180494071a5bb5460df9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 968KB
        • SHA256 a6d9f6469d2b3428e832d8617134fd2335cd524186fca6c9d2481b403605dd82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 e990f97da803889f7d6d77680e8d2e6d122d99ad2d7d2e1668746aaf362d5407
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4948-4-0x000001B8ADB10000-0x000001B8ADB93000-memory.dmp
        Download

        memory/4948-5-0x000001B8ADB10000-0x000001B8ADB93000-memory.dmp
        Download

        memory/4948-3-0x000001B8ADB10000-0x000001B8ADB93000-memory.dmp
        Download

        memory/4948-2-0x000001B8ADA50000-0x000001B8ADB0F000-memory.dmp
        Download