9e7d96a68029ee55a1ade4b13675283cbb3b8ea838edb1a79aa4c2b39023c024

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_0c9d0502d19e940f72756d6bd92c1c73_cobalt-strike_icedid_njrat_ryuk_satacom.exe
Size 3.8MB
Sample260930-rc7f8sterd
SHA256 9e7d96a68029ee55a1ade4b13675283cbb3b8ea838edb1a79aa4c2b39023c024
MD5 0c9d0502d19e940f72756d6bd92c1c73
SHA1 96c6d4ed4a7776438b9f4446f8329af2bc467e1e
SHA512 9badbf6c342b2c33411ecb3e1d27664582159dde9e708d230eb004888232b3cd94793766845ee51d075bf3d360322cb3c5a27ce7b1dff8c2b3fa7364b7c400c8
SSDEEP 49152:0fZ1DKPzWz5cNvx0hjhvFPz+RS5V+swpk1atMY0mT+No9sdnUkdohKn6zTokrgTe:wNKgcl4KY5VZIT+nnUkGHjrgTFlF2
TLSH
T13D068D13F2D901D8D06ED2788B6A8233EA72BC458B35B6DF0A5076251F76EE45B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5056	alg.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-09-30_0c9d0502d19e940f72756d6bd92c1c73_cobalt-strike_icedid_njrat_ryuk_satacom.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5076	2026-09-30_0c9d0502d19e940f72756d6bd92c1c73_cobalt-strike_icedid_njrat_ryuk_satacom.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 892	5076	2026-09-30_0c9d0502d19e940f72756d6bd92c1c73_cobalt-strike_icedid_njrat_ryuk_satacom.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-09-30_0c9d0502d19e940f72756d6bd92c1c73_cobalt-strike_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_0c9d0502d19e940f72756d6bd92c1c73_cobalt-strike_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=154.0.8037.59 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x14031c418,0x14031c428,0x14031c438
  2⤵
  PID:892

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 b413c113670c6aef76604732b4e85ec4bc77c11b9b32ef369ddacbe365d3ef8e
MD5 797ccddbec32bca5dccdb8be2aa14fc4
SHA1 803bd806a6d8b16c5fbafb16bb415441d2bbfb13
SHA512 5c4edde6c842edbc695c206bbf0dd583b6110fba42e06ed2c7b3e96bb9572d647183470d0d21a792fd09f5cf52d6ca3a1379169af5d06bc249752e4e7701b8d8
SSDEEP 12288:yEP3R/XzDOkfbJTlrTadaYzMJjQMBMMIIUnAqMt4wcVrv8HUZ:x/ukzHSdTCQSMbnAqMtdcVrvOu
TLSH
T18545122D276DA0F6D936903DC6958246C372F4B1AB5263EF0690C13D4F77AEA6D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5056-17-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/5056-18-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/5076-6-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/5076-8-0x0000000140000000-0x00000001403FA000-memory.dmp

Download

memory/5076-0-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/5076-12-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/5076-14-0x0000000140000000-0x00000001403FA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads