Overview

overview

7

Static

static

3

2026-10-01...ar.exe

windows10-2004-x64

7

2026-10-01...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/10/2026, 20:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-01_fe1c2af1b7607aad04524cf0fee03cd4_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  • Size 2.9MB
  • Sample261001-y2vbjayt6q
  • SHA256 1cf813858f1a08ffe146091574a5cba4325f08b8876f09160d44e2cae8c208cc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 23 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_fe1c2af1b7607aad04524cf0fee03cd4_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_fe1c2af1b7607aad04524cf0fee03cd4_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4108
    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_fe1c2af1b7607aad04524cf0fee03cd4_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-01_fe1c2af1b7607aad04524cf0fee03cd4_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x320,0x324,0x330,0x32c,0x334,0x7ff6040fa6a0,0x7ff6040fa6b0,0x7ff6040fa6c0
      2⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1780

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DisabledGoogleUpdate.exe
        • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
        • Size 6.4MB
        • SHA256 a94eb2cc5988bf8d1d4190695ada4c0e8261c2bb76888455cfe4f54d55f75f4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 8bae05750aad65a44357af70cef424415d9f16eb8a857de6288d0d5610d38264
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 e15addcd6dbc62e2eac63b916f0b2e424f07163b995e14867c4af819d5ec448a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 0ac97a128bf4ed5ffd8a5611f34c4a54b376f6867ee41ef33cacb5571f96c575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 107142e599cef24f8569e5d640f60bfb538791633705b8af217b2a69331deb67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 24b1404f1b6178da26e0b39a14e6808013c9dfa7f44f54ca80a5dc507c346730
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 3c07367e128d5e7ac277097b8c24e4dcffa9cef42c4dc3adb9c54f6e0ee07d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 aab7a2f1561e84c7c35bfc7267ef8d735cf1aaa6b43943800aebdf560ee4fc77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 a486b64cdda7d4ac86df1f52528a0151fbf1218f9208c11f50ea0094b44887dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        3e24785a7465cd71.bin
        • Path C:\Users\Admin\AppData\Roaming\3e24785a7465cd71.bin
        • Size 12KB
        • SHA256 3e61fa2c3d11736abf31bbeeed122c1e9d50c0a32047ff6c900304024f6cbf8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 04ee0ae5d4a018131df5d875bcf507bca242e5fb4657418830fb9d75b9599a9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 220b0c507410660162d15770db61593c8e7fd80ee368b9eb26ec2a0eb791ef59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 828KB
        • SHA256 d42c16136e40f7faa330660ffe4f5ef47e790a27311fe8eb9fb075b86bfb5c1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 792KB
        • SHA256 e397375dd41dabfe28cb87ac795b8077a2c7d509cb622a1854ad3d42b92da13c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 189bdc1cf5bef0815d1f47d7f449ca64484a2162d137b4d93844d54d4b1a69f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 996KB
        • SHA256 d549058d432f9026cad26357212d3207e0a2cc123953029ef9cd1177cce4e8da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 7821130e94d91528878d13d5f35a04bab4c1aba2a9bbc481514e746f3234c340
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 27edca721646b3fee425132635e64a98d6d49829f7cf357483be4d093b0d2c65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 144774fb4137d234c4cf7a53c1b74571a42f4eaee814582f0b6b75b4aa0dead8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 6926918c98bf3e0ec62185148d822792efbc2d935981d078a03c35f49196a8b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 d40d43658a93343ac771e25745abd3ff3a065b1443b7accf19f9ca57ad1cbb95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 d2997f4c80d111838c0343bb70d2e24b850ab9eef146f13fe3a63bdeb939a2b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 944KB
        • SHA256 df2a525d073f6633b5f1fed06ee5398862ad5933a1c4c0c6435f7d6a0c2320a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 928KB
        • SHA256 99cc86380fe9a0ffb66b1f4fdb13eba5b8a3df25a69d0f5d0a8e85f4d214b763
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 936KB
        • SHA256 2bc77851178220d3ade15d5fd27a67a780341328d105c2b6ddce708c9c894513
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 800KB
        • SHA256 a5a1b4c6f2d7b0e61602575a01499df1ad5a7b1e185cc3522bbb1dbd460a2ff8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 fbade005e42453ece2ddeb63ba5b872c5dbec98c375fb626fbc41e4b0d722eb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 960KB
        • SHA256 9979937221b634fd63f3c8d82788fe4d123c2ba0e8ec5ea7c4fd9b77d8dc0372
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 534dbb49edb06c968c46be97f6bbb674c89acd273775826349c77623ab70f160
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\system32\AppVClient.exe
        • Size 1.5MB
        • SHA256 47d2c37d2178d37854b15795f6b95c9a4c402712eada63dbe1bbde0e78a14d30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1780-12-0x0000023862E40000-0x0000023862EC3000-memory.dmp
        Download

        memory/1780-11-0x0000023862E40000-0x0000023862EC3000-memory.dmp
        Download

        memory/1780-10-0x0000023862E40000-0x0000023862EC3000-memory.dmp
        Download

        memory/4108-2-0x00000203C9920000-0x00000203C99A3000-memory.dmp
        Download

        memory/4108-18-0x00000203C9920000-0x00000203C99A3000-memory.dmp
        Download

        memory/4108-1-0x00000203C9920000-0x00000203C99A3000-memory.dmp
        Download

        memory/4108-0-0x00000203C96F0000-0x00000203C9807000-memory.dmp
        Download

        memory/4108-3-0x00000203C9920000-0x00000203C99A3000-memory.dmp
        Download