Overview

overview

7

Static

static

3

2026-10-03...ar.exe

windows10-2004-x64

7

2026-10-03...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/10/2026, 23:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-03_f5b7ac8c40f9f934cdce4989101bd5f5_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  • Size 2.9MB
  • Sample261003-3cmbvaz1cs
  • SHA256 e6ec68c8ea50c511e83f8a38d4203219a65856b19cdc54f0bbd4a04dd9de342f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 23 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-03_f5b7ac8c40f9f934cdce4989101bd5f5_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-03_f5b7ac8c40f9f934cdce4989101bd5f5_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5952
    • C:\Users\Admin\AppData\Local\Temp\2026-10-03_f5b7ac8c40f9f934cdce4989101bd5f5_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-03_f5b7ac8c40f9f934cdce4989101bd5f5_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x324,0x328,0x334,0x330,0x338,0x7ff7e37ba6a0,0x7ff7e37ba6b0,0x7ff7e37ba6c0
      2⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4352

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 ae784c7347c4c728220566ed1142832b9e09e1c0ddbcba28926912b9fbc4838b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1021KB
        • SHA256 ccc44f997414ec4472d2f4385ef3f3c8ee879de31900f0cf4a810278980af3b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 1002KB
        • SHA256 268429eeb139e7eb6c030f586cf51baf6ad70b216c48f01fbe7adb22b5b41f61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.6MB
        • SHA256 6d1dc721257467630d12843e9a5ef10f23bf71061afc70e329d32a18db253854
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 055e107b2f14848b7c944f6db5a36216e828959e47266a927ec4e864cfbb5e9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 fd035a5be65124017e9366166f305bb4563fc42c509278485b4157460dc943d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 e32436b9563540c69d22524f8f335957ea17e871c0d1be93e31997231a477dea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 a72b90fa17968955f191d7da5e44a6274f1bcece4c544c57df9878c65331287e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e34a6b6b3ebf6fe8.bin
        • Path C:\Users\Admin\AppData\Roaming\e34a6b6b3ebf6fe8.bin
        • Size 12KB
        • SHA256 3be7b36e962b019e56085828873fcdaf0ab93a59480ebc122ac3c431487a564e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 782KB
        • SHA256 a82930a5be963f59f31d13ed14e674805e221461709861e1ecc712d38117c37b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 0bcc193d154b3d9c31fd2075221715588a3f9682c064125cb6a2d4d9e3259275
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 836KB
        • SHA256 8600c33f47af06472eb04a7fb834cccee000a9b9e35ad6f355d80fccef09d471
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 800KB
        • SHA256 8c4a0b449dc3a7253ca7932b63e7775250ba42565ea47f10e9dccd6d080d853d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 62395430530a08f0155c5402746b99a47608a9a1751f6514b78edf5029070cea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 1004KB
        • SHA256 8e1fbdcad81e7919d121417b4324e13f841c44b84aaf265753a7d8a99dacc5cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 d69b1dde6f86eb48565c1810d221085f6ce471ce9675432abc83185cd4895e87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 09642ea0e041d680df960c4ba338cbb8db2e79ae5a282009ab7f2684e0c86cb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 64cf80c859e2adb177eb7fc959d21d224a920ecd216baee43ea56b1c5c0e4f6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 b0ac170cf30147600c53068e33ad8f9a24e14b13fcd247f7c3e5e550d9b14c5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 b18f4ecd321d8357a3cbb90838601d511e66cf01ab1abe32cb6e2e7ae20ecaf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.2MB
        • SHA256 55d388b9a401e9016d62039c12b59618bc6c963e2ce32233d6498810e1cbde1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 952KB
        • SHA256 7d043a636e442f1235a96d5855f0ea0f7e1d04bae0ab536ce95b34639fbc240a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 936KB
        • SHA256 34d97532ca89292f975125e281294d0396f11997078c5276655eced27ca12416
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 944KB
        • SHA256 9abf76cfbaaff078b6b22c06a46aacac56c37320ce344b15c63559c26cd6d32f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 808KB
        • SHA256 db102d3fdf31604daf03167ba8dd54dcf08da42adeef9f3e9eb0273f3e516c22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 f1a5e9214fe6d8ff7f09f2a9329dc8351ac2028b1b7747a4a59db196ee21a1bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 968KB
        • SHA256 2672cfee0003839e3058a736f8e1415644c1a8bae5fb3f64a61d8b193505ebfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 c09bec0a2132d06cfb916974e7cc579b15332279731ddadb42d49347cdd9e015
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\system32\AppVClient.exe
        • Size 1.5MB
        • SHA256 abe676fd0fc3e7e154a0585f7cc05cb2843a41989d7180c40a000eb9d8d32b23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4352-10-0x0000015904270000-0x00000159042F4000-memory.dmp
        Download

        memory/4352-12-0x0000015904270000-0x00000159042F4000-memory.dmp
        Download

        memory/4352-11-0x0000015904270000-0x00000159042F4000-memory.dmp
        Download

        memory/5952-1-0x0000015CA1830000-0x0000015CA18B4000-memory.dmp
        Download

        memory/5952-19-0x0000015CA1830000-0x0000015CA18B4000-memory.dmp
        Download

        memory/5952-4-0x0000015CA1830000-0x0000015CA18B4000-memory.dmp
        Download

        memory/5952-0-0x0000015CA30C0000-0x0000015CA321E000-memory.dmp
        Download

        memory/5952-2-0x0000015CA1830000-0x0000015CA18B4000-memory.dmp
        Download