Overview

overview

7

Static

static

3

2026-10-16...ar.exe

windows10-2004-x64

7

2026-10-16...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/10/2026, 17:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-16_542c80d92cc16c2512963cc226045648_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  • Size 2.9MB
  • Sample261017-vwrrnsaz2x
  • SHA256 79a5898c5f6745f7454951831656fc1e6f2719290b832ffef1a9a95ccc21fe28
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 33 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-16_542c80d92cc16c2512963cc226045648_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-16_542c80d92cc16c2512963cc226045648_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2504
    • C:\Users\Admin\AppData\Local\Temp\2026-10-16_542c80d92cc16c2512963cc226045648_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-16_542c80d92cc16c2512963cc226045648_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x328,0x32c,0x338,0x334,0x33c,0x7ff716d6a6a0,0x7ff716d6a6b0,0x7ff716d6a6c0
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5780

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        java.exe
        • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe
        • Size 1.0MB
        • SHA256 902a7e4f4b73ea5d879df6ad43bba7528a5bec23512dc0810b4fcc4905a89923
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe
        • Size 1.0MB
        • SHA256 f2ae38e979c22b14ed103846f12f5c1c3d4052f1adeb9dbd92c2ec02a32bc952
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe
        • Size 1.2MB
        • SHA256 d990db2ff039180fa1907eeddb2f8f1f625888e4c005dfa8818c70a70b3f1830
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DisabledGoogleUpdate.exe
        • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
        • Size 6.4MB
        • SHA256 6c00eec42f1fb51bc736df81f9409a47863a7414a987cc15e5997c01395d1ada
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 20b371b89bf80f23909b586e590b809f04d0d93f02d85c9417ec3520c7a20445
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
        • Size 820KB
        • SHA256 bce6d9bcaca834736d338dc518c2124befadfd33085dae6638eb79a956316bde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 35b26aeab53446f9c70f847872f44870c50828c24cbf8d47824923c6fa1ab679
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 625bc3b9358a79c8862e892b677e03d60f960923c4853446ba30586222923aee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 b9030897110723ca771c143ac0b35a44af7326353f5e6d461daf853ad4d552dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 a9da9d038026157c73068ecc8ad1115dd7f1bac7ef3fabfb16b477a0dda244b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 144b7336cd33d07ee12ae2443a498e6aede6d80ddf25bc9a30be9971344bbe55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 252597a68bd239810ebef71c28270de9f7c874cd968490ea6649587c83980b57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e963ba663a35217a.bin
        • Path C:\Users\Admin\AppData\Roaming\e963ba663a35217a.bin
        • Size 12KB
        • SHA256 f669ad113dc9236bb60d23eb7afeccf4d4577b32fc66b30176430353385ce2e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWow64\perfhost.exe
        • Size 779KB
        • SHA256 f9db916ff0d48b3c083d66f9788076b96cc8d6ba8235bf7fce00a9e1d33d6110
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 bf7118b74047bb66475591dcfcd22811b4567d0e5c69f0de944f3eb1cee39d02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 832KB
        • SHA256 57b89a5e31fef7ae581e99f704b571148ecadd511a4a6287caf23adee045c6cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 d1fc4a1845b1680d00cde3b390884cc36e3af0fe5c435b0db9afc38a290c2922
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 5805c2bbfe56272cd4093963c4cbf2faa9f0639c044d1019fff89203c52b3175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 d1d50cc68871c0537d5191e818ab5679da1637dfd5b87c2a9469373ae44a64b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 7ddaa7d14f0a0603df39f8a199bf6c7f228df7da99d7d18c791ca3adc2d59126
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 a678224cc8405f017e64b89a9d2498b68472475b20a5e0dfa5d2b209ae97b182
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.2MB
        • SHA256 d0cf2ab663eb1355d8c754354807efeafc67dd9e9970ccf7672625ddc5c653a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 948KB
        • SHA256 a0250bb1c9975adc31b27a162fbff2d2c4a9a0e79e27607d4ce72c724aed8762
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 932KB
        • SHA256 b806e31a592b0328f8d599e7ab921bd7e1f1d1e1336960cccaf0083fcc4e16c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 804KB
        • SHA256 1d4aea57267e9330caca20d7c6cb7405ce315db98e1fddf6e7927e3b7ce1693a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 00ad5826ab9fe06bff47dfdf100a4833acd9d9ffb8a72d220ee51edac70d07e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 964KB
        • SHA256 291f8eb10ba70f8340f3cecc2e04f1a10fdaa6d0c2d8eb3065b3f488667270af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 1d03058937efa533a69fdc07ea6e6e745bd673723423b29a8c6696023619e0f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\system32\AppVClient.exe
        • Size 1.5MB
        • SHA256 734574a173144122aada6084ce328841b4e7238b452e6314aa3596e95a2f43f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 1000KB
        • SHA256 0e324c3e26785921cdb791658ee9dae3b1585a0cd6c37955b9d89f147447d71f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 0f63228f7c2323c38b23825d04f957cd3e50d39c28c556936f7a91dac969c258
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        locator.exe
        • Path C:\Windows\system32\locator.exe
        • Size 796KB
        • SHA256 3870e6c9ea6ac8b1d30cf196da98a1031c3c7608d46be80c77cccd34102955bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\system32\msiexec.exe
        • Size 940KB
        • SHA256 805950968e2a2cc75ac248744dfbb7d08b155dc8a3f89dd19549f25076a53530
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
        • Size 998KB
        • SHA256 8d025fb9fc186f9d105e3918219479ce12491391ba17c829d66b7a796964aed3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2504-18-0x000001E2E6620000-0x000001E2E66A3000-memory.dmp
        Download

        memory/2504-0-0x000001E2E6400000-0x000001E2E64D3000-memory.dmp
        Download

        memory/2504-1-0x000001E2E6620000-0x000001E2E66A3000-memory.dmp
        Download

        memory/2504-3-0x000001E2E6620000-0x000001E2E66A3000-memory.dmp
        Download

        memory/2504-2-0x000001E2E6620000-0x000001E2E66A3000-memory.dmp
        Download

        memory/5780-11-0x00000235EF420000-0x00000235EF4A3000-memory.dmp
        Download

        memory/5780-12-0x00000235EF420000-0x00000235EF4A3000-memory.dmp
        Download

        memory/5780-10-0x00000235EF420000-0x00000235EF4A3000-memory.dmp
        Download