Overview

overview

7

Static

static

3

2026-10-20...ar.exe

windows10-2004-x64

7

2026-10-20...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/10/2026, 08:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-20_1e53db788697de9c127e424787c6f24c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  • Size 2.9MB
  • Sample261020-kkcs9sft6x
  • SHA256 5681820e60cac96e7581ea1372eda2ee8f0f92b637f6682b50d49a6816f8dbed
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 23 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-20_1e53db788697de9c127e424787c6f24c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-20_1e53db788697de9c127e424787c6f24c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5656
    • C:\Users\Admin\AppData\Local\Temp\2026-10-20_1e53db788697de9c127e424787c6f24c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-20_1e53db788697de9c127e424787c6f24c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x320,0x324,0x330,0x32c,0x334,0x7ff6d538a6a0,0x7ff6d538a6b0,0x7ff6d538a6c0
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1688

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DisabledGoogleUpdate.exe
        • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
        • Size 1.3MB
        • SHA256 47be32126675b5f51e372618c75028cbd169338801d7171600dfb9cca3142051
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 89cf9cb6d5932b11964b07d8e632df995e1cd3dd57a2a990ae9f16631fee89cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1021KB
        • SHA256 659e3b853c30a6e326443eabac75c709593b6bd55b610e1733219eb1c135806e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 1001KB
        • SHA256 02a5036b8a236b689b710e4c5698b06181ce9ecd6d2c18d0b578c1af4b826003
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 6acb08b19ae604e451d9edc2c29fd141693cf87290c5f7f233aa191619aeaa93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 eeac2930ab6ca96360140dc295b3dc33e7471fabf55f4be112bcc45b552ae7a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 aed954b37401e595478ff4c34ad55f8235349cfe2d2f76a28eaafc3278ee160f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 46de78ba79fc9728cc5af398428d232feaab5fe66088de8242efa0fbc57f5942
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 bf803648bd21054542f5563407893daf6c3f0179b28a66381c116d22aec02247
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        a9eeb544b68fd3f0.bin
        • Path C:\Users\Admin\AppData\Roaming\a9eeb544b68fd3f0.bin
        • Size 12KB
        • SHA256 dae89744b1e385f996a86aba302e3e0a91b8098e05b448f11ae7722b15688e21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 782KB
        • SHA256 236ff63116a502e085dfdd0183a4450716b869520e5916c876c2c1496b2eae52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 350caa0fa95cb7a364c514d15c8f7c32735dff1ae117055c6bac94f4b827be41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 836KB
        • SHA256 c72f6cf1f17ea82406e8ded5466b68548ae12eb8f7c45ea8cce7f3047004c59b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 800KB
        • SHA256 9f1deac2edb385261c25e0755318a930b7ffb12d1211e5eca8491faaff86598f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 5765d210634a04a68599492d6f5e641d7866a2d5dbede466717a483439292d53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 1004KB
        • SHA256 ae7365c29fde8d6906780dd57060dc01ec9658177ad12ecedadc0e68baf6ceca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 f378dfc1edbdf7ae54f87c054f404c0e60bbe883c68b5d16545049b495550690
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 dba1366cb038279ac3a60cf8a54f73ae305b86ea446ff319800a1cf26767ab93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 8808cc7edbdad559c156d8216637f0f1b3a230b8230a25a08a1e5e1800bcdf0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 580a3fa4caa88fc1f10b338228c7055cf2e7078f4e5f4797036aab3b995c0e92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 7c6a3623574f936bf8e43db29ec0aee13ba7c357ffc4e53ffacf938b1bf7e91c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.2MB
        • SHA256 b674f4b7a02072839cfee925518da354f178f4a533536b06abb440f001122de7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 952KB
        • SHA256 ca8889b781a435416834ab23f1b50a1331a3712b904c668c6bbbfe238ac1d443
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 936KB
        • SHA256 d335fa65340efa4825b0f3725a7334b9f23f4a0b6e64b3449bc18728ef836933
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 944KB
        • SHA256 e74acdd155cd62a81cbe917ad58adb93a5b8faa99ee991003a0aef5ee1bec5d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 808KB
        • SHA256 d58d2b75f98c01b25038c02008b3af42bdbabd0df7875ba811aeb12e335cc6dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 8392722fb43e83f71421814ef1011c8dd5023f7a3f8453d904439bcbd1b55555
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 968KB
        • SHA256 20e4a8233f01b6720f3efba94cd1f77d919b5b14f00b7a6248abea1b9e0d86ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 0c6278f547112cd2a57d5fb60e4f1eac30dc8bc33a5e67ada282891ff9ab6d19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\system32\AppVClient.exe
        • Size 1.5MB
        • SHA256 23ee649d59aa7d2103b9ffe1e5540a1559aa832f4ecdca61cbf95f32fe8d7424
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1688-12-0x00000211B05D0000-0x00000211B0654000-memory.dmp
        Download

        memory/1688-10-0x00000211B05D0000-0x00000211B0654000-memory.dmp
        Download

        memory/1688-11-0x00000211B05D0000-0x00000211B0654000-memory.dmp
        Download

        memory/5656-0-0x0000012F328C0000-0x0000012F329C4000-memory.dmp
        Download

        memory/5656-3-0x0000012F32B90000-0x0000012F32C14000-memory.dmp
        Download

        memory/5656-18-0x0000012F32B90000-0x0000012F32C14000-memory.dmp
        Download

        memory/5656-2-0x0000012F32B90000-0x0000012F32C14000-memory.dmp
        Download

        memory/5656-1-0x0000012F32B90000-0x0000012F32C14000-memory.dmp
        Download