Overview

overview

7

Static

static

3

2026-10-21...ar.exe

windows10-2004-x64

7

2026-10-21...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/10/2026, 21:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-21_740fada5394d2f45fda4779ece49c501_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  • Size 2.9MB
  • Sample261022-1bf3bsfx3w
  • SHA256 c4affd77f933e29ef1d7e4f553cf2af74fcc51a30eb2f495901186dd38cb85ac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 25 IoCs
  • UPX packed file 28 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-21_740fada5394d2f45fda4779ece49c501_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-21_740fada5394d2f45fda4779ece49c501_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:680
    • C:\Users\Admin\AppData\Local\Temp\2026-10-21_740fada5394d2f45fda4779ece49c501_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-21_740fada5394d2f45fda4779ece49c501_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x30c,0x310,0x31c,0x318,0x320,0x7ff636cba6a0,0x7ff636cba6b0,0x7ff636cba6c0
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2272

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        java.exe
        • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_157859\java.exe
        • Size 1.0MB
        • SHA256 940c45f98cffc8ddbf610ae32c85600ab0229b01fc4223d40198ffe454e15c54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_157859\javaw.exe
        • Size 1.0MB
        • SHA256 382b818642ab678bdd2f81a6070daab17eabe694b2d6e7081c1839ae45a22687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_157859\javaws.exe
        • Size 1.2MB
        • SHA256 647886ff375a580d28bd6730c7c1e7ca86448894532369b29b97f86bb452d562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DisabledGoogleUpdate.exe
        • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
        • Size 6.4MB
        • SHA256 49865d8435e809d57551f86afaa9092fdceae3d2be5b610ba04fa8e9a35ef8dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 e36dfa91198868289938ebf5dfdae0660087b04d5f3b474daedfbbdd6ab5ea95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
        • Size 820KB
        • SHA256 cee0f85230f23d507b0c4c2a7e2413c9cdeaa58bad0f11d5bb7837d75da2c241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 fb32dacebc026b416bfae77a6a324c8844f23cc1fac70593cade35629da2d5a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 b1b68705ddfcb697d94251a601afa14299ca58d2530c780ac844cd19337b6a58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 23c81dde3e8c7a353c749e6fc9661dcaa68856a13c296565b87328aff7b3c9d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.7MB
        • SHA256 f6076ca0217bb56beb44a6275a5ae0e23e2df949f041bdf40b3d315b94d56bf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2bb6405288da564.bin
        • Path C:\Users\Admin\AppData\Roaming\2bb6405288da564.bin
        • Size 12KB
        • SHA256 0553ddf66adcca5ff422e3c7da3f666029382f27ea34ae7d53a60cf75c37a392
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 777KB
        • SHA256 816c303a2dc498288e6d6fbe54665177e9b9515d4d5392f46535a216671d2672
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.9MB
        • SHA256 d990a345c69c414829c0e54d9a67a7018946485977d090e533a8139842941ae0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 767KB
        • SHA256 10e07f912ce3c11c03e5cddf47efbe78be55172dae88ad322563be4d710032ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.1MB
        • SHA256 6f4dcf7f76bf243f8f4aa974514f8544dce4ec2f56ea04d1d9028e3c02d37aea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 860KB
        • SHA256 ccbbaad118a8380dadbfda8130fda5db400890e0c7e9b59dbaa5394986d3f2f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 a106c434538ab9b88de69ec419d1c7771013d0718b96162c121bc2c7d1e9d373
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 f96cabe64e4a863f3cd8f9d3fbaa02af3a3933d2bc8e9c6cb2d30f8eb83e30bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\SgrmBroker.exe
        • Size 1.0MB
        • SHA256 4927811f81ae885f8fd18e1efb8860ea67e8dcc8b59c692cb0a3c85a4561bab1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Spectrum.exe
        • Path C:\Windows\System32\Spectrum.exe
        • Size 1.6MB
        • SHA256 9930419a44b18e297c70fd402fc5800d6a6ac31e549a1267c98ad814bf641166
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.0MB
        • SHA256 50537aa587c3fa1c680aeca531903b85ca9f47daca454bd2554f7b60b8252a03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 1eef3a6c79cd5a3a39ea1da17eecd3a3c7dbf77ac7568fba866e845ca542e529
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 850KB
        • SHA256 93c1e599ffcdb3f0960c05a03c555f5b7f1200690863d7da8752f8c60624aafb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 901KB
        • SHA256 2a8b66c28c2db3a863bdb8950adef4def419c5dde4035d6fdcb699f9bc3113e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 824KB
        • SHA256 3eb28176157e40fca31f1ed3c4503056e5c6d161eea052033bac1962cddfc639
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 773KB
        • SHA256 e528455944076d2d3e2e3e04b603df297d6a98d6a5ff647cb214ad7302710087
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 3b86b33047f6ce63897e12b37db078d8a75cd22c8aa580ae994654b7c863e044
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 961KB
        • SHA256 919f9068e6c21ec5a146b34593c679f241ae2e4ca0009c4319ab555ae29fb760
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.3MB
        • SHA256 102afdbd93269ee13bc8d5046feb9c88a5daf932983b40ee197f2f5c27b6a392
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\system32\AppVClient.exe
        • Size 1.5MB
        • SHA256 c3daff4453f243af5bb3a1ff53d2a74589e1e93a5862777ada0ecc4858847d32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DiagnosticsHub.StandardCollector.Service.exe
        • Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
        • Size 848KB
        • SHA256 cd507de588b7f27d725abc91dfc8f33577b4f009b368d74873b3c099b3e220ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fxssvc.exe
        • Path C:\Windows\system32\fxssvc.exe
        • Size 1.4MB
        • SHA256 a91b51d411a34dff1bf00e528bcf36beb588edf352826fbe7c78dd2c753da36e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/680-0-0x000001F4686E0000-0x000001F4687AF000-memory.dmp
        Download

        memory/680-21-0x000001F46A110000-0x000001F46A193000-memory.dmp
        Download

        memory/680-3-0x000001F46A110000-0x000001F46A193000-memory.dmp
        Download

        memory/680-1-0x000001F46A110000-0x000001F46A193000-memory.dmp
        Download

        memory/2272-12-0x000002E810570000-0x000002E8105F3000-memory.dmp
        Download

        memory/2272-10-0x000002E810570000-0x000002E8105F3000-memory.dmp
        Download