Overview

overview

7

Static

static

3

2026-10-21...ar.exe

windows10-2004-x64

7

2026-10-21...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/10/2026, 21:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-21_740fada5394d2f45fda4779ece49c501_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  • Size 2.9MB
  • Sample261022-1bf3bsfx3w
  • SHA256 c4affd77f933e29ef1d7e4f553cf2af74fcc51a30eb2f495901186dd38cb85ac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 23 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-21_740fada5394d2f45fda4779ece49c501_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-21_740fada5394d2f45fda4779ece49c501_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4404
    • C:\Users\Admin\AppData\Local\Temp\2026-10-21_740fada5394d2f45fda4779ece49c501_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-21_740fada5394d2f45fda4779ece49c501_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x320,0x324,0x330,0x32c,0x334,0x7ff654ada6a0,0x7ff654ada6b0,0x7ff654ada6c0
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4108

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 c3d5aa5576f6cd5c3363deb203bd1f2992c2543c21b4fd2a04326aa3277560bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 7b553b6da4da2b6587b02b7253f3e0048415954bd929be19ec4fbccfa92e094b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 8b1b337fd09d8beb466b212c84a20a7dd031629c8b0d4b4df500970c0fc43cf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 467b9550e55f0d671905f751e8943c8f922ed9162524757e8c3165ee8eeaf432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 8003500184e7fd8264c3122b53bca1835bef15e7fbf73039e59ee6e452c49c2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 8843c431bfe12d9c02fc51cb950af99d6c35d4b8f84b1a384c19451c750c3618
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 48ca72961c2e3672c14f72a8b1c2d3a9898798147167fd0545d8f9651a4930ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 bccdaedfe97e21476fda416e8183070abb96ee57736ef5ac2fa78b9ef9b42931
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aa4df431c17a6531.bin
        • Path C:\Users\Admin\AppData\Roaming\aa4df431c17a6531.bin
        • Size 12KB
        • SHA256 9513ba391c02ec6985f925546e0d7e5564685339c66820f0bd8f1626e2e87006
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 0a2b75924f7bbef567d18f8a474c44d4e59026f83d8cf1c7a6f5f5245ecb8590
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 f5fb079136c395aaa739c95fc568fb7a7dde1413a1c3bf12483617f45b209e0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 828KB
        • SHA256 197bbbfba3d2a078127319104182773fb08db94e2b0369884c3c8004dc8be687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 792KB
        • SHA256 400476f4f0dc6add2e73a69ec40ee7c408349f4bf12dd8e1a0adc558662b02cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 40ec91ea43a865317f559a4c3f2b693f61f0cf0b54e525aab9a4caee81a6bc67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 996KB
        • SHA256 4fcdda6e3c7b35d591fdf011c647f6e015cebdda129ed6b4d4aa0ac7ac36a022
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 150e8267ce1535cb55a829b992640ac69dd14a71e384820efe45eb67bea6c825
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 fba895c1c3fb1b4958c15955e49a522221d5b62c0ff6a9c37855121a40b57c19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 46d93e091314d235c8af2165c8d78341901910a04b79ed70a8957cf39a12df21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 1e34e7b13c63e52719b2335653387a9174938230dbbf32f19f337f1a0594c9a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 1fdf9e238f5a2dfc04a68ad28541224e04d3804737e8e93bfea9e459dc2653c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 4c60764b23c41a370e7dc0559fd14cae1d11222926b4a90d7c362431075944ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 944KB
        • SHA256 85657d192715c6afbe0bdd800a7184a6388f44028390d69567f09892bc4cfa92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 928KB
        • SHA256 a19450319fae49c1fab149510b0744b79612dfd270a06333413aae9c765db82d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 936KB
        • SHA256 9e04fbe7cc48bdbf98e542fa383d3a55a2309974ebe37e25fe75d86b85ab2041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 800KB
        • SHA256 8845ce4b45b29d6e2aeef0e09d355273e3b813b6bf5340ecbd7595ea4d4a0418
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 811278d66125845fe8d63c4aa98543263e4a4dba5988bca248b14265f49f4fff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 964KB
        • SHA256 ecf99ce142fa29be087657e7ad68f2a3ef21cc395f9acdd5b94dd723c88c5a11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 2439d398b1d8072d91fee25739c4cf2bb5105d914c6f77a95fe77e621451839e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\system32\AppVClient.exe
        • Size 1.5MB
        • SHA256 6ce9fe2b568ea03a85adff0d0f14abcb07583dd4a6d71affe0c7c4d4ef819874
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4108-10-0x00000189F9290000-0x00000189F9313000-memory.dmp
        Download

        memory/4108-11-0x00000189F9290000-0x00000189F9313000-memory.dmp
        Download

        memory/4108-9-0x00000189F9290000-0x00000189F9313000-memory.dmp
        Download

        memory/4404-17-0x00000257D64C0000-0x00000257D6543000-memory.dmp
        Download

        memory/4404-0-0x00000257D62E0000-0x00000257D63AF000-memory.dmp
        Download

        memory/4404-1-0x00000257D64C0000-0x00000257D6543000-memory.dmp
        Download

        memory/4404-2-0x00000257D64C0000-0x00000257D6543000-memory.dmp
        Download