Overview

overview

7

Static

static

3

2026-10-22...ar.exe

windows10-2004-x64

7

2026-10-22...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/10/2026, 22:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_0513df2c7271f14ec9fd24a48f870151_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  • Size 2.9MB
  • Sample261024-2trr8acy31
  • SHA256 fc0541c8e045e87e48dc9af300e6d4accb3858962bae5c3c3ce5b5f2bb6836da
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 25 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_0513df2c7271f14ec9fd24a48f870151_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_0513df2c7271f14ec9fd24a48f870151_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5092
    • C:\Users\Admin\AppData\Local\Temp\2026-10-22_0513df2c7271f14ec9fd24a48f870151_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-22_0513df2c7271f14ec9fd24a48f870151_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x2f8,0x2fc,0x308,0x304,0x30c,0x7ff74bb0a6a0,0x7ff74bb0a6b0,0x7ff74bb0a6c0
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2456

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        java.exe
        • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\java.exe
        • Size 1.0MB
        • SHA256 e1fa79f14edfb9db9c7ea79e67898f9e6ae851c37eb8e70f83c2debffcf4ee4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\javaws.exe
        • Size 1.2MB
        • SHA256 c8c8217cb7a47a44375e3916bdf1889c4e5e1cde66d4758dd8d8c2c6c12d62b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 429acb6840511c2ba7f1c3c0166d3aa88be832ef20597599c1f14e2db963d16b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 e5dcbc0d35da923522e97fb88a8e9ffea4d84e38f3eb9f00debbf69e5f254667
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 67767d54614c87115aab556a792bd239cde7db85115bb47d0461abb23a9ba720
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 c69a79afce2200110e199ccd79ec7205912287b80a4d8c5357c943eae35a0339
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 3019cdaa803a41537ad765bdba8ae3b5733d23d788e2757fa0f460d961324b0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.7MB
        • SHA256 adcb42b5ca807f8df74170b2fc1208c414ade1abe0e639ff42a0473da2955f0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fb6a842fa26b1277.bin
        • Path C:\Users\Admin\AppData\Roaming\fb6a842fa26b1277.bin
        • Size 12KB
        • SHA256 051cc63fd0af658cf20725fd2942e6062a4d10da055ad39e55022215330c82ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 e358281a1dacac459fb9235f62384bfb6e9dcd7adc0b47719e10eb3f0b428048
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.9MB
        • SHA256 5a2b71daa9adc14802ed3ffa6157f249022837a4cdf2104856ddb8decc99a6b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 767KB
        • SHA256 f207c2b6b0bb126f5da787d7d4514f11a990d09048849a1d50438b97aad8bba6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.1MB
        • SHA256 781f3b1c54f15b4af946586d45f31feada22599bc078c9c21631e0fbf1425ea5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 860KB
        • SHA256 b6b81bfeacdf96f2dfcdb5da9d8d93522d6ecb95592ab4e3ed7d4935439cdf24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 d00eca6874f84ddc1dca5b4c07aa3378e7e4eb46167b4d588cae544dc0233b28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 33a35e8c24678561b98e92989b376dee02d60b0edb9a94328418d7d76371d7a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\SgrmBroker.exe
        • Size 1.0MB
        • SHA256 45a81e86e886f5145017d89cf662b062893a11b48037c6f80e410af8a068ba95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Spectrum.exe
        • Path C:\Windows\System32\Spectrum.exe
        • Size 1.6MB
        • SHA256 a33575e890bbf82730d4a3e166409132637c62657eb5665d42af876f734522e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.0MB
        • SHA256 bf0b5e09990380595bf032b7979092d5be4c0a6ad6b6d4cb9ff1b6365d47c203
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 7228d516441d5a6d68bb109541666e445ca3099af058ff85c13fa17f110cb67f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 850KB
        • SHA256 74b19d7f3868063d6806c5f0f9ca415f14ea15826a69b903524320eb2916ff44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 901KB
        • SHA256 b0fa03e6bed13f14d72c419ee0ca483c1f490c4a2e8a4ba5a3960ea220757d7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 824KB
        • SHA256 404a49238901f3fd29103489e0143d27e77e3ef97f01bff05864c47ef61364bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 773KB
        • SHA256 b94d06f9150710a9d175c5b1521e5624b13e36733ba301543dd820259e8d5774
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 4f1ee20e6b97fd73a37bea30fc344464d82b57b007ea4a53613e5860bfa90b61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 961KB
        • SHA256 fd97dfe1288c629ad07ec922643be04302015c750f8d29e89fed62e858828c12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.3MB
        • SHA256 5a3d051362dc421e522a944d5312d2154b3a5d929a343aa7b0b598e3ed12346e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\system32\AppVClient.exe
        • Size 1.5MB
        • SHA256 d001b3abdc7acc116743ba8c5f1aa9fa1aedbd031d1892aad1d7d51b5796027b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DiagnosticsHub.StandardCollector.Service.exe
        • Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
        • Size 848KB
        • SHA256 6dda0af52d00193d20db1afd66062df4d27afc04fd86196deceb14b42d9cc0d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fxssvc.exe
        • Path C:\Windows\system32\fxssvc.exe
        • Size 1.4MB
        • SHA256 b18cb7acd7bf8834a95c52a0ebd8c11f76ed0c22b42bd23ab18744882138b541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2456-10-0x0000021CDA6E0000-0x0000021CDA763000-memory.dmp
        Download

        memory/2456-12-0x0000021CDA6E0000-0x0000021CDA763000-memory.dmp
        Download

        memory/5092-1-0x0000020E7BFB0000-0x0000020E7C033000-memory.dmp
        Download

        memory/5092-18-0x0000020E7BFB0000-0x0000020E7C033000-memory.dmp
        Download

        memory/5092-3-0x0000020E7BFB0000-0x0000020E7C033000-memory.dmp
        Download

        memory/5092-0-0x0000020E7BD00000-0x0000020E7BE9F000-memory.dmp
        Download