Overview

overview

7

Static

static

3

2026-10-22...ar.exe

windows10-2004-x64

7

2026-10-22...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 22:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_0513df2c7271f14ec9fd24a48f870151_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  • Size 2.9MB
  • Sample261024-2trr8acy31
  • SHA256 fc0541c8e045e87e48dc9af300e6d4accb3858962bae5c3c3ce5b5f2bb6836da
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 23 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_0513df2c7271f14ec9fd24a48f870151_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_0513df2c7271f14ec9fd24a48f870151_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5380
    • C:\Users\Admin\AppData\Local\Temp\2026-10-22_0513df2c7271f14ec9fd24a48f870151_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-22_0513df2c7271f14ec9fd24a48f870151_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x320,0x324,0x330,0x32c,0x334,0x7ff72820a6a0,0x7ff72820a6b0,0x7ff72820a6c0
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4952

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DisabledGoogleUpdate.exe
        • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
        • Size 6.4MB
        • SHA256 be7dc1dd822bc6103e435d5a9fdaf563358de99d93100573e847936a198417e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 818ad4bba487a63125e06093da77d6caa4e582ea2bac30184c553942e77c4d94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 0a946f9129f83f393c4de2d9866ae755953aa92c45911fd187211ec3cb02f317
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 4694c960bb518607c46a5a8c8cc70af8d03fe617c711c77f3df84463bb2661c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 37ba2425f1858c52a916c079eb3902602ff6ba96854b8f5d739fba02aabb91b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 8fdc02bfc8a63017479ef426aaefdf55bfd5156f36291e4b4247a2a887435308
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 55aa21f74b33aee94ad126a31b00995dbceb180ec405659bca22e955d3b7d8cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 485a599bc4713adf73ea6d621b1b7871c1f7b0be5f921a3219f10fb13f04f3d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 ff3b2e06054221b99d264e3b357c990553fae9285467e987e881a3500b7613f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2ab82063227843b8.bin
        • Path C:\Users\Admin\AppData\Roaming\2ab82063227843b8.bin
        • Size 12KB
        • SHA256 90895fc3976568c29074e09459d9c917858d386f45773054843559ac29ef5fa0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 7cdac0382f0b8db8d4473f774d0f756a0db60ddc668bdd7207a867a9eb559b8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 2e48fa2a26af212c6d6c16e3f0b73ae03f803d3bdb753e1f16566c95cbf7b7d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 828KB
        • SHA256 862eaecc11bef539b9d52ac986fc28b4a51f7a3283a83e343e1d99f3f1e7b92e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 792KB
        • SHA256 c5fc55f4992e3ff3bc728f3dfd6943751eac424526f6614c0c62ebd8072d2d13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 6458c8ba6870287528ac9f9111f5eb173acb81a2cc903f2c51a6703e05f3522b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 996KB
        • SHA256 cc08b7880141ca64852356b7629601cc29bafdee636da96822d9b569d9cfa2eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 442700c7029db744e31466f0375082bdfa929f8965469b57f1d274848d82d4a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 9f4bcb7bc226fcdb27ca85d9b07068314cd1062823d611e5c8605b52cabba387
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 3b60b93287706e41d3f73be54b17d3365614d4be360d692d73fe33df3b696cad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 87ae8fbe53f6da6ad06de7d370af3152ee064eab3326db05bb7cd19a39993b10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 424eef4217e4daa51c7ce8b35aea3c4ae55df8142a21acaa1802aa9935f7ff17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 9e7e0b1609c1496eb1bb8f3cc79ab01924b752e2cd52ed374a8df0260ea0b7dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 944KB
        • SHA256 9d4659251c2715d90140cb63743cab096b303a3b342ec54670b97540769631e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 928KB
        • SHA256 f92297cd4e1193e62e1e19e410e2a141a9c4edfde2ec8d44b96540b8903cd1d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 936KB
        • SHA256 30a2dd391b2be8dc0e9425c5542c3a765d92d7d918ee9d7904c9ac79d93c26ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 800KB
        • SHA256 b964f2b05f16c41de9147fb594e5bf41a296965be002ac1a98fc5a85985680bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 968a9dfde11cf3b0e538210379002659fab84424ed9761bb8a7c4e594875eebf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 960KB
        • SHA256 167ee544c6305c103e9bd83466203264eb5e31d00a7e7a94b2606bb388863861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 38e35e97defaae12d253b7f5985b9a4a377b5382fd3571a223838f181b9a0b26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\system32\AppVClient.exe
        • Size 1.5MB
        • SHA256 e3002c61e1f47da0719a5fe279f5a8e351d378fc5eaa06ffd15fcd1505d3dba5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4952-12-0x000001EF96800000-0x000001EF96883000-memory.dmp
        Download

        memory/4952-11-0x000001EF96800000-0x000001EF96883000-memory.dmp
        Download

        memory/4952-10-0x000001EF96800000-0x000001EF96883000-memory.dmp
        Download

        memory/5380-0-0x000001E345CC0000-0x000001E345E5F000-memory.dmp
        Download

        memory/5380-18-0x000001E345FF0000-0x000001E346073000-memory.dmp
        Download

        memory/5380-1-0x000001E345FF0000-0x000001E346073000-memory.dmp
        Download

        memory/5380-3-0x000001E345FF0000-0x000001E346073000-memory.dmp
        Download