Overview

overview

7

Static

static

3

2026-10-26...ar.exe

windows10-2004-x64

7

2026-10-26...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 09:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-26_a8f76c43fc860a162fb3a5c6942256df_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  • Size 2.9MB
  • Sample261027-lsf2bsbz9v
  • SHA256 bc2bd8f83b764f69d367c41cf112fe4ce27e66c65011ee4e40b9375f0c124db9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 30 IoCs
  • UPX packed file 28 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_a8f76c43fc860a162fb3a5c6942256df_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-26_a8f76c43fc860a162fb3a5c6942256df_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1376
    • C:\Users\Admin\AppData\Local\Temp\2026-10-26_a8f76c43fc860a162fb3a5c6942256df_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-26_a8f76c43fc860a162fb3a5c6942256df_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x330,0x334,0x340,0x33c,0x344,0x7ff68cc2a6a0,0x7ff68cc2a6b0,0x7ff68cc2a6c0
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5820
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3036

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          java.exe
          • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe
          • Size 1.0MB
          • SHA256 d456b164602b9e9b071aeb6e2ebdbb85eb0cf866046eec1971757e5eacd2ec8a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javaws.exe
          • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaws.exe
          • Size 1.2MB
          • SHA256 a77a9d01643653fec95a7c62c1de4bd15b61365cf1ff62ff47a31c8428c906f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DisabledGoogleUpdate.exe
          • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
          • Size 6.4MB
          • SHA256 feedc3c11f9cca559d4388d6d96e9f9d688a038ded6202c815292e2a6b53aa51
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
          • Size 2.9MB
          • SHA256 7e8e6dc911983a0f08f6fd7c62075838f68a714533eb8b87a1601ddc5f73a184
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Uninstall.exe
          • Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
          • Size 820KB
          • SHA256 54164e3231feaa92f27a96af91ba8a7e20c7848ddad573ad1d70a01158ef6142
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          maintenanceservice.exe
          • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
          • Size 1017KB
          • SHA256 fc6309b51e55f6a6ef54c6d305d126075bde489141e60855705b9aa6f92b0c2c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
          • Size 6.8MB
          • SHA256 c9c17f3e2a7e018194e231d6af0a6e04c77437a9e037ce04ab6c7e43051df1ee
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          • Size 3.0MB
          • SHA256 63b77d1f9af8ba1deaf2a983906b237e9f1e21996f65e081e813570351ee2c1c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MsSense.exe
          • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
          • Size 1.2MB
          • SHA256 5db29b703f0f917923fbfd08b156df3af1969a02977c6846553a94791dfbd76b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NisSrv.exe
          • Path C:\Program Files\Windows Defender\NisSrv.exe
          • Size 3.7MB
          • SHA256 7af80208ecd49849e2a1965ab9a468a9b1df64b7dd85a4c2c732fa981fecc862
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wmpnetwk.exe
          • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
          • Size 1.6MB
          • SHA256 2976d0540753f000de01b0262f9d3fc21cec4d7ca3e151727fc026131c770971
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          1b4ee2c33a35217a.bin
          • Path C:\Users\Admin\AppData\Roaming\1b4ee2c33a35217a.bin
          • Size 12KB
          • SHA256 0878cf91e0bd87d9113bb46095e40814f279aa586e79dc37597b8ecb128f56bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          perfhost.exe
          • Path C:\Windows\SysWow64\perfhost.exe
          • Size 778KB
          • SHA256 22c73beefad99668af66d7a49ed1f522ac1823312f2b42eda8817cf39898cd41
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AgentService.exe
          • Path C:\Windows\System32\AgentService.exe
          • Size 1.6MB
          • SHA256 2426b68e236719977b05a98f1bfca523ba2eb06226c70d7a1ff3fae407e02712
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GameInputSvc.exe
          • Path C:\Windows\System32\GameInputSvc.exe
          • Size 832KB
          • SHA256 ece9e1158b45742a0a4ed4fe18d17a3d36099d3db8d6c192c723b8a854202909
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ssh-agent.exe
          • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
          • Size 1.3MB
          • SHA256 78e71723f29edd8c4fda99995c79ac941844861c641e2f1770651c291131ca30
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ReFsDedupSvc.exe
          • Path C:\Windows\System32\ReFsDedupSvc.exe
          • Size 2.8MB
          • SHA256 efb2bd3da21b25c7e05ef5914e089009b8c146e90f5d23cd8963a61289867764
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SearchIndexer.exe
          • Path C:\Windows\System32\SearchIndexer.exe
          • Size 1.6MB
          • SHA256 a9e1674e44aeb6593e5fb2e73a18a24f0e2c80dbac69ae43076128581445a724
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SensorDataService.exe
          • Path C:\Windows\System32\SensorDataService.exe
          • Size 1.9MB
          • SHA256 faeea770fcee575731d08b153ef92c4acef6003e81a65e62253471ae38fcc6ec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SgrmBroker.exe
          • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
          • Size 1.1MB
          • SHA256 f872393804d20edeb7a90ecee485ae03f8c984dc43ce242319de1984fc61504e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          TieringEngineService.exe
          • Path C:\Windows\System32\TieringEngineService.exe
          • Size 1.1MB
          • SHA256 bcef98df53497f732d1693264a80b75b406e3eb27d8b12b57ccc053d65a51b6b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VSSVC.exe
          • Path C:\Windows\System32\VSSVC.exe
          • Size 2.2MB
          • SHA256 57f8502243a1dca94a5c65153dffb09db3bc0266a157d4e00224b8fb53f1992d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          alg.exe
          • Path C:\Windows\System32\alg.exe
          • Size 948KB
          • SHA256 592cd5d34f2edadb0b5309b5e24976a0a2a115d25de0f1593a203bc3ab8d21a9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msdtc.exe
          • Path C:\Windows\System32\msdtc.exe
          • Size 932KB
          • SHA256 d2cd503ce5e6d360764235d471a954948e27ea307b2e5bd8055c3b063be96b71
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          snmptrap.exe
          • Path C:\Windows\System32\snmptrap.exe
          • Size 804KB
          • SHA256 d5f0a0295565419474a77a55bf7939b85bf9f25f6f052dee6aa82fb964b6da65
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vds.exe
          • Path C:\Windows\System32\vds.exe
          • Size 1.4MB
          • SHA256 e5716e02e2617007238ce5f6486dde2ed920e1c845bd0aad0655ed1f41fcfd92
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WmiApSrv.exe
          • Path C:\Windows\System32\wbem\WmiApSrv.exe
          • Size 964KB
          • SHA256 37455637ca2ecbd15cc04be3eeba433ad8f0c3c5c074e9ad62f243815e469fe5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wbengine.exe
          • Path C:\Windows\System32\wbengine.exe
          • Size 2.2MB
          • SHA256 6582c7664b76383162815eed220759d9085206451122d4552feb699ddf3d1a43
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AppVClient.exe
          • Path C:\Windows\system32\AppVClient.exe
          • Size 1.5MB
          • SHA256 6865537c81be19ef6b9ea7a5598188ded0ceb2a73e460ccce7a143901dcdd1cc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PerceptionSimulationService.exe
          • Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
          • Size 1000KB
          • SHA256 664ffbeeecea2b99c8ba4e06bb82aa9e903602a32727260e8058e2cdeaeb7137
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          locator.exe
          • Path C:\Windows\system32\locator.exe
          • Size 796KB
          • SHA256 f3d64090f130adbef21cc391cd812311b5cc614ecc96402bf55b24b40881fbf3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msiexec.exe
          • Path C:\Windows\system32\msiexec.exe
          • Size 940KB
          • SHA256 83ff0fc8aa30f4eaa60641579955c4462c3bab7c89ddef8334be377e918472df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OSE.EXE
          • Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
          • Size 997KB
          • SHA256 3fe7a44f870e8d078fdb827700025d44323c34f1e713c8b5f88ae250c7f74217
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1376-0-0x000001FCE7F60000-0x000001FCE8063000-memory.dmp
          Download

          memory/1376-18-0x000001FCE8070000-0x000001FCE80F3000-memory.dmp
          Download

          memory/1376-3-0x000001FCE8070000-0x000001FCE80F3000-memory.dmp
          Download

          memory/1376-2-0x000001FCE8070000-0x000001FCE80F3000-memory.dmp
          Download

          memory/1376-1-0x000001FCE8070000-0x000001FCE80F3000-memory.dmp
          Download

          memory/5820-12-0x00000231B2D60000-0x00000231B2DE3000-memory.dmp
          Download

          memory/5820-11-0x00000231B2D60000-0x00000231B2DE3000-memory.dmp
          Download

          memory/5820-10-0x00000231B2D60000-0x00000231B2DE3000-memory.dmp
          Download