Overview

overview

7

Static

static

3

2026-10-28...ar.exe

windows10-2004-x64

7

2026-10-28...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/10/2026, 19:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-28_bc577fde8d8f9eeed8fe34deae190637_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  • Size 2.9MB
  • Sample261029-ympshaev4s
  • SHA256 28b4c1adebc13c78bcac18c576a178d6578d5f41f48c4cfbcc28e9fa58da9693
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 25 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-28_bc577fde8d8f9eeed8fe34deae190637_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-28_bc577fde8d8f9eeed8fe34deae190637_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3392
    • C:\Users\Admin\AppData\Local\Temp\2026-10-28_bc577fde8d8f9eeed8fe34deae190637_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-28_bc577fde8d8f9eeed8fe34deae190637_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x2f8,0x2fc,0x308,0x304,0x30c,0x7ff691a8a6a0,0x7ff691a8a6b0,0x7ff691a8a6c0
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1660

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 fb69ff87af1f00432f54b4d4ba1319ea6a8af24ef45af28ce6ddb5ba761517c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 b19bb6d0b3615cf488442ef232b73499737b80a63bdbbaff3d4766b2df50f692
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 aeb0e04d284afcfde7738f9e344738caeb9e7c40282765875867614a2adba505
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 d5af2604299056334504e04d1251d206af3bc3dd9c6b353f6554e9270b83916b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 2288c6db594c4679675af740cfd33998a854d7d7015817f2e4c3003d138ebcd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.7MB
        • SHA256 3618a91acd445ede36625bcd2467787ea383cfec2c7e03bd6547bfdf2c557729
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        b9701d4d9b11239b.bin
        • Path C:\Users\Admin\AppData\Roaming\b9701d4d9b11239b.bin
        • Size 12KB
        • SHA256 13bd90a31db6aca5b8c25d8d615ff642e6fe3ddf52938f93c1d967efb9234d43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 f48a560dc62e72b4a262257f905e55a98e78f0d45529da1dbc618061173ddd6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.9MB
        • SHA256 4dc1de5b5dca8ec488b149c79faead74078a45b35e038a5c5533de9a7fd7585a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 767KB
        • SHA256 bdb98c2de1c5bbac2c3ba442f5066c81d93026b0a204ff8f33c1a900d0dec248
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.1MB
        • SHA256 689ea59217b678c652718eee7a07b2c6a62f37a976a4ce5bb21cc0ba79a86242
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 860KB
        • SHA256 f2cc0b48a42707c345276c5ce68ed4b6cae087b10cc51b98c79f472858c13082
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 58934193be895ac29d4a10752a8909d1d19ec5400da325a48523e05a87d1d447
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 c4627ba67d1d2e5101d97243b6a68ae8de18535ab26e0e13ba4dcb83a2c65cdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\SgrmBroker.exe
        • Size 1.0MB
        • SHA256 ce59b3ef2b697c835b50ce8232eeb66631c53fb360a4f266b55e8a17b0097988
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Spectrum.exe
        • Path C:\Windows\System32\Spectrum.exe
        • Size 1.6MB
        • SHA256 7347e7f821a9948f7593951e96dedd2e6c91055002064d4dbe6472dee31c2019
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.0MB
        • SHA256 e20c193b33f0a3ee63799d08f94099c828c0e03cb49bae6fbdc95335f372e193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 593fe5172e196e7cb4402d5796a5fbe5474600c3f8f984d457155fdb8c219092
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 850KB
        • SHA256 54f88956e46c52109aeed2baf0316efe4b412b36afdaed9d8f5ddedd687f6ed0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 901KB
        • SHA256 85ea7ea2a2cff971d8bbbb07689f04ef0ae0c2ce1a60a57c075415f08071ca3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 824KB
        • SHA256 2838cb5c8f4402eaeae3f46569995899135632b71edbd70010a0182f2f144cf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 773KB
        • SHA256 e0d10188dad58fc3c247808c7a3301c0240bf8efe2859ffb83b61ec274202a12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 ab92311cb556db29229372adcc4792d4d707ab38eefdb802ae33a7d67d84b2ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 961KB
        • SHA256 31cd7278dfeef4babfbe2717a26c82c0a130e2c6c204ad0a98a3d96d439e1d24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.3MB
        • SHA256 02d12357a27ae4003bf5907eab66e7bc4548ce0d37175367a2f0fe7466cbc95c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\system32\AppVClient.exe
        • Size 1.5MB
        • SHA256 710e0e4f3d762c11d9ead1f73183001ef58dc669e1066ba40f48eec2f2f25c3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DiagnosticsHub.StandardCollector.Service.exe
        • Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
        • Size 848KB
        • SHA256 cb3658d48653a62f44ee41c2fe6e72d38bee29daf0cae81db285d34b63b04b22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fxssvc.exe
        • Path C:\Windows\system32\fxssvc.exe
        • Size 1.4MB
        • SHA256 eeb61a48b79626347541d5c9fd8278259c0881c1f7ff96816f1d359c5a354560
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1660-11-0x0000018C79B50000-0x0000018C79BD3000-memory.dmp
        Download

        memory/1660-10-0x0000018C79B50000-0x0000018C79BD3000-memory.dmp
        Download

        memory/1660-12-0x00007FFFA15D0000-0x00007FFFA17C5000-memory.dmp
        Download

        memory/1660-23-0x00007FFFA15D0000-0x00007FFFA17C5000-memory.dmp
        Download

        memory/3392-18-0x000001AC280B0000-0x000001AC28133000-memory.dmp
        Download

        memory/3392-21-0x00007FFFA15D0000-0x00007FFFA17C5000-memory.dmp
        Download

        memory/3392-2-0x000001AC280B0000-0x000001AC28133000-memory.dmp
        Download

        memory/3392-4-0x00007FFFA15D0000-0x00007FFFA17C5000-memory.dmp
        Download

        memory/3392-1-0x000001AC280B0000-0x000001AC28133000-memory.dmp
        Download

        memory/3392-0-0x000001AC29950000-0x000001AC29ABB000-memory.dmp
        Download