Overview

overview

7

Static

static

3

2026-10-28...ar.exe

windows10-2004-x64

7

2026-10-28...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    117s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/10/2026, 19:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-28_bc577fde8d8f9eeed8fe34deae190637_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  • Size 2.9MB
  • Sample261029-ympshaev4s
  • SHA256 28b4c1adebc13c78bcac18c576a178d6578d5f41f48c4cfbcc28e9fa58da9693
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 23 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-28_bc577fde8d8f9eeed8fe34deae190637_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-28_bc577fde8d8f9eeed8fe34deae190637_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Users\Admin\AppData\Local\Temp\2026-10-28_bc577fde8d8f9eeed8fe34deae190637_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-28_bc577fde8d8f9eeed8fe34deae190637_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x320,0x324,0x330,0x32c,0x334,0x7ff7190aa6a0,0x7ff7190aa6b0,0x7ff7190aa6c0
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3260

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DisabledGoogleUpdate.exe
        • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
        • Size 6.4MB
        • SHA256 8dcf706e085051112ff6ac51ebbdbf70bf8d2880d2bc3c64e03bfa1ec373516b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 a440a6dc82834641e5b2ea27ff710758768da266c0460d306b452567fa397619
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
        • Size 820KB
        • SHA256 b92853027baddd6136d7a62b5b01858174c96f62384883fbbf9bf18e52e7db09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 3c91674bcf007d633064d15cf03ea9101e9a36fee38de7bb72ed764121253ae7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 d18f89cc3cbe1a758bb4712c30de12df0a7e310b65176d192930b38c47c7066b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 75cadf6c80ce6938c65d055bad214c55f02fbd15686782fc3873d1c6121ea740
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 039639e8c33176457fc026ea9d3051483cb9909367671f8f32e0aa53b83e1c80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 a3efc55c5b5fc6ccbfd63ff3c3753e7efaef4148231b86c923b5bdd497363bde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 abcc54411b853a17b1f5dec6436e0e50fa9409dfd153eec0bc62b7fab07083de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 d12935ef73a62f4d25ac21fb7ce768c148e4bbac31006dbaaaa9ed5a7bb8a014
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        56f33173227843b8.bin
        • Path C:\Users\Admin\AppData\Roaming\56f33173227843b8.bin
        • Size 12KB
        • SHA256 cfad210f45e21ac8d161d546fdb35c8e48dd7b10b4a761e8a07684ddaebd1e4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 0bfd2eee5428a70b74ae9b7c6ef80301d2a558d2efeb9edad9530a61316f7d45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 4d47299daa76ee4dbf1e63904228eaae94e39ccda281657fb58dfad872fa31e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 828KB
        • SHA256 569f96be33eb981a7fc039b99dc98f3b584bdd213e5d9319b668b8e06931bed3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 792KB
        • SHA256 9b89e6f5234f2267e087b066ae9ac02d779e7c7c41c833fa5da1af301eccd7ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 6fd7345307313564753cbc995732520659b6e5534a7e8f3a0724a654e3119d96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 996KB
        • SHA256 88a44ce346812ae7f4b21eeb52b4aa5ecd6c29ebaae0577e66162a536eeceedc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 cdfb28210bcd493f48dbc1d32e558120b2e5baf4c31286c068b5a7951e6d4cce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 66ec3f90ddfb7f8d08b129dac57c4843f54c77c8828935bff7a134adcc17e224
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 d41d3f4441d14dc21002f7d5b8f10cacc3b4b52ef863274af619469603110c95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 7fba22267da0386ab7b6d32dbac836cb00fbc417e84871ab3a7cf20857d81bfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 84d5634693646c7dca0515f9c8bc1d0798253a7da7ecdd188d0e2b041c0e77c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 2ca39960df399e88622de6aa204eacc999fc1fbed566f1c1386ad8b8715b47b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 944KB
        • SHA256 9005d8dd81e654d3a3e97cea4bf1ef3fe94e2bdc8a98571ca4826144bd2d5d43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 928KB
        • SHA256 a824c7c04b64f458434911b397f9a4175108755ffc8aabb477853cd0d6ec4933
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 936KB
        • SHA256 29f39bbb64cd8e81380b1f439a38879396510b68ecabddc5fa1a2c9292f2e46b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 800KB
        • SHA256 2975ecc059c4c37a00057c9a3e36f9b48b094c0835634b732c2313cab5f3cf85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 0accf4859e89563f64306b3770010810e98ad080902de4717630842471bbb65e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 960KB
        • SHA256 8ee749a74eb1a7165297420d936df988d4edef087b3508e609c5456b68afb81d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 f9211a87be1fef4fe6e87d14b57569234ef6c0f2f864bbae052a98987388b2a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\system32\AppVClient.exe
        • Size 1.5MB
        • SHA256 4cdd99f577686ff97ca030aa24324b1171f02ea1bd44d486e6d3192118996aca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2016-18-0x000001CF67B90000-0x000001CF67C13000-memory.dmp
        Download

        memory/2016-0-0x000001CF67CA0000-0x000001CF67E0B000-memory.dmp
        Download

        memory/2016-2-0x000001CF67B90000-0x000001CF67C13000-memory.dmp
        Download

        memory/2016-3-0x000001CF67B90000-0x000001CF67C13000-memory.dmp
        Download

        memory/2016-1-0x000001CF67B90000-0x000001CF67C13000-memory.dmp
        Download

        memory/3260-12-0x0000026B7D070000-0x0000026B7D0F3000-memory.dmp
        Download

        memory/3260-11-0x0000026B7D070000-0x0000026B7D0F3000-memory.dmp
        Download

        memory/3260-10-0x0000026B7D070000-0x0000026B7D0F3000-memory.dmp
        Download