Overview

overview

7

Static

static

3

2026-11-01...ar.exe

windows10-2004-x64

7

2026-11-01...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 12:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_a659317b7204693ef0d03d8d24d37f3a_cobalt-strike_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
  • Size 14.1MB
  • Sample261102-pwh7mstwcs
  • SHA256 60b4fe2a87c51c8e02fb4db7cb2fceef23134fb7c3323cbd2076d72d2a65ec84
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 20 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_a659317b7204693ef0d03d8d24d37f3a_cobalt-strike_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_a659317b7204693ef0d03d8d24d37f3a_cobalt-strike_glassworm_icedid_njrat_remcos_satacom_stealc_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2592

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DisabledGoogleUpdate.exe
        • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
        • Size 6.4MB
        • SHA256 1e6bf93fe3f5b7b1c8ce9c945da81b24b43e0572b2a7342c897e4423cf2a7130
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 329d0ee060cef9904df02bc41790f625102f4cfb81b2ba6a9eb4b3c9441d914b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
        • Size 820KB
        • SHA256 9877b052a6ade766f6dad7fc309231ac18b0706a2c65786071500f0422a60c57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 eedb6961f10e509f8ebd4407d303adc61058405f3e43293e700b677a0b789207
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 998KB
        • SHA256 aa2f26b52cc3d77202a2f457de10749500ad17dfd396c5e66bd2e25abe03f2f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 248f935764beef3772bd142a66f10dfb4662b6606224137fe7d6fe93d905ec89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 6943d28f69f1d278c9964690901f3cd21e3051ddfe7a01633535f142bac58b77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 1.0MB
        • SHA256 3c942ad9c3f87a6c02d5eda36e19464d21649f2a2a080aeffc8e6e4e5575fed9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
        • Size 1.0MB
        • SHA256 7c159a6efa52227289731b844fd89ed9866e6ea7194db496b2340f8a67ce58fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
        • Size 1.2MB
        • SHA256 c0e5502018fff468974a9bbb3b628ef116cbc2c32597806cba50a93f309dc9f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 2ae110d9f4ed40fd2f47b74e6a1bed0b929f19a2cef7a808119577ee2a2dbcd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 a02cbb1ce2aed18ddb7e4a986ebebba220a89688fb81aed8f363a180ee002db9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 65d460c3b063bb91ae96d15cf3d6e230c3d234391d3f72e32b84d22bf96acced
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 d8d9b3a9ac3b6da903a85dbf9c677ab5f400f1d886e89968fb0d180317962c6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 61a23ca3e1dd1554be32f4edeb3b8dc4c98328b6143a833fcca76a49a9f10ecf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 f56a9a5e68c4f55e408ff480467841c54039286d8e76001f50f862b67a236c99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 832KB
        • SHA256 5458b5152cac659cbedad70b4a7adeea63dd28ab5fe9fd0edec0962e616ca295
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 796KB
        • SHA256 4969df02e51b685d31ccccf5fd8da439b53799b0382dc2df5bc3a640f69d011b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 c4a0ae8f0724b48697d6c5f71cfffdf20b634818572a68e8e0f118957252d6a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 1000KB
        • SHA256 562b136769819ad5f41b42200ce76c16a44f146c5f1c3a126d8d80c182467281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 8b160edd74e679aabc13a13bcb41b16336116a3dce553fc1dd12ab7f82f9fd26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 0db8b573e303d2a664f199c8ba74e7853bf7fe19512cc46f41b3ede33334a362
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 1547d9aeb6905367a82467e9ca9c982d24c4c3ced8ef9ec529f38aff5d5d1c25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 0fc85b14558a31732a0c9d265077342ce1576fc5256a44a7dac131659cf57f90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 dc61c49c653f7792cda989264ff9d713c82b64a47e0057235f28bb64e056dee8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.2MB
        • SHA256 052b09f0c01a1941070e1e528d8194c954f5a057d1baef2bb091371f3ca05edb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 948KB
        • SHA256 80860c920346f04ab7f3cc463b3e7d56f80e20c96879f11081f3187c380d4045
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 932KB
        • SHA256 eba41f02f01f3f193b1d9c62c8c74ed26be54ec353197722e872a48b301275cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 940KB
        • SHA256 e66ded8703f7e5746a4040a351eefa1e63ec2c27c9dc930f79b50fa6c1613e31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 804KB
        • SHA256 84bb4054cbfae6d1217b9ace02516d386f6651d30ca1691569aed7866baad700
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 dc09edf6ad966c554d289bfb5d63a2a6b915b7ffc5ec60b3446a03920cd835ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 964KB
        • SHA256 5c9709493ad488d504cf7df1874e3ca3c4f5656d8e0c0878996a33a94b438057
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 7e1124951b080ed4335b4da4a32e06848e400031fefdbe6c12d21681d370cee0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2592-1-0x0000022A95280000-0x0000022A95303000-memory.dmp
        Download

        memory/2592-9-0x00007FF99A0B0000-0x00007FF99A0B1000-memory.dmp
        Download

        memory/2592-0-0x0000022A95000000-0x0000022A9516B000-memory.dmp
        Download

        memory/2592-3-0x0000022A95280000-0x0000022A95303000-memory.dmp
        Download

        memory/2592-2-0x0000022A95280000-0x0000022A95303000-memory.dmp
        Download