Overview

overview

7

Static

static

3

2026-11-03...ar.exe

windows10-2004-x64

7

2026-11-03...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/11/2026, 23:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-03_35ee3ac6601070e4105a19e0fd776b3c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  • Size 2.9MB
  • Sample261104-3yb31aet2x
  • SHA256 050b2f51abc2fd402bf8e9f2da26e1003e46278dac652651b3c74458c2156753
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-03_35ee3ac6601070e4105a19e0fd776b3c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-03_35ee3ac6601070e4105a19e0fd776b3c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4976
    • C:\Users\Admin\AppData\Local\Temp\2026-11-03_35ee3ac6601070e4105a19e0fd776b3c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-11-03_35ee3ac6601070e4105a19e0fd776b3c_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x328,0x32c,0x338,0x334,0x33c,0x7ff72333a6a0,0x7ff72333a6b0,0x7ff72333a6c0
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2800

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DisabledGoogleUpdate.exe
        • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
        • Size 6.4MB
        • SHA256 cd160014dd04f1ee325814ccfb083722ddec5e4b4a959cb73dcec61b95aeca92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 5b97dc46215f6e486d675cddc0c85271ffbc596a01787f7afc3673d1608db7b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 ab77453c5da5015ba999462d2a002ac68cf217f251d09877b79a1f624c11750a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 03f44bffaaa1e7a1485670634b01f3ebfd4e275d480671527e2a84af5a2decd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 edd49e05b9688c2f78e9eff99bf211a58e59958e7ea4c140badc8a425fca93cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 c9ed199b657b073d249411cd02bd08717d31d42ac0a29bb529c5477c16e326e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 0eb0cc0ae6bd6de752f9e8bc7c0034b06951a3722224535c71d3006b1f3d1d52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 9c895374410bd094c9c85aef9b828761c87d884c57b51cb39f2af26eaf525ecd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        868b2a33a35217a.bin
        • Path C:\Users\Admin\AppData\Roaming\868b2a33a35217a.bin
        • Size 12KB
        • SHA256 f3df4a776a09ef95a8f14763efc4125514f943eae556484e1a9db0122ebe7265
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWow64\perfhost.exe
        • Size 778KB
        • SHA256 6582f8e709ccccab3b9a10ed09f73246a01dc528e7674e42632a0cba44cb1aa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 56760629620dbee66318a2b227c7f6e11a440b6b04f5e835b23710847f9edc34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 828KB
        • SHA256 5383e2a22e86753179a45651f192062a7fec300edfa83077a8b8fcffea9a4416
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 4a1bb58b621217ca468f3b400668633d8ac4ce268194a7f513e269e9ae3534bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 7d88f3ac82eba568bd5c86ff13967c3b6dce8d686b469ef0ac878b0ef7c32e70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 bbecdb79294c4107e75e7c2013407879636a34649b675452aff5186c6ee89dfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 465c2719e8d3b0ddc6ec12f927a1c8db531a322174bdc8330fea8acc067f3bbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 fdd6df8d2327e51d02fa4630fdbdc132ee98812ff33a6ae82888d7118a9a72e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 46038068b299996fefff410ae7ccf9b15ed3a73a17932213945e2daf5b3784eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 aac71f8b2a9a68c40f09adbef6aed42b33644ad1a230350d2344f890cf2c3f60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 944KB
        • SHA256 b68f1ad709168fb4b6fdd44eca35dcec0ebfd73b4e070dbfcdaa9bc244be4022
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 928KB
        • SHA256 926ae13847ac080e1c285cec67d651b2debf84f715cce183c2c5f5dcd25a098d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 800KB
        • SHA256 8d36e00f2ed893af2d163682f64a386700a7432f30af91d026dd68829a046178
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 185d4e172cc3dffba67ccd548b42e211e181dda9cb960dd21474792450af5f0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 960KB
        • SHA256 ffcff1ae2e1154c7dfd4276da64c7db0a8607831d13c91f9fa0603d286b9070a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 6146d430c192eb0bea152018802a4558fa201391d8e5352be3134ec147d5e640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\system32\AppVClient.exe
        • Size 1.5MB
        • SHA256 fd2aceca81c9e1c23e710de07513c49e1c6730d1cfce162b253f88cf7536245e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 996KB
        • SHA256 95c729c9c57c74437b2a9e7b800f1c0f389c37f7ad81b616abad05b5d09c072e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        locator.exe
        • Path C:\Windows\system32\locator.exe
        • Size 792KB
        • SHA256 5cbac3fcaaca59b7aef2a35740d5a3aefde4fe33fd095bd1ca45b193cbede996
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\system32\msiexec.exe
        • Size 936KB
        • SHA256 aab2d763dfd06ebab3c13a97f45df1e31ebf39ecd4ba17e0543ae59edce16c50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 baea9cd1a5aaaaa3fb308e3e34c80737e6ec0f443f6a815c66c195a8052c4771
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2800-12-0x0000013F9ADB0000-0x0000013F9AE33000-memory.dmp
        Download

        memory/2800-11-0x0000013F9ADB0000-0x0000013F9AE33000-memory.dmp
        Download

        memory/2800-10-0x0000013F9ADB0000-0x0000013F9AE33000-memory.dmp
        Download

        memory/4976-20-0x000001D42E020000-0x000001D42E0A3000-memory.dmp
        Download

        memory/4976-0-0x000001D42DE30000-0x000001D42DF05000-memory.dmp
        Download

        memory/4976-2-0x000001D42E020000-0x000001D42E0A3000-memory.dmp
        Download

        memory/4976-3-0x000001D42E020000-0x000001D42E0A3000-memory.dmp
        Download

        memory/4976-1-0x000001D42E020000-0x000001D42E0A3000-memory.dmp
        Download