Overview

overview

7

Static

static

3

2026-11-03...ar.exe

windows10-2004-x64

7

2026-11-03...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/11/2026, 18:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-03_652eeaa32f4f480ebd612ed10cf5ce2f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
  • Size 2.9MB
  • Sample261104-w8gynstxdv
  • SHA256 171d0197a2f7a1f11d3225b6075c4007279e221d981beda2a1afa85ba2a3a29e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 23 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-03_652eeaa32f4f480ebd612ed10cf5ce2f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-03_652eeaa32f4f480ebd612ed10cf5ce2f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4604
    • C:\Users\Admin\AppData\Local\Temp\2026-11-03_652eeaa32f4f480ebd612ed10cf5ce2f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-11-03_652eeaa32f4f480ebd612ed10cf5ce2f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=80.0.3987.132 --initial-client-data=0x320,0x324,0x330,0x32c,0x334,0x7ff7400ca6a0,0x7ff7400ca6b0,0x7ff7400ca6c0
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3416

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 e519bb321582b6a67daacc066988ec07f81a33a527a0a91b3dc9e4964f54d636
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 4fdb279a8451aed338612f7b0f8c71e54e4f292328ba42e623adda5f93041b71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 998KB
        • SHA256 9bd78c10963bf6d9fccca5be7f4f667b5d1cd02a8fac6351bb745783dc1b7a72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 1f057d2e3f71b16c8693e474d44951a73286109c1926269fe197aca114eabec0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 a3b8e7af2b357ff8ea6e7b5cc92bf8f5237d78b1cde65b29a89cd3153c8ccc3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 d563ce6b1bd0ec849f729a558b63e85372f928de21f61a5122c6223c5b1c127f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 bef82e46dcc4a21ae844208da7f13f8727918f4b37d9e0154edb4231a5f8a56e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 e7271705511d5413689db98504d3b580acd34871cbcd63cc7cabc1abc503faa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        594253493ebf6fe8.bin
        • Path C:\Users\Admin\AppData\Roaming\594253493ebf6fe8.bin
        • Size 12KB
        • SHA256 fe03030dc78feec7d389954b0bbe5385ad8ab55c2c249565b3166a7e834e4e03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 3660e2048dbb90b264cc44be4e4df385766b11437389e7bc1a57b86941296525
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 1e7e5e198ded199eecd4bb9f4ba5dbc617e516f11f48e6855243cf78efd42438
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 832KB
        • SHA256 f7828e28f38fb6485561f927646ab58757e9b301765ae8a3398f48c4dca14282
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 796KB
        • SHA256 c43cafedef4fea7c8159482083fb6c5a9aa3c6f9f0066ade81825d78dc335047
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 ce067e2ab75cd8dd06ee3f79f17e4b210fc6ff46b87797cebbfb42c663b45479
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 1000KB
        • SHA256 49376101be233aaab579666755315ca2e89231aac707c87b4a04549f7a2dc1e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 e1286d0968c2bda982411256b67886449e3392fdbf71298ea4d98f6ce4bb0ba2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 88d51dbe78be61a9a5a7eccf55d1854a097f05dcdf1a91cc96124ee0ae31cc99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 21b4f92b56f916307e3fe573b128b5e6a18aa0b2caa667d395c45616dd005014
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 23097deb63fa7f3895c26506fc145c3db020948fbd799ce9ac2e8536f4339179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 4dc94f0d868ae4c8f40e595229199399e2c8ee2d88a09b06b6f52909f292655c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.2MB
        • SHA256 9de4c3f3d4233713eec7ce0985f54cfad7cce63f319c5bd08b209ad655c62c3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 948KB
        • SHA256 2a304b2e1d47c60d0488e7e151e7f347a1b6f32d4883017eaadbbfcc3b187197
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 932KB
        • SHA256 e576c668cfff59e768dfd031a60023a9a421ad7f854221a509baba8f7225c533
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 940KB
        • SHA256 cb39609c631d2f45468e8487a7686a70a385979e41af9b5e00ed07e62ec46c32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 804KB
        • SHA256 c4e4dd80d4bf7e4acc1bcb2d51c216d3296d5ccb34115131b6627bc5efb8c2a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 8b219739d232a6edf7164ee6f174e0da3bb71a3d5770b7566b76696466c6029c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 964KB
        • SHA256 b9e2bca15d1eb70960ea883e265ef0e32adc929b05fd48e7a1073a7b03941fa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 ff410877598b921d09f31a6c0ccdd18987480cf03240a69355d6380f438f6fe1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\system32\AppVClient.exe
        • Size 1.5MB
        • SHA256 6856e1a3a1c4412c9f408f053ec22fa42706b6ab15014a062f6ddf13814346a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3416-10-0x000002A2A0EB0000-0x000002A2A0F33000-memory.dmp
        Download

        memory/3416-11-0x000002A2A0EB0000-0x000002A2A0F33000-memory.dmp
        Download

        memory/3416-12-0x000002A2A0EB0000-0x000002A2A0F33000-memory.dmp
        Download

        memory/4604-1-0x000001B8D8370000-0x000001B8D83F3000-memory.dmp
        Download

        memory/4604-0-0x000001B8D8180000-0x000001B8D8255000-memory.dmp
        Download

        memory/4604-18-0x000001B8D8370000-0x000001B8D83F3000-memory.dmp
        Download

        memory/4604-3-0x000001B8D8370000-0x000001B8D83F3000-memory.dmp
        Download