71419feb219cf2994acbce575b18fb5693c3bc49a98b40659b1df3a96dfe2e24

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	chrome_update.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	chrome_update.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome_update.exe	chrome_update.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome_update.exe	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe

Executes dropped EXE 1 IoCs

pid	Process
4668	chrome_update.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Update\\chrome_update.exe"	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Update\\chrome_update.exe"	chrome_update.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ip-api.com

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4368	PING.EXE
3000	cmd.exe
408	PING.EXE
4704	cmd.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome_update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome_update.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
408	PING.EXE
4368	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4488	schtasks.exe
4672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4464	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
4464	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
4464	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
4464	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
4668	chrome_update.exe
4668	chrome_update.exe
4668	chrome_update.exe
4668	chrome_update.exe
4668	chrome_update.exe
4668	chrome_update.exe
4668	chrome_update.exe
4668	chrome_update.exe
4464	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
4464	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
4464	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
4464	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4488	4464	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	85
PID 4464 wrote to memory of 4712	4464	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	86
PID 4464 wrote to memory of 4712	4464	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	86
PID 4464 wrote to memory of 2988	4464	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	92
PID 4464 wrote to memory of 2988	4464	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	92
PID 4668 wrote to memory of 4672	4668	chrome_update.exe	93
PID 4464 wrote to memory of 3700	4464	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	96
PID 4668 wrote to memory of 1672	4668	chrome_update.exe	98
PID 4668 wrote to memory of 1672	4668	chrome_update.exe	98
PID 3700 wrote to memory of 6020	3700	cmd.exe	99
PID 4464 wrote to memory of 716	4464	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	100
PID 716 wrote to memory of 5212	716	cmd.exe	104
PID 4464 wrote to memory of 5216	4464	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	105
PID 5216 wrote to memory of 3480	5216	cmd.exe	107
PID 4668 wrote to memory of 5804	4668	chrome_update.exe	108
PID 4668 wrote to memory of 5804	4668	chrome_update.exe	108
PID 4668 wrote to memory of 4320	4668	chrome_update.exe	111
PID 4320 wrote to memory of 5356	4320	cmd.exe	113
PID 4668 wrote to memory of 5980	4668	chrome_update.exe	114
PID 5980 wrote to memory of 5984	5980	cmd.exe	116
PID 4668 wrote to memory of 5892	4668	chrome_update.exe	117
PID 5892 wrote to memory of 5156	5892	cmd.exe	119
PID 4668 wrote to memory of 3000	4668	chrome_update.exe	124
PID 3000 wrote to memory of 408	3000	cmd.exe	126
PID 4464 wrote to memory of 4704	4464	2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	130
PID 4704 wrote to memory of 4368	4704	cmd.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Drops startup file
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "GoogleUpdateTaskMachineCore" /tr "C:\Users\Admin\AppData\Local\Microsoft\Update\chrome_update.exe" /sc ONLOGON /f /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg export "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\WinSCP\sessions.reg" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\system32\reg.exe
    reg export "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\WinSCP\sessions.reg" /y
    3⤵
    PID:6020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmdkey /list
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Windows\system32\cmdkey.exe
    cmdkey /list
    3⤵
    PID:5212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg export "HKCU\Software\SimonTatham\PuTTY\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\PuTTY\sessions.reg" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5216
- - C:\Windows\system32\reg.exe
    reg export "HKCU\Software\SimonTatham\PuTTY\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\PuTTY\sessions.reg" /y
    3⤵
    PID:3480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 3 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1972

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3028

C:\Users\Admin\AppData\Local\Microsoft\Update\chrome_update.exe
C:\Users\Admin\AppData\Local\Microsoft\Update\chrome_update.exe
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "GoogleUpdateTaskMachineCore" /tr "C:\Users\Admin\AppData\Local\Microsoft\Update\chrome_update.exe" /sc ONLOGON /f /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg export "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\WinSCP\sessions.reg" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\system32\reg.exe
    reg export "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\WinSCP\sessions.reg" /y
    3⤵
    PID:5356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmdkey /list
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Windows\system32\cmdkey.exe
    cmdkey /list
    3⤵
    PID:5984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg export "HKCU\Software\SimonTatham\PuTTY\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\PuTTY\sessions.reg" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5892
- - C:\Windows\system32\reg.exe
    reg export "HKCU\Software\SimonTatham\PuTTY\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\PuTTY\sessions.reg" /y
    3⤵
    PID:5156
- C:\Windows\system32\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 3 >nul & del /f /q "C:\Users\Admin\AppData\Local\Microsoft\Update\chrome_update.exe"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3440

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2316

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion