Overview

overview

10

Static

static

10

2026-04-19...om.exe

windows10-2004-x64

9

2026-04-19...om.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    19/04/2026, 22:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
  • Size 2.2MB
  • Sample260419-2mlbvsgv31
  • SHA256 71419feb219cf2994acbce575b18fb5693c3bc49a98b40659b1df3a96dfe2e24
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Custom signature
    Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
    defense_evasion
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
    defense_evasion
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Drops startup file
    • Adds Run key to start application
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4784
    • C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "GoogleUpdateTaskMachineCore" /tr "C:\Users\Admin\AppData\Local\Microsoft\Update\chrome_update.exe" /sc ONLOGON /f /rl HIGHEST
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3760
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      2⤵
        PID:4336
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        2⤵
          PID:1868
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c reg export "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\WinSCP\sessions.reg" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3364
          • C:\Windows\system32\reg.exe
            reg export "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\WinSCP\sessions.reg" /y
            3⤵
              PID:2348
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c cmdkey /list
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2816
            • C:\Windows\system32\cmdkey.exe
              cmdkey /list
              3⤵
                PID:2384
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c reg export "HKCU\Software\SimonTatham\PuTTY\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\PuTTY\sessions.reg" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4868
              • C:\Windows\system32\reg.exe
                reg export "HKCU\Software\SimonTatham\PuTTY\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\PuTTY\sessions.reg" /y
                3⤵
                  PID:1452
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c ping 127.0.0.1 -n 3 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-04-19_ba119db5afcc08cfdbc58bb6616058af_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe"
                2⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Suspicious use of WriteProcessMemory
                PID:560
                • C:\Windows\system32\PING.EXE
                  ping 127.0.0.1 -n 3
                  3⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:1972
            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
              1⤵
                PID:1276
              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                1⤵
                  PID:1240
                • C:\Users\Admin\AppData\Local\Microsoft\Update\chrome_update.exe
                  C:\Users\Admin\AppData\Local\Microsoft\Update\chrome_update.exe
                  1⤵
                  • Looks for VirtualBox Guest Additions in registry
                  • Looks for VMWare Tools registry key
                  • Drops startup file
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:4288
                  • C:\Windows\system32\schtasks.exe
                    schtasks /create /tn "GoogleUpdateTaskMachineCore" /tr "C:\Users\Admin\AppData\Local\Microsoft\Update\chrome_update.exe" /sc ONLOGON /f /rl HIGHEST
                    2⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:4656
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                    2⤵
                      PID:2124
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                      2⤵
                        PID:1732
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c reg export "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\WinSCP\sessions.reg" /y
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2744
                        • C:\Windows\system32\reg.exe
                          reg export "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\WinSCP\sessions.reg" /y
                          3⤵
                            PID:3608
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c cmdkey /list
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3372
                          • C:\Windows\system32\cmdkey.exe
                            cmdkey /list
                            3⤵
                              PID:1324
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c reg export "HKCU\Software\SimonTatham\PuTTY\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\PuTTY\sessions.reg" /y
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4800
                            • C:\Windows\system32\reg.exe
                              reg export "HKCU\Software\SimonTatham\PuTTY\Sessions" "C:\Users\Admin\AppData\Local\Temp\chromelev_data\VPN_RDP\PuTTY\sessions.reg" /y
                              3⤵
                                PID:756
                            • C:\Windows\system32\cmd.exe
                              cmd.exe /c ping 127.0.0.1 -n 3 >nul & del /f /q "C:\Users\Admin\AppData\Local\Microsoft\Update\chrome_update.exe"
                              2⤵
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4820
                              • C:\Windows\system32\PING.EXE
                                ping 127.0.0.1 -n 3
                                3⤵
                                • System Network Configuration Discovery: Internet Connection Discovery
                                • Runs ping.exe
                                PID:960
                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                            1⤵
                              PID:3188
                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                              1⤵
                                PID:4216

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Scheduled Task

                                    1
                                    T1053.005

                                    Persistence

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Scheduled Task

                                    1
                                    T1053.005

                                    Privilege Escalation

                                    Boot or Logon Autostart Execution

                                    1
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Scheduled Task

                                    1
                                    T1053.005

                                    Defense Evasion

                                    Modify Registry

                                    1
                                    T1112

                                    Virtualization/Sandbox Evasion

                                    2
                                    T1497

                                    Credential Access

                                    Credentials from Password Stores

                                    1
                                    T1555

                                    Credentials from Web Browsers

                                    1
                                    T1555.003

                                    Unsecured Credentials

                                    1
                                    T1552

                                    Credentials In Files

                                    1
                                    T1552.001

                                    Discovery

                                    Query Registry

                                    4
                                    T1012

                                    Remote System Discovery

                                    1
                                    T1018

                                    System Information Discovery

                                    1
                                    T1082

                                    System Network Configuration Discovery

                                    1
                                    T1016

                                    Internet Connection Discovery

                                    1
                                    T1016.001

                                    Virtualization/Sandbox Evasion

                                    2
                                    T1497

                                    Lateral Movement

                                    Collection

                                    Data from Local System

                                    1
                                    T1005

                                    Command and Control

                                    Exfiltration

                                    Impact

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    chrome_update.exe
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Update\chrome_update.exe
                                    • Size 2.2MB
                                    • SHA256 71419feb219cf2994acbce575b18fb5693c3bc49a98b40659b1df3a96dfe2e24
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    1592254210.db
                                    • Path C:\Users\Admin\AppData\Local\Temp\chromelev_data\.temp\1592254210.db
                                    • Size 138KB
                                    • SHA256 a58c4279f5c1f3166e39b966446f0336ecf1de7e0ba1a711429b5fe8415111f6
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    3125271924.db
                                    • Path C:\Users\Admin\AppData\Local\Temp\chromelev_data\.temp\3125271924.db
                                    • Size 224KB
                                    • SHA256 2d8571ac33b06ca1bda8b4e494359e692e472987222f5de95eec25a12c853d1f
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    fingerprint.json
                                    • Path C:\Users\Admin\AppData\Local\Temp\chromelev_data\Chrome\fingerprint.json
                                    • Size 970B
                                    • SHA256 05858155353f8516ea3adb45fc45e06ba1a396f49ed8bdcbb670824072e68f1b
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    fingerprint.json
                                    • Path C:\Users\Admin\AppData\Local\Temp\chromelev_data\Chrome\fingerprint.json
                                    • Size 970B
                                    • SHA256 066eff94a9828fa1f5c2425f0fc83c91b3af0f8c4b9ff000d9b32e039be51d99
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    Chrome_Default.txt
                                    • Path C:\Users\Admin\AppData\Local\Temp\chromelev_data\Cookies Browser\Chrome_Default.txt
                                    • Size 295B
                                    • SHA256 fad3d98f8c16368aacccc488ed90bedb8c7f371f09e6da4b7eda4f920a64a399
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    fingerprint.json
                                    • Path C:\Users\Admin\AppData\Local\Temp\chromelev_data\Edge\fingerprint.json
                                    • Size 979B
                                    • SHA256 5cd3d4f3c7aef19119936bb22e23d34e107bb8a40ed557b71ade440e7940bbb1
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    fingerprint.json
                                    • Path C:\Users\Admin\AppData\Local\Temp\chromelev_data\Edge\fingerprint.json
                                    • Size 979B
                                    • SHA256 315ca328451c922036454c453e20df52fbfed89920a29d5187367e6d55d71864
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    spectrenx_debug.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\spectrenx_debug.log
                                    • Size 629B
                                    • SHA256 38d087c39939a619ee164668cbcce05608d440f967dccab9ee3d220f6ece9866
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    spectrenx_debug.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\spectrenx_debug.log
                                    • Size 944B
                                    • SHA256 602b3ec39e8ec48c8fbf55f1f5077993c890ff4913158c3b43e6b14c8519dff6
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    spectrenx_debug.log
                                    • Path C:\Users\Admin\AppData\Local\Temp\spectrenx_debug.log
                                    • Size 1KB
                                    • SHA256 59a1ed51e7e7ae157b275f218c6499ec28e75fc7418d8a7235432242b14b777d
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    memory/4288-18-0x00007FFA50700000-0x00007FFA50909000-memory.dmp
                                    Download

                                    memory/4784-0-0x00007FFA50700000-0x00007FFA50909000-memory.dmp
                                    Download