chromelevator | 7b40649c9163df824a157321511b29e6840f1daa07e773b498ea00ef5c82df05

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_6d5be6b68ff6f20b976b88dea1e906c6_cobalt-strike_icedid_satacom_stealc.exe
Size 3.3MB
Sample260426-e8byzsdv7z
SHA256 7b40649c9163df824a157321511b29e6840f1daa07e773b498ea00ef5c82df05
MD5 6d5be6b68ff6f20b976b88dea1e906c6
SHA1 51e7b8d07812e48a36cc3932f7bb26b4d0b7e761
SHA512 3dc6600066de3b9d652512e6eca4f6cf75fe724cb7288d483f44bdbe2a663539ee5e4fd8d7315d59298eb2dc883308b3535457e30e06defb085db7dff492706f
SSDEEP 98304:BOB6CtUuwcn4gZTtNq30wRGi112QT4e5g8rPm6:JYZ4Q0112Q1g8rb
TLSH
T190F52319B7E848F9E97B8539CD020982DE32BD550765D6CF07624AA34F67AB0CD3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution chromelevator hacktool spyware stealer

Malware Config

Signatures

Family: ChromElevator
ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.
hacktool chromelevator

Detects ChromElevator 2 IoCs

resource	yara_rule
behavioral2/files/0x002000000002b1b9-9.dat	family_chromelevator
behavioral2/files/0x001900000002b306-17.dat	family_chromelevator

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x002000000002b1b9-9.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x002000000002b1b9-9.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Executes dropped EXE 3 IoCs

pid	Process
3476	PL3302.tmp
3024	chromelevator.exe
1644	chromelevator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
856	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
856	powershell.exe
856	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	856	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 3476	4932	2026-04-26_6d5be6b68ff6f20b976b88dea1e906c6_cobalt-strike_icedid_satacom_stealc.exe	81
PID 3476 wrote to memory of 3316	3476	PL3302.tmp	82
PID 3316 wrote to memory of 3980	3316	cmd.exe	83
PID 3476 wrote to memory of 3024	3476	PL3302.tmp	84
PID 3024 wrote to memory of 4564	3024	chromelevator.exe	86
PID 3024 wrote to memory of 4564	3024	chromelevator.exe	86
PID 3476 wrote to memory of 1644	3476	PL3302.tmp	89
PID 1644 wrote to memory of 1120	1644	chromelevator.exe	91
PID 1644 wrote to memory of 1120	1644	chromelevator.exe	91
PID 3476 wrote to memory of 856	3476	PL3302.tmp	92

C:\Users\Admin\AppData\Local\Temp\2026-04-26_6d5be6b68ff6f20b976b88dea1e906c6_cobalt-strike_icedid_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_6d5be6b68ff6f20b976b88dea1e906c6_cobalt-strike_icedid_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\PL3302.tmp
  "C:\Users\Admin\AppData\Local\Temp\PL3302.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c chcp 65001 > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3980
- - C:\Users\Admin\AppData\Local\Temp\chromelevator.exe
    "C:\Users\Admin\AppData\Local\Temp\chromelevator.exe" chrome --output-path "C:\Users\Admin\AppData\Local\Temp\\Winapi\Browsers\Chrome_raw" --kill
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:4564
- - C:\Users\Admin\AppData\Local\Temp\chromelevator.exe
    "C:\Users\Admin\AppData\Local\Temp\chromelevator.exe" edge --output-path "C:\Users\Admin\AppData\Local\Temp\\Winapi\Browsers\Edge_raw" --kill
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:1120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\\Winapi\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\\win.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5036

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PL3302.tmp

Path C:\Users\Admin\AppData\Local\Temp\PL3302.tmp
Size 3.1MB
SHA256 73e0812748cac198cad890d34e19968820fcc928987843019e1ad9abffcf9fa8
MD5 b058f54a6248c06e82cdfbdb891cd8f2
SHA1 eded1d24bbc9a98a0c5f7a9dafdc12b88884b006
SHA512 289c982eb3feb0d7e2afcfa191041ebd656c2820a97b2ebd1caee2c07fac3b43ad3f90aedf5473c0c3cea2cf0828d3f953a3eefcb76e17b77f58032a70089a62
SSDEEP 49152:PHu8lT2+bHY0YDjaGuRuAziBeDOh7r/BhGuwX9j6T+rENuKhdiA7:vXtNb45Djhu5Uf2ZrP+diA7
TLSH
T12AE5C04AE3B400FDD067C178C91A5617EBB2B846037597DF239489A66F23AE15F7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chrome_Cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\Winapi\Browsers\Chrome_Cookies.txt
Size 303B
SHA256 660451c09912491510b9b7062438fbe19e14db63fc164e184a0b4f604d636ea2
MD5 ff39cf18a35354ac9807e30fc32ec710
SHA1 36717b30c4ae4070995a21565706502166a15b2f
SHA512 ce255166cae5458a727495cebb5db69782633f4696bb30732a4f7d9c085da34f1246d6275a64ec1f98df40191ab71458d13bdef66c8927970d022bd554dbcad4
TLSH
T10BE0E7C5386B618C4048C019B772017F09265D1213B5F754C403BE4403D6CE86F5D0E6
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\Winapi\Browsers\Chrome_raw\Chrome\Default\cookies.json
Size 350B
SHA256 532cfa5080063063d69512c403a68a98e16af2b23858a73b095e80f5b1f67b23
MD5 f72e41fd3b12c903d7f29d8f1d11665c
SHA1 7afd45f5d7f47d523dce6bb53918e756a6a34b24
SHA512 909e2b965bce0be0f01a61923f5bce22f4e8ea911ad8fd36b13531fd3c88d8bedac4e517f1d0ac177ec86dfa78823d4429d7b3e0cb1167837812c4b135ab02ee
TLSH
T149E0C0C624DA645DC8119129AE2106AF2A39661202B4BE58C826F8480791DA8261A0D6
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox_Cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\Winapi\Browsers\Firefox_Cookies.txt
Size 31B
SHA256 fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
MD5 b7161c0845a64ff6d7345b67ff97f3b0
SHA1 d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA512 98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
MD5 SHA1 SHA512

Submit Download

Screenshot.bmp

Path C:\Users\Admin\AppData\Local\Temp\Winapi\Screenshot.bmp
Size 7.9MB
SHA256 e4c679e672a85c9f3e9af2a518baea7269faa448d4c4d5858c7c5f17a1ed152f
MD5 855fbe0e5c239095318866f9390e93cc
SHA1 82b36bb32b4c0e2688fdb5ddb99abaa58be70afb
SHA512 712549cf1ae514244d4fee52ac73f4f344bb01c1e6b4871f35d77d617891dd4bd1059e0db3e30519cb2816c944942cb2b66ff6f0a4ab6d223f76903ac4541060
SSDEEP 196608:knq+RWlShbCMJpm/qyNONNYlOOlQwyao+wq1HL:knq+RWlShbCMJpm/qyNONNYlOOlQwyad
TLSH
T19B86E1E93B086C59C53387F16CC0E2B834280E9DE795C158A9F1EEA3F4D6C539D9B192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.txt

Path C:\Users\Admin\AppData\Local\Temp\Winapi\System.txt
Size 428B
SHA256 906ff9d46ea8f4291db4ec62ac861ab2a412436d46d76000b9e4e3784da385c5
MD5 2440a93c4e68f25093861e0ddef00d4e
SHA1 43af3fda90f163ebe878bb632bfe6a4aefd266c3
SHA512 8b56bdceebc9f4cfd32499b76597fdbf4cd50c2b0f640b9be247bc7afdc756642859077fb55748a2bc7255f1ce56620dda1ed9d9020da38d27e3436d4c32e618
TLSH
T143E0AB5891C5E175B23581B203A30F0D20C2BA452BFA9A7191FE926037C60ACE88F181
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_h1x5czdt.s4l.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h1x5czdt.s4l.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\chromelevator.exe
Size 1.4MB
SHA256 a95ad2f5dec66f6ce6c7ab58d158b64225437e42e2397b8f958bfa507ebb7dbe
MD5 c80f02f86d552c237009ac30499d306a
SHA1 ec380a96795ba9765bdb56fed8a087f406f43e96
SHA512 1b7145b0af0ae5c8c5deee9c7f8243b7aa88bca780e948275be38170e6ab5ec8e417d4cca3ddcafb033816c025c5d046e15a7f7f8a39924ba9d046d8f1a1d8a8
SSDEEP 24576:01Dag/zCuwX9j6f7+rxD6WtcbuERQrSPUPvehdidbqqME:0BhGuwX9j6T+rENuKhdiA7
TLSH
T1F565121AEBA414FDD1B7D534CD624806DBB2F88A07A0A78F13E445965F336A05E3F722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win.zip

Path C:\Users\Admin\AppData\Local\Temp\win.zip
Size 538KB
SHA256 588581255d55fd821e7cb9822247247c578f54b8e4649f01a411526f8491501b
MD5 8b317d8b8e6294e691e6cde32e3dcc4f
SHA1 5d551b34133486e96322d944c875f77d17c8ce12
SHA512 99a002f27d470a30bae8e8fdc2cb6839381c50ba01d29e60bd370afcd1870ec547b5528fd73f4155ab16cfa1d80b9c54c4bf402cca76dc99622a916836244fb9
SSDEEP 12288:or/oIAa9suHPk8/POX8oQksUQ/b4PDeESpF7:ojoIAanXPTUKEST
TLSH
T15DC4239E78F6D248DECF1C7A8FE19715427857072C15966EB236C46CDA42AB82F04B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/856-55-0x0000018FB7610000-0x0000018FB761A000-memory.dmp

Download

memory/856-56-0x0000018FB78D0000-0x0000018FB78E2000-memory.dmp

Download

memory/856-57-0x0000018FB7520000-0x0000018FB752A000-memory.dmp

Download

memory/856-54-0x0000018FB7550000-0x0000018FB7603000-memory.dmp

Download

memory/856-53-0x0000018FB7520000-0x0000018FB753C000-memory.dmp

Download

memory/856-40-0x0000018FB7270000-0x0000018FB7292000-memory.dmp

Download

memory/856-71-0x0000018FB7220000-0x0000018FB7232000-memory.dmp

Download

memory/856-72-0x0000018FB7870000-0x0000018FB78C6000-memory.dmp

Download

memory/3476-74-0x0000019EF3870000-0x0000019EF3879000-memory.dmp

Download