afd24dc3e5320d2156dfff2675d0ebd1ada3c8cda935803f6342bc8f0e647c19

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/05/2026, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 805KB
Sample260503-nn71csgs5x
SHA256 afd24dc3e5320d2156dfff2675d0ebd1ada3c8cda935803f6342bc8f0e647c19
MD5 6316c66c8967eba7133de8b91d07b1e5
SHA1 48a40a3de801b6389af6a9e7ef4b314e511c238d
SHA512 d5fe2d0780a176c3537f62038d35ba52a384beed0c0c9a0d944505615fa08fe1872d32f879f90a60e679085609278cc9ec846b55059ae35f600d268988c8bdd2
SSDEEP 12288:tPveYDLCE2BMKO2Vs0EKZET7yDBl+RjzoHg9Y:tXeG12xO3oeW1lOX
TLSH
T1B9057C2E965401BCE1B7E2B4CF534D43E3B1784F037169EF078159A62F2A5A86E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Loads dropped DLL 1 IoCs

pid	Process
3040	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5068	2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5068	2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5068	2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
5068	2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 3040	5068	2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Loads dropped DLL
  PID:3040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:672

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

abe_00005BEF.dat

Path C:\Users\Admin\AppData\Local\Temp\abe_00005BEF.dat
Size 1KB
SHA256 f7653257e21cf9c6f11525e789e89394aa00c730beae8806d7a2b0224ea6efae
MD5 e65abd6e79c85ea8e61face42a31b163
SHA1 dfc0c7c96cc390773a4e98bce15b25507138cbdf
SHA512 88fd73284c9bf97028a34a5e3195171136b7a6abea7e386c8338274ff2a8bf2c025a882f900331b6d09ceba593af693f247979a93783460c62090682ae9ab5d5
TLSH
T15C216511AABE1349E192033A50EF46979EEFD66EFF9050CC68A693059958440C778E03
MD5 SHA1 SHA512 TLSH

Submit Download

abe_00005BEF.dll

Path C:\Users\Admin\AppData\Local\Temp\abe_00005BEF.dll
Size 94KB
SHA256 5f18d886675ba5bcda93216554cf206419d63b78d4b1f4a33556f6c9097015eb
MD5 9d6cf4cb38306c1fec1b7795135e6c40
SHA1 70d54844422a814ebdf52831a1c4f5902876dd9f
SHA512 8bfe2a448847e6ff99034e03db58371c4bae0dd1da8a1f2fc60a22c57d16f94cb3973d6a95240e69e56fcf819adef46852e8d06d6cb2753916bf09c84cd5da30
SSDEEP 1536:rDFL1b/koKpIhOttdetxNn5jlpZT3uvVUy2h:/vMJ/d+3uqF
TLSH
T1B19308CDBAC5AC97D925523951ABC336233AF6C907838F13593866350E177D0BECA682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download