afd24dc3e5320d2156dfff2675d0ebd1ada3c8cda935803f6342bc8f0e647c19

Analysis

max time kernel
149s
max time network
116s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 805KB
Sample260503-nn71csgs5x
SHA256 afd24dc3e5320d2156dfff2675d0ebd1ada3c8cda935803f6342bc8f0e647c19
MD5 6316c66c8967eba7133de8b91d07b1e5
SHA1 48a40a3de801b6389af6a9e7ef4b314e511c238d
SHA512 d5fe2d0780a176c3537f62038d35ba52a384beed0c0c9a0d944505615fa08fe1872d32f879f90a60e679085609278cc9ec846b55059ae35f600d268988c8bdd2
SSDEEP 12288:tPveYDLCE2BMKO2Vs0EKZET7yDBl+RjzoHg9Y:tXeG12xO3oeW1lOX
TLSH
T1B9057C2E965401BCE1B7E2B4CF534D43E3B1784F037169EF078159A62F2A5A86E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Loads dropped DLL 1 IoCs

pid	Process
468	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3824	2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
3824	2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
3824	2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
3824	2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 468	3824	2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_6316c66c8967eba7133de8b91d07b1e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Loads dropped DLL
  PID:468

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4276

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

abe_000046D3.dat

Path C:\Users\Admin\AppData\Local\Temp\abe_000046D3.dat
Size 1KB
SHA256 a112c8af1215c1b20b9a9169963c3147e71266ccb959e221ae3dac6ea9d8e897
MD5 cc23d77ad6a30dd481ecaa54a8b71a57
SHA1 7e5f2f18ef481aed6c117dc7eeb2125d176977d4
SHA512 80ace1933ea700937d2f09644984da728ce7b5674ea370c2ba8993304327ec7dd89642b9faa16865a658ef8a4db87d59c2057ef7816f8d6adcc58ebaaa185e28
TLSH
T1CD216505489652D1E6904770C0E75E3F29E7EEDE8B7F6051004417360729A2D126EAB3
MD5 SHA1 SHA512 TLSH

Submit Download

abe_000046D3.dll

Path C:\Users\Admin\AppData\Local\Temp\abe_000046D3.dll
Size 94KB
SHA256 5f18d886675ba5bcda93216554cf206419d63b78d4b1f4a33556f6c9097015eb
MD5 9d6cf4cb38306c1fec1b7795135e6c40
SHA1 70d54844422a814ebdf52831a1c4f5902876dd9f
SHA512 8bfe2a448847e6ff99034e03db58371c4bae0dd1da8a1f2fc60a22c57d16f94cb3973d6a95240e69e56fcf819adef46852e8d06d6cb2753916bf09c84cd5da30
SSDEEP 1536:rDFL1b/koKpIhOttdetxNn5jlpZT3uvVUy2h:/vMJ/d+3uqF
TLSH
T1B19308CDBAC5AC97D925523951ABC336233AF6C907838F13593866350E177D0BECA682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download