6f0a24fda266cdd0238d82280c7ef21f96e14816a5a6eeb9c9960b22becb03e7

General

Target
2026-05-06_1d4cfd65a5f29386e1fb0c621d9979a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 874KB
Sample260506-lwk5fsey5v
SHA256 6f0a24fda266cdd0238d82280c7ef21f96e14816a5a6eeb9c9960b22becb03e7
MD5 1d4cfd65a5f29386e1fb0c621d9979a5
SHA1 8369420c2706c3f76f786e7ed8b32bf87590ca45
SHA512 64c3afae962ee811675e2861acfbb71847593e736096dfb14a03b350fbec4ea1827c9432bf04e571ecd3b247eea4eee8685b1fd8c17c0ef6c54f812e4898f15d
SSDEEP 12288:2raG3vgFDcme0Z3Jm19O49TChi+yOPGN1sK/j9ivQ0obQ2vpfj4flmDxcTgKpNEv:un/8e0ZYfoGN1sKLoIhQ2
TLSH
T1CD155D1AE66800BDD0B7C6B4CE665D43D771F84A03706ADB03D05AA63F277E49A3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
1	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-05-06_1d4cfd65a5f29386e1fb0c621d9979a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-05-06_1d4cfd65a5f29386e1fb0c621d9979a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 1504	4196	2026-05-06_1d4cfd65a5f29386e1fb0c621d9979a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	79
PID 4196 wrote to memory of 1504	4196	2026-05-06_1d4cfd65a5f29386e1fb0c621d9979a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	79
PID 4196 wrote to memory of 4028	4196	2026-05-06_1d4cfd65a5f29386e1fb0c621d9979a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	81
PID 4196 wrote to memory of 4028	4196	2026-05-06_1d4cfd65a5f29386e1fb0c621d9979a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	81
PID 4196 wrote to memory of 4348	4196	2026-05-06_1d4cfd65a5f29386e1fb0c621d9979a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	83
PID 4196 wrote to memory of 4348	4196	2026-05-06_1d4cfd65a5f29386e1fb0c621d9979a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	83
PID 4196 wrote to memory of 3028	4196	2026-05-06_1d4cfd65a5f29386e1fb0c621d9979a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	85
PID 4196 wrote to memory of 3028	4196	2026-05-06_1d4cfd65a5f29386e1fb0c621d9979a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-06_1d4cfd65a5f29386e1fb0c621d9979a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-06_1d4cfd65a5f29386e1fb0c621d9979a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3028

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6036