chromelevator | 6025ec3fa54fde63c8717264390124645c85953dceead06802c2880997adc236

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_00df455cf2a585536e1740c791844a1d_cobalt-strike_icedid_satacom_stealc.exe
Size 3.3MB
Sample260523-b136qaav6n
SHA256 6025ec3fa54fde63c8717264390124645c85953dceead06802c2880997adc236
MD5 00df455cf2a585536e1740c791844a1d
SHA1 966d331603804cc5613b62a955f4c6763d6410dc
SHA512 f451937c79f2188071185d0444ccaa41f2f1bfe051b016c8bdef86eef380daf5bc011481f858cde75d4029cd76cfc20e1911f133f7212c18dd93af4df96f7534
SSDEEP 98304:BOlNCzwrEsPIzBxlbtq//WW00T2mIR35gE6eg7p9:7uIzBxVtoF00TYR3Z6Z7p9
TLSH
T172F5235AB7651CF6F977C078CA160A01EDB6B86743A0DBCF13910B625E076E09D3E362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution chromelevator hacktool spyware stealer

Malware Config

Signatures

Family: ChromElevator
ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.
hacktool chromelevator

Detects ChromElevator 2 IoCs

resource	yara_rule
behavioral2/files/0x001d00000002b30b-9.dat	family_chromelevator
behavioral2/files/0x001900000002b47e-17.dat	family_chromelevator

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x001d00000002b30b-9.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Custom signature

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x001d00000002b30b-9.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Executes dropped EXE 3 IoCs

pid	Process
4128	PL14CB.tmp
3256	chromelevator.exe
3140	chromelevator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5016	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5016	powershell.exe
5016	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 4128	3940	2026-05-23_00df455cf2a585536e1740c791844a1d_cobalt-strike_icedid_satacom_stealc.exe	81
PID 4128 wrote to memory of 1336	4128	PL14CB.tmp	82
PID 1336 wrote to memory of 4404	1336	cmd.exe	83
PID 4128 wrote to memory of 3256	4128	PL14CB.tmp	84
PID 3256 wrote to memory of 2580	3256	chromelevator.exe	86
PID 3256 wrote to memory of 2580	3256	chromelevator.exe	86
PID 4128 wrote to memory of 3140	4128	PL14CB.tmp	89
PID 3140 wrote to memory of 5036	3140	chromelevator.exe	91
PID 3140 wrote to memory of 5036	3140	chromelevator.exe	91
PID 4128 wrote to memory of 5016	4128	PL14CB.tmp	92

C:\Users\Admin\AppData\Local\Temp\2026-05-23_00df455cf2a585536e1740c791844a1d_cobalt-strike_icedid_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_00df455cf2a585536e1740c791844a1d_cobalt-strike_icedid_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Users\Admin\AppData\Local\Temp\PL14CB.tmp
  "C:\Users\Admin\AppData\Local\Temp\PL14CB.tmp"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c chcp 65001 > nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4404
- - C:\Users\Admin\AppData\Local\Temp\chromelevator.exe
    "C:\Users\Admin\AppData\Local\Temp\chromelevator.exe" chrome --output-path "C:\Users\Admin\AppData\Local\Temp\\Winapi\Browsers\Chrome_raw" --kill
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3256
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:2580
- - C:\Users\Admin\AppData\Local\Temp\chromelevator.exe
    "C:\Users\Admin\AppData\Local\Temp\chromelevator.exe" edge --output-path "C:\Users\Admin\AppData\Local\Temp\\Winapi\Browsers\Edge_raw" --kill
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\\Winapi\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\\win.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5016

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PL14CB.tmp

Path C:\Users\Admin\AppData\Local\Temp\PL14CB.tmp
Size 3.1MB
SHA256 ddce404a910147581c0ab2dce564f8d8b60816cc55fbb306427119503879ce81
MD5 413dfff25663486060eb0d6263297acf
SHA1 c02d3c73672a44ee6e1c4067d5d0a9e85bf74414
SHA512 ad4ae8f9a41ea19ce8554829a9ca300e8b1a725372dc52d443d00f60dce428180f8dd0ec4b3f2b120804756ce046ed3638b5f2db13cdf1827248ee36891e9955
SSDEEP 49152:DHu8lT2+bHY0YDjaGuRuAziBeDOhsb/BhGuwX9j6T+rENuKhdiA7:jXtNb45Djhu5tf2ZrP+diA7
TLSH
T19BE5C04AE3B400FDD067C178C91A5617EBB2B846037597DF239489A66F23AE15F7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Chrome_Cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\Winapi\Browsers\Chrome_Cookies.txt
Size 292B
SHA256 042592a7868a29bbedba2f3bd8c11aed1997367564021125c0e93bf020041110
MD5 f545ec861ebcffd9a21351f89606d687
SHA1 3e43059bcb0fc33d4d20f7712d63eea03519f5b4
SHA512 90c30a76caf91ff769406eb56e6f10e8790bc0296e4df9b1a342fca90fc49c827f896f1863baf35672a0a6aefc313edf5f9a0685ed30b57909439d817ecd674a
TLSH
T180E0725A1C570A4988B6C0111A4482EA8F002BDA3225FA882100983013BCA86BBA82EB
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\Winapi\Browsers\Chrome_raw\Chrome\Default\cookies.json
Size 339B
SHA256 fbe581f94df820b834b892fe9af12906fd8a186e5c85954651c2d46ee49354d9
MD5 84498b58ebd33557b528154c68ad99d8
SHA1 b196e054c35c8603535470e68b19e5900c46a29f
SHA512 e79100331f4e108a6083cacc67ffc9ed8e03ab22d66992b6c9b15cd65d62a83ca6b13aa32a28bda323880d360f266326e633c42271d2cc43d610ba89dcdece2f
TLSH
T1E0E0C6AA88860E16CC3280214C4086EEAF202B973128FE882618C82017B8A8AB3250C7
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox_Cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\Winapi\Browsers\Firefox_Cookies.txt
Size 31B
SHA256 fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
MD5 b7161c0845a64ff6d7345b67ff97f3b0
SHA1 d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA512 98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
MD5 SHA1 SHA512

Submit Download

Screenshot.bmp

Path C:\Users\Admin\AppData\Local\Temp\Winapi\Screenshot.bmp
Size 7.9MB
SHA256 4f77f2dc2642df598003d481549654b46ffc370ad44c9e2ba9b74d92f3dbf1d6
MD5 2090a24afe829cca85be1e0716a53258
SHA1 304b47781690c2a4cd8e90653c1f6a1309f91464
SHA512 43711ab853fc5821237252b03c6d7e697ec126ce91c024caaed45dbb608942dcb494d68b8ee4a0ceb98519ddc5a85798421f3c87690227569edafc2ef54ab967
SSDEEP 196608:lvMYTYsC5bc6Jp//q+VuTBRxOOZ4ayLNW7dRcV:lvMYTYsC5bc6Jp//q+VuTBRxOOZ4ayLV
TLSH
T1D986D1E93B086C49C53387F16CC4E2B834280E9DE795C198A9F1EEA3F4E6C535D9B191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.txt

Path C:\Users\Admin\AppData\Local\Temp\Winapi\System.txt
Size 429B
SHA256 9fcae11dc32a1a5e540f4f72b32f7316ed8de46cf3821f43d8eb41efcdc53c8d
MD5 799b37e14127f7169234ba604170b515
SHA1 73c07c6bb34d9ada01fdb3f67b9d000eac448cb8
SHA512 819e77c7d75e0c6835c2f7326de6ee5605d3f0fc6ca22a2c8abbd1f5f5a3dbb58eb90d5e08739836180186d21769d01ac5154cda0b4f79cafd96f9a7b2616a0e
TLSH
T1D7E0AB98A144E169B13482B303A71F4E61D1BA192AFA5E30D4EFE26027C709CA98E981
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ee4ytfee.n1j.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ee4ytfee.n1j.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\chromelevator.exe
Size 1.4MB
SHA256 a95ad2f5dec66f6ce6c7ab58d158b64225437e42e2397b8f958bfa507ebb7dbe
MD5 c80f02f86d552c237009ac30499d306a
SHA1 ec380a96795ba9765bdb56fed8a087f406f43e96
SHA512 1b7145b0af0ae5c8c5deee9c7f8243b7aa88bca780e948275be38170e6ab5ec8e417d4cca3ddcafb033816c025c5d046e15a7f7f8a39924ba9d046d8f1a1d8a8
SSDEEP 24576:01Dag/zCuwX9j6f7+rxD6WtcbuERQrSPUPvehdidbqqME:0BhGuwX9j6T+rENuKhdiA7
TLSH
T1F565121AEBA414FDD1B7D534CD624806DBB2F88A07A0A78F13E445965F336A05E3F722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win.zip

Path C:\Users\Admin\AppData\Local\Temp\win.zip
Size 527KB
SHA256 b0a901fd04eb8101496a7711418129f8f209dd544bdf90a9863d5e78a2715c02
MD5 cbcd052a9ac095f0913f2937b7a4e326
SHA1 c5c34e4b9dabb597b2e0be91c5a184d001f8ebf3
SHA512 5dd164dc659d222b06b4e8f35f90e2a76a34f6d60f86b6f9db3dda8241a1467e62b5dd751c309c6a7aaa0005c373f0cf3d394094837294bc7fb742f4893144f4
SSDEEP 12288:1I2uzckWOGH7pHpBhxBDNAv0X5WCa4WJwQUVDJCJRHSY+OJz7xL:1cc9NpBhxBDNjpWCaYVDJmyY+OZxL
TLSH
T14FB42329B173BD0CCDD368344E681FCD59DC747AEA548A3B926C152C9422FE93A18B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5016-54-0x0000017CD0B10000-0x0000017CD0BC3000-memory.dmp

Download

memory/5016-57-0x0000017CD0AF0000-0x0000017CD0AFA000-memory.dmp

Download

memory/5016-56-0x0000017CD0BD0000-0x0000017CD0BE2000-memory.dmp

Download

memory/5016-55-0x0000017CD0BD0000-0x0000017CD0BDA000-memory.dmp

Download

memory/5016-53-0x0000017CD0AF0000-0x0000017CD0B0C000-memory.dmp

Download

memory/5016-45-0x0000017CB4E90000-0x0000017CB4EB2000-memory.dmp

Download