c82a875a0ee65d52f62cf3d5f7c7aee739d5b94e4053beb896e8796a03830674

Analysis

max time kernel
149s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 18:10

Target
2026-05-28_9f55b977e0d24554fec09e52c0d3457f_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
Size 1.6MB
Sample260528-wsh6ssh19y
SHA256 c82a875a0ee65d52f62cf3d5f7c7aee739d5b94e4053beb896e8796a03830674
MD5 9f55b977e0d24554fec09e52c0d3457f
SHA1 1ffe8b734bcf9fc7c1cdac01b8e8ef69bc15dd48
SHA512 7e2f4ec7bbb91b837763556514c30ee1353c250b1ea691fcf42c4fabaa72d50729bff4aa6b792e063fdb82c740ab86b1026751c9167b89cd8ed04f9c338d4184
SSDEEP 24576:wxLZKAyt5tmx1Y51t05ZtP7gQA+YXIySn46BKuK5XaMsG0TM2jlX6cL:UByHh51t0jaBm4MKuK5Xaksjl
TLSH
T1D675024AA3A451FCE1BBC178C992450ADB71FC250B70AADF17945AA71F23BE05E3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 5032	1812	2026-05-28_9f55b977e0d24554fec09e52c0d3457f_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	82
PID 1812 wrote to memory of 5032	1812	2026-05-28_9f55b977e0d24554fec09e52c0d3457f_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	82
PID 1812 wrote to memory of 3352	1812	2026-05-28_9f55b977e0d24554fec09e52c0d3457f_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	85
PID 1812 wrote to memory of 3352	1812	2026-05-28_9f55b977e0d24554fec09e52c0d3457f_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-28_9f55b977e0d24554fec09e52c0d3457f_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_9f55b977e0d24554fec09e52c0d3457f_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3352

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3876

cookies.json

Path C:\Users\Admin\AppData\Local\vVqAz3\Chrome\Default\cookies.json
Size 342B
SHA256 a2a189c86abb0577da2febd1afee61cfdad309888b3766ebe28eb1dd1706036e
MD5 1c29a35f43e808e0f28bec274370c238
SHA1 c562b3e15a711531d89e72b62388dc428fb9585a
SHA512 e6b5df81b99de32817366174d7bba300490ca0865d11d59ad05b7d9a1818c7ecc7ee2ad5b11edae1c6a990638829a9497649f0f189be4b9357cc111992b5054c
TLSH
T12DE0C0DBBC53253CCC425058C1102C9D99702602D1DC4E21758BD4C9026097B733E695
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\vVqAz3\Chrome\Default\cookies.txt
Size 254B
SHA256 416c5acdb439376ac6740c0d8d999455a6aac8e57cf85029502b38d2f98a200a
MD5 66c6d3cac408fefa73b59714905fa87b
SHA1 ba33012798e691a3cce29d4ee1e6b9c6f4a6211c
SHA512 fce3b96bbcabc3308e261ce6328445ee4dbcf9a8aacdcac65601342cea1cb5842f4b1504d481c2f8df1da9dbcda7b2c688f6c2470c7eec4aab2fb31ccadc23ec
TLSH
T1F8D0955B7D57B35C8455C05881B05C5D8D406D01D1EC97317249D1D5135157F772D771
MD5 SHA1 SHA512 TLSH

Submit Download

fingerprint.json

Path C:\Users\Admin\AppData\Local\vVqAz3\Chrome\fingerprint.json
Size 970B
SHA256 658aa41c1a12b07a036c4f53edbd20d66c11ae6e64ff59a4943b3e47f6695097
MD5 02a580e0d081439a915aefd4649a5350
SHA1 67cf7fd891a41986384f6bbbf10f46db859ffca3
SHA512 e355d5b21a6f5a343aa16ae4afcec8340ee2a831e0f299b2cf09560c1cbdc771b1d63fa03b2b2f9c9943d1a10809456151a6de997de0de7996c3fbfd654c25c0
TLSH
T13811DC02A805D4FF2971F058D27495573AB24F2D31F90C1733FBA418195A77E315AFA2
MD5 SHA1 SHA512 TLSH

Submit Download