be9b29a0871f32328fdfd9feedaddffcc43ce7d65a8ee9b1862d9ebed5f5c761

General

Target
2026-05-29_fc6180dea457667f607426fbb62756f7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 874KB
Sample260529-naernaat2n
SHA256 be9b29a0871f32328fdfd9feedaddffcc43ce7d65a8ee9b1862d9ebed5f5c761
MD5 fc6180dea457667f607426fbb62756f7
SHA1 9e7f25022b36eddbeaeab6b47c339021aa37dbc8
SHA512 d707da2c43ca9fc7523881c2a77e4fb523c8494b58893c08aae745d7b03e57f6dde55cdfc0c35d851a18035ebc88baeeab12de6c7d2750bb30fd403c5f8e1ae8
SSDEEP 12288:t9KG6EwibnUchC97UlCiYUZshreupPVNMe1R/OiMWAYNc2vpfj4flmDxcTgKpNEm:H3zqchwucVNMe1RXDHc2M
TLSH
T164155D1AE6A800BDD0B7C6B4CE665D43D771B84B03705ADB03D05AA63F277E49A3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-05-29_fc6180dea457667f607426fbb62756f7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-05-29_fc6180dea457667f607426fbb62756f7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5248 wrote to memory of 5888	5248	2026-05-29_fc6180dea457667f607426fbb62756f7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	80
PID 5248 wrote to memory of 5888	5248	2026-05-29_fc6180dea457667f607426fbb62756f7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	80
PID 5248 wrote to memory of 5084	5248	2026-05-29_fc6180dea457667f607426fbb62756f7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	82
PID 5248 wrote to memory of 5084	5248	2026-05-29_fc6180dea457667f607426fbb62756f7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	82
PID 5248 wrote to memory of 5416	5248	2026-05-29_fc6180dea457667f607426fbb62756f7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	84
PID 5248 wrote to memory of 5416	5248	2026-05-29_fc6180dea457667f607426fbb62756f7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	84
PID 5248 wrote to memory of 4020	5248	2026-05-29_fc6180dea457667f607426fbb62756f7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	86
PID 5248 wrote to memory of 4020	5248	2026-05-29_fc6180dea457667f607426fbb62756f7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-05-29_fc6180dea457667f607426fbb62756f7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_fc6180dea457667f607426fbb62756f7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:5248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4020

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5496

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4868