53ac31b61dc1a236e9d1823da26b309adca8262861743b7894b04d8b0ddcdb9b

General

Target
2026-07-23_75cdfccc6edd49e2d9fdcd35b32b1647_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 861KB
Sample260723-m3c8vswejh
SHA256 53ac31b61dc1a236e9d1823da26b309adca8262861743b7894b04d8b0ddcdb9b
MD5 75cdfccc6edd49e2d9fdcd35b32b1647
SHA1 5e290579ebb6212f270d5199017182283b36099e
SHA512 b2816deb4c4fcf6a078d1f76b63486d54e48147474362f2690b1439bbc920f7fdbfebec05296af886425321e3d7395c960aece3ce57ca4b8cca06e9782b5072a
SSDEEP 12288:Rg9ANYPuw2vX753/llDB/CjE+HSDpqyxBlDetAqxSv9Kj:RMAqv2vX7RXBqjEGGpqybe
TLSH
T18A157C1AF3A502F8D17BC178C9424552EB72B8565330AADF03E15A6A1F376E05F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-23_75cdfccc6edd49e2d9fdcd35b32b1647_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-23_75cdfccc6edd49e2d9fdcd35b32b1647_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2560	2026-07-23_75cdfccc6edd49e2d9fdcd35b32b1647_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
2560	2026-07-23_75cdfccc6edd49e2d9fdcd35b32b1647_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 752	2560	2026-07-23_75cdfccc6edd49e2d9fdcd35b32b1647_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 2560 wrote to memory of 752	2560	2026-07-23_75cdfccc6edd49e2d9fdcd35b32b1647_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 2560 wrote to memory of 2968	2560	2026-07-23_75cdfccc6edd49e2d9fdcd35b32b1647_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	94
PID 2560 wrote to memory of 2968	2560	2026-07-23_75cdfccc6edd49e2d9fdcd35b32b1647_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	94
PID 2560 wrote to memory of 4732	2560	2026-07-23_75cdfccc6edd49e2d9fdcd35b32b1647_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	97
PID 2560 wrote to memory of 4732	2560	2026-07-23_75cdfccc6edd49e2d9fdcd35b32b1647_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	97
PID 2560 wrote to memory of 2280	2560	2026-07-23_75cdfccc6edd49e2d9fdcd35b32b1647_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	100
PID 2560 wrote to memory of 2280	2560	2026-07-23_75cdfccc6edd49e2d9fdcd35b32b1647_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-07-23_75cdfccc6edd49e2d9fdcd35b32b1647_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_75cdfccc6edd49e2d9fdcd35b32b1647_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2280

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ABAC9979-2DE2-6965-06F1-0A1DEEE9B255.txt

Path C:\ProgramData\ABAC9979-2DE2-6965-06F1-0A1DEEE9B255.txt
Size 64B
SHA256 056dceea9a822a04d2742f115b64c90b87b215956b355525982d01945e44849d
MD5 3d42405333ab0ae568c1780d1a3be5b0
SHA1 cc9699e33d7ed16fef5af479137b73e91b3cfff7
SHA512 ae1ff4c424f97a3250658dd3c49b01079edcec0071378683974327a91ae4b1fac4e46b5ec5b82c27c4fe2e0aa14e5d843da46799b3aa801ee77d6267e837f3a5
TLSH
T1DFA022020A0888030A002A00C08E00030F8C8300E0CA80EEBC2A200300200BA88E0BC0
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing