Analysis
- max time kernel
151s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
08/08/2026, 09:54
General
- Target 2026-08-08_871bf8fc8037e77cc68b334a114399d1_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe
- Size 65.0MB
- Sample260808-lxap4sdk6x
- SHA256 46847732d3bee759c899fb3063267980992730966202c89b8368e31510b48594
Malware Config
Signatures
- Executes dropped EXE 6 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 5 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_871bf8fc8037e77cc68b334a114399d1_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_871bf8fc8037e77cc68b334a114399d1_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe"C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" chrome2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\.bane_decoy\decoy_installer.exe"C:\Users\Admin\AppData\Local\Temp\.bane_decoy\decoy_installer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-YD2QZI68JD.tmp\decoy_installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-YD2QZI68JD.tmp\decoy_installer.tmp" /SL5="$6029A,30538501,855040,C:\Users\Admin\AppData\Local\Temp\.bane_decoy\decoy_installer.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe"C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" edge2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\.bane_decoy\decoy_installer.exe"C:\Users\Admin\AppData\Local\Temp\.bane_decoy\decoy_installer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-91R5FVQ9OE.tmp\decoy_installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-91R5FVQ9OE.tmp\decoy_installer.tmp" /SL5="$602D2,30538501,855040,C:\Users\Admin\AppData\Local\Temp\.bane_decoy\decoy_installer.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
decoy_installer.exe
cookies.json
chromelevator.exe
bane_debug.log
bane_debug.log
bane_debug.log
decoy_installer.tmp
memory/1176-77-0x0000000000110000-0x000000000054A000-memory.dmp
memory/1176-113-0x0000000000110000-0x000000000054A000-memory.dmp
memory/1176-129-0x0000000000110000-0x000000000054A000-memory.dmp
memory/1176-97-0x0000000000110000-0x000000000054A000-memory.dmp
memory/1176-121-0x0000000000110000-0x000000000054A000-memory.dmp
memory/1176-117-0x0000000000110000-0x000000000054A000-memory.dmp
memory/1176-81-0x0000000000110000-0x000000000054A000-memory.dmp
memory/1176-125-0x0000000000110000-0x000000000054A000-memory.dmp
memory/1176-85-0x0000000000110000-0x000000000054A000-memory.dmp
memory/1176-109-0x0000000000110000-0x000000000054A000-memory.dmp
memory/1176-89-0x0000000000110000-0x000000000054A000-memory.dmp
memory/1176-105-0x0000000000110000-0x000000000054A000-memory.dmp
memory/1176-93-0x0000000000110000-0x000000000054A000-memory.dmp
memory/1176-101-0x0000000000110000-0x000000000054A000-memory.dmp
memory/1404-76-0x0000000000510000-0x00000000005EF000-memory.dmp
memory/1404-24-0x0000000000510000-0x00000000005EF000-memory.dmp
memory/3880-78-0x0000000000510000-0x00000000005EF000-memory.dmp
memory/3880-69-0x0000000000510000-0x00000000005EF000-memory.dmp
memory/4464-115-0x0000000000360000-0x000000000079A000-memory.dmp
memory/4464-119-0x0000000000360000-0x000000000079A000-memory.dmp
memory/4464-87-0x0000000000360000-0x000000000079A000-memory.dmp
memory/4464-111-0x0000000000360000-0x000000000079A000-memory.dmp
memory/4464-83-0x0000000000360000-0x000000000079A000-memory.dmp
memory/4464-99-0x0000000000360000-0x000000000079A000-memory.dmp
memory/4464-79-0x0000000000360000-0x000000000079A000-memory.dmp
memory/4464-107-0x0000000000360000-0x000000000079A000-memory.dmp
memory/4464-91-0x0000000000360000-0x000000000079A000-memory.dmp
memory/4464-123-0x0000000000360000-0x000000000079A000-memory.dmp
memory/4464-103-0x0000000000360000-0x000000000079A000-memory.dmp
memory/4464-127-0x0000000000360000-0x000000000079A000-memory.dmp
memory/4464-95-0x0000000000360000-0x000000000079A000-memory.dmp
memory/4464-131-0x0000000000360000-0x000000000079A000-memory.dmp