Analysis
- max time kernel
150s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 07:49
General
- Target 2026-08-09_690919ffe94eff16f9bdd7d33338e19d_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe
- Size 33.4MB
- Sample260809-jnqc4abp21
- SHA256 7ae88fcc9b9b63f4831c0b7e1850f01014a560423984af267d295233047fe34b
Malware Config
Signatures
- Executes dropped EXE 6 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 5 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_690919ffe94eff16f9bdd7d33338e19d_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_690919ffe94eff16f9bdd7d33338e19d_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe"C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" chrome2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe"C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" edge2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\.bane_decoy\decoy_installer.exe"C:\Users\Admin\AppData\Local\Temp\.bane_decoy\decoy_installer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-K9H5UR6R3U.tmp\decoy_installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-K9H5UR6R3U.tmp\decoy_installer.tmp" /SL5="$500FA,30538501,855040,C:\Users\Admin\AppData\Local\Temp\.bane_decoy\decoy_installer.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\.bane_decoy\decoy_installer.exe"C:\Users\Admin\AppData\Local\Temp\.bane_decoy\decoy_installer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-ENEWCIR7YM.tmp\decoy_installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-ENEWCIR7YM.tmp\decoy_installer.tmp" /SL5="$14022A,30538501,855040,C:\Users\Admin\AppData\Local\Temp\.bane_decoy\decoy_installer.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
decoy_installer.exe
chromelevator.exe
bane_debug.log
decoy_installer.tmp
memory/1216-107-0x00000000009A0000-0x0000000000DDA000-memory.dmp
memory/1216-91-0x00000000009A0000-0x0000000000DDA000-memory.dmp
memory/1216-123-0x00000000009A0000-0x0000000000DDA000-memory.dmp
memory/1216-119-0x00000000009A0000-0x0000000000DDA000-memory.dmp
memory/1216-115-0x00000000009A0000-0x0000000000DDA000-memory.dmp
memory/1216-71-0x00000000009A0000-0x0000000000DDA000-memory.dmp
memory/1216-111-0x00000000009A0000-0x0000000000DDA000-memory.dmp
memory/1216-75-0x00000000009A0000-0x0000000000DDA000-memory.dmp
memory/1216-103-0x00000000009A0000-0x0000000000DDA000-memory.dmp
memory/1216-79-0x00000000009A0000-0x0000000000DDA000-memory.dmp
memory/1216-99-0x00000000009A0000-0x0000000000DDA000-memory.dmp
memory/1216-83-0x00000000009A0000-0x0000000000DDA000-memory.dmp
memory/1216-95-0x00000000009A0000-0x0000000000DDA000-memory.dmp
memory/1216-87-0x00000000009A0000-0x0000000000DDA000-memory.dmp
memory/2008-77-0x0000000000810000-0x0000000000C4A000-memory.dmp
memory/2008-121-0x0000000000810000-0x0000000000C4A000-memory.dmp
memory/2008-93-0x0000000000810000-0x0000000000C4A000-memory.dmp
memory/2008-85-0x0000000000810000-0x0000000000C4A000-memory.dmp
memory/2008-97-0x0000000000810000-0x0000000000C4A000-memory.dmp
memory/2008-81-0x0000000000810000-0x0000000000C4A000-memory.dmp
memory/2008-101-0x0000000000810000-0x0000000000C4A000-memory.dmp
memory/2008-117-0x0000000000810000-0x0000000000C4A000-memory.dmp
memory/2008-105-0x0000000000810000-0x0000000000C4A000-memory.dmp
memory/2008-69-0x0000000000810000-0x0000000000C4A000-memory.dmp
memory/2008-109-0x0000000000810000-0x0000000000C4A000-memory.dmp
memory/2008-73-0x0000000000810000-0x0000000000C4A000-memory.dmp
memory/2008-113-0x0000000000810000-0x0000000000C4A000-memory.dmp
memory/2008-89-0x0000000000810000-0x0000000000C4A000-memory.dmp
memory/4604-70-0x0000000000340000-0x000000000041F000-memory.dmp
memory/4604-61-0x0000000000340000-0x000000000041F000-memory.dmp
memory/4948-26-0x0000000000340000-0x000000000041F000-memory.dmp
memory/4948-68-0x0000000000340000-0x000000000041F000-memory.dmp