fa53f59ddd585fa6d2a1a1ab8e7a343330ad7a6788b41cdbcdb02006df7b3f8e

General

Target
2026-08-13_06ecb1923c1dba11909ca8165d5f7fa3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 2.8MB
Sample260813-mt2j4aac43
SHA256 fa53f59ddd585fa6d2a1a1ab8e7a343330ad7a6788b41cdbcdb02006df7b3f8e
MD5 06ecb1923c1dba11909ca8165d5f7fa3
SHA1 33b2c18587c802e07d877cea3d7edc113f311319
SHA512 0faab55f5a2afff678531a7db3a40c20330552150bdbdbb28b3b0aec6947aed92bf81918c6efba319437ef4c724566da8021577651c3c45a4c49e90a1e73b89d
SSDEEP 49152:CltNhCakB0baS4ILJtCh8phcPZT2uFl1RCeysY/MRikomhhpNzQNbAEooxQ8r7ML:YNfaAJEapmPZNl3hUbAAQq7cWJATblh1
TLSH
T177D5C157F2B400FCD167C178C9565A07EBB1B8161774ABDF13908A6A2F23AE11E7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2796	upd2af9.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2004	cmd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 2796	4792	2026-08-13_06ecb1923c1dba11909ca8165d5f7fa3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 2796 wrote to memory of 1592	2796	upd2af9.exe	92
PID 2796 wrote to memory of 1592	2796	upd2af9.exe	92
PID 2796 wrote to memory of 4288	2796	upd2af9.exe	94
PID 2796 wrote to memory of 4288	2796	upd2af9.exe	94
PID 4792 wrote to memory of 2004	4792	2026-08-13_06ecb1923c1dba11909ca8165d5f7fa3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	98
PID 2004 wrote to memory of 2128	2004	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-13_06ecb1923c1dba11909ca8165d5f7fa3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_06ecb1923c1dba11909ca8165d5f7fa3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Users\Admin\AppData\Local\Temp\upd2af9.exe
  "C:\Users\Admin\AppData\Local\Temp\upd2af9.exe" all --output-path "C:\Users\Admin\AppData\Local\Temp\svchost32\Cookies"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd /d "C:\Users\Admin\AppData\Local\Temp\svchost32" && tar -cf "C:\Users\Admin\AppData\Local\Temp\2_127.0.0.1.zip" * >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\system32\tar.exe
    tar -cf "C:\Users\Admin\AppData\Local\Temp\2_127.0.0.1.zip" *
    3⤵
    PID:2128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2_127.0.0.1.zip

Path C:\Users\Admin\AppData\Local\Temp\2_127.0.0.1.zip
Size 32KB
SHA256 7159ffbf77adac2fcdefbac8ef91f41ed07e731687d6206fc77d9c8a2d0ec226
MD5 6af84ce913e288e66e9e02c3cd6b106c
SHA1 eab70bb71a27a53c0f78432f707ccdb10a582894
SHA512 f29e6da30774a3b775158f8b918ed77c4cc7e04bf50295749ed1fb7ae1eab10400fa879c1641a3b3c0efc57ec87bb9aea091ac21cf5d52bd56500344d04aac88
SSDEEP 384:bEGEPeF+h7lAiUhTZfs2DCjZ0NJekDeIVZF6Nz23yGugwW:bK2FYZUhTd3NldVv6Y3
TLSH
T192E26DF497609D95FE367532E9D1FCCD12ED3AC28BC6E4C64AF4138115633A9EE22821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bookmarks.txt

Path C:\Users\Admin\AppData\Local\Temp\svchost32\Cookies\Firefox\6uwf3l8l.default-release\bookmarks.txt
Size 334B
SHA256 48409468e146b1bc9564e685214c1d7ee1109bff6eab78e9626cc8b5d422c9fb
MD5 45a8d6d79d94a87108b2e46aab696445
SHA1 09a5633f3e41de29320aa8f7059737ef3bd191dc
SHA512 f5568cc582c987771ba88c08babb0aa106c9514bec337d143251a4eeb98cd8bbebdb7ff98e35bb66e4cd298a074e38240cc266895f4bf418fa0b50f23cf74f9a
TLSH
T155E026A3617241680F00CD55742A770A69C7C7088EE612CBB045397284F93A091E528C
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\svchost32\Cookies\Firefox\6uwf3l8l.default-release\cookies.txt
Size 30B
SHA256 99a9c0a5c436b2bf8d19c18b3fc7933479511ac89225cda5afbbe18773df9b19
MD5 d83ce0cb4be91fa1c2baa2983db5e256
SHA1 1988e5040506b744db3a7b3ecd166f45b16569fc
SHA512 7aa28026269303cc313423562147f42bb813696fd418981032e7f530479dfa6e8271e23661ee873542e3618dcba9b0ec3a3e74f4b166f361438c77d7e7b20138
MD5 SHA1 SHA512

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\svchost32\Cookies\Firefox\6uwf3l8l.default-release\history.txt
Size 304B
SHA256 f3bb035ad1fb3ef5dae0d4d278d5e2eded651f76957ad640b3ace074a3bb5d66
MD5 c17c898a3874329ba4d53ed6060d8e6a
SHA1 1a31eb2c8ddd42ca8e7e10d7be60431eccfed787
SHA512 c46befc7cb8cd4e02ba73ee8aa0de824c1d97552ef581da9e91611b3eb1f93621d7fad955ca355cd356befa35725cd0cc1943f9ca008a203d716789e9329dcdd
TLSH
T10EE0CD7B667341281F209D14741D7249ECD7C7088DE150C6F447347240A979148E564D
MD5 SHA1 SHA512 TLSH

Submit Download

wallets.txt

Path C:\Users\Admin\AppData\Local\Temp\svchost32\Crypto\Raw Wallets\wallets.txt
Size 20KB
SHA256 97946248277038ceff63ab5a315d5359d37152ffee9746ee236311e20d2d949b
MD5 48c16273343d3457ffd4840a62032fc7
SHA1 d10654eb837727091e58e3677424e899b4bdc365
SHA512 fda8f3ce95a8d4bed7dc687cdf18268af06902c004fb547786306e47441e4b3084fa5e3896a18c7ed0d540b3dec67a362abd442b1c76d3b6b437a112d93192ac
SSDEEP 384:qEGEPeF+h7lAiUhTZfs2DCjZ0NJekDeIVZF6Nz23yGugwWx:qK2FYZUhTd3NldVv6Y3D
TLSH
T168927EF4A7109E99373B7553EE11D8CD12A10A16DF8BE4C782B462C221632ADFE33821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.txt

Path C:\Users\Admin\AppData\Local\Temp\svchost32\log.txt
Size 329B
SHA256 da4cdf8b665ce4db37599261a7631b4484aad6daa1b66aa14f9122894a33adb1
MD5 b529c56eea205562a14118b205bed316
SHA1 8316bfe447b271d5a7deb6d0bcf37dae65929c4e
SHA512 cc7204b5cc16c2514ece58d0ccec819ada7802422e7b07b1a1d8823d5aaf7fb8479e11638a58cf99f559d5dc32720f82a2161a2c0352a5ccea1fe45bc516c197
TLSH
T1D6E0863B7B9E79090473F2A3924694F18338F5097F043A7D828C464F0F5763107566E2
MD5 SHA1 SHA512 TLSH

Submit Download

upd2af9.exe

Path C:\Users\Admin\AppData\Local\Temp\upd2af9.exe
Size 1.3MB
SHA256 2fc0757205d53cd44f4665cb5c1fa7ae931b72668d49f3276528d8fb5f42a2e0
MD5 e1100bb2e0e23eed6be98a05af626e72
SHA1 63b44f8fe2acc262b456bc5a0b2d69e5f80e12fe
SHA512 2c487b1ca79fa434bd70916015a9154ab14d9e72073fbec47700209294acf52fd4c8df772685713b739ccd0e14799f433eb69a95a68551b94b42c773a8413bcc
SSDEEP 24576:SY/MxPF9ikomh62QkJpDZpxQNbAEoPAxQ8rkYvZ7M622p0NeDJjsTblhkOPLIhNa:SY/MRikomhhpNzQNbAEooxQ8r7MDNWJE
TLSH
T17C551219B6B400FCE1A7C574CD628906DBB6FC564370E78F13A446A71F276909E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4792-0-0x00007FF6F66A0000-0x00007FF6F6979000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads