e200a997756a140555d8cc9db17a641fd2cb7cef7291e1fb11109253cede1ba3

General

Target
2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe
Size 33.5MB
Sample260815-1a2mmsgq6x
SHA256 e200a997756a140555d8cc9db17a641fd2cb7cef7291e1fb11109253cede1ba3
MD5 b871aabc7f4c9554f9832e01653b2077
SHA1 3d551366af066f59cb687dcedb9a08d142b0d037
SHA512 8f500f89f3132725942fee852d1507055880b163cf51fa29226ca0b7806f5a111cddf930174aec3ae476d3b4df180b7406260c0cb8c27e7dbb6722310dea59e2
SSDEEP 786432:Az8rxl0vX27zo1RdApDqz/gfC2Q/FgtXeLweHEa0lSMNm:A8xQT1TApDqzX2QNgeweka0l/m
TLSH
T18177332BA2AA01BCD06FC13A99769502EA73B8101B319DCB47D0C9A95F376F11E3F751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4308	chromelevator.exe
4980	chromelevator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3608	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 4308	3592	2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe	85
PID 4308 wrote to memory of 4316	4308	chromelevator.exe	87
PID 4308 wrote to memory of 4316	4308	chromelevator.exe	87
PID 3592 wrote to memory of 4980	3592	2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe	90
PID 4980 wrote to memory of 860	4980	chromelevator.exe	92
PID 4980 wrote to memory of 860	4980	chromelevator.exe	92
PID 3592 wrote to memory of 3608	3592	2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe	93
PID 3608 wrote to memory of 3840	3608	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
  "C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" chrome
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4316
- C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
  "C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" edge
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg export "HKCU\Software\Ankama\Dofus" "C:\Users\Admin\AppData\Local\Temp\Ba5dcd-289ce4DD\dofus_ankama_data\dofus_shield.reg" /y
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\system32\reg.exe
    reg export "HKCU\Software\Ankama\Dofus" "C:\Users\Admin\AppData\Local\Temp\Ba5dcd-289ce4DD\dofus_ankama_data\dofus_shield.reg" /y
    3⤵
    PID:3840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1648

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge\Chrome\Default\cookies.json
Size 339B
SHA256 6f875b968afebb71ce5ad91fc257eece437803664c0d30a9cf14ed411cc67ed7
MD5 ffa791e9f0c929f6294fb41eec1e0503
SHA1 161020a5f89e1f47a47aa63cf92e2a618b051fe9
SHA512 d3cc8ce7a09bc125aff86ac73d571227c3412b758392eb19f7a7713be45841a96b95228406d7d248db68590ba9b8610c777aba21e111cafb4c648408e49a17ff
TLSH
T107E02D67889A3E12C43746EB1D14198EBF266B8BE13FEECAC0368A00769480B6521083
MD5 SHA1 SHA512 TLSH

Submit Download

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
Size 1.4MB
SHA256 3ede96af87cdcd799f87e9f3def0b42ce4c5e37b9aa488f45d5c357dc2dd147a
MD5 2d0811cf7c53709960970ad2145de0da
SHA1 d62cea234c5f4a5d2e91eb39af22ed7cf614fc5f
SHA512 711d332cfcee351b8a56a5e3de502080d788684e0d7a7c849a95a8ca4ceff330901b1c5aabdab9685e2885d7fbb0149e0a401176baea29ac207dba5f06bd6d64
SSDEEP 24576:wr8XOrkshL+EMsrN5x1/CPznl2RDMkJt4MjYIBrf6hr3qFt:wrPphLEs7x1/CzlMb4eFyhz4
TLSH
T1CE650216A6A501F9E2B7D678C9525906DA33FC124F61B7DF03984A9A1F337E08E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bane_debug.log

Path C:\Users\Admin\AppData\Local\Temp\bane_debug.log
Size 1KB
SHA256 c2ec05b9774eb0ba9440c89e3ed684a76c90d91371add70b704c1dabb07c623e
MD5 58e1f90e0f6d347031d3bcb986eac2fb
SHA1 c524ea41939af036544f36aa8be0f37299a2b328
SHA512 fce4cb0ce165aeb630ab6d6a039e7e4e74970a17d98033a579e40de148586ca2d002969a8d886e4a4e5c6f598011a07bcf730313dfc1469ff2b1212b1cf303bf
TLSH
T1B73160D139FFC27B0D269089CE686F8DCDB17D0796A53DE06714C444678580EBE97B11
MD5 SHA1 SHA512 TLSH

Submit Download

bane_debug.log

Path C:\Users\Admin\AppData\Local\Temp\bane_debug.log
Size 2KB
SHA256 10bbce59811db53762f876a76fe2940b9f77eb450ab1f08c0b448a86e511c714
MD5 22a2ccbb4a25e4a00a8bc5851e27c37e
SHA1 475b4b55156d8bde81ee4c1eb1b3dd6bc69f1414
SHA512 05cdb0f4b3d92feb93d4c3aca0de56b1eec8ffea3bfa16c688fae0681a3df2d5d9e5453be5a088a279b25d10c27f98f8e2f3a0f03501936dc6ac58fa5c715863
TLSH
T14B518DD539FFC2770D665089CE685FD8CEB07E0797B62DE06718C408668580ABE57A01
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads