e200a997756a140555d8cc9db17a641fd2cb7cef7291e1fb11109253cede1ba3

General

Target
2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe
Size 33.5MB
Sample260815-1a2mmsgq6x
SHA256 e200a997756a140555d8cc9db17a641fd2cb7cef7291e1fb11109253cede1ba3
MD5 b871aabc7f4c9554f9832e01653b2077
SHA1 3d551366af066f59cb687dcedb9a08d142b0d037
SHA512 8f500f89f3132725942fee852d1507055880b163cf51fa29226ca0b7806f5a111cddf930174aec3ae476d3b4df180b7406260c0cb8c27e7dbb6722310dea59e2
SSDEEP 786432:Az8rxl0vX27zo1RdApDqz/gfC2Q/FgtXeLweHEa0lSMNm:A8xQT1TApDqzX2QNgeweka0l/m
TLSH
T18177332BA2AA01BCD06FC13A99769502EA73B8101B319DCB47D0C9A95F376F11E3F751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2828	chromelevator.exe
2180	chromelevator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1512	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 2828	4656	2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe	89
PID 2828 wrote to memory of 5048	2828	chromelevator.exe	91
PID 2828 wrote to memory of 5048	2828	chromelevator.exe	91
PID 4656 wrote to memory of 2180	4656	2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe	94
PID 2180 wrote to memory of 5948	2180	chromelevator.exe	96
PID 2180 wrote to memory of 5948	2180	chromelevator.exe	96
PID 4656 wrote to memory of 1512	4656	2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe	97
PID 1512 wrote to memory of 1304	1512	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
  "C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" chrome
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:5048
- C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
  "C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" edge
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:5948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg export "HKCU\Software\Ankama\Dofus" "C:\Users\Admin\AppData\Local\Temp\Bc3f82-5c2d6bDD\dofus_ankama_data\dofus_shield.reg" /y
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\system32\reg.exe
    reg export "HKCU\Software\Ankama\Dofus" "C:\Users\Admin\AppData\Local\Temp\Bc3f82-5c2d6bDD\dofus_ankama_data\dofus_shield.reg" /y
    3⤵
    PID:1304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4636

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
Size 1.4MB
SHA256 3ede96af87cdcd799f87e9f3def0b42ce4c5e37b9aa488f45d5c357dc2dd147a
MD5 2d0811cf7c53709960970ad2145de0da
SHA1 d62cea234c5f4a5d2e91eb39af22ed7cf614fc5f
SHA512 711d332cfcee351b8a56a5e3de502080d788684e0d7a7c849a95a8ca4ceff330901b1c5aabdab9685e2885d7fbb0149e0a401176baea29ac207dba5f06bd6d64
SSDEEP 24576:wr8XOrkshL+EMsrN5x1/CPznl2RDMkJt4MjYIBrf6hr3qFt:wrPphLEs7x1/CzlMb4eFyhz4
TLSH
T1CE650216A6A501F9E2B7D678C9525906DA33FC124F61B7DF03984A9A1F337E08E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bane_debug.log

Path C:\Users\Admin\AppData\Local\Temp\bane_debug.log
Size 1KB
SHA256 a2d096b42fbb90b8c08c66ef3f5ad5f13da7e5c84af8661d27d74389a637cbc0
MD5 f832762edbe95068fd25a8076b646b31
SHA1 35418cad9287bb7c5afe9628aa51811da659466b
SHA512 f7d185ec2a1f60f447f07933bac6fd63d5439f80280a1e931a58f73b8f72cca0e479988e7fe0edf1e360fe158e8a9da05dec7efd0959b5106f0614e0d11743d7
TLSH
T1BA3191953DFFC13B1D76509A8B786F8CC8717E0B96422D906708C444B78480ABE67B71
MD5 SHA1 SHA512 TLSH

Submit Download

bane_debug.log

Path C:\Users\Admin\AppData\Local\Temp\bane_debug.log
Size 2KB
SHA256 def80b10f87d0288a732be6d63e15d9a6f9a6eb0e0bb67911394ad8657a11f4c
MD5 0755b4caa3600c395eb27f0a73785323
SHA1 f2bfe31df32b276ab87ce3cbbdfb4890ec379499
SHA512 832827f82a9d188bd429361f641ee5f851c52d80f71540f55ee54172ef0f5ef7741df2832c6cd0f8bef7baf80a7dda6e7819d78007a07c5c78fb40ef178a5327
TLSH
T16C514C993DFFC13B0D66604A8E7D6FD8C8617E0B97922DE06708C444769180AFEA7A61
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads