508392b14b67831c6e14c397cb177ad77283ef317c233da781d7a8873728e7ad

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_54fc8c3560740ee3bb71421f97747c73_cobalt-strike_icedid_njrat_satacom.exe
Size 65.3MB
Sample260910-vadmxsdg76
SHA256 508392b14b67831c6e14c397cb177ad77283ef317c233da781d7a8873728e7ad
MD5 54fc8c3560740ee3bb71421f97747c73
SHA1 e3d3add20857eb27213488e149540deda4f094ec
SHA512 f92c5d2e3265d87359c7831e964a68eddf603c33a46d38e7a45c3ea2f8c270537ed47086760a78636add4a6f40a0dbb9664e90182e5cbcfb6e4be372265cc688
SSDEEP 786432:bIBTOkj/R9PD23vr4bSfsa6vpCm6SazMDaxsszNmSLX9ZsNQ:bnkj/Hr3RpjGxlm8r
TLSH
T1A6E7868DA7493E02B929B6D2D01F525E4C8DFA98471902C6FF810DA71C1E0B4D6DBBB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery installer spyware stealer

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/memory/2172-40-0x00000264B9A00000-0x00000264BDB00000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/memory/2172-40-0x00000264B9A00000-0x00000264BDB00000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	pt_DF10.tmp.exe

Executes dropped EXE 5 IoCs

pid	Process
3460	pt_DF10.tmp.exe
4288	chromelevator.exe
2376	chromelevator.exe
4228	setup.exe
2000	setup.tmp

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.tmp

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x0007000000024398-25.dat	innosetup
behavioral1/memory/4228-38-0x0000000000FD0000-0x00000000010AF000-memory.dmp	innosetup
behavioral1/memory/2172-40-0x00000264B9A00000-0x00000264BDB00000-memory.dmp	innosetup
behavioral1/memory/4228-94-0x0000000000FD0000-0x00000000010AF000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	pt_DF10.tmp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pt_DF10.tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 3460	2172	2026-09-10_54fc8c3560740ee3bb71421f97747c73_cobalt-strike_icedid_njrat_satacom.exe	85
PID 3460 wrote to memory of 4288	3460	pt_DF10.tmp.exe	86
PID 4288 wrote to memory of 736	4288	chromelevator.exe	88
PID 4288 wrote to memory of 736	4288	chromelevator.exe	88
PID 3460 wrote to memory of 4228	3460	pt_DF10.tmp.exe	91
PID 3460 wrote to memory of 2376	3460	pt_DF10.tmp.exe	93
PID 2376 wrote to memory of 2828	2376	chromelevator.exe	95
PID 2376 wrote to memory of 2828	2376	chromelevator.exe	95
PID 4228 wrote to memory of 2000	4228	setup.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-09-10_54fc8c3560740ee3bb71421f97747c73_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_54fc8c3560740ee3bb71421f97747c73_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\pt_DF10.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\pt_DF10.tmp.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
    "C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" chrome
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:736
- - C:\Users\Admin\AppData\Local\Temp\.bane_decoy\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\.bane_decoy\setup.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\is-R6JXWP0DDL.tmp\setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-R6JXWP0DDL.tmp\setup.tmp" /SL5="$A0264,30538501,855040,C:\Users\Admin\AppData\Local\Temp\.bane_decoy\setup.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2000
- - C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
    "C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe" -o "C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge" edge
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:2828

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\.bane_decoy\setup.exe
Size 30.3MB
SHA256 9447a4bacfbb52ac358070da7575f3e7b8ff61891263a7bcdb86eede5a983773
MD5 8d11c0ccae04df7069d67bfff35ca138
SHA1 3c15e5d144f6b2562cd1bc38046f35bf38b300ad
SHA512 162bddb23b1125b3a81e49b1891e7f2f0974d72fbcf1fb5d4d93aaddbac77018dca597d2427b82c3084b8dc719df9af023eabe49d37ea8d889151dd04b29d07a
SSDEEP 786432:P8rxl0vX27zo1RdApDqz/gfC2Q/FgtXeLweHEa0lSMNmB:IxQT1TApDqzX2QNgeweka0l/mB
TLSH
T10E67333F635B613DE46E9A3B39B6C210953B7660A8128C065BD0C99CDF391B21D3F6D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\bane_abe_bridge\Chrome\Default\cookies.json
Size 338B
SHA256 dec13b26f4288d16e3037e4a228e22ba45fec19ea5d62ad5f43a649cfabca4be
MD5 14900e13def9e3e4b6f774f3c1e73fda
SHA1 c2462864f0aed69d452ed729af4e2386361ae48e
SHA512 93564ce71f30644aacdbf103462b0953fc6cca32a589963d310babb74d84f679334e70e19118786f605fe0830d318a6743631a7259345e46bc353aa824094b85
TLSH
T10BE0C08D1E9A5817CC835D955E18CE55BB6A325168E1DC5202A0E4042E14F151294053
MD5 SHA1 SHA512 TLSH

Submit Download

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\bane_ce\chromelevator.exe
Size 1.4MB
SHA256 3ede96af87cdcd799f87e9f3def0b42ce4c5e37b9aa488f45d5c357dc2dd147a
MD5 2d0811cf7c53709960970ad2145de0da
SHA1 d62cea234c5f4a5d2e91eb39af22ed7cf614fc5f
SHA512 711d332cfcee351b8a56a5e3de502080d788684e0d7a7c849a95a8ca4ceff330901b1c5aabdab9685e2885d7fbb0149e0a401176baea29ac207dba5f06bd6d64
SSDEEP 24576:wr8XOrkshL+EMsrN5x1/CPznl2RDMkJt4MjYIBrf6hr3qFt:wrPphLEs7x1/CzlMb4eFyhz4
TLSH
T1CE650216A6A501F9E2B7D678C9525906DA33FC124F61B7DF03984A9A1F337E08E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bane_debug.log

Path C:\Users\Admin\AppData\Local\Temp\bane_debug.log
Size 2KB
SHA256 5dbd9158abf13bd700ab74118d8591f4e1faae389c764b965b83f88d69ab2f84
MD5 c170b6040ef96039f1072387ca301535
SHA1 7370f7dd8b884335e2336cc822f42c2288343f05
SHA512 f4c45996d72370bf9d105b4a23e34267053f3ffcd89cd9ca2ad77f6354dc2964c6867e34ae2d888e137635f335fa684d90abbf5306ca01c83b2f11efba359ca9
TLSH
T1F4415B9437AFC63B28882497C555DF9E55923B2B97A7AF205307B018F540A0DBE97381
MD5 SHA1 SHA512 TLSH

Submit Download

bane_debug.log

Path C:\Users\Admin\AppData\Local\Temp\bane_debug.log
Size 2KB
SHA256 83a4e18ce27dbe2484fbdce9e81547ca24a34dc4dbc5450010a85f4806001eff
MD5 d8818a6858567d6ccbdc5f2d4813ac6a
SHA1 f6760e191b0807836088020040e390ec31b7ac32
SHA512 da2a8a9fc09b10b9f961ca58696727490d212c2e8be74468eb4abd32bb421dbbe8b8ea0ce693c60c30029d8b011e26e3ae073d37b3ce2cf93cf7f1fa8e3c9b8b
TLSH
T114517C9836AEC23B28882497C555DFEE5692372B97B3AF206307B518F500A0DFE57641
MD5 SHA1 SHA512 TLSH

Submit Download

setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-R6JXWP0DDL.tmp\setup.tmp
Size 4.2MB
SHA256 5314d2aee6d72870017b303b70dd003c6edb63d24736b657b3626ab578ad5c8f
MD5 a1dd0001a41f8616eb4dff3c58f3506f
SHA1 d00d0e25256a60952cdf1e99d00abd7d1eeee394
SHA512 664cf1eded40e30bed3d76a08916b79eda166ff2ccfa1eccec97e6535051c48e482ef7326940da5eb276352da8f1d14ef126db1d631fb4244aeb1b399ad22a38
SSDEEP 98304:/YU5hnuOajWwMPdCpepI3GrwrA+J6333m:pxuHjWfZIzd
TLSH
T18F168F03B388753EE4671A3A583FA284983F7A213A26CD4F6BF40D5C8F395416D2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2000-95-0x0000000000DD0000-0x000000000120A000-memory.dmp

Download

memory/2172-0-0x00007FFB6FF30000-0x00007FFB70125000-memory.dmp

Download

memory/2172-40-0x00000264B9A00000-0x00000264BDB00000-memory.dmp

Download

memory/2172-88-0x00000264B9A00000-0x00000264B9BF5000-memory.dmp

Download

memory/4228-38-0x0000000000FD0000-0x00000000010AF000-memory.dmp

Download

memory/4228-94-0x0000000000FD0000-0x00000000010AF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads