1bc4fd91f87005e7dca606a09115849b337192980174bac7c643d17c9f6153c6

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 2.1MB
Sample261102-wheevsdz9j
SHA256 1bc4fd91f87005e7dca606a09115849b337192980174bac7c643d17c9f6153c6
MD5 f75e4b9a1549d9c8e7fa8571a47c59a9
SHA1 0df63fb4d6dee09a94f2cca74123dc12c363b915
SHA512 e8245660874eea9246f72c87d52feb9bf5de2c9477f1bb7a577f6ca3f7077ad24c369e9f8ab9349be3c17a6cfdcf5f5832cadcb2fda36028db44bf4367860165
SSDEEP 49152:NYgah0BGucNSQMIZI7VbDMS4BsNgMLIu:voK
TLSH
T14FA58D17A3B800FDD1B7C1B9C9165903EB71B8490731AADF03909AA61F23AE55F7B724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000244f1-4.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral1/files/0x00080000000244f2-10.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000244f1-4.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/files/0x00080000000244f2-10.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000244f1-4.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/files/0x00080000000244f2-10.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000244f1-4.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/files/0x00080000000244f2-10.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1508	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
1184	VnsService.exe

Loads dropped DLL 3 IoCs

pid	Process
2912	chrome.exe
1468	chrome.exe
880	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VnsService = "\"C:\\Users\\Admin\\AppData\\Local\\vns\\VnsService.exe\""	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4088	cmd.exe
3824	cmd.exe
2812	cmd.exe
4744	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4744	cmd.exe
4820	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
880	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BB2AA26B-343A-4072-8B6F-80557B8CE571}\ProxyStubClsid32	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0014D784-7012-4A79-8AB6-ADDB8193A06E}\1.0\FLAGS	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\TypeLib\Version = "1.0"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2721D66-376E-4D2F-9F0F-9070E9A42B5F}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BB2AA26B-343A-4072-8B6F-80557B8CE571}\ProxyStubClsid32	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\TypeLib\Version = "1.0"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0014D784-7012-4A79-8AB6-ADDB8193A06E}\1.0\0	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0014D784-7012-4A79-8AB6-ADDB8193A06E}\1.0\0\win64\ = "C:\\Program Files\\Google\\Chrome\\Application\\140.0.7339.81\\elevation_service.exe"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2721D66-376E-4D2F-9F0F-9070E9A42B5F}\TypeLib\Version = "1.0"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BB2AA26B-343A-4072-8B6F-80557B8CE571}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BB2AA26B-343A-4072-8B6F-80557B8CE571}\TypeLib	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\ProxyStubClsid32	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}\ProxyStubClsid32	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\ = "IElevatorChromium"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BB2AA26B-343A-4072-8B6F-80557B8CE571}\TypeLib	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\TypeLib\Version = "1.0"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0014D784-7012-4A79-8AB6-ADDB8193A06E}\1.0	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2721D66-376E-4D2F-9F0F-9070E9A42B5F}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2721D66-376E-4D2F-9F0F-9070E9A42B5F}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BB2AA26B-343A-4072-8B6F-80557B8CE571}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0014D784-7012-4A79-8AB6-ADDB8193A06E}\1.0\ = "Elevator 1.0 Type Library"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0014D784-7012-4A79-8AB6-ADDB8193A06E}\1.0\FLAGS\ = "0"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0014D784-7012-4A79-8AB6-ADDB8193A06E}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2721D66-376E-4D2F-9F0F-9070E9A42B5F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\ProxyStubClsid32	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\TypeLib	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\TypeLib	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2721D66-376E-4D2F-9F0F-9070E9A42B5F}\ProxyStubClsid32	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2721D66-376E-4D2F-9F0F-9070E9A42B5F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BB2AA26B-343A-4072-8B6F-80557B8CE571}\TypeLib\Version = "1.0"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\TypeLib	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}\ProxyStubClsid32	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\ = "IElevatorChrome"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2721D66-376E-4D2F-9F0F-9070E9A42B5F}\TypeLib	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2721D66-376E-4D2F-9F0F-9070E9A42B5F}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0014D784-7012-4A79-8AB6-ADDB8193A06E}\1.0\HELPDIR	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}\ = "IElevator"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}\ = "IElevator"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\TypeLib\Version = "1.0"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\ = "IElevatorChromeCanary"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0014D784-7012-4A79-8AB6-ADDB8193A06E}\1.0\HELPDIR\ = "C:\\Program Files\\Google\\Chrome\\Application\\140.0.7339.81"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}\TypeLib	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BB2AA26B-343A-4072-8B6F-80557B8CE571}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\TypeLib	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1280	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
1280	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
1280	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
1280	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
2912	chrome.exe
2912	chrome.exe
1280	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
1280	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
1280	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
1280	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
2912	chrome.exe
2912	chrome.exe
3360	chrome.exe
3360	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe
Token: SeShutdownPrivilege	2912	chrome.exe
Token: SeCreatePagefilePrivilege	2912	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 4088	1280	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe	87
PID 4088 wrote to memory of 4652	4088	cmd.exe	89
PID 1280 wrote to memory of 3824	1280	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe	90
PID 3824 wrote to memory of 1508	3824	cmd.exe	92
PID 1280 wrote to memory of 2812	1280	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe	93
PID 2812 wrote to memory of 1452	2812	cmd.exe	95
PID 1280 wrote to memory of 4744	1280	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe	96
PID 4744 wrote to memory of 4820	4744	cmd.exe	98
PID 1280 wrote to memory of 2912	1280	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe	99
PID 2912 wrote to memory of 1468	2912	chrome.exe	100
PID 2912 wrote to memory of 3976	2912	chrome.exe	103
PID 2912 wrote to memory of 3976	2912	chrome.exe	103
PID 2912 wrote to memory of 880	2912	chrome.exe	104
PID 2912 wrote to memory of 1680	2912	chrome.exe	105
PID 2912 wrote to memory of 1680	2912	chrome.exe	105
PID 2912 wrote to memory of 4604	2912	chrome.exe	107
PID 2912 wrote to memory of 3472	2912	chrome.exe	108
PID 2912 wrote to memory of 4604	2912	chrome.exe	107
PID 2912 wrote to memory of 3472	2912	chrome.exe	108
PID 2912 wrote to memory of 4264	2912	chrome.exe	109
PID 2912 wrote to memory of 4264	2912	chrome.exe	109
PID 2912 wrote to memory of 4320	2912	chrome.exe	112
PID 2912 wrote to memory of 4348	2912	chrome.exe	124
PID 2912 wrote to memory of 4956	2912	chrome.exe	125
PID 2912 wrote to memory of 1096	2912	chrome.exe	126
PID 2912 wrote to memory of 3360	2912	chrome.exe	129

C:\Users\Admin\AppData\Local\Temp\2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Adds Run key to start application
- Checks system information in the registry
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    PID:4652
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c netsh advfirewall firewall set rule group="remote desktop" new enable=Yes >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1508
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c netsh wlan export profile folder="C:\Users\Admin\AppData\Local\Temp\vns_wifi" key=clear
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\system32\netsh.exe
    netsh wlan export profile folder="C:\Users\Admin\AppData\Local\Temp\vns_wifi" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1452
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c netsh wlan show profiles
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  --no-first-run --no-default-browser-check
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9dba9c728,0x7ff9dba9c734,0x7ff9dba9c740
    3⤵
    - Loads dropped DLL
    PID:1468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,12137019548908252160,7822427213801795765,262144 --field-trial-handle=1988,i,814898038266193291,6671701715122560746,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1984 /prefetch:2
    3⤵
    PID:3976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1588,i,13453124069143189323,18159088560635803627,524288 --field-trial-handle=1988,i,814898038266193291,6671701715122560746,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2340 /prefetch:3
    3⤵
    - Loads dropped DLL
    - System Time Discovery
    PID:880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,8411146727860912168,1991149407978785765,524288 --field-trial-handle=1988,i,814898038266193291,6671701715122560746,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2520 /prefetch:8
    3⤵
    PID:1680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,13786043228486843255,487472618661469045,2097152 --field-trial-handle=1988,i,814898038266193291,6671701715122560746,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:4604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,10574744317142126477,4468551104901474596,2097152 --field-trial-handle=1988,i,814898038266193291,6671701715122560746,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:3472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4552,i,5376766057823356578,15084130630456716628,2097152 --field-trial-handle=1988,i,814898038266193291,6671701715122560746,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4572 /prefetch:1
    3⤵
    PID:4264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,10531941893525114480,2977724878542064812,524288 --field-trial-handle=1988,i,814898038266193291,6671701715122560746,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5212 /prefetch:8
    3⤵
    PID:4320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,15563108611328721303,14914823091377344920,524288 --field-trial-handle=1988,i,814898038266193291,6671701715122560746,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5380 /prefetch:8
    3⤵
    PID:4348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,9984591507148407855,1256670411745222869,524288 --field-trial-handle=1988,i,814898038266193291,6671701715122560746,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5596 /prefetch:8
    3⤵
    PID:4956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,10844893137353623195,4252601886423848941,524288 --field-trial-handle=1988,i,814898038266193291,6671701715122560746,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5628 /prefetch:8
    3⤵
    PID:1096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5560,i,17236122823467880642,5844106257451518941,262144 --field-trial-handle=1988,i,814898038266193291,6671701715122560746,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=756 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3360

C:\Users\Admin\AppData\Local\vns\VnsService.exe
"C:\Users\Admin\AppData\Local\vns\VnsService.exe"
1⤵
- Executes dropped EXE
PID:1184

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1612

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4880

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3592

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4a45c0dd-3c67-46f0-b440-bbf9ebf63d21.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4a45c0dd-3c67-46f0-b440-bbf9ebf63d21.tmp
Size 269KB
SHA256 dd0bf66aa3de5a867b9cb124eff282168ffb231e2a21ac5905d25552d1a1f738
MD5 d33aa9373459b2e95834441d50d4ead2
SHA1 f7cd30d8cd6c1693687411b6862aae0454dcc59e
SHA512 6fafdcf9ae29803f12a807cab50ba49508b54da62035c1ee3b7afe665a5b9593f9e0d95175cfbb959fdcf9aa8e94bc3f29951dacecc6e341e3f6ea36de947689
SSDEEP 6144:grvHWeF0Ux3yQiPY0J4HsM9ZzVS+hFD+7t56OD9ZfSApprZ:glFr9HsM96yFSXD9ZfS43
TLSH
T1E84413716AD468BB8AFC4146F247E711ADA45AFC87EAAB4084902D8E614B4DD0673F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59cc22a8-a1b3-4e6f-b8c0-355508fdcd46.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\59cc22a8-a1b3-4e6f-b8c0-355508fdcd46.tmp
Size 130KB
SHA256 376de325e25719b5d63c73821d761df91505cfc1f39201c2672ec6f82c068932
MD5 10eba7fc03a08467119278143661c1d5
SHA1 bf7c21b5df264da710f766fa6b7a7be471177186
SHA512 71e16e83e4b53049689405693596a256d463b2cb5d206fee216093cd0bae5265d546c34277c1ded9a5a6a183ca2eb72718f1210f00e6b82a31592f60100adf2d
SSDEEP 3072:i+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:i+hFD+7t56OD9ZfSApprZ
TLSH
T16FD31232AA91C8BBC9FC6541B197A300DE626CED55DE3A09444A5F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73c877cb-0430-437c-865f-71b25116805d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\73c877cb-0430-437c-865f-71b25116805d.tmp
Size 269KB
SHA256 b3b1f1f4f79a97824a16a07516ec594eb35b5fd49217e3816a4eaae07458bb71
MD5 22abc89e52a7e80b15138244e74dc07c
SHA1 38e5b89003cc12f11f2e930a89048cc4d5c9da1e
SHA512 74b0c972f96e40d0744ed02bd3ad18d24df6b483206b2b3698be9c49af8ff1de7db91bd48c5814261342121fda860f138d2c85533486604e4b2e87881cc465e7
SSDEEP 6144:FrvHWeF0Ux3yQiPY0J4HsM9ZzVS+hFD+7t56OD9ZfSApprZ:FlFr9HsM96yFSXD9ZfS43
TLSH
T1774423716AD468BBCAFC4147F247E711BDA45AFC87EAAB4084902D8E614B4DD0673F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95ebba9a-3465-4236-a643-4bf895c974fd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\95ebba9a-3465-4236-a643-4bf895c974fd.tmp
Size 270KB
SHA256 a09eb8a278708021f6355b15c0f4a246932d015a5203849bcb1833e0505576ef
MD5 0ef900312443c8a6798088a38fd79de1
SHA1 4b8cb12b88e0ca5818317b6025f89d9df6130b9e
SHA512 b6feeedb5dc8eccea542edf9bb0623fab87c7241da05a9b2aaeb3b8d83d013ae3131ab6b863ef4d1af7d0bfaa985aa37e42487f5ea76a84d8cfe15b398c199b6
SSDEEP 6144:+7vHWeF0Ux3yQiPY0J4HsM9ZzVS+hFD+7t56OD9ZfSApprZ:SFr9HsM96yFSXD9ZfS43
TLSH
T1C84423716AD0A8B7CEFC4146F243E710ADA45AFD87EAAF44C4941E8A614B4DD0673F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05eb064a-7655-4cd6-89f2-5aab1a58d5dd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\05eb064a-7655-4cd6-89f2-5aab1a58d5dd.tmp
Size 414B
SHA256 5f27bde8a79ee7913ddabf1f1afad8c6097a4d31b6a9ff29be4325758bddcc88
MD5 f89b291768797428b92220559eec2f7b
SHA1 fb6948ca0cc81f00edcc3cffa1d224721eac05c3
SHA512 83379dd51f03d035814b9eee629235ff1d3679f7a0bb60d8c399ee51a6efa4d1d6e2a91e31397bb3fa310e711a27b91d0f7c94b19f81a881acdfec1272d31538
TLSH
T19EE022A9C821E97718FD075A6468078BF75113A72A91C90B3A3CC2098FB563A918A92C
MD5 SHA1 SHA512 TLSH

Submit Download

4a561cc3-4fca-4843-b6bd-f679391b4d4f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4a561cc3-4fca-4843-b6bd-f679391b4d4f.tmp
Size 11KB
SHA256 d160989d52bbb13ec163df8dbc1a8862e9bafd5e05f5d2d7e1eed793d41a4d61
MD5 6e4ec88b5156ed12dd8f8a80f10f0cfa
SHA1 b7a2bf0037bbb20bf1ca1e41bf6319420675e332
SHA512 7aed23e13e31a4917572c1170161a9f15fbef860d4d8a07edbde3e9d8598c160353b7ddccdd9512b9e16a133de27b0fed16ed80cd14f00a00ecb61f21596f8b2
SSDEEP 192:MRgibtGv73pAPRp2m9vHsb+WNnNV0/FeQYOYaiVyIsnAUgtaJ:MRgihybUXphwz0yHai8
TLSH
T15642A52DAD20757B6CDBD21AEA227B53E7F5102274942E80EAFDC93C15D79CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b59bae9-917e-4b64-9eaa-548b5a1dd636.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8b59bae9-917e-4b64-9eaa-548b5a1dd636.tmp
Size 13KB
SHA256 eff4472df129bc4e2b803cc39a1ba520374d3b607d22cd6393104a3be124b9c2
MD5 8607790a422ecb522e4c0dbd3b269b34
SHA1 e5c7ec8f685c74ebdd01a67f0e763209d8676d75
SHA512 27cdf461b3cdb01cf1d4a2f802f426248ba3f5fe8ed4c31dd046a71cdb0f38b25a10db78f318bacc40577b31c54a1cd046ec06e134194cc0934ab8961d501a55
SSDEEP 384:ftjDu7KxkXqKf/pUZNCgVLH2HfgslHEXODDK+ErU3gbHGVQoiTCGY:ftDu7KxkXqKf/pUZNCgVLH2HfgsdWOHH
TLSH
T120521927A88C9A7F0FD4D98DDC176F4FACF501576568486852FB9C0803A6BCA114E2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95b2d546-f2c6-4e7c-a717-d66be421adac.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\95b2d546-f2c6-4e7c-a717-d66be421adac.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

91d81343-7431-41cd-a0ba-31d08808b04a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\91d81343-7431-41cd-a0ba-31d08808b04a.tmp
Size 2KB
SHA256 9f2168af2699be2fd379935c627c69b1b56422a411d3c6ca528b3266998079fa
MD5 7d05922ceefba37ef0f248f0cd7f19aa
SHA1 35ecb8b0e564468d139b7b2bb32d1d90cdb485cd
SHA512 07e625c446896d51cf55ed0d9bb4c785df08acf5e417eed484fe284b5ae0284a5720da76b13d56f87f84cfffebc23d5f938354cafb4f519d6763a60b0082e0d9
TLSH
T1964189F7D3E4896D851156F4DB21AE1FCE7D0A15121C3C6288D8AE4B43F2872E20139F
MD5 SHA1 SHA512 TLSH

Submit Download

e4897e9f-22e5-44ed-b9d5-b23a3043e4cb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e4897e9f-22e5-44ed-b9d5-b23a3043e4cb.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f641a587-a3c0-4586-94a9-5acfaf84a4d0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f641a587-a3c0-4586-94a9-5acfaf84a4d0.tmp
Size 12KB
SHA256 3290f435ba8946b883f90308dc7b031a7f4c37159e456a06773f5c9f5199a970
MD5 7dd1a19788a6d7f58f5aa531c48711af
SHA1 4dd4df16544c64fb84d4778e1a376c282c1910c5
SHA512 5502c1006288e597a4248268a4d6c9f912b6a7e219ae22c56ebc71affa738c80b97b079dec37435de55123bf29a0725b2abb7502f42207f6ff4cf9ddb65321ad
SSDEEP 192:MRgibtGv73prPRpTm9vHsb+WNnNV0kFeQYOYazVyIsnAUgraJ:MRgihyblXqhwz0XHaVe
TLSH
T13042B62DAD20797B6CD7D21AFA227B53E7F5102264942E84EAFCC93C15E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcboost_abe_chrome.bin

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.bin
Size 32B
SHA256 bfa1d85b0d2341c7affc64a739311359eb7454cf1529a340e39736e13e34cd79
MD5 f7a9fcb35718b9d18cd184297b4b7798
SHA1 188c043aa50b589a6f107e5e55c9ba359a3909f8
SHA512 a04411ad50d7ec1c989a5e2592ca68ee8a4e0a2129c5fb7dd8e3f5c82ca9c93854d0f997e678f163f57398a7fae969399b056c1f47deded408a76b4e775ec3cb
MD5 SHA1 SHA512

Submit Download

pcboost_abe_chrome.cfg

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.cfg
Size 106B
SHA256 9e65979328b61e50207454aae039c2384d233f323d25949b6190decfda13303a
MD5 ab63b3fa1a8b1b7ecdf848b1f4ed9193
SHA1 5c5075e4fd34c174e049ec67251022d8d8559fdd
SHA512 e9d6c3e793f900ffd178f3a9af98dcc37bbf7d0840155dfd8894e4661a0c00017a4be28ff10e254be52dbf35e516dbb12cf4c05fdde76cabb2a0cc086d8ae119
TLSH
T14CB01240F646B75A011088FE9CF40A494E50558D3CBC12850378555FC68652D75E5E86
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_abe_chrome.trace

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.trace
Size 177B
SHA256 adff039eef1a43afc96db8b2e76659b92eeecc4a78513c81814c50803ef16f17
MD5 465860b4ff2858f51b517a98489bbbdc
SHA1 8d15dda466df44f99ee278e113e9533402773880
SHA512 043762963206e0bfdf236fe552c16393b8c1f59be7712a905f36dcba8b22a7f80333f27d449c2c8d7b82b832db19fb0ba98a05f251d514adf851df2dceba9027
TLSH
T178C04C55F6833391EDCC710B296FFB363327F6160DD528A94063736432F964455E3A0A
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_abe_chrome.trace

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.trace
Size 193B
SHA256 2fb82ee5184a9087432b97b91a264fb6e62c486a43120f12416706edfdf018f6
MD5 bae6a63edfe7426cc27111a397e5df6c
SHA1 d63722e99cb76ab786b310556208989606b2c8d4
SHA512 8feec986b2196f6a415ce845363f6b2e5e14d652490dd141c5774a6f92b19fbbd8dd881a1fbb8ebf8cdd3da60811a35804fdc8773b25774e4a1ad8765f0e377b
TLSH
T16FC00255F6833691EDCC710B2A6EBB36232BF6160DE528A94063736432F964495E3A0A
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_abe_chrome.trace

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.trace
Size 210B
SHA256 e91c591a35bb340869db1728653ea8a448f48c71b4938ddce8428f4752e73d40
MD5 79b8076e8529d12e56a8be0fe1efa018
SHA1 146ebf0e83a1189ac0282b14ebbfffca8541f3bb
SHA512 bcbf1a575ee86ff2dec85ad4ab07ff87ca7e2ce405ee3d16ca5bb55553c67c99efe5fb04607403c9ca8c7ddae77a95a30594ceda6916d0d17c9478dfa48520ec
TLSH
T172D0E955F6833691DD8C710B2A6EBB36232BB5170DE518A94063636421F964495E350A
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_abe_chrome.trace

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.trace
Size 440B
SHA256 6674708931f7ec7cfb80e96bfc62e23218d6724599869e8c426225e90ffb419c
MD5 48f3f2635f2865af2c43368ab4accc9e
SHA1 3d00e214c769e16abcd87bcdad83aaa9e309de1e
SHA512 591a0a25a9ea1c5df82f02039231604a8e7e300d5fb8a96d287c6364f955963103b38162ff4aa077dab6ee9aaa16081d160e278f3201e4ca8c725ee7c7464293
TLSH
T170F06D6AF14B3AE0DC8CB14B622DBFFA231FB0060DD005E64122AB3822FD38446D6508
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_abe_chrome.trace

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.trace
Size 495B
SHA256 4dc3dca8fd3ae36c708926453bbde11a1e08eab1798055b0116ae105bc2e40ed
MD5 67af299e13491f66b94549ecec92abf2
SHA1 ddf849d5081cdadb3584f4877f7a1a420a141bf6
SHA512 b93b150b07549efd67d2472b9631d183ae4eabe043add2e852abda7e6df28d656f6766d37c0926e52500aef6d732cdb0ac591c7c22d7471217e1bd3eca3ae462
TLSH
T19EF0A0AAF04B37E0CD8CF14B622CBFFA271FB1161DD015E64122AB3822FD38482C2506
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_abe_chrome.trace

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.trace
Size 160B
SHA256 48f92f0708a15da50d3c9953401d092f673517e70b6fb6a9e415b70f488f5bd7
MD5 6b86431c9b01009c9df0f5982d70d507
SHA1 c91e2ae28bde2f7ac408a053bf3fd805583d605d
SHA512 7a45061950c0175152608e19c296729c0fc536c24e2b03a6720c7c6c3ef0f1431c846d33056e5094efd02b3bb6f585b3a6da9f4731c250fa7c88982303def2d7
TLSH
T19CC04C04F6833391EDCC71072967FB363327F6160DD528950053322432E854455E3906
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_abe_chrome.txt

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.txt
Size 150B
SHA256 059877beff128e43847a6de29e6a15fe61f9441baa109c541993ec9022f8ab4a
MD5 e1cf28086d896e10c25e2a0bcdc23a7c
SHA1 a78b543787b15e1a0b20879ea6fb83fe733554a2
SHA512 2f930b23b01fdc4c7ea62306010f671f8cde5ca24a17886ff07df580844cbd45edc1143dcb141f656f78d91685e5580ae255383b58d548e59b82e0de620fe56d
TLSH
T14DC09289C24E6002E7AE49124ABEB905C5C2332B00E2C94A401AE3C5DE23AC4CF4CB9C
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_bridge_1280_1.dll

Path C:\Users\Admin\AppData\Local\Temp\pcboost_bridge_1280_1.dll
Size 167KB
SHA256 1961a16fa49742ce898c0e0d11ca809af783026a22d7f59d178ca36a2619e145
MD5 631654645939a6097d2921ee78bc1658
SHA1 5185085e5dc01e956cf83489a49cbd12c4fef6ee
SHA512 1f7e3eebefdc75fd91e9d53b3547bbbfbb3fdd0c41599bdbaadd1ec7fb495dc76d8376c2c003dd63b8178ea4c38b84bababef0c763c7f1c866bab90922cf4967
SSDEEP 3072:CxpDkKf96NZFmV4UH3JFlkifS0QXP82jdi+EOCcsNKqioSkp:CvPH3JFrUf3lCA
TLSH
T11CF37E16BBA9407FE5379578C9430A01EF72BC564761AACF03900EB65F2B7E48A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vns_progress.txt

Path C:\Users\Admin\AppData\Local\Temp\vns_progress.txt
Size 552B
SHA256 47ac8ee3b45459393a810f9fb744066aec4be8bd4bc9180eb129635d77513827
MD5 13f3101bdaf12334d34580e369018a33
SHA1 dc4bc4fbf9b40d63d38ab25c62096406e99ae23e
SHA512 4d187f38c0dd694f7651cb33b2195e188acf11e5380059fcca05467eb66c046b93c1fcbe28f5d4479034d13ce81520fedfc42bb43a454529e3f56f766fae52a7
TLSH
T15EF0C938AF49822BC7201EE78C61B0088C81322F2CDA8580D27292899C96D0EDD4C3AA
MD5 SHA1 SHA512 TLSH

Submit Download

vns_progress.txt

Path C:\Users\Admin\AppData\Local\Temp\vns_progress.txt
Size 228B
SHA256 6b7fc082c986a3fe513b27a388055735485d7306a80a76a135f8dbf6addcfbf4
MD5 09702f8c703907ce5b21a805bcacc7ad
SHA1 52033d1359f86c6ce189460854731c9a2f2bc367
SHA512 c7686fd14b326e8e5e35d1fe0153982b0f404e7785dd709692cb9a3ea981614da44087cf5860b8d51f9d589e08138ad2d9ab4a7881adee382d7e6af42f8941f5
TLSH
T14FD0A73CED89827D4BA54AD95851442D9D14404A6DD90640A73200806C9DD5E94DD365
MD5 SHA1 SHA512 TLSH

Submit Download

VnsService.exe

Path C:\Users\Admin\AppData\Local\vns\VnsService.exe
Size 2.1MB
SHA256 1bc4fd91f87005e7dca606a09115849b337192980174bac7c643d17c9f6153c6
MD5 f75e4b9a1549d9c8e7fa8571a47c59a9
SHA1 0df63fb4d6dee09a94f2cca74123dc12c363b915
SHA512 e8245660874eea9246f72c87d52feb9bf5de2c9477f1bb7a577f6ca3f7077ad24c369e9f8ab9349be3c17a6cfdcf5f5832cadcb2fda36028db44bf4367860165
SSDEEP 49152:NYgah0BGucNSQMIZI7VbDMS4BsNgMLIu:voK
TLSH
T14FA58D17A3B800FDD1B7C1B9C9165903EB71B8490731AADF03909AA61F23AE55F7B724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VnsService.exe.new

Path C:\Users\Admin\AppData\Local\vns\VnsService.exe.new
Size 2.1MB
SHA256 90cfdacbca987efd9b4ba4d77eacb9291ddbcd6396fce633ddf0d11e8dd06fe6
MD5 0e3fdcad9454a39af1095c248a60aa06
SHA1 e550c1a650cd383e9a3042b65240105b28bb1b67
SHA512 7167ac218f92c9cfdf942ad0a7c6f971196bb716f49d0b922de63710e4838590f93def20f9423eb5072f48482da6bb774cf0a7fdf85fc0eaef2a89e95f646365
SSDEEP 24576:dC2vNG/TMA5XggAT+vsqDhgWXRHmlQ60Mq1Q6D3wEQFNgMIqoXPW:c2vGTpwgAT+vsqDhDZf1QSQFNgMIf
TLSH
T192A57E27A2B400FDD1B7C1B9C9165907EB71B8490730AADF13D09AA61F33AE15F7A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download