Overview

overview

7

Static

static

3

2026-07-05...lc.exe

windows10-2004-x64

7

2026-07-05...lc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 10:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_5c086187244b1b07f545614ca9efa85f_icedid_luca-stealer_njrat_qakbot_stealc.exe
  • Size 3.0MB
  • Sample260705-ma148aby3t
  • SHA256 553f8bbbd862c6c1ef8315a9cc58903d2872eda06c106fe7061ed788d8394ae5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 3 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_5c086187244b1b07f545614ca9efa85f_icedid_luca-stealer_njrat_qakbot_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_5c086187244b1b07f545614ca9efa85f_icedid_luca-stealer_njrat_qakbot_stealc.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1584
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC ONLOGON /TN "WindowsSystemUpdate" /TR "C:\Users\Admin\AppData\Local\Temp\2026-07-05_5c086187244b1b07f545614ca9efa85f_icedid_luca-stealer_njrat_qakbot_stealc.exe" /F
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2144
    • C:\Users\Admin\AppData\Local\Temp\ce_240693218.exe
      "C:\Users\Admin\AppData\Local\Temp\ce_240693218.exe" -k -o "C:\Users\Admin\AppData\Local\Temp\rvs_93593\Browsers\ce_raw" chrome
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        3⤵
          PID:1336
      • C:\Users\Admin\AppData\Local\Temp\ce_240693859.exe
        "C:\Users\Admin\AppData\Local\Temp\ce_240693859.exe" -k -o "C:\Users\Admin\AppData\Local\Temp\rvs_93593\Browsers\ce_raw" edge
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1432
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
          3⤵
            PID:1856
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C timeout /t 7 /nobreak >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-07-05_5c086187244b1b07f545614ca9efa85f_icedid_luca-stealer_njrat_qakbot_stealc.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2896
          • C:\Windows\system32\timeout.exe
            timeout /t 7 /nobreak
            3⤵
            • Delays execution with timeout.exe
            PID:4024
      • C:\Users\Admin\AppData\Local\Temp\2026-07-05_5c086187244b1b07f545614ca9efa85f_icedid_luca-stealer_njrat_qakbot_stealc.exe
        C:\Users\Admin\AppData\Local\Temp\2026-07-05_5c086187244b1b07f545614ca9efa85f_icedid_luca-stealer_njrat_qakbot_stealc.exe
        1⤵
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4564
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC ONLOGON /TN "WindowsSystemUpdate" /TR "C:\Users\Admin\AppData\Local\Temp\2026-07-05_5c086187244b1b07f545614ca9efa85f_icedid_luca-stealer_njrat_qakbot_stealc.exe" /F
          2⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4608
        • C:\Users\Admin\AppData\Local\Temp\ce_240694625.exe
          "C:\Users\Admin\AppData\Local\Temp\ce_240694625.exe" -k -o "C:\Users\Admin\AppData\Local\Temp\rvs_95015\Browsers\ce_raw" chrome
          2⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2980
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe"
            3⤵
              PID:4596
          • C:\Users\Admin\AppData\Local\Temp\ce_240695250.exe
            "C:\Users\Admin\AppData\Local\Temp\ce_240695250.exe" -k -o "C:\Users\Admin\AppData\Local\Temp\rvs_95015\Browsers\ce_raw" edge
            2⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:576
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
              3⤵
                PID:4600
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C timeout /t 7 /nobreak >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-07-05_5c086187244b1b07f545614ca9efa85f_icedid_luca-stealer_njrat_qakbot_stealc.exe"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2160
              • C:\Windows\System32\timeout.exe
                timeout /t 7 /nobreak
                3⤵
                • Delays execution with timeout.exe
                PID:2020
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
            1⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4288
            • C:\Windows\System32\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC ONLOGON /TN "WindowsSystemUpdate" /TR "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe" /F
              2⤵
              • Scheduled Task/Job: Scheduled Task
              PID:3464
            • C:\Users\Admin\AppData\Local\Temp\ce_240694796.exe
              "C:\Users\Admin\AppData\Local\Temp\ce_240694796.exe" -k -o "C:\Users\Admin\AppData\Local\Temp\rvs_95171\Browsers\ce_raw" chrome
              2⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2112
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                3⤵
                  PID:1740
              • C:\Users\Admin\AppData\Local\Temp\ce_240695453.exe
                "C:\Users\Admin\AppData\Local\Temp\ce_240695453.exe" -k -o "C:\Users\Admin\AppData\Local\Temp\rvs_95171\Browsers\ce_raw" edge
                2⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:5200
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                  3⤵
                    PID:4532
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C timeout /t 7 /nobreak >nul & del /f /q "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4372
                  • C:\Windows\System32\timeout.exe
                    timeout /t 7 /nobreak
                    3⤵
                    • Delays execution with timeout.exe
                    PID:5796
              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                1⤵
                  PID:1328
                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                  1⤵
                    PID:4428
                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                    1⤵
                      PID:1668
                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                      1⤵
                        PID:5088
                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                        1⤵
                          PID:588
                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                          1⤵
                            PID:3024

                          Network

                                MITRE ATT&CK Enterprise v16

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Persistence

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Defense Evasion

                                Modify Registry

                                1
                                T1112

                                Credential Access

                                Credentials from Password Stores

                                1
                                T1555

                                Credentials from Web Browsers

                                1
                                T1555.003

                                Unsecured Credentials

                                1
                                T1552

                                Credentials In Files

                                1
                                T1552.001

                                Discovery

                                Browser Information Discovery

                                1
                                T1217

                                Query Registry

                                1
                                T1012

                                System Information Discovery

                                1
                                T1082

                                Lateral Movement

                                Collection

                                Data from Local System

                                1
                                T1005

                                Command and Control

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
                                • Size 2KB
                                • SHA256 9fcef90c4a963a1a6dd72a61113584894fabf802d11c0599f7da59ee82df685b
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
                                • Size 2KB
                                • SHA256 e6de41b3d59a48e9d3250616d60ddc3c870bb06e7c159ed2b8d104a0d11495d3
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
                                • Size 450B
                                • SHA256 ef88c58b139c3be2a830b1ff167cec5dbe547452ce49ee257c62dcf60a67ec17
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
                                • Size 474B
                                • SHA256 608db46369f86963a567ba080b85ee57bfc5e912d9c0a9cedd4b4401991b454a
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                ce_240693218.exe
                                • Path C:\Users\Admin\AppData\Local\Temp\ce_240693218.exe
                                • Size 1.4MB
                                • SHA256 08943baad0716d4b096cd2efc9210881168c4a42f138fb8300742e00e8fa18aa
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                cookies.json
                                • Path C:\Users\Admin\AppData\Local\Temp\rvs_93593\Browsers\ce_raw\Chrome\Default\cookies.json
                                • Size 339B
                                • SHA256 d9d156bf72db4fcf455c01120fef5c7d77081858048b5da3430f1cb999514a55
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                cookies.json
                                • Path C:\Users\Admin\AppData\Local\Temp\rvs_95015\Browsers\Edge\Default\cookies.json
                                • Size 6B
                                • SHA256 f171c90e5540d56f6269f2d6a10364fe37fd6c1fde6aed83a83e61eac125dd7b
                                • MD5 SHA1 SHA512
                                Submit Download

                                cookies_netscape.txt
                                • Path C:\Users\Admin\AppData\Local\Temp\rvs_95015\Browsers\Edge\Default\cookies_netscape.txt
                                • Size 129B
                                • SHA256 e2496c7449d97fa416fcae16b4f1923d3853ca1f5d109a7f713cccbf316ae675
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                history.txt
                                • Path C:\Users\Admin\AppData\Local\Temp\rvs_95015\Browsers\Edge\Default\history.txt
                                • Size 81B
                                • SHA256 e51813eafe2e9e0cc0bce1fe00e81dbee99f358774f53a4df2125cd816943d39
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                all_cookies_netscape.txt
                                • Path C:\Users\Admin\AppData\Local\Temp\rvs_95015\Browsers\all_cookies_netscape.txt
                                • Size 487B
                                • SHA256 98f0df7be2995de3813aec679c001dedd77278a53a8e246328110e51c4c3fa75
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                cookies_netscape.txt
                                • Path C:\Users\Admin\AppData\Local\Temp\rvs_95171\Browsers\Chrome\Default\cookies_netscape.txt
                                • Size 390B
                                • SHA256 27963c2f2458737dae3bc1b3f7fa791ccef4892529039b76605647f9cb2984df
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                Screenshot.bmp
                                • Path C:\Users\Admin\AppData\Local\Temp\rvs_95171\System\Screenshot.bmp
                                • Size 7.9MB
                                • SHA256 6bf1ed521e09cb354164321a16219f70ed50d7b9b85234192de33237d6adb30f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                svchost.exe
                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
                                • Size 3.0MB
                                • SHA256 553f8bbbd862c6c1ef8315a9cc58903d2872eda06c106fe7061ed788d8394ae5
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download