Overview

overview

8

Static

static

3

2026-07-09...lc.exe

windows10-2004-x64

7

2026-07-09...lc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 00:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-09_1d4392789eca9d08add3c639b589f25f_icedid_stealc.exe
  • Size 2.0MB
  • Sample260709-a3cwwaa17n
  • SHA256 30d32e64697e3225f581474b7f0ff770804007142795d75b3d9caa0b1f641e70
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 7 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 54 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_1d4392789eca9d08add3c639b589f25f_icedid_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-09_1d4392789eca9d08add3c639b589f25f_icedid_stealc.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Windows\System32\sdclt.exe
      "C:\Windows\System32\sdclt.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5592
      • C:\Windows\System32\control.exe
        "C:\Windows\System32\control.exe" /name Microsoft.BackupAndRestoreCenter
        3⤵
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:3408
    • C:\Windows\System32\sdclt.exe
      "C:\Windows\System32\sdclt.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5832
      • C:\Windows\System32\control.exe
        "C:\Windows\System32\control.exe" /name Microsoft.BackupAndRestoreCenter
        3⤵
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:5964
    • C:\Users\Admin\AppData\Local\Temp\tmp240732712\csrss240732437.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp240732712\csrss240732437.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3140
      • C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\BlueStacksInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\BlueStacksInstaller.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1128
        • C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\HD-CheckCpu.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\HD-CheckCpu.exe" --cmd checkHypervEnabled
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5924
        • C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\HD-CheckCpu.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\HD-CheckCpu.exe" --cmd checkSSE4
          4⤵
          • Executes dropped EXE
          PID:3872
    • C:\Users\Admin\AppData\Local\Temp\tmp240732712\svchost240732454.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp240732712\svchost240732454.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2280
      • C:\Users\Admin\AppData\Local\Temp\7zS8E85D519\BlueStacksInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS8E85D519\BlueStacksInstaller.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2480
        • C:\Users\Admin\AppData\Local\Temp\7zS8E85D519\HD-CheckCpu.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS8E85D519\HD-CheckCpu.exe" --cmd checkHypervEnabled
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5816
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3712
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1352
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k SDRSVC
    1⤵
      PID:5632
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1408
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3996
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:8
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2500

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 603B
          • SHA256 b162cad3e5056ed4fc0b7ea8dcb12c1ef3631852158a72df85c1ec280c90ce97
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 595B
          • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          backicon.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\Assets\backicon.png
          • Size 15KB
          • SHA256 fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          change_hover.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\Assets\change_hover.png
          • Size 310B
          • SHA256 8e5847487da148ebb3ea029cc92165afd215cdc08f7122271e13eb37f94e6dc1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          close_red.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\Assets\close_red.png
          • Size 15KB
          • SHA256 d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          custom.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\Assets\custom.png
          • Size 17KB
          • SHA256 fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          discord_icon.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\Assets\discord_icon.png
          • Size 564B
          • SHA256 c29b35c6be50f9e34f1120bd346ce01884f0c7ba1121c866d95b24e46e420b0c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          folder.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\Assets\folder.png
          • Size 298B
          • SHA256 7ffa875fab1be82e384022a27f3e627ab75131eb168be949cc83c03b6e291bbf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          help_icon.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\Assets\help_icon.png
          • Size 1KB
          • SHA256 97c7450d55ecda9017d0a9eed0049b8176e1828f3525aaf5660985ba214010cc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          info_icon.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\Assets\info_icon.png
          • Size 929B
          • SHA256 ee91e51aaa8356318cc75d60476d9422bf84be7d8a25e1b884aa16c3198dc764
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          installer_bg.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\Assets\installer_bg.jpg
          • Size 78KB
          • SHA256 4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          installer_logo.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\Assets\installer_logo.png
          • Size 9KB
          • SHA256 462b64f2e016d25a2a6a653ba896206129c4ac841d61a6c2fd116009606f7e1c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          installer_minimize.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\Assets\installer_minimize.png
          • Size 113B
          • SHA256 a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          loader.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\Assets\loader.png
          • Size 279B
          • SHA256 076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          logo_text.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\Assets\logo_text.png
          • Size 4KB
          • SHA256 66df86129129d8aa8dd3ba014eb3b3c27a36c22e4782f3dbd6a9a4bc1f4a87bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setpath.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\Assets\setpath.png
          • Size 15KB
          • SHA256 5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BlueStacksInstaller.exe.config
          • Path C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\BlueStacksInstaller.exe.config
          • Size 324B
          • SHA256 d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          JSON.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\JSON.dll
          • Size 411KB
          • SHA256 d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i18n.en-US.txt
          • Path C:\Users\Admin\AppData\Local\Temp\7zS44CF4C09\Locales\i18n.en-US.txt
          • Size 21KB
          • SHA256 945cbd36495c301dcf1cad837a4147479077974bce2790a3cb3961c9c71f22e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          discord_icon_click.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS8E85D519\Assets\discord_icon_click.png
          • Size 512B
          • SHA256 6b126c8a7015c2274e6a2ac969e0f31ecae421e1652b446b2aafd2b03d0dc3f5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          exit_close.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS8E85D519\Assets\exit_close.png
          • Size 670B
          • SHA256 7aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          minimize_progress.png
          • Path C:\Users\Admin\AppData\Local\Temp\7zS8E85D519\Assets\minimize_progress.png
          • Size 212B
          • SHA256 2f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          BlueStacksInstaller.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7zS8E85D519\BlueStacksInstaller.exe
          • Size 642KB
          • SHA256 314b5c6d83cfcd93f2b6a95908de0b6fea026709211e73d5bff546b571b90053
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          HD-CheckCpu.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7zS8E85D519\HD-CheckCpu.exe
          • Size 200KB
          • SHA256 2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ThemeFile
          • Path C:\Users\Admin\AppData\Local\Temp\7zS8E85D519\ThemeFile
          • Size 80KB
          • SHA256 de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          installer_bg_5.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\Assets\installer_bg_5.jpg
          • Size 30KB
          • SHA256 873030e34515538dac3efb98edec519596439fa05b7aad37f6137ca954ba41a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          csrss240732437.exe
          • Path C:\Users\Admin\AppData\Local\Temp\tmp240732712\csrss240732437.exe
          • Size 927KB
          • SHA256 5fd249d18a3c30e9a9c16f8993d747df4bd062ae1efffa67cc65ccf3a58bd2c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/8-406-0x000001D514210000-0x000001D514230000-memory.dmp
          Download

          memory/8-372-0x000001D503930000-0x000001D503950000-memory.dmp
          Download

          memory/8-357-0x000001D5001E0000-0x000001D5002E0000-memory.dmp
          Download

          memory/8-389-0x000001D503D70000-0x000001D503D90000-memory.dmp
          Download

          memory/8-373-0x000001D513F00000-0x000001D514000000-memory.dmp
          Download

          memory/1128-296-0x0000000000670000-0x0000000000714000-memory.dmp
          Download

          memory/1128-334-0x000000001D2C0000-0x000000001D361000-memory.dmp
          Download

          memory/1128-318-0x000000001BEE0000-0x000000001BEEE000-memory.dmp
          Download

          memory/1128-317-0x000000001BF10000-0x000000001BF4E000-memory.dmp
          Download

          memory/2480-313-0x000000001CF00000-0x000000001D428000-memory.dmp
          Download

          memory/2480-333-0x000000001C8B0000-0x000000001C951000-memory.dmp
          Download

          memory/2480-316-0x000000001CCF0000-0x000000001CCF8000-memory.dmp
          Download

          memory/2480-299-0x000000001B100000-0x000000001B168000-memory.dmp
          Download