Overview

overview

10

Static

static

10

2026-07-10...lc.exe

windows10-2004-x64

9

2026-07-10...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 02:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-10_e0d445d431d4824425a535dd465ab23d_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
  • Size 1.3MB
  • Sample260710-cfsd6ac12z
  • SHA256 c32ad2e9a562283fb7479623173b0bfde98501d5905ee241cbb179250270c3b4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Drops startup file 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • NTFS ADS 5 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_e0d445d431d4824425a535dd465ab23d_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-10_e0d445d431d4824425a535dd465ab23d_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Drops startup file
    • Registers new Windows logon scripts automatically executed at logon.
    • Adds Run key to start application
    • Subvert Trust Controls: Mark-of-the-Web Bypass
    • Checks processor information in registry
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4520
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization','C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' -Force 2>$null"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4516
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization','C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup' -Force 2>$null"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5048
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c schtasks /create /tn "OneDriveUpdateScheduler" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe\"" /rl highest /sc onlogon /ru "Admin" /delay 0000:30 /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:6092
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn "OneDriveUpdateScheduler" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe\"" /rl highest /sc onlogon /ru "Admin" /delay 0000:30 /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1988
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="SCStormFlt",EventNameSpace="root\cimv2",QueryLanguage="WQL",Query="SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_LocalTime' AND TargetInstance.Minutes=0"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1280
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="SCStormFlt",EventNameSpace="root\cimv2",QueryLanguage="WQL",Query="SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_LocalTime' AND TargetInstance.Minutes=0"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4872
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c wmic /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="SCStormCon",CommandLineTemplate="\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe\""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3860
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="SCStormCon",CommandLineTemplate="\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe\""
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4260
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"SCStormFlt\"",Consumer="CommandLineEventConsumer.Name=\"SCStormCon\""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5724
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"SCStormFlt\"",Consumer="CommandLineEventConsumer.Name=\"SCStormCon\""
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5436
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe
    C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe
    1⤵
    • Executes dropped EXE
    • Subvert Trust Controls: Mark-of-the-Web Bypass
    • NTFS ADS
    PID:4952
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Personalization\ThemeMonitor.exe"
    1⤵
    • Executes dropped EXE
    • Subvert Trust Controls: Mark-of-the-Web Bypass
    • NTFS ADS
    PID:696

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        PowerShell

        1
        T1059.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Boot or Logon Initialization Scripts

        1
        T1037

        Logon Script (Windows)

        1
        T1037.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Boot or Logon Initialization Scripts

        1
        T1037

        Logon Script (Windows)

        1
        T1037.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Modify Registry

        1
        T1112

        Subvert Trust Controls

        1
        T1553

        SIP and Trust Provider Hijacking

        1
        T1553.003

        Virtualization/Sandbox Evasion

        3
        T1497

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Browser Information Discovery

        1
        T1217

        Query Registry

        6
        T1012

        System Information Discovery

        2
        T1082

        Virtualization/Sandbox Evasion

        3
        T1497

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        2026-07-10_e0d445d431d4824425a535dd465ab23d_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-07-10_e0d445d431d4824425a535dd465ab23d_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
        • Size 1.3MB
        • SHA256 c32ad2e9a562283fb7479623173b0bfde98501d5905ee241cbb179250270c3b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        brdC84.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\brdC84.tmp
        • Size 138KB
        • SHA256 6b366d1224218f09a94d5e273f83d1f1101eddff0bbb6f7d72565b6abfe48f47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        brdC95.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\brdC95.tmp
        • Size 256KB
        • SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lskC7F.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\lskC7F.tmp
        • Size 4KB
        • SHA256 b555c4af81f0cfad6cbc5b09bf4ac3e56648ba7431b9fe456f6ec3c3c814b94b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lskC81.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\lskC81.tmp
        • Size 38KB
        • SHA256 3f7c7287c8e1efe4056d68dbc0d1c936db3c4695e75b6f52aa9df2f00e4a0f01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OneDriveAaawat.exe:Zone.Identifier
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDriveAaawat.exe:Zone.Identifier
        • Size 26B
        • SHA256 1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33
        • MD5 SHA1 SHA512
        Submit Download

        memory/5048-24-0x0000016669B00000-0x0000016669BB2000-memory.dmp
        Download

        memory/5048-26-0x00007FF8E32B0000-0x00007FF8E3C54000-memory.dmp
        Download

        memory/5048-19-0x00007FF8E32B0000-0x00007FF8E3C54000-memory.dmp
        Download

        memory/5048-20-0x00007FF8E32B0000-0x00007FF8E3C54000-memory.dmp
        Download

        memory/5048-17-0x00007FF8E32B0000-0x00007FF8E3C54000-memory.dmp
        Download

        memory/5048-23-0x0000016669AE0000-0x0000016669AFE000-memory.dmp
        Download

        memory/5048-25-0x0000016669BC0000-0x0000016669BCA000-memory.dmp
        Download

        memory/5048-18-0x00007FF8E32B0000-0x00007FF8E3C54000-memory.dmp
        Download

        memory/5048-27-0x00007FF8E32B0000-0x00007FF8E3C54000-memory.dmp
        Download

        memory/5048-28-0x00007FF8E32B0000-0x00007FF8E3C54000-memory.dmp
        Download

        memory/5048-30-0x0000016669FB0000-0x000001666A0A0000-memory.dmp
        Download

        memory/5048-31-0x00007FF8E32B0000-0x00007FF8E3C54000-memory.dmp
        Download

        memory/5048-16-0x00007FF8E32B0000-0x00007FF8E3C54000-memory.dmp
        Download

        memory/5048-15-0x00007FF8E32B0000-0x00007FF8E3C54000-memory.dmp
        Download

        memory/5048-14-0x0000016669A30000-0x0000016669A52000-memory.dmp
        Download

        memory/5048-11-0x00007FF8E343F000-0x00007FF8E3440000-memory.dmp
        Download