Overview

overview

10

Static

static

10

2026-07-11...lc.exe

windows10-2004-x64

7

2026-07-11...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/07/2026, 04:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-11_aeb5778be7660f202aeb59c73be012c0_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
  • Size 8.0MB
  • Sample260711-ewfreabt8m
  • SHA256 69e270489cb10eb8c0c5c976c05307b9c4418d9b1a476dfc60cc05b3fef98916
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasionexecutionpersistencespywaretrojan

Malware Config

Signatures

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Modifies system certificate store 2 TTPs 35 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_aeb5778be7660f202aeb59c73be012c0_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-11_aeb5778be7660f202aeb59c73be012c0_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies trusted root certificate store through registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3916
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$d=$env:SystemDrive.TrimEnd(':');$p=Get-Partition -DriveLetter $d -ErrorAction Stop|Select-Object -First 1;$disk=Get-Disk -Number $p.DiskNumber -ErrorAction Stop;Write-Output $disk.PartitionStyle"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3112
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1276
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4388
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$names=@('Microsoft-Hyper-V-All','VirtualMachinePlatform','HypervisorPlatform');$features=Get-WindowsOptionalFeature -Online;foreach($n in $names){$f=$features|Where-Object{$_.FeatureName -eq $n}|Select-Object -First 1;if($null -eq $f){Write-Output ($n + '=NotPresent')}else{Write-Output ($f.FeatureName + '=' + $f.State)}}"
      2⤵
      • Drops file in Windows directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4324
      • C:\Windows\System32\Dism\dismhost.exe
        C:\Windows\System32\Dism\dismhost.exe {800A80CB-DDF8-4A7A-B259-B1414A379A0B}
        3⤵
        • Drops file in Windows directory
        PID:2528
    • C:\Users\Admin\AppData\Local\NVC\nvc.exe
      C:\Users\Admin\AppData\Local\NVC\nvc.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:1804
  • C:\Users\Admin\AppData\Local\NVC\nvc.exe
    C:\Users\Admin\AppData\Local\NVC\nvc.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    PID:4300

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        0CB652C796BAB51B3514BE21AACE5383
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0CB652C796BAB51B3514BE21AACE5383
        • Size 656B
        • SHA256 97658de8c68dfa98ace1e5028a63d54a1aae911b3e21471076c6850cd08cbab4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        BDE28772A83DB7274166C9CC07B6A827
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BDE28772A83DB7274166C9CC07B6A827
        • Size 682B
        • SHA256 0fc0901cca2bae9e9fdbb02d50d02f1094f7b36672086991b9e897626dc485f0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        0CB652C796BAB51B3514BE21AACE5383
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0CB652C796BAB51B3514BE21AACE5383
        • Size 194B
        • SHA256 4ec16ee772f0e3c9b7219029a8b84b29bf76bb1ade3dca6850a4179dbdc8e04c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        BDE28772A83DB7274166C9CC07B6A827
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BDE28772A83DB7274166C9CC07B6A827
        • Size 192B
        • SHA256 da42cbb9330dcdcc78e6191b01a924428499f748d17283830ca41dc7cf19fa4f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 bf1a3e3022329c8228a13f8074aee9608720baee1ea2cc587db2ad9566770b91
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 8ee292cdd52353acbfbfd93afd64ade7cfeeaf929af9e2d868a68bcd7d59b1c3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 071d0c1886d654c2f7bf0d569e9e9c1dc56d01eb98bb28208b64a2e2c2020d8a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nvc.exe
        • Path C:\Users\Admin\AppData\Local\NVC\nvc.exe
        • Size 6.9MB
        • SHA256 3f4c9e88a2fdab25ddc1b8b9cce430c9d7d869c6ae39110364a6b89ce8d8724b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        loader_diag.log
        • Path C:\Users\Admin\AppData\Local\Ring-1\loader_diag.log
        • Size 1KB
        • SHA256 587cda081730c100fc9c5d8f381a7d349bcb9fadb533c27dd54e0f4884f385c7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        loader_diag.log
        • Path C:\Users\Admin\AppData\Local\Ring-1\loader_diag.log
        • Size 400B
        • SHA256 6742014659575d892b3f4904d0302ccbd7b385b1cc7d53ed8bbad3b276abb1ee
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_smn1rftn.l41.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_smn1rftn.l41.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dism.log
        • Path C:\Windows\Logs\DISM\dism.log
        • Size 295KB
        • SHA256 a9a55443afa197e651bf8239204ae112691336b114788d38c462f463061aba00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dism.log
        • Path C:\Windows\Logs\DISM\dism.log
        • Size 297KB
        • SHA256 9f49a1861c716457039b9477af90277f6cf9baccf94844d35fa6611cf698b752
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1276-107-0x00000253FBE70000-0x00000253FBF60000-memory.dmp
        Download

        memory/1276-105-0x00000253FB8F0000-0x00000253FB914000-memory.dmp
        Download

        memory/1276-104-0x00000253FB8F0000-0x00000253FB91A000-memory.dmp
        Download

        memory/3112-73-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
        Download

        memory/3112-94-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
        Download

        memory/3112-82-0x0000028DBF790000-0x0000028DBF7AE000-memory.dmp
        Download

        memory/3112-84-0x0000028DBF7B0000-0x0000028DBF7BA000-memory.dmp
        Download

        memory/3112-85-0x0000028DBFC10000-0x0000028DBFC2E000-memory.dmp
        Download

        memory/3112-86-0x0000028DBF7C0000-0x0000028DBF7CA000-memory.dmp
        Download

        memory/3112-87-0x0000028DBFBF0000-0x0000028DBFBFA000-memory.dmp
        Download

        memory/3112-88-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
        Download

        memory/3112-89-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
        Download

        memory/3112-90-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
        Download

        memory/3112-91-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
        Download

        memory/3112-92-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
        Download

        memory/3112-93-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
        Download

        memory/3112-83-0x0000028DBF9E0000-0x0000028DBFA92000-memory.dmp
        Download

        memory/3112-96-0x0000028DC0130000-0x0000028DC0220000-memory.dmp
        Download

        memory/3112-97-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
        Download

        memory/3112-79-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
        Download

        memory/3112-77-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
        Download

        memory/3112-76-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
        Download

        memory/3112-75-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
        Download

        memory/3112-74-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
        Download

        memory/3112-72-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
        Download

        memory/3112-37-0x00007FF8EA99F000-0x00007FF8EA9A0000-memory.dmp
        Download

        memory/3112-71-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
        Download

        memory/3112-65-0x0000028DBF6F0000-0x0000028DBF712000-memory.dmp
        Download

        memory/3112-46-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
        Download

        memory/4324-120-0x000001C33CD40000-0x000001C33CD68000-memory.dmp
        Download

        memory/4388-114-0x000001F2EC890000-0x000001F2EC980000-memory.dmp
        Download