Overview

overview

10

Static

static

10

2026-07-23...lc.exe

windows10-2004-x64

9

2026-07-23...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/07/2026, 23:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-23_ee86d1e399a97e607dbf2049ab0bd943_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
  • Size 471KB
  • Sample260723-3qj4msdf38
  • SHA256 d52e8f8bb91a9a3af77b946b005380ee69d1c1a5e3f29056a9a7503b0e68862e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionspywarestealertrojan

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-23_ee86d1e399a97e607dbf2049ab0bd943_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-23_ee86d1e399a97e607dbf2049ab0bd943_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops desktop.ini file(s)
    • Suspicious use of WriteProcessMemory
    PID:1480
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c ipconfig /all > "C:\Users\Admin\AppData\Local\Temp\sysupdate\ipconfig.txt"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:6112
      • C:\Windows\system32\ipconfig.exe
        ipconfig /all
        3⤵
        • Gathers network information
        PID:4420
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c tasklist /v > "C:\Users\Admin\AppData\Local\Temp\sysupdate\tasklist.txt"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:936
      • C:\Windows\system32\tasklist.exe
        tasklist /v
        3⤵
        • Enumerates processes with tasklist
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3984
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c netstat -an > "C:\Users\Admin\AppData\Local\Temp\sysupdate\netstat.txt"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2488
      • C:\Windows\system32\NETSTAT.EXE
        netstat -an
        3⤵
        • Gathers network information
        • Suspicious use of AdjustPrivilegeToken
        PID:4852
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c whoami /all > "C:\Users\Admin\AppData\Local\Temp\sysupdate\whoami.txt"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4980
      • C:\Windows\system32\whoami.exe
        whoami /all
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3900
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c net user > "C:\Users\Admin\AppData\Local\Temp\sysupdate\netuser.txt"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2428
      • C:\Windows\system32\net.exe
        net user
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5940
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 user
          4⤵
            PID:6084
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c net localgroup administrators > "C:\Users\Admin\AppData\Local\Temp\sysupdate\admins.txt"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3408
        • C:\Windows\system32\net.exe
          net localgroup administrators
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3284
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 localgroup administrators
            4⤵
              PID:6036
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k GPSvcGroup
        1⤵
          PID:2672

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              admins.txt
              • Path C:\Users\Admin\AppData\Local\Temp\sysupdate\admins.txt
              • Size 278B
              • SHA256 8ce93e47255a325d44bd3254d06341d273056fdadbd9f796910ee588c0146167
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ipconfig.txt
              • Path C:\Users\Admin\AppData\Local\Temp\sysupdate\ipconfig.txt
              • Size 1021B
              • SHA256 ea99ad405a2d57c253acc17ee617b340d8ed56e28e72d3be7bb8a93b2257a055
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              netstat.txt
              • Path C:\Users\Admin\AppData\Local\Temp\sysupdate\netstat.txt
              • Size 2KB
              • SHA256 465be25a672dbc9086c0d8a3fb2c81af866cdc4a2cde98ce348ff8435fda8450
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              netuser.txt
              • Path C:\Users\Admin\AppData\Local\Temp\sysupdate\netuser.txt
              • Size 283B
              • SHA256 550d1bc4f927fcd9375baa5fd5099fcd42aaae84a6f6a7b1ee5c33a823c4a8e1
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              tasklist.txt
              • Path C:\Users\Admin\AppData\Local\Temp\sysupdate\tasklist.txt
              • Size 20KB
              • SHA256 46fccff7916a16e60a52dbe9094fba893251af53137e571984a9d3991f9a220d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              whoami.txt
              • Path C:\Users\Admin\AppData\Local\Temp\sysupdate\whoami.txt
              • Size 5KB
              • SHA256 4260c16c4db235423eec146f2e237215e564892866592e26221ec8f535eeb888
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download