Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 22:34
General
- Target 2026-08-04_9b84a5c18c0adb159a0e9f562e5bf1e1_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
- Size 4.4MB
- Sample260804-2hdffssare
- SHA256 a6ba8ac6245ebec97acebebbf4d9dc930bb58342dafee3c4a8a648470ca4b26b
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Drops desktop.ini file(s) 7 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 1 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Delays execution with timeout.exe 1 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 34 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_9b84a5c18c0adb159a0e9f562e5bf1e1_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_9b84a5c18c0adb159a0e9f562e5bf1e1_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wininits.exe"C:\Users\Admin\AppData\Local\Temp\wininits.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Public\Documentsmz.txt" /B+"C:\Users\Public\Documentsmzy.jpg" /B C:\Users\Public\Documents\kxrlejzv.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 /nobreak && sc start "kxrlejzv"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 1 /nobreak4⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\sc.exesc start "kxrlejzv"4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Public\Documents\kxrlejzv.exeC:\Users\Public\Documents\kxrlejzv.exe -service1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Documents\kxrlejzv.exe"C:\Users\Public\Documents\kxrlejzv.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CurrentDatabase_400.wmdb
CurrentDatabase_400.wmdb
LocalMLS_3.wmdb
WMSDKNS.XML.bak
wininits.exe
wmsetup.log
梦醒时分-陈淑桦-1989一念间_电视原声带.mp3
Documentsmz.txt
Documentsmzy.jpg
memory/1016-52-0x0000000000EE0000-0x0000000000EE1000-memory.dmp
memory/5388-92-0x00000000077B0000-0x00000000077C0000-memory.dmp
memory/5388-97-0x00000000077B0000-0x00000000077C0000-memory.dmp
memory/5388-58-0x0000000008330000-0x0000000008340000-memory.dmp
memory/5388-63-0x0000000008330000-0x0000000008340000-memory.dmp
memory/5388-64-0x0000000008330000-0x0000000008340000-memory.dmp
memory/5388-60-0x0000000008330000-0x0000000008340000-memory.dmp
memory/5388-69-0x00000000077B0000-0x00000000077C0000-memory.dmp
memory/5388-71-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-72-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-74-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-75-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-76-0x00000000077B0000-0x00000000077C0000-memory.dmp
memory/5388-77-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-78-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-80-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-81-0x00000000077B0000-0x00000000077C0000-memory.dmp
memory/5388-79-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-83-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-82-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-86-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-84-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-87-0x00000000077B0000-0x00000000077C0000-memory.dmp
memory/5388-88-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-89-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-90-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-91-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-61-0x0000000008330000-0x0000000008340000-memory.dmp
memory/5388-94-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-93-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-96-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-95-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-59-0x0000000008330000-0x0000000008340000-memory.dmp
memory/5388-99-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-98-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-102-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-101-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-103-0x00000000077B0000-0x00000000077C0000-memory.dmp
memory/5388-105-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-104-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-107-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-106-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-108-0x00000000077B0000-0x00000000077C0000-memory.dmp
memory/5388-110-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-109-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-113-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-112-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-114-0x00000000077B0000-0x00000000077C0000-memory.dmp
memory/5388-115-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-116-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-117-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-118-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-119-0x00000000077B0000-0x00000000077C0000-memory.dmp
memory/5388-121-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-120-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-124-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-123-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-125-0x00000000077B0000-0x00000000077C0000-memory.dmp
memory/5388-126-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-127-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-128-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-129-0x0000000007810000-0x0000000007820000-memory.dmp
memory/5388-130-0x00000000077B0000-0x00000000077C0000-memory.dmp
memory/5388-131-0x0000000007810000-0x0000000007820000-memory.dmp