Overview

overview

10

Static

static

10

2026-08-04...lc.exe

windows10-2004-x64

9

2026-08-04...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 06:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_76acd46cb81e2fc96871402408ed528a_cobalt-strike_coinminer_hijackloader_icedid_luca-stealer_njrat_satacom_stealc.exe
  • Size 6.5MB
  • Sample260804-hjev5aef37
  • SHA256 f94fb4fd7581b179e98ab593aa06747c51555424d93b409bdcc120d8d2f91df4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryspywarestealerupx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 3 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_76acd46cb81e2fc96871402408ed528a_cobalt-strike_coinminer_hijackloader_icedid_luca-stealer_njrat_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_76acd46cb81e2fc96871402408ed528a_cobalt-strike_coinminer_hijackloader_icedid_luca-stealer_njrat_satacom_stealc.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Users\Admin\AppData\Local\Temp\1642250422551330.exe
      "C:\Users\Admin\AppData\Local\Temp\1642250422551330.exe" --binder-child
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1656
      • C:\Users\Admin\AppData\Local\Temp\7zS876CA278\setup-stub.exe
        .\setup-stub.exe --binder-child
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:1100

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1642250422551330.exe
        • Path C:\Users\Admin\AppData\Local\Temp\1642250422551330.exe
        • Size 341KB
        • SHA256 8d0e6a04a748452823319990a2917abd39ca9af478f0a834242492a3fee4299f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup-stub.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zS876CA278\setup-stub.exe
        • Size 551KB
        • SHA256 45fabe4b7336d0356b02a765fbc590b3f1b3b2ae15d4562fba00a766b4e483c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log.txt
        • Path C:\Users\Admin\AppData\Local\Temp\log.txt
        • Size 1KB
        • SHA256 9bbb422e5f5f8a4b4ccd9462f6c3e3b6a706894603dbd68fc6278617dcd35845
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CertCheck.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsi4CA5.tmp\CertCheck.dll
        • Size 15KB
        • SHA256 d56e2407b6050d669e94e452f1a54ee1859a1751179a3f1e2b4253305a23a0cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CityHash.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsi4CA5.tmp\CityHash.dll
        • Size 53KB
        • SHA256 c299a0a71bf57eb241868158b4fcfe839d15d5ba607e1bdc5499fdf67b334a14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InetBgDL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsi4CA5.tmp\InetBgDL.dll
        • Size 17KB
        • SHA256 dc98ed352476af459c91100b8c29073988da19d3adc73e2c2086d25f238544a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsi4CA5.tmp\System.dll
        • Size 22KB
        • SHA256 b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UAC.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsi4CA5.tmp\UAC.dll
        • Size 28KB
        • SHA256 ec6a56d981892bf251df1439bea425a5f6c7e1c7312d44bedd5e2957f270338c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UserInfo.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsi4CA5.tmp\UserInfo.dll
        • Size 14KB
        • SHA256 c6c413108539f141bea3f679e0e2ef705898c51ec7c2607f478a865fc5e2e2df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WebBrowser.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsi4CA5.tmp\WebBrowser.dll
        • Size 103KB
        • SHA256 281a0dc8b4f644334c2283897963b20df88fa9fd32acca98ed2856b23318e6ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        installing.html
        • Path C:\Users\Admin\AppData\Local\Temp\nsi4CA5.tmp\installing.html
        • Size 1KB
        • SHA256 6259f3a41a703f13466503e6fbd37ca40e94f565a2f4b4087fbcd87a13bf3ee1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        installing.js
        • Path C:\Users\Admin\AppData\Local\Temp\nsi4CA5.tmp\installing.js
        • Size 2KB
        • SHA256 2c286b6eefd38f032a385f3ac6a1f794deab3bac0fbff71bd0ba21453f477878
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        stub_common.js
        • Path C:\Users\Admin\AppData\Local\Temp\nsi4CA5.tmp\stub_common.js
        • Size 817B
        • SHA256 0e28aa770b0afade30be85c6dc1e50344db8f8cdd3fa01989d81a9e20a4990bd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1656-102-0x0000000000400000-0x0000000000446000-memory.dmp
        Download

        memory/1656-13-0x0000000000400000-0x0000000000446000-memory.dmp
        Download