Analysis
- max time kernel
64s - max time network
120s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/08/2026, 01:46
General
- Target 2026-08-12_0aea304e3fd57b46310689768ba5eefc_amadey_cobalt-strike_darkgate_icedid_luca-stealer_njrat_quasar-rat_satacom_vidar.exe
- Size 7.4MB
- Sample260812-b67fbsgp5x
- SHA256 2c0f7141fc75fcfb1e25d3b1ce6dbacf8344c5434126ff68219e844f63be9696
Malware Config
Signatures
- Detects executables packed with Themida 33 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 8 IoCs
- Themida packer 5 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 22 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_0aea304e3fd57b46310689768ba5eefc_amadey_cobalt-strike_darkgate_icedid_luca-stealer_njrat_quasar-rat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_0aea304e3fd57b46310689768ba5eefc_amadey_cobalt-strike_darkgate_icedid_luca-stealer_njrat_quasar-rat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sfx_0E59B82B\LineInst.exe"C:\Users\Admin\AppData\Local\Temp\sfx_0E59B82B\LineInst.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LineInst_240805484.exeC:\Users\Admin\AppData\Local\Temp\\LineInst_240805484.exe /M3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\LINE\bin\26.4.0.3944\LineAppMgr.exe"C:\Users\Admin\AppData\Local\LINE\bin\26.4.0.3944\LineAppMgr.exe" -afterinstall4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
C:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exeC:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exe3⤵
-
C:\Users\Admin\AppData\Local\LINE\bin\26.4.0.3944\LINE.exe"C:\Users\Admin\AppData\Local\LINE\bin\26.4.0.3944\LINE.exe" run -t 2408280784⤵
-
C:\Users\Admin\AppData\Local\LINE\bin\26.4.0.3944\LineConnector.exe"C:\Users\Admin\AppData\Local\LINE\bin\26.4.0.3944\LineConnector.exe" --register5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "get-appxpackage -name LINE | remove-appxpackage"6⤵
-
-
-
C:\Users\Admin\AppData\Local\LINE\bin\LineUpdater.exeC:\Users\Admin\AppData\Local/LINE//bin/LineUpdater.exe --deploy 26.4.0.3944 en-US real 05⤵
-
C:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exe"C:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exe" --updated 26.4.0.39446⤵
-
C:\Users\Admin\AppData\Local\LINE\bin\26.4.0.3944\LINE.exe"C:\Users\Admin\AppData\Local\LINE\bin\26.4.0.3944\LINE.exe" run --updated 26.4.0.3944 -t 2408491717⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sfx_0E59B82B\svchost.exe"C:\Users\Admin\AppData\Local\Temp\sfx_0E59B82B\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k DriftJadeGroup -s KarmaGraceSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
havensolar.dat
Line.exe
LineAppMgr.exe
LineUpdater.exe
Qt6Core.dll
Qt6Core5Compat.dll
Qt6Gui.dll
Qt6Multimedia.dll
Qt6Network.dll
Qt6OpenGL.dll
Qt6Qml.dll
Qt6QmlModels.dll
Qt6Quick.dll
Qt6Svg.dll
Qt6TextToSpeech.dll
Qt6Widgets.dll
VCRUNTIME140.dll
WebView2Loader.dll
dbghelp.dll
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
skottie.dll
vcruntime140_1.dll
LineLauncher.exe
System.dll
UserInfo.dll
killProc.dll
LineInst.exe
svchost.exe
memory/748-12-0x0000021FFABA0000-0x0000021FFAC68000-memory.dmp
memory/1132-249-0x00007FF63B830000-0x00007FF63C147000-memory.dmp
memory/1132-245-0x00007FF63B830000-0x00007FF63C147000-memory.dmp
memory/1132-244-0x00007FF63B830000-0x00007FF63C147000-memory.dmp
memory/1132-243-0x00007FF63B830000-0x00007FF63C147000-memory.dmp
memory/1720-345-0x0000024FFB2A0000-0x0000024FFB2AA000-memory.dmp
memory/1720-330-0x0000024FE2DC0000-0x0000024FE2DE2000-memory.dmp
memory/1720-344-0x0000024FFB1D0000-0x0000024FFB1D6000-memory.dmp
memory/1720-347-0x0000024FFB570000-0x0000024FFB596000-memory.dmp
memory/1720-346-0x0000024FFB2B0000-0x0000024FFB2B8000-memory.dmp
memory/1720-343-0x0000024FFB1C0000-0x0000024FFB1C8000-memory.dmp
memory/1720-342-0x0000024FFB5B0000-0x0000024FFB5DA000-memory.dmp
memory/1720-341-0x0000024FFB520000-0x0000024FFB53A000-memory.dmp
memory/1720-340-0x0000024FFB730000-0x0000024FFB934000-memory.dmp
memory/1720-339-0x0000024FFB1E0000-0x0000024FFB292000-memory.dmp
memory/1720-337-0x0000024FFB1C0000-0x0000024FFB1DE000-memory.dmp
memory/3884-11-0x00007FF79FCD0000-0x00007FF79FF46000-memory.dmp
memory/4816-312-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/4816-348-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/4816-313-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/4816-314-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/4816-326-0x0000021E1D580000-0x0000021E1D782000-memory.dmp
memory/4816-324-0x0000021E1D130000-0x0000021E1D572000-memory.dmp
memory/4816-300-0x00007FFD5D6B0000-0x00007FFD5DBED000-memory.dmp
memory/4816-310-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/4816-309-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/4816-308-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/4816-307-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/4816-306-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/4816-305-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/4816-303-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/4816-302-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/4816-311-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/4816-301-0x00007FFD5CF20000-0x00007FFD5D534000-memory.dmp
memory/5300-14-0x00007FFD6AC40000-0x00007FFD6AC90000-memory.dmp
memory/6020-360-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/6020-363-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/6020-355-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/6020-356-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/6020-357-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/6020-358-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/6020-354-0x00007FFD5D3E0000-0x00007FFD5D9F4000-memory.dmp
memory/6020-359-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/6020-362-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/6020-353-0x00007FFD5E230000-0x00007FFD5E76D000-memory.dmp
memory/6020-364-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/6020-366-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/6020-365-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/6020-367-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/6020-389-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp
memory/6020-391-0x00007FF62BD30000-0x00007FF630FA4000-memory.dmp