Overview

overview

10

Static

static

3

2026-09-04...lc.exe

windows10-2004-x64

10

2026-09-04...lc.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/09/2026, 16:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-04_26b541d0a84e81279baf3b1b10725bd3_icedid_luca-stealer_njrat_stealc.exe
  • Size 11.5MB
  • Sample260905-tjqs6seq7t
  • SHA256 0a622c7c2fa691883a9ddaa860a205d8b42bcbf36fb84199d6a6649c7b1c7fd6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    remove IFEO.

    defense_evasion
  • Modifies boot configuration data using bcdedit 5 IoCs
  • Drops file in System32 directory 1 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies Control Panel 9 IoCs
    defense_evasion
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-04_26b541d0a84e81279baf3b1b10725bd3_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-04_26b541d0a84e81279baf3b1b10725bd3_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies security service
    • Indicator Removal: Clear Persistence
    • Drops file in System32 directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c for /d %I in ("C:\Users\*") do @attrib -h -s -r "%I\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{5b6da672-ae89-45ee-9e46-e5541bec671b}\Easy Context Menu" /s /d
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1656
      • C:\Windows\system32\attrib.exe
        attrib -h -s -r "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{5b6da672-ae89-45ee-9e46-e5541bec671b}\Easy Context Menu" /s /d
        3⤵
        • Views/modifies file attributes
        PID:2068
      • C:\Windows\system32\attrib.exe
        attrib -h -s -r "C:\Users\Public\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{5b6da672-ae89-45ee-9e46-e5541bec671b}\Easy Context Menu" /s /d
        3⤵
        • Views/modifies file attributes
        PID:5700
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c for /d %I in ("C:\Users\*") do @rmdir /S /Q "%I\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{5b6da672-ae89-45ee-9e46-e5541bec671b}\Easy Context Menu"
      2⤵
      • Executes a command shell one-liner
      PID:2512
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /deletevalue disabledynamictick
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:304
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /deletevalue useplatformtick
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:4684
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /deletevalue isolatedcontext
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:3680
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /deletevalue vsmlaunchtype
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:3508
    • C:\Windows\SYSTEM32\bcdedit.exe
      bcdedit /deletevalue vm
      2⤵
      • Modifies boot configuration data using bcdedit
      PID:4484

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads