Overview

overview

8

Static

static

3

2026-09-07...lc.exe

windows10-2004-x64

8

2026-09-07...lc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    61s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/09/2026, 04:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-07_339e4b344334c45d90db5ed9e6c0c895_cryptbot_icedid_luca-stealer_njrat_stealc.exe
  • Size 74.6MB
  • Sample260909-epaltabl2x
  • SHA256 5ef54b7fafb832dd8ee1b73e6ce65633dd93c743a0b2dab03a0b4a5fac8badef
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionexploit

Malware Config

Signatures

  • Possible privilege escalation attempt 4 IoCs
    exploit
  • Executes dropped EXE 1 IoCs
  • Modifies file permissions 1 TTPs 4 IoCs
    discovery
  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-07_339e4b344334c45d90db5ed9e6c0c895_cryptbot_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-07_339e4b344334c45d90db5ed9e6c0c895_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1860
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\GameExplorer.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\GameExplorer.exe" /S
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:948
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\Copy.bat" /S"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3416
        • C:\Windows\system32\takeown.exe
          takeown /F "C:\Windows\System32" /R /D Y
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:5268
        • C:\Windows\system32\icacls.exe
          icacls "C:\Windows\System32" /grant Administrators:F /T /C
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:2888
        • C:\Windows\system32\takeown.exe
          takeown /F "C:\Windows\SysWOW64" /R /D Y
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1144
        • C:\Windows\system32\icacls.exe
          icacls "C:\Windows\SysWOW64" /grant Administrators:F /T /C
          4⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:4804
        • C:\Windows\system32\Robocopy.exe
          robocopy "C:\Users\Admin\AppData\Local\Temp\RarSFX1\System32" "C:\Windows\System32" /E /IS /IT /R:0 /W:0
          4⤵
            PID:832
          • C:\Windows\system32\Robocopy.exe
            robocopy "C:\Users\Admin\AppData\Local\Temp\RarSFX1\SysWOW64" "C:\Windows\SysWOW64" /E /IS /IT /R:0 /W:0
            4⤵
              PID:1864

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            GameExplorer.exe
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\GameExplorer.exe
            • Size 1.7MB
            • SHA256 ce1c8575fa852d4e4ce52c6f13dcc6ef4cd6cb436908b9a95ef45d2b1752a46a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Copy.bat
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\Copy.bat
            • Size 365B
            • SHA256 aac3a5d9b9512d693e98a14d53dc51ed2cd8e5df6aac2b1aea05041b05e4d496
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            gameux.dll
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\SysWOW64\gameux.dll
            • Size 2.3MB
            • SHA256 afd55b15352eb7e878db7b0ce9fd7744db135808cbdde26f95c3f628c87daefe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            gameuxmig.dll
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\SysWOW64\migration\gameuxmig.dll
            • Size 29KB
            • SHA256 39e4b7bc831b8428eadca2ff9ad714c2ebd3911d045358460191320d03a09f5d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            GameUXLegacyGDFs.dll
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\System32\GameUXLegacyGDFs.dll
            • Size 4.0MB
            • SHA256 def32eb30b1966bd9dae4e8957d58a3a1a4799853303061997daa397a6f639d1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            gameuxmig.dll
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\System32\Migration\gameuxmig.dll
            • Size 34KB
            • SHA256 17a6ad0fda10b0767ca5d722a2c680073dbae788fbabac310fb9173d7ad2c562
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            gameux.dll.mui
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\System32\en-us\gameux.dll.mui
            • Size 18KB
            • SHA256 4a96dbdaad707ed4e30f3a06deadbf3797dc86c74a20acd248d15901aec70a47
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            gameux.dll
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\System32\gameux.dll
            • Size 2.4MB
            • SHA256 3c507b8345c87d3b285a332448c2d9f55a0db7e66b619b42f0d700516ef4c485
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download