Overview

overview

7

Static

static

3

2026-09-22...lc.exe

windows10-2004-x64

7

2026-09-22...lc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/09/2026, 07:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-22_398f6765096a56754e319b27f7646554_icedid_luca-stealer_njrat_stealc.exe
  • Size 3.1MB
  • Sample260922-jm698abc22
  • SHA256 1fd8d2eb699125ff997bbf0979283047b26a55224900cbe877b50e0b96d49f2d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
collectiondefense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Maps connected drives based on registry 3 TTPs 3 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 2 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • outlook_office_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-22_398f6765096a56754e319b27f7646554_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-22_398f6765096a56754e319b27f7646554_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • Adds Run key to start application
    • Checks for any installed AV software in registry
    • Checks whether UAC is enabled
    • Maps connected drives based on registry
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    PID:948
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --no-first-run
      2⤵
        PID:5488
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
        PID:2668
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\shhost.exe
        C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\shhost.exe
        1⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4716

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Defense Evasion

            Modify Registry

            1
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            2
            T1552

            Credentials In Files

            1
            T1552.001

            Credentials in Registry

            1
            T1552.002

            Discovery

            Browser Information Discovery

            1
            T1217

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            5
            T1012

            Software Discovery

            1
            T1518

            Security Software Discovery

            1
            T1518.001

            System Information Discovery

            5
            T1082

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Lateral Movement

            Collection

            Data from Local System

            2
            T1005

            Email Collection

            1
            T1114

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            shhost.exe
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\ShellExperience\shhost.exe
            • Size 3.1MB
            • SHA256 1fd8d2eb699125ff997bbf0979283047b26a55224900cbe877b50e0b96d49f2d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download