Overview

overview

10

Static

static

10

2026-09-23...lc.exe

windows10-2004-x64

9

2026-09-23...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/09/2026, 09:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-23_4504f63a8d3c5b3b5dac7e6031e3db26_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
  • Size 3.4MB
  • Sample260924-ltwheaag44
  • SHA256 5a253c29556471eae726d621b84877f232880c722ccbb99a97c245507d658860
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoverypersistenceprivilege_escalationupx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 18 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory 1 TTPs 4 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 13 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3216
    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_4504f63a8d3c5b3b5dac7e6031e3db26_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_4504f63a8d3c5b3b5dac7e6031e3db26_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe"
      2⤵
      • Checks computer location settings
      • Creates a file in the Startup directory
      • Adds Run key to start application
      • Checks processor information in registry
      • Modifies registry class
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5932
      • C:\Users\Admin\AppData\Local\Temp\982CAB52\tor.exe
        "C:\Users\Admin\AppData\Local\Temp\982CAB52\tor.exe" -f "C:\Users\Admin\AppData\Local\Temp\982CAB52\torrc"
        3⤵
        • Executes dropped EXE
        PID:1084
  • C:\Users\Admin\AppData\Roaming\StartMenuExperienceHost.exe
    C:\Users\Admin\AppData\Roaming\StartMenuExperienceHost.exe
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:5856
  • C:\Users\Admin\AppData\Roaming\StartMenuExperienceHost.exe
    "C:\Users\Admin\AppData\Roaming\StartMenuExperienceHost.exe"
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:4056

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cached-microdesc-consensus.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\982CAB52\data\cached-microdesc-consensus.tmp
        • Size 3.2MB
        • SHA256 06bffd3b958e551a1669d6e8eecb486e571b08e10e2f9bf522bd50f8d00d8bc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cached-microdescs.new
        • Path C:\Users\Admin\AppData\Local\Temp\982CAB52\data\cached-microdescs.new
        • Size 20.5MB
        • SHA256 9f24e26db2dbd71b6188838d5c93f0b3821f0e06662ccc83d336f4d663afe9bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notice.log
        • Path C:\Users\Admin\AppData\Local\Temp\982CAB52\notice.log
        • Size 2KB
        • SHA256 97a8118255cf86f71ec5fc22d0fcb067b0ce9639609e4909ea60b9446b564898
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        notice.log
        • Path C:\Users\Admin\AppData\Local\Temp\982CAB52\notice.log
        • Size 2KB
        • SHA256 b625061e49bb80258940b54ff8714871893927417301f56dc83843305f500d1f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        notice.log
        • Path C:\Users\Admin\AppData\Local\Temp\982CAB52\notice.log
        • Size 2KB
        • SHA256 9c38f4ccb58f9008f002eefde98b7f5098c3c3c0284bc3db2b63127eefaca4f9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        notice.log
        • Path C:\Users\Admin\AppData\Local\Temp\982CAB52\notice.log
        • Size 3KB
        • SHA256 d589852d23d0b3e4651de1865933dabc4461bf0ec7773b52b5eadf74dfc5cd35
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        notice.log
        • Path C:\Users\Admin\AppData\Local\Temp\982CAB52\notice.log
        • Size 4KB
        • SHA256 e029453dd51d5d92ea2dae66e39b312c928ffbf6e189fa68422a0eb1976c4cbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notice.log
        • Path C:\Users\Admin\AppData\Local\Temp\982CAB52\notice.log
        • Size 4KB
        • SHA256 936a28216e9b09810f70bbcbf347f8a41e2803669b53d8fd88d90704a85ea428
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notice.log
        • Path C:\Users\Admin\AppData\Local\Temp\982CAB52\notice.log
        • Size 4KB
        • SHA256 9e4df494fd7e8c1f4cebfc6d8d1daf119d4179fb21c6ce834e0955f6b8bf3ad1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notice.log
        • Path C:\Users\Admin\AppData\Local\Temp\982CAB52\notice.log
        • Size 4KB
        • SHA256 d072cc9c0129560f487e15c8b1992f7f9aa88a6b03ba5535278a200bfec2690d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notice.log
        • Path C:\Users\Admin\AppData\Local\Temp\982CAB52\notice.log
        • Size 5KB
        • SHA256 84d94f593280eaf82e918a7db3b15183783c563a8d2195126ec67be8191c3d93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tor.exe
        • Path C:\Users\Admin\AppData\Local\Temp\982CAB52\tor.exe
        • Size 2.8MB
        • SHA256 ff658abdd717c949e39a9ed41c1f157ae622d40c100761a4f3a31cfca24b6ae8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        torrc
        • Path C:\Users\Admin\AppData\Local\Temp\982CAB52\torrc
        • Size 260B
        • SHA256 882168020e13cf75d86569877c92bda3d3d4c08212ceff045228b4e1b09d1565
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wctk.dat
        • Path C:\Users\Admin\AppData\Local\Temp\wctk.dat
        • Size 42B
        • SHA256 c121ed4e0b6d235efa95ac3e0bc7f7256c296c8b14c8d30f9bf1af2d0ee9650b
        • MD5 SHA1 SHA512
        Submit Download

        .wctg
        • Path C:\Users\Admin\AppData\Roaming\.wctg
        • Size 8B
        • SHA256 0d6e734ae9d5a27b3b4eae0aa3bfd1f4a17fe16e919bff0be2da47ec56e1631f
        • MD5 SHA1 SHA512
        Submit Download

        StartMenuExperienceHost.lnk
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartMenuExperienceHost.lnk
        • Size 953B
        • SHA256 a64d5582440064c34c2c8be2286c6aba9511218105d341cc7b456cf1a88d92a6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartMenuExperienceHost.exe
        • Path C:\Users\Admin\AppData\Roaming\StartMenuExperienceHost.exe
        • Size 3.4MB
        • SHA256 5a253c29556471eae726d621b84877f232880c722ccbb99a97c245507d658860
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1084-92-0x00007FF6E6910000-0x00007FF6E71B9000-memory.dmp
        Download

        memory/1084-89-0x00007FF6E6910000-0x00007FF6E71B9000-memory.dmp
        Download

        memory/1084-99-0x00007FF6E6910000-0x00007FF6E71B9000-memory.dmp
        Download

        memory/1084-98-0x00007FF6E6910000-0x00007FF6E71B9000-memory.dmp
        Download

        memory/1084-97-0x00007FF6E6910000-0x00007FF6E71B9000-memory.dmp
        Download

        memory/1084-96-0x00007FF6E6910000-0x00007FF6E71B9000-memory.dmp
        Download

        memory/1084-82-0x00007FF6E6910000-0x00007FF6E71B9000-memory.dmp
        Download

        memory/1084-83-0x00007FF6E6910000-0x00007FF6E71B9000-memory.dmp
        Download

        memory/1084-86-0x00007FF6E6910000-0x00007FF6E71B9000-memory.dmp
        Download

        memory/1084-87-0x00007FF6E6910000-0x00007FF6E71B9000-memory.dmp
        Download

        memory/1084-88-0x00007FF6E6910000-0x00007FF6E71B9000-memory.dmp
        Download

        memory/1084-95-0x00007FF6E6910000-0x00007FF6E71B9000-memory.dmp
        Download

        memory/1084-91-0x00007FF6E6910000-0x00007FF6E71B9000-memory.dmp
        Download

        memory/1084-41-0x00007FF6E6910000-0x00007FF6E71B9000-memory.dmp
        Download

        memory/1084-93-0x00007FF6E6910000-0x00007FF6E71B9000-memory.dmp
        Download

        memory/1084-94-0x00007FF6E6910000-0x00007FF6E71B9000-memory.dmp
        Download

        memory/3216-23-0x0000000002D50000-0x0000000002D51000-memory.dmp
        Download

        memory/3216-22-0x0000000002D40000-0x0000000002D41000-memory.dmp
        Download

        memory/3216-21-0x0000000180000000-0x0000000180006000-memory.dmp
        Download

        memory/3216-16-0x0000000180000000-0x0000000180006000-memory.dmp
        Download

        memory/5932-15-0x0000020529520000-0x0000020529521000-memory.dmp
        Download