Overview

overview

10

Static

static

10

2026-09-23...lc.exe

windows10-2004-x64

9

2026-09-23...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 09:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-23_4504f63a8d3c5b3b5dac7e6031e3db26_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
  • Size 3.4MB
  • Sample260924-ltwheaag44
  • SHA256 5a253c29556471eae726d621b84877f232880c722ccbb99a97c245507d658860
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoverypersistenceprivilege_escalationupx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 18 IoCs
  • Creates a file in the Startup directory 1 TTPs 4 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 11 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1060
    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_4504f63a8d3c5b3b5dac7e6031e3db26_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_4504f63a8d3c5b3b5dac7e6031e3db26_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe"
      2⤵
      • Creates a file in the Startup directory
      • Adds Run key to start application
      • Checks processor information in registry
      • Modifies registry class
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2408
      • C:\Users\Admin\AppData\Local\Temp\BDBB00C5\tor.exe
        "C:\Users\Admin\AppData\Local\Temp\BDBB00C5\tor.exe" -f "C:\Users\Admin\AppData\Local\Temp\BDBB00C5\torrc"
        3⤵
        • Executes dropped EXE
        PID:3208
  • C:\Users\Admin\AppData\Roaming\StartMenuExperienceHost.exe
    "C:\Users\Admin\AppData\Roaming\StartMenuExperienceHost.exe"
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:720
  • C:\Users\Admin\AppData\Roaming\StartMenuExperienceHost.exe
    C:\Users\Admin\AppData\Roaming\StartMenuExperienceHost.exe
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:4388

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        cached-microdesc-consensus
        • Path C:\Users\Admin\AppData\Local\Temp\BDBB00C5\data\cached-microdesc-consensus
        • Size 3.2MB
        • SHA256 06bffd3b958e551a1669d6e8eecb486e571b08e10e2f9bf522bd50f8d00d8bc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cached-microdescs.new
        • Path C:\Users\Admin\AppData\Local\Temp\BDBB00C5\data\cached-microdescs.new
        • Size 20.5MB
        • SHA256 41a3024a8faf87189e420bcc4c55052854ff4caa15e89fe5c8d7c969f96f09dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notice.log
        • Path C:\Users\Admin\AppData\Local\Temp\BDBB00C5\notice.log
        • Size 2KB
        • SHA256 6dced719425779eeb432a63148c8f79c6ae90de646aa793e0f4b39be05ad4b31
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        notice.log
        • Path C:\Users\Admin\AppData\Local\Temp\BDBB00C5\notice.log
        • Size 2KB
        • SHA256 719535c0fb62bf54f31fea2c5c367bdcfded8b659025eb969a00b39b16bef173
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        notice.log
        • Path C:\Users\Admin\AppData\Local\Temp\BDBB00C5\notice.log
        • Size 3KB
        • SHA256 8c0f026e82ebadbdf516c66fdbd194b3aa045e74c7e146576ec89068a25163d7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        notice.log
        • Path C:\Users\Admin\AppData\Local\Temp\BDBB00C5\notice.log
        • Size 4KB
        • SHA256 66b2e95b89a9b1568ae556d549cb1ea05a7d0441ad5cfd1cd8f97b1825d73924
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notice.log
        • Path C:\Users\Admin\AppData\Local\Temp\BDBB00C5\notice.log
        • Size 4KB
        • SHA256 1e5a7ddfdd0ec4ccb1bed91ffda985082a8de1a113dc8c2506125591b5bbc2de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notice.log
        • Path C:\Users\Admin\AppData\Local\Temp\BDBB00C5\notice.log
        • Size 4KB
        • SHA256 16f8e686e1e9461cd88aa975f429e03c9ceda519f2dfc4206722848c9b1af0c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notice.log
        • Path C:\Users\Admin\AppData\Local\Temp\BDBB00C5\notice.log
        • Size 4KB
        • SHA256 a943c0383b33b13aa6f32b2793de491900f07688b3f8ce300b4f64574029dbbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notice.log
        • Path C:\Users\Admin\AppData\Local\Temp\BDBB00C5\notice.log
        • Size 4KB
        • SHA256 fb348c89dbe0bdb665e89927b112e5aa21e9f541a09f74adccb6ec345acc8c1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notice.log
        • Path C:\Users\Admin\AppData\Local\Temp\BDBB00C5\notice.log
        • Size 5KB
        • SHA256 b0c6b1902f9916601b42d0cbd9980eeee28ca226f243ad459cfc772de496809a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tor.exe
        • Path C:\Users\Admin\AppData\Local\Temp\BDBB00C5\tor.exe
        • Size 2.8MB
        • SHA256 ff658abdd717c949e39a9ed41c1f157ae622d40c100761a4f3a31cfca24b6ae8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        torrc
        • Path C:\Users\Admin\AppData\Local\Temp\BDBB00C5\torrc
        • Size 260B
        • SHA256 1cf294e5177e6946c4f9abb53136125de65628d69da97f2d71b37439acf33b01
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wctk.dat
        • Path C:\Users\Admin\AppData\Local\Temp\wctk.dat
        • Size 42B
        • SHA256 c121ed4e0b6d235efa95ac3e0bc7f7256c296c8b14c8d30f9bf1af2d0ee9650b
        • MD5 SHA1 SHA512
        Submit Download

        .wctg
        • Path C:\Users\Admin\AppData\Roaming\.wctg
        • Size 8B
        • SHA256 d7ea362be8de025236c781da9e69416b23d79516f16296dd89782f9ba5962e72
        • MD5 SHA1 SHA512
        Submit Download

        StartMenuExperienceHost.lnk
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartMenuExperienceHost.lnk
        • Size 953B
        • SHA256 2b174eca5c06b948611d5dbc1a5abb776a0cfc1fd28b12c0fb925ee0899caa09
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartMenuExperienceHost.exe
        • Path C:\Users\Admin\AppData\Roaming\StartMenuExperienceHost.exe
        • Size 3.4MB
        • SHA256 5a253c29556471eae726d621b84877f232880c722ccbb99a97c245507d658860
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1060-16-0x0000000180000000-0x0000000180006000-memory.dmp
        Download

        memory/1060-18-0x0000000001110000-0x0000000001111000-memory.dmp
        Download

        memory/1060-17-0x0000000001100000-0x0000000001101000-memory.dmp
        Download

        memory/1060-11-0x0000000180000000-0x0000000180006000-memory.dmp
        Download

        memory/2408-10-0x0000018C99430000-0x0000018C99431000-memory.dmp
        Download

        memory/3208-85-0x00007FF60E170000-0x00007FF60EA19000-memory.dmp
        Download

        memory/3208-86-0x00007FF60E170000-0x00007FF60EA19000-memory.dmp
        Download

        memory/3208-35-0x00007FF60E170000-0x00007FF60EA19000-memory.dmp
        Download

        memory/3208-77-0x00007FF60E170000-0x00007FF60EA19000-memory.dmp
        Download

        memory/3208-80-0x00007FF60E170000-0x00007FF60EA19000-memory.dmp
        Download

        memory/3208-81-0x00007FF60E170000-0x00007FF60EA19000-memory.dmp
        Download

        memory/3208-75-0x00007FF60E170000-0x00007FF60EA19000-memory.dmp
        Download

        memory/3208-82-0x00007FF60E170000-0x00007FF60EA19000-memory.dmp
        Download

        memory/3208-74-0x00007FF60E170000-0x00007FF60EA19000-memory.dmp
        Download

        memory/3208-84-0x00007FF60E170000-0x00007FF60EA19000-memory.dmp
        Download

        memory/3208-87-0x00007FF60E170000-0x00007FF60EA19000-memory.dmp
        Download

        memory/3208-88-0x00007FF60E170000-0x00007FF60EA19000-memory.dmp
        Download

        memory/3208-89-0x00007FF60E170000-0x00007FF60EA19000-memory.dmp
        Download

        memory/3208-90-0x00007FF60E170000-0x00007FF60EA19000-memory.dmp
        Download

        memory/3208-91-0x00007FF60E170000-0x00007FF60EA19000-memory.dmp
        Download

        memory/3208-92-0x00007FF60E170000-0x00007FF60EA19000-memory.dmp
        Download