Overview

overview

10

Static

static

3

2026-10-10...lc.exe

windows10-2004-x64

10

2026-10-10...lc.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/10/2026, 07:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-10_99345b33585820b71bf890f63cf47bc8_cobalt-strike_icedid_satacom_stealc.exe
  • Size 1.4MB
  • Sample261011-jk35saec76
  • SHA256 20e26fd04664ddb25d86f03b35f284c232aeb77c95168dfddbab2c34468c33b4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Modifies Windows Firewall 2 TTPs 3 IoCs
    defense_evasion
  • Executes dropped EXE 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Program Files directory 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-10_99345b33585820b71bf890f63cf47bc8_cobalt-strike_icedid_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-10_99345b33585820b71bf890f63cf47bc8_cobalt-strike_icedid_satacom_stealc.exe"
    1⤵
    • UAC bypass
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:960
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Suporte Infologika - server" dir=in action=allow program="C:\Program Files\SuporteInfologika\winvnc.exe" enable=yes profile=any
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:6076
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Suporte Infologika - viewer" dir=in action=allow program="C:\Program Files\SuporteInfologika\vncviewer.exe" enable=yes profile=any
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:2984
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Suporte Infologika - plink" dir=in action=allow program="C:\Program Files\SuporteInfologika\plink.exe" enable=yes profile=any
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      PID:5140
    • C:\Program Files\SuporteInfologika\abreSuporte.exe
      "C:\Program Files\SuporteInfologika\abreSuporte.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3492
      • C:\Program Files\SuporteInfologika\atualizaSuporte.exe
        "C:\Program Files\SuporteInfologika\atualizaSuporte.exe"
        3⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        PID:5436

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Privilege Escalation

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Defense Evasion

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Impair Defenses

        2
        T1562

        Disable or Modify System Firewall

        1
        T1562.004

        Disable or Modify Tools

        1
        T1562.001

        Modify Registry

        2
        T1112

        Credential Access

        Discovery

        Network Share Discovery

        1
        T1135

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        System Network Configuration Discovery

        1
        T1016

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        SupportVersion
        • Path C:\Program Files\SuporteInfologika\SupportVersion
        • Size 30B
        • SHA256 9426b598f28a5d0a829cd2d0910eb814055a2fb00c49baad7a8a0e469d781b35
        • MD5 SHA1 SHA512
        Submit Download

        MSLogonACL.exe
        • Path C:\Users\Admin\AppData\Local\Temp\InstallSuporteInfologika\64\MSLogonACL.exe
        • Size 121KB
        • SHA256 5e36e7bcd0f45ae726796e857612771920dc856495f0b7edd262e6f523f1e398
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SCHook64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\InstallSuporteInfologika\64\SCHook64.dll
        • Size 97KB
        • SHA256 37ec2996461cc0935bd2cee0173535b3f918dc0d33195f1943ed76a41952dd86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UVncVirtualDisplay.dll
        • Path C:\Users\Admin\AppData\Local\Temp\InstallSuporteInfologika\64\UVncVirtualDisplay64\UVncVirtualDisplay.dll
        • Size 58KB
        • SHA256 32eae05c28f78a4d7c6c6d64ef75c820febf6556ac97e361fbce33eddfce0c52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UVncVirtualDisplay.inf
        • Path C:\Users\Admin\AppData\Local\Temp\InstallSuporteInfologika\64\UVncVirtualDisplay64\UVncVirtualDisplay.inf
        • Size 3KB
        • SHA256 6fc15a8582c91cc038734d12667201e3a11476adcb7a503e0a7f49cbc86664da
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        uvncvirtualdisplay.cat
        • Path C:\Users\Admin\AppData\Local\Temp\InstallSuporteInfologika\64\UVncVirtualDisplay64\uvncvirtualdisplay.cat
        • Size 8KB
        • SHA256 1ee82e7912c37a482fba1426a845ddd32a518871e586929125aff7e180abcedb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setcad.exe
        • Path C:\Users\Admin\AppData\Local\Temp\InstallSuporteInfologika\64\setcad.exe
        • Size 43KB
        • SHA256 4e3bf0e5a348f62c3061a6a573e08b6da896c4fee62c3ec422d4fb636cc35174
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setpasswd.exe
        • Path C:\Users\Admin\AppData\Local\Temp\InstallSuporteInfologika\64\setpasswd.exe
        • Size 49KB
        • SHA256 3938ebeffad1c7d798eac6c6da9bf66233c6b94a1b3d4ac7c72c07bb3bd2b2bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uvnc_settings.exe
        • Path C:\Users\Admin\AppData\Local\Temp\InstallSuporteInfologika\64\uvnc_settings.exe
        • Size 507KB
        • SHA256 7f4e9dd6dfc706a37a915f87e79f184811278d15e2d1eb0c45276cf54781db22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uvnckeyboardhelper.exe
        • Path C:\Users\Admin\AppData\Local\Temp\InstallSuporteInfologika\64\uvnckeyboardhelper.exe
        • Size 95KB
        • SHA256 11b9ba8f2f8dcc4faf8c66b8afad335840fe4c0119af09c1effa0296a13c155c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        abreSuporte.exe
        • Path C:\Users\Admin\AppData\Local\Temp\InstallSuporteInfologika\abreSuporte.exe
        • Size 388KB
        • SHA256 3788f43dfe6809e8a632cb36dd6c3ffe47361b0ddffc6a979695ecace8b43131
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        atualizaSuporte.exe
        • Path C:\Users\Admin\AppData\Local\Temp\InstallSuporteInfologika\atualizaSuporte.exe
        • Size 382KB
        • SHA256 2f73507ddb66b9bb89fbd2b318048fd397d28ceee91d91defca67960654bc97e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Licence.txt
        • Path C:\Users\Admin\AppData\Local\Temp\InstallSuporteInfologika\both\Licence.txt
        • Size 17KB
        • SHA256 6c4beace9ad98f6530a2e9b491e928e010b5996e2acdb439e8dce6cb3f25204b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Readme-Licence.txt
        • Path C:\Users\Admin\AppData\Local\Temp\InstallSuporteInfologika\both\Readme-Licence.txt
        • Size 7KB
        • SHA256 0924c1f3bd41f83fc3472d530ca3b70359b0378a2136b14b252d57706c0eb9a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ultravnc.ini
        • Path C:\Users\Admin\AppData\Local\Temp\InstallSuporteInfologika\both\ultravnc.ini
        • Size 1KB
        • SHA256 7f4063676891f4758b9f11b350f26c6e20c3f77dde747dd6d4d6f288592c172f
        • MD5 SHA1 SHA512 TLSH
        Submit Download