Overview

overview

7

Static

static

5

2026-10-22...lc.exe

windows10-2004-x64

7

2026-10-22...lc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 16:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_39c947ba2ae52a8a258512233e69601d_akira_glassworm_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
  • Size 7.8MB
  • Sample261024-ttkpxazz3j
  • SHA256 0bd9cd4c43b605502481791207b1d60df4f701d0bae6db3bf89dadc7becde7b9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Uses WMI to collect hardware manufacturer information 2 TTPs 1 IoCs

    Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

    defense_evasion
  • Drops file in System32 directory 20 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Queries system WMI classes for hardware identifiers 2 TTPs 2 IoCs

    Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

    discovery
  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_39c947ba2ae52a8a258512233e69601d_akira_glassworm_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_39c947ba2ae52a8a258512233e69601d_akira_glassworm_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3084
    • C:\Windows\system32\cmd.exe
      "cmd" /C "wmic csproduct get UUID /value"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5788
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic csproduct get UUID /value
        3⤵
        • Queries system WMI classes for hardware identifiers
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5012
    • C:\Windows\system32\cmd.exe
      "cmd" /C "wmic diskdrive get SerialNumber /value"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4468
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic diskdrive get SerialNumber /value
        3⤵
        • Queries system WMI classes for hardware identifiers
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4384
    • C:\Windows\system32\cmd.exe
      "cmd" /C "wmic csproduct get Name /value"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3232
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic csproduct get Name /value
        3⤵
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        PID:4796
    • C:\Windows\system32\cmd.exe
      "cmd" /C "wmic baseboard get manufacturer"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:252
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic baseboard get manufacturer
        3⤵
        • Uses WMI to collect hardware manufacturer information
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        PID:5284
    • C:\Windows\system32\cmd.exe
      "cmd" /C "wmic os get Version /value"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5668
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic os get Version /value
        3⤵
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        PID:5052
    • C:\Windows\system32\cmd.exe
      "cmd" /C "wmic Path Win32_PhysicalMemory Get Capacity /value"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2644
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic Path Win32_PhysicalMemory Get Capacity /value
        3⤵
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        PID:5720

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DisabledGoogleUpdate.exe
        • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
        • Size 6.4MB
        • SHA256 06e57ee333bd96ef6885d1cc3c9f3d0ee4d2dfc3d855535f83cf977a405e0987
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 eccc53264826fcffd54bf316182a6edc7dbc6fc93376ce49ed923461a0a6e808
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 c5f65f0b697e651c70325d7df5c6a23d247a04afba9c015ee2c634a720d7588a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 91cff7a4b2db52dea60aee14e568bc33afabc11631a241e34d38d99a64a8d66d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 c0909fb3d2d7e53c3dbf18f21e1ece28cb934be7ffa77a67ece00715d9b47f43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 e9ebf404a6d2b9426e5ea46bb4209383db4086752d1faf59082e24cf3f4f84d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 b34c8fd507e20b96c929d35c5c47685f117355710e3e7cbf30f3e97c37151aa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 8353bc4b80cbdc82bc1db938ec60b1bb72f5309cc234f0ed42866af26e1c56e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 02a93a005ffb1cdcf106674baceeb12e78eac1a61046844ddf82e77a20af42c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        custom.db2.temp.1792858867
        • Path C:\Users\Admin\AppData\Local\Doubao\User Data\Installer\custom.db2.temp.1792858867
        • Size 16B
        • SHA256 374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
        • MD5 SHA1 SHA512
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 9a885803d7e72265133b129269996e67a345a1e66a19a36ad536ab2fa2dd4b98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 cce6544cadf7b07010a22e3919824d75285472453f48b68037300acecaa970db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 e2ccb2aede8630d7344ce4beab2040fa2b26fd7dfaf52c23e349981bae8ba364
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 828KB
        • SHA256 4a37b8316bd3ebb84fc3e9e0c3a14af4601ae68ba1e592bf57c2032c74c82925
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 792KB
        • SHA256 1e50d25b2f5c2e387d84e164418464430dec33861a24415dc33ae6ee44bfed4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 9836aae0624332eab75f19dee491c5ce734eb4e6c76dcbd1ff57ce46806fb175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 996KB
        • SHA256 02ac8cd25d6cb538bbc6a6156057d53e7b7880296ea033bc7264e05b2f047bcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 2038ef81e85862aa20fa556526a26ef3c88380a6a7b2119e9d1bd8b2e07daefc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 7db4ef7da6f5fb665b4488a2a2cf6b57a477440fbef16f034d5c15c2026e9e2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 50e4eec638c87251b478ffa3476400aa65824b88a0ec013656fba1d5e97600a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 4fd0cb0a30c948a4b7c59e5ac5c4f6af7b6597009c14b66075e348795ddc30b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 c862f9bcc9cf3770ea223c1bee965d01449bc0f91e4cc852af53d5900a07c5be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 1d525499fd0f2e6d8912f46655407691a6f0d36d627b28fb39f15a84b74a3008
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 944KB
        • SHA256 1fc720452f07b483b355f74d2bf787684ce3a3c0148b39d02f677ac37c342b16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 928KB
        • SHA256 83510206bcc170c526881c3f2b46650b425460049d87e8e8f87690d0df023dab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 936KB
        • SHA256 7edd20486dfa53058ce9f8d3ad16b0705a2c787fc9cd52c8098d7ab344a8c828
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 800KB
        • SHA256 67d460dc22ac26e49440a8c79ccd73cd0b09931c974155f091458cbbd66b7e09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 cfe4a6bfcd3c044ee7e4165090898621859c1cf24ce4d00b782731397d67766b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 960KB
        • SHA256 5ac7464f9980f5f6383091b85e461146ca8800ae94f54fe71a094385460916b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 f4e05860bfcd57f517e0bf37eb55dc0b0141c2d51fd5bb5bf15a614a36d4e88c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3084-0-0x000002372CC20000-0x000002372CCA3000-memory.dmp
        Download

        memory/3084-21-0x00007FF6B1B50000-0x00007FF6B312B000-memory.dmp
        Download

        memory/3084-3-0x00007FF6B1B50000-0x00007FF6B312B000-memory.dmp
        Download

        memory/3084-1-0x000002372CC20000-0x000002372CCA3000-memory.dmp
        Download