Analysis
- max time kernel
149s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
10/11/2026, 15:32
General
- Target 2026-11-09_786afa78e1510b03db914f109e0d386d_icedid_luca-stealer_njrat_stealc.exe
- Size 6.2MB
- Sample261110-syrtcaaz5l
- SHA256 59467db538729ff918be24d3fccd80fa14b92fc0a2590aa7047b78050d5b642c
Malware Config
Signatures
- Custom signatureDetects command variations typically used by ransomware 1 IoCs
- Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Disables cmd.exe use via registry modification 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
- Drops file in System32 directory 2 IoCs
- Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_786afa78e1510b03db914f109e0d386d_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_786afa78e1510b03db914f109e0d386d_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "$C = @{'namespace'='root\standardcimv2\embedded'}; $P = Get-WmiObject -class WEKF_PredefinedKey @C | where {$_.Id -eq 'Ctrl+Alt+Delete'}; if ($P) { $P.Enabled = 1; $P.Put() | Out-Null }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} safeboot minimal >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} safeboot minimal3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} safeboot >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /deletevalue {default} safeboot3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {bootmgr} displaybootmenu No >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {bootmgr} displaybootmenu No3⤵
- Modifies boot configuration data using bcdedit
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_tgih3tv4.qgk.ps1
SystemVolumeHelper.exe
memory/256-15-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp
memory/256-18-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp
memory/256-4-0x00000296D9130000-0x00000296D9152000-memory.dmp
memory/256-11-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp
memory/256-13-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp
memory/256-14-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp
memory/256-2-0x00007FFE401FF000-0x00007FFE40200000-memory.dmp
memory/256-16-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp
memory/256-17-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp
memory/256-5-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp
memory/256-20-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp
memory/256-19-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp
memory/256-21-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp
memory/256-22-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp
memory/256-23-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp
memory/256-25-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp
memory/256-3-0x00007FFE40070000-0x00007FFE40A14000-memory.dmp