Overview

overview

7

Static

static

3

2026-11-11...lc.exe

windows10-2004-x64

7

2026-11-11...lc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 11:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-11_5e9c855a6ea0cfd4429a93ca4981a3e9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
  • Size 3.9MB
  • Sample261113-nnfacaay3s
  • SHA256 b6b1b2e66d93af01b5c41ad7f266fac9be26dd4dabd7545c57b0c3d93343634c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 20 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-11_5e9c855a6ea0cfd4429a93ca4981a3e9_cryptbot_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-11_5e9c855a6ea0cfd4429a93ca4981a3e9_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:1788

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DisabledGoogleUpdate.exe
        • Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
        • Size 6.4MB
        • SHA256 cab8767cc9e74d44235f90aa7a4a447834b89e2886a6eccc4ce100875e134db2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 87017034495e654d29f5fd1647222f4a6092815b0dab2a4677f8e6de36f3d28e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1021KB
        • SHA256 e3a870b38be5dc689fa918087041677b2bed5dda021ff4b732b84fd42a2015f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 1001KB
        • SHA256 5549a8eb6b944330a60c0f153d7265309ac4491d8991f0404fc1a39a723e2e7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 ef749361ba1d8af0dbbaa2af04a589bba2d535d57698dbc7c899ee8d04955d63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 fe5fbb707291dd5e6680577abe491ecaeda87c76c57b6477dac868ecec6c38ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 9d1aee4e4e5d891aa5ed7a8356c297410c35a6b263f3ec798a716ea8c9ee171d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 0ee570715f0b9b1556935b6cbd76f83d0036385c522608e0c132ba6fdd01d171
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 0fd75dc7c2ee8c343876be10a41cd86d165907edf821753aa1e1b57c36aee6ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 782KB
        • SHA256 ccf9accabc444c3c5b6058ae413e1a670a93a444bfe42a4babd60c1c7d047fef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 1952bc8b21f657e3ed33f9002290cc79c6238ae8fca449c89c336aaf9beac2ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 743c3b7a726bcf27a42f3e025e62ccfacf21bef13e7925038aa57f4c79f0d1c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 836KB
        • SHA256 4de393570cffcaf7288ee111d82394e50e69daf37d9de2bbc8642d8b923a8b0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 800KB
        • SHA256 def1f94573874cdd9407581fc47ca379f2b03bb6c1d6c9cc19cc77ff12243fb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 e5753915787800c674480fa3906ad778c4eec4b874935b7e8b04b5b492fa46d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 1004KB
        • SHA256 65af85f14d637df1477da19a15728c66820774b8424f8d4d366e2b1f8a2ad767
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 c8eb03d8ada6eaaff87dfae9fc63246c069a83a2b3f1f430743fa18d468bd971
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 1df8efa4cb06e87a0a2e93337a0e7b561dcac0a8a9d9e0b8475461665dfe805f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 2def9be89d23af612fc1767948438bf2dc02cbf1a2be63f7cc0b327e0498f91c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 138b6876be5e2c6236fac7ae84bab56506b6c16dcc68bda7645bf4e7ebc83dd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 1b6b647d8969bc050c0927fb9b5c24602a8d4e7cc02aa7cf86758612fe058d66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.2MB
        • SHA256 05a4c2b53ca9ac8e647f49ddf303a736628ccc156f0f445a4cf30ba33b32b142
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 952KB
        • SHA256 3731899d4456e5239e247dbba7f73611bf031de9a999e26814ecad5f3c37fce5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 936KB
        • SHA256 d37f48b260a660a5336d1ad2bc921c37bce1e44992e8e9dc8b2f46a1e4c8a189
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 944KB
        • SHA256 34ad6fc85ff8cea3c723a4db99f18dbffb88f9ae3c894f7b5e7c471e4c35b8d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 808KB
        • SHA256 107495faf2efd46d09f8384727ab8fa0479d176189868524205e303daaecb535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 8d73ed2807edfd981750a29c9d9893f1cb0af886f5483152bbd077d626c280f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 968KB
        • SHA256 c3789881dee5ee860c24551599080f0f947a0376e007c509f5eaf5e6a77b6dc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 ae538e4f40056b7666f8968d826f01a26d6fe5506381f29e6ca9e11fe75ff797
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1788-2-0x0000020DAF8E0000-0x0000020DAF964000-memory.dmp
        Download

        memory/1788-1-0x0000020DAF8E0000-0x0000020DAF964000-memory.dmp
        Download

        memory/1788-3-0x0000020DAF8E0000-0x0000020DAF964000-memory.dmp
        Download

        memory/1788-0-0x0000020DAF5E0000-0x0000020DAF79B000-memory.dmp
        Download