923dabe99470c82445a14145ae54e93ef0f60a17b5f5b4e57b11115abc38d0c3

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 02:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 3.8MB
Sample260522-cq78csft9v
SHA256 923dabe99470c82445a14145ae54e93ef0f60a17b5f5b4e57b11115abc38d0c3
MD5 079675e73ea1bcd961c21de33e8e4ffc
SHA1 04d1c20926ea1b57396a91d1e4e462ac98ed6860
SHA512 16e01d025e213f8a8471602611815abe329c63260e330c0e65be28d997a66c57376b2831515fbb2b3854e0a8bb130541c9890f892873a1c7aef7f7e306a5f70f
SSDEEP 98304:6+0Qqc39sxNkb6TVke27tdmobQ9FZF+6TF/KgeUUDJU4yeKLm:6+0QD394NkOTVke27+5FZF+65/IUUDJd
TLSH
T14F06E00BDFBE20C1C7B0D438A423A4256C3EF67D8A9C815777D9F6D42A5F652288B352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1340	apprtc172.exe
4560	apprtc172.exe
3992	svcc172.exe
1204	svcc172.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppRtc172 = "C:\\Users\\Admin\\AppData\\Local\\AppRtc172\\apprtc172.exe"	2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppSvcc172 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\c172\\svcc172.exe"	apprtc172.exe

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
48	ip-api.com
71	checkip.amazonaws.com
72	checkip.amazonaws.com
74	checkip.amazonaws.com
33	checkip.amazonaws.com
34	checkip.amazonaws.com
47	checkip.amazonaws.com

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	apprtc172.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	apprtc172.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svcc172.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svcc172.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svcc172.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	apprtc172.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svcc172.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	apprtc172.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1500	2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1500	2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1340	apprtc172.exe
1340	apprtc172.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
1500	2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1340	apprtc172.exe
4560	apprtc172.exe
3992	svcc172.exe
1204	svcc172.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1340	1500	2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	102
PID 1340 wrote to memory of 3992	1340	apprtc172.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\AppData\Local\AppRtc172\apprtc172.exe
  "C:\Users\Admin\AppData\Local\AppRtc172\apprtc172.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Users\Admin\AppData\Local\Programs\c172\svcc172.exe
    "C:\Users\Admin\AppData\Local\Programs\c172\svcc172.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3992

C:\Users\Admin\AppData\Local\AppRtc172\apprtc172.exe
C:\Users\Admin\AppData\Local\AppRtc172\apprtc172.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:4560

C:\Users\Admin\AppData\Local\Programs\c172\svcc172.exe
C:\Users\Admin\AppData\Local\Programs\c172\svcc172.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8
Size 1KB
SHA256 602e1e5954aca716eb81f5cee9950e49a8971e29cd0170aec7cee80fefadd966
MD5 6d74ebed44a5a113e33c70eb0346999d
SHA1 5114bb32061f52bf5b4ff81796c187da70f124d8
SHA512 ba771e2a9494d147d6a00dc0cd4316e3a73c42928deb8a7b1670e1ba52a673a9336190f3ec253826a7681bbd0a2322ece5793407b515c3e8616aabf9065ebb6a
TLSH
T1BC21C6E60F683CD0AD922E9D25F8D23B7D30F6DCA6D18C2398354A5268843772B1905F
MD5 SHA1 SHA512 TLSH

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 1KB
SHA256 929e9b11bdf96347b23e884267928d4086ba750b0aea28fee90282282e0d54ba
MD5 f39cdf78e6f5b798ffc24d6a4b13d812
SHA1 527e092857c9d4f9745a302ac20480418844b6f5
SHA512 f73af496fae8af7a1fb8d707fef5938b2aab4016c293070fad82e58a4a5f00a8701924ebfec1cd8b854eda8f5e872791171843d07547423d310e854c17210f15
TLSH
T19E31E7EE0F351522AF85BD45EE8DD23A2C3197E874954C21F529C04298C0FF6AC8881E
MD5 SHA1 SHA512 TLSH

Submit Download

DCFA8A6A40F33E8B34FE71DB3E9E5817

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DCFA8A6A40F33E8B34FE71DB3E9E5817
Size 1.3MB
SHA256 d3d7f82a4603b02546fb894accfaa5d8f5af0d6b72de1d13ffb979df502908f6
MD5 00ef00745fab3c23238bc090a93cc8ff
SHA1 324cd9b7714a8d02775070341a74459bf5ccb527
SHA512 0f3ff76bcda8dc5929d864811f48fd71ccf1ae51ca50ba1853d330b65ace2b58eff5cc1435f0716cf2eb3b294b9794fb0da0d90373be93a56ce7a71cc287d414
SSDEEP 12288:cbgUS/QiVFhq2oN5hlqNs0Y9Ym6QvNH+OhMJQ:8Gnhq2oNRqNZYCbhOiQ
TLSH
T1C255C7AD5858A4A320656D30D9DB9EDBACF1D48123A1D69BC6719F061420FCFCEDB0B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8
Size 438B
SHA256 c651f9ff251b48a7bf6b35d254fa5543ff6c3580c0cd2eb305e2e5799eb54f85
MD5 ba800f096e6c2a23616df69a8040be53
SHA1 74773707450238fe357b64c07805e80b5e6276ce
SHA512 f6c916915790889ad17874a1abef9a0ed01cbfccfa07f84276facb7ed3e968545b453bb9a243fc280ba705746b07cf761c55765214118eda8b7806536334637e
TLSH
T1CEF06838AAFF412EF137E97557DE5B30C82AF0364C2493B413F096197780E40AD22A13
MD5 SHA1 SHA512 TLSH

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 432B
SHA256 2c0b8282b75fd93cc6129475bd8b5d7275ac220c377c299a51b2714429c8fa79
MD5 46a6481d781044a892689d9c3953bb1d
SHA1 1be0f23e44089ed2e048257ff7800781d4c3ea68
SHA512 2e8f575d53503cfb2ecf7445628f3a9e68de74914bfd7ad04ab388177bfb452c1097745d664431778895b33ad3ba923f1f2b7d0e7a8ede768974e8f92f068282
TLSH
T169E0615525FD4309F1E0D7760BCEBD62C47FF1231458629213E46B05B7055800D35536
MD5 SHA1 SHA512 TLSH

Submit Download

DCFA8A6A40F33E8B34FE71DB3E9E5817

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DCFA8A6A40F33E8B34FE71DB3E9E5817
Size 238B
SHA256 b6a257bb900c58ef249265103f1432e35794c016eaf7a741a81a88b147c702f0
MD5 ed7e5065006c1bf41aed24b5114e20d3
SHA1 b730a4633a7eea685de5352cd64fe1d70c22061e
SHA512 e3f57f9c8dbda7e1fce0ebb2b7212079fa66b3b17f24c8f7fce269771ce22b8d46cee535071c74a9c803088b783c4db6485210637f4b4a78f47209aa6e9caae9
TLSH
T1E7D0C9124B6C4A02F27B56BAABE946029A69949588529B0811B8EF899E34E466822C1D
MD5 SHA1 SHA512 TLSH

Submit Download

apprtc172.exe

Path C:\Users\Admin\AppData\Local\AppRtc172\apprtc172.exe
Size 3.8MB
SHA256 130ee701049edd41793efe02281b20c9fbd5415c4e94ce082b5dba34a52842bc
MD5 9af55438382f54af935549b44f90daad
SHA1 e49b855e3f19377d05e203ec75ac3b40acd588bd
SHA512 92feb4bff93bc2fc12a7dc55c1ef6ebfba2158795899a23a94774d0ba73b29c2d5b09b672fca867a1a271d4295dc77655a8f71ecf696cb04f870da2e4b3c2154
SSDEEP 98304:T+0Qqc39sxNkb6TVke27tdmobQ9FZF+6TF/KgeUUDJU4yeKLw:T+0QD394NkOTVke27+5FZF+65/IUUDJL
TLSH
T1AC06E00BDFBE20C1C7B0D438A423A4256C3EF67D8A9C815777D9F6D42A5F652288B352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svcc172.exe

Path C:\Users\Admin\AppData\Local\Programs\c172\svcc172.exe
Size 3.8MB
SHA256 6cdadf5841c65105b4a6420804ad8a2a95b05fdcf73db732f8625680ec95c1ec
MD5 38675f741e2809251bb7821a6285a8a0
SHA1 d5252a68e4cb516de79728a17062abdeef3680db
SHA512 a6835f969cc9dfe83dcf9cfcec6c7c48ec01721c52fcf3727510fe2e9894bd2d79ebd7dbe20c0dc92334f8665d9babbff3afcd507f38010f12528c3ede8bd7e5
SSDEEP 98304:F+0Qqc39sxNkb6TVke27tdmobQ9FZF+6TF/KgeUUDJU4yeKL9:F+0QD394NkOTVke27+5FZF+65/IUUDJi
TLSH
T15906E00BDFBE20C1C7B0D438A423A4256C3EF67D8A9C815777D9F6D42A5F652288B352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_2026-05_1204.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_1204.txt
Size 463B
SHA256 763185c752cb10b69fce5bfa67a7c650f5c06a49c0d249df11803262a7346957
MD5 e77ffde59c93759a7a8f90da1b0d612b
SHA1 5888bf34ffbb2fbfa7ac25338b57caf9e63e351c
SHA512 a3539d8fda8967ba7ce47591425da2aa165defb18921d8adfa6767dd73a6bf37fabf2772884988eb447abfe427d331326dfc84e52588b9a262858b02b22e8c54
TLSH
T164F0E22A79F5781E26A0EA49E3E46E821D523203D9763938B038415C24538623F8E3C8
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_1204.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_1204.txt
Size 1KB
SHA256 d378b40777b082f02ef968f5520b79b367f5e9b03c49d2afd914d2f81804df8c
MD5 389e86fa3e23e6713a9780d411acf906
SHA1 7d5d6eb2f02dc8fcac4252b1d64e574b62da04c9
SHA512 742872a50dab543cbc3143197131c81596d62bec7ab54d1d92c9b14f835a59a70075d23146dca9ecfdf256e72d9798672205e1e3dc15d90cf5f5e9dbde85fd60
TLSH
T11721066A65F9784E1270F52993686E811E063007C1797D38B23441586497DA27FCF7D8
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_1340.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_1340.txt
Size 1KB
SHA256 8d21cbfe0edd46f06da08a99d71b8f52bacd20e24b35d6b3765391b06e762a59
MD5 74d0b4845ca1b1823c1e7a559e6c5440
SHA1 3c1c4354d25166429f9c37b18500f1035598d586
SHA512 77b5d71ae340e1fa8ffa406ebe046eb1388a2da4295f816e71d871e3cec2c10c9c658190cba3ca3303a8e532ae9d36362963f8389a78ad093983d6be5cf704b3
TLSH
T10321F67A7BF9384A30A1F535D3707F972424334E4975A9A27200819C45969BA77CC7D8
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_1500.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_1500.txt
Size 657B
SHA256 78503072e0b4506a19e4115670a3acc809533779e38243822d279f1534186c8f
MD5 82dc5239c0d59645362755467f12be32
SHA1 6217e94b541c86bf35b2f2f4d25112e3e0ebf605
SHA512 5cfdf9644bafab5f13c0f409dae01703a466933fb18746b807be8db8187c79516f0f5a15a7c39983f486152a283fc3055037a1784ec28be29319997a7f9e6467
TLSH
T18D01F9A971FA380E2BA6F78AE1D47EA11840320BD6B23D27B290506C7164D2277E8394
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_3992.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_3992.txt
Size 846B
SHA256 a71f0f22087c070263992ce271d8536d4ebd4858ac065e58db87928430363c27
MD5 c1c786fc522291bbcd10c95a748e4993
SHA1 45911031e7841f1405db8479e41b2e2906951e77
SHA512 59ec455a23bac3f221d256eff0cfa1f9f3e7eb440c8a36a08aeef8f849a9fe894aaae9f9549a5a255696db5d62fb86e5a161af131588f6817e14ffb7582d5756
TLSH
T12801046A71F93C0E11B0D54AE2A87E912A41320F86BE1505B11592FC786B5EA7FCF3D8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1500-0-0x0000000180000000-0x0000000180480000-memory.dmp

Download