923dabe99470c82445a14145ae54e93ef0f60a17b5f5b4e57b11115abc38d0c3

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 02:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 3.8MB
Sample260522-cq78csft9v
SHA256 923dabe99470c82445a14145ae54e93ef0f60a17b5f5b4e57b11115abc38d0c3
MD5 079675e73ea1bcd961c21de33e8e4ffc
SHA1 04d1c20926ea1b57396a91d1e4e462ac98ed6860
SHA512 16e01d025e213f8a8471602611815abe329c63260e330c0e65be28d997a66c57376b2831515fbb2b3854e0a8bb130541c9890f892873a1c7aef7f7e306a5f70f
SSDEEP 98304:6+0Qqc39sxNkb6TVke27tdmobQ9FZF+6TF/KgeUUDJU4yeKLm:6+0QD394NkOTVke27+5FZF+65/IUUDJd
TLSH
T14F06E00BDFBE20C1C7B0D438A423A4256C3EF67D8A9C815777D9F6D42A5F652288B352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5508	apprt4c74.exe
1752	apprt4c74.exe
2144	svc4c74.exe
5892	svc4c74.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt4c74 = "C:\\Users\\Admin\\AppData\\Local\\AppRt4c74\\apprt4c74.exe"	2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvc4c74 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\4c74\\svc4c74.exe"	apprt4c74.exe

Looks up external IP address via web service 10 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org
3	ipinfo.io
3	icanhazip.com
4	checkip.amazonaws.com
15	icanhazip.com
24	checkip.amazonaws.com
3	checkip.amazonaws.com
3	ip-api.com
11	ipinfo.io
23	checkip.amazonaws.com

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	apprt4c74.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	apprt4c74.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svc4c74.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svc4c74.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	apprt4c74.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	apprt4c74.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svc4c74.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svc4c74.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2616	2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2616	2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5508	apprt4c74.exe
5508	apprt4c74.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
2616	2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5508	apprt4c74.exe
1752	apprt4c74.exe
2144	svc4c74.exe
5892	svc4c74.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 5508	2616	2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	80
PID 5508 wrote to memory of 2144	5508	apprt4c74.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_079675e73ea1bcd961c21de33e8e4ffc_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
  "C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:5508
- - C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe
    "C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2144

C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:1752

C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe
C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:5892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

620BEF1064BD8E252C599957B3C91896

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\620BEF1064BD8E252C599957B3C91896
Size 964B
SHA256 fcf886bbc4e4b6958aae3ec7225e9a81132b198a79dddf1012f4959dc738eb22
MD5 78410ccd38e6d08d1aa3986c027897be
SHA1 abad1a49de0a578c4d7d7d9ac218daf92eb1e527
SHA512 94924eef9db5b30c4ba9615ec25cc62d170f9f0c59f346a27169ee45c16c7f1556bbe9fc5aaa3527116771aedcd2c736a9150e871e2628a4569b86c9d4ee0f0a
TLSH
T16811AB2E0A14213317A13BF28BC8CD97DCB14A844BD6866B41140B58181DFD24FC94EE
MD5 SHA1 SHA512 TLSH

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 1KB
SHA256 929e9b11bdf96347b23e884267928d4086ba750b0aea28fee90282282e0d54ba
MD5 f39cdf78e6f5b798ffc24d6a4b13d812
SHA1 527e092857c9d4f9745a302ac20480418844b6f5
SHA512 f73af496fae8af7a1fb8d707fef5938b2aab4016c293070fad82e58a4a5f00a8701924ebfec1cd8b854eda8f5e872791171843d07547423d310e854c17210f15
TLSH
T19E31E7EE0F351522AF85BD45EE8DD23A2C3197E874954C21F529C04298C0FF6AC8881E
MD5 SHA1 SHA512 TLSH

Submit Download

D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698
Size 471B
SHA256 b4c16e559d0086181f440703a6ae04b776a8e860209abcce70da596cb8c49403
MD5 e051d9040999c249f7555e3b402a60d4
SHA1 1180674185d75e277b7ed22c05bca3efbccc55a2
SHA512 c9836c0b63c4b1bc28fd7d310ccb5e4eb0cc2e42feeb07a59d97d56783bdc21fb68fc498d8ac8344fa42e379544f4d053ea45c1ca27dd0ffd70dea9af975dd8c
TLSH
T129F0DC97273ABD1117410DD622ECC776B96BD7021CD2AA81A0103A6B3A123A9DC23C12
MD5 SHA1 SHA512 TLSH

Submit Download

620BEF1064BD8E252C599957B3C91896

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\620BEF1064BD8E252C599957B3C91896
Size 280B
SHA256 0c1ac726728f1578c839cb22cc067f558ae6687794bd658eb48fe6c0897fae4e
MD5 411d1a3bdc09ad6a78209417719f7f4f
SHA1 817a10b7579d96fc2055a48bd9d78288a0fa501d
SHA512 4a879c81ccfb0dacb1d1add87e7a718b195f4f8fbf57b63b87bdd82d9a65ab4d7508889d76e489fe49acd2a5a3b4c3994ad6a230be55cc5ea1ac326813d458d9
TLSH
T170D0A7241F790652F13F87BEEE8155127F3275016441C31906755B8C192BE130DF1F1A
MD5 SHA1 SHA512 TLSH

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 432B
SHA256 28c042d8b8c857a1105d771e83b14c7c2a9712030e971ffbdd41da43bf2ce74b
MD5 fc3fa4a6a836525fb6364f2b03fa45b7
SHA1 cf1b62dbaad1b14d28d627d587405bca8de2f33b
SHA512 03184dbfaf606c3d424d58b7bb8b9b4ed13e5b59633863a74d2c7a13ff434906ff4547753f46eb3b473e0073b6d04c6a1cdac1ceac781877c005dc350029c303
TLSH
T128E0685525FE4309F6E1DBBA0BCEBD52C07FF1231058A2A312A46B09BB158810D36A36
MD5 SHA1 SHA512 TLSH

Submit Download

D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698
Size 418B
SHA256 31330e5dd43e7346eac026a42922166d8fd13dcff8ecc63d4c9ca9dc54e69782
MD5 371a62493b963f54a9d82d18fc625c74
SHA1 ee6f81ca274728112c40ba1c855912c457fae6b0
SHA512 83310ba0aa50dd36aa7a96ad271e08c16f11069faf13f03a9313b23bffaaf402829e86210132942b00a61c65d350fb9faf613187db56a0aa8d2e15ce24cbd53b
TLSH
T1D4E0C00922FE430EF179CBB80ADDF522DC0BF5139850E3B60172134CD521900AC56474
MD5 SHA1 SHA512 TLSH

Submit Download

apprt4c74.exe

Path C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
Size 3.8MB
SHA256 82e055e99225f0988a38e2c3c74a5edb44c67e75c1e9f8352fcdc18e4c089ec8
MD5 ea85f0d5b8db1b88f2f8445215749220
SHA1 e475d9357616be01bede583ffc0758ceddcfda1f
SHA512 3de4067fc403583ae649b27af201682bc24db1aee7ce7a8b14a850fd7e46c289b0fb8358c44da660153925f77338d4334df81d9de490ea70c8b76d4c968f461a
SSDEEP 98304:e+0Qqc39sxNkb6TVke27tdmobQ9FZF+6TF/KgeUUDJU4yeKLJ:e+0QD394NkOTVke27+5FZF+65/IUUDJ6
TLSH
T1D106E00BDFBE20C1C7B0D438A423A4256C3EF67D8A9C815777D9F6D42A5F652288B352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc4c74.exe

Path C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe
Size 3.8MB
SHA256 15b3151cb6026cb224da2a92457b8a800098200367750431b2db446581517b97
MD5 3d001c4cedcdb1a31d157e056dbebd3d
SHA1 d6dc86e05c0709866a44403325289bbce336ee98
SHA512 d388d7c3487562f4d4a63e739735deaf82a8f079e766cb856653f21c449df832c8af0ff3dea2fcc853bc7ebd909c4cad1131769ad2f0fcab4c8da8c6da148742
SSDEEP 98304:f+0Qqc39sxNkb6TVke27tdmobQ9FZF+6TF/KgeUUDJU4yeKLe:f+0QD394NkOTVke27+5FZF+65/IUUDJF
TLSH
T14406E00BDFBE20C1C7B0D438A423A4256C3EF67D8A9C815777D9F6D42A5F652288B352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_2026-05_1752.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_1752.txt
Size 1KB
SHA256 83573faa4b9aa708dfd60d104df090b7ba6394bad3eb6cf23462392393b5d216
MD5 10bee97dc768e360652650c582656437
SHA1 6655182022e3f4707564e578c3ed9930f2c840ce
SHA512 571d3241a8a8fa39f82a0e074355b5a43eaf220ea8b700d1f1f796141cec9434acf3ec11815e0db657acf7fe163cec64a77c99f38c45299d4978573a404be5fe
TLSH
T12821D6ED61FA38CF2260F927D3687BC11556321A86B97D05B300C0586896B3677D8FE9
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_2616.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_2616.txt
Size 846B
SHA256 314ed770bbece28ac5cc78d13dfc9547574ea7da1f785c0b1ea91f74d1905161
MD5 c2c52f0eb9b9270462a97ef83c4e9008
SHA1 6e3fadd2da40518ab1dded33db2d5c0133fd2f30
SHA512 e6e89e8fe55f7eb7fbdeace9ba4d63a19a9f62e93cec83c851d2f9db032558a54c56b19925080c5458e932021b09c0ce26c91795a5b65e0e902dfff72e94490c
TLSH
T1A301C8AE75FB389F1E7AF54EE2E07E9138603147D6712D0671D0506C749452377CC299
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_5892.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_5892.txt
Size 657B
SHA256 88a8cfc37ceb35a34090487d183a99c9c5eb499ef53a6d1947752dec1e81abfb
MD5 4c4b05ef58333bd6edfe57fa91bab116
SHA1 ac443b103567297232b6dd05fd2375e1cc089c49
SHA512 5620b79c0b540554e93b707d72c68a8c348f9b9bd45914b5a2511719bf27b8392f922ee182268179640ef2f6ff2b3e5ee37d12091824b856be0181e838409c99
TLSH
T15901D66A71F93C0E36E0D7CAF1F57A82184073079EB11A0DB454F0ED58655A277D83D4
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_5892.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_5892.txt
Size 1KB
SHA256 0262241e5a9d634d5a1920a8070012438d33fd62aba9d05b16ce4d7c0bc92ab7
MD5 d0408c8b2ca052c1855df2682df5eec1
SHA1 ff2d85410e20e6be4c10484516a42cf93e350006
SHA512 d4be9ebd69b0c26c5d8e4edaf5d373b01c2b989b7fa2ba1b4047ecf2c04aee7f8b5ba90dbc800d735da8f3414b6bdc8be5b240ba412852bdaba56b42ff1da733
TLSH
T119210A2E71FA3C4A3070E7C5E2E97AC31414B20B49794A0CB680F0DE48959B677CDBD8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2616-0-0x0000000180000000-0x0000000180480000-memory.dmp

Download