cda9fb8415f90790b6dba1049513bdc69ca5836067ca41b57ef1ffa8756e3c65

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_137639a67ed5f313d8d1023bd7c2b3ff_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 3.8MB
Sample260522-ct4pcacv8r
SHA256 cda9fb8415f90790b6dba1049513bdc69ca5836067ca41b57ef1ffa8756e3c65
MD5 137639a67ed5f313d8d1023bd7c2b3ff
SHA1 fbc30dc498ee4f84d5b7280277c55b381537ab3e
SHA512 b659a01655d729893bef527f033147c4ed0f781e3a266d06d320f20faca1959c2ae274546b5df7d134bd4cc5a32c7434768aa6469c86126b54255c1bd93c3e07
SSDEEP 98304:XRjrV0DsCoLzUL7z39+LOg7qdk6WspAIJQQ4Yu:XRj2DsCovUJAVeCuzJQCu
TLSH
T16206D0919AA6D297DAF3303EC2265354AAC8299C6E12E5C43EC38605DF5F0F44E773B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4996	apprt4d2f.exe
1968	apprt4d2f.exe
3612	svc4d2f.exe
4424	svc4d2f.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppRt4d2f = "C:\\Users\\Admin\\AppData\\Local\\AppRt4d2f\\apprt4d2f.exe"	2026-05-22_137639a67ed5f313d8d1023bd7c2b3ff_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppSvc4d2f = "C:\\Users\\Admin\\AppData\\Local\\Programs\\4d2f\\svc4d2f.exe"	apprt4d2f.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6044	2026-05-22_137639a67ed5f313d8d1023bd7c2b3ff_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
6044	2026-05-22_137639a67ed5f313d8d1023bd7c2b3ff_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4996	apprt4d2f.exe
4996	apprt4d2f.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6044 wrote to memory of 4996	6044	2026-05-22_137639a67ed5f313d8d1023bd7c2b3ff_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	109
PID 4996 wrote to memory of 3612	4996	apprt4d2f.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-05-22_137639a67ed5f313d8d1023bd7c2b3ff_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_137639a67ed5f313d8d1023bd7c2b3ff_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Users\Admin\AppData\Local\AppRt4d2f\apprt4d2f.exe
  "C:\Users\Admin\AppData\Local\AppRt4d2f\apprt4d2f.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Users\Admin\AppData\Local\Programs\4d2f\svc4d2f.exe
    "C:\Users\Admin\AppData\Local\Programs\4d2f\svc4d2f.exe"
    3⤵
    - Executes dropped EXE
    PID:3612

C:\Users\Admin\AppData\Local\AppRt4d2f\apprt4d2f.exe
C:\Users\Admin\AppData\Local\AppRt4d2f\apprt4d2f.exe
1⤵
- Executes dropped EXE
PID:1968

C:\Users\Admin\AppData\Local\Programs\4d2f\svc4d2f.exe
C:\Users\Admin\AppData\Local\Programs\4d2f\svc4d2f.exe
1⤵
- Executes dropped EXE
PID:4424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt4d2f.exe

Path C:\Users\Admin\AppData\Local\AppRt4d2f\apprt4d2f.exe
Size 3.8MB
SHA256 62f65b9ac59daf4cfa3228434609c7ab539932d22228a3a6c456dd1ce9603fe9
MD5 81cebea5494d3ac2ff34e4ded1b88f6a
SHA1 e72cf749be356b1c109e39137b9d4bd847095491
SHA512 6baea939d0644ca7210530da79238d4daaea4ce9688b6094e937565d03e0250d72f29fc4b2694401f85a115a7d71aa8e5adb6edd06ae2456f1c57ea08fcc1b80
SSDEEP 98304:cRCrV0DsCoLzUL7z39+LOg7qdk6WspAIJQQ4YJ:cRC2DsCovUJAVeCuzJQCJ
TLSH
T14806D0919AA6D297DAF3303EC2265354AAC8299C6E12E5C43EC38605DF5F0F44E773B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc4d2f.exe

Path C:\Users\Admin\AppData\Local\Programs\4d2f\svc4d2f.exe
Size 3.8MB
SHA256 e4f14f40e44d4fd72accdac561681f784e99220ee7255358389298e3757db121
MD5 b8d8249f2d3172a4f31cc82c33bb732e
SHA1 96774af67bb78981fdaed0dcf6e31d1ba9981c22
SHA512 1f9fd92d2d96d5962af28c6c78926983bf450a2fdf52685e6ca4f85dc49ca36cc6386a915896701c23f8cf43222d218792b75be9e27d785917f9b9e1ac233a26
SSDEEP 98304:VRprV0DsCoLzUL7z39+LOg7qdk6WspAIJQQ4YQ:VRp2DsCovUJAVeCuzJQCQ
TLSH
T13206D0919AA6D297DAF3303EC2265354AAC8299C6E12E5C43EC38605DF5F0F44E773B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download