cda9fb8415f90790b6dba1049513bdc69ca5836067ca41b57ef1ffa8756e3c65

Analysis

max time kernel
149s
max time network
139s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_137639a67ed5f313d8d1023bd7c2b3ff_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 3.8MB
Sample260522-ct4pcacv8r
SHA256 cda9fb8415f90790b6dba1049513bdc69ca5836067ca41b57ef1ffa8756e3c65
MD5 137639a67ed5f313d8d1023bd7c2b3ff
SHA1 fbc30dc498ee4f84d5b7280277c55b381537ab3e
SHA512 b659a01655d729893bef527f033147c4ed0f781e3a266d06d320f20faca1959c2ae274546b5df7d134bd4cc5a32c7434768aa6469c86126b54255c1bd93c3e07
SSDEEP 98304:XRjrV0DsCoLzUL7z39+LOg7qdk6WspAIJQQ4Yu:XRj2DsCovUJAVeCuzJQCu
TLSH
T16206D0919AA6D297DAF3303EC2265354AAC8299C6E12E5C43EC38605DF5F0F44E773B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4100	apprt6933.exe
4212	apprt6933.exe
1996	svc6933.exe
4908	svc6933.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt6933 = "C:\\Users\\Admin\\AppData\\Local\\AppRt6933\\apprt6933.exe"	2026-05-22_137639a67ed5f313d8d1023bd7c2b3ff_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvc6933 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\6933\\svc6933.exe"	apprt6933.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4696	2026-05-22_137639a67ed5f313d8d1023bd7c2b3ff_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4696	2026-05-22_137639a67ed5f313d8d1023bd7c2b3ff_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4100	apprt6933.exe
4100	apprt6933.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 4100	4696	2026-05-22_137639a67ed5f313d8d1023bd7c2b3ff_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	80
PID 4100 wrote to memory of 1996	4100	apprt6933.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-05-22_137639a67ed5f313d8d1023bd7c2b3ff_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_137639a67ed5f313d8d1023bd7c2b3ff_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
  "C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Users\Admin\AppData\Local\Programs\6933\svc6933.exe
    "C:\Users\Admin\AppData\Local\Programs\6933\svc6933.exe"
    3⤵
    - Executes dropped EXE
    PID:1996

C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
1⤵
- Executes dropped EXE
PID:4212

C:\Users\Admin\AppData\Local\Programs\6933\svc6933.exe
C:\Users\Admin\AppData\Local\Programs\6933\svc6933.exe
1⤵
- Executes dropped EXE
PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt6933.exe

Path C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
Size 3.8MB
SHA256 59451fccb82972d32e3f2ad04d9700b90271e8e8474710aabffdead1b2768237
MD5 1277a60dff8da10455a834931061ca5e
SHA1 6e618b6101a68440a7fc39a87f561dc3857e288c
SHA512 1f37d56160ddbc3e56c1d81ce53c72fec3eeba30e622fc6ef74aac122837b9116ea95bc9bfba49a15c32c56a5fc3e44525632967f5e388c38e551564fe1990a1
SSDEEP 98304:jRNrV0DsCoLzUL7z39+LOg7qdk6WspAIJQQ4Y1:jRN2DsCovUJAVeCuzJQC1
TLSH
T1AC06D0919AA6D297DAF3303EC2265354AAC8299C6E12E5C43EC38605DF5F0F44E773B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc6933.exe

Path C:\Users\Admin\AppData\Local\Programs\6933\svc6933.exe
Size 3.8MB
SHA256 984a03d71124beb22a6169d4a7ccc9a5d194a3a6607c8ea5bbc8f9b9e656d5f0
MD5 91842e5caeaad6332d987d28beada8d6
SHA1 aae00d3e3f01688fa46c4b639b7efb076e09fc8d
SHA512 5f9695903e07075bcd19645e4887c1cba5d4a878006b4332e311c8e8a250c84e6ed84d20fa52031fb77b5ae3f27eea525995972b9f423cbc6fdc64a11eaa86ae
SSDEEP 98304:oRxrV0DsCoLzUL7z39+LOg7qdk6WspAIJQQ4YZ:oRx2DsCovUJAVeCuzJQCZ
TLSH
T16006D0919AA6D297DAF3303EC2265354AAC8299C6E12E5C43EC38605DF5F0F44E773B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download