b6ac55fdae3980bafc82c1da7002258b658959a9e1cbeddf1af8ff8dba171922

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_1322673e36efc93a414979635f9cd9ae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 3.8MB
Sample260522-ctx7kafv3x
SHA256 b6ac55fdae3980bafc82c1da7002258b658959a9e1cbeddf1af8ff8dba171922
MD5 1322673e36efc93a414979635f9cd9ae
SHA1 8dae6e84eca2d8d84b683a49b2b7c18a5ba84381
SHA512 93404aa6e638019be0594fee815830531fd465ee1a4b21025f5e1bdafe98c246aa3c9fd9703bb3dae4b24b0e16b248f5154461e0312b4de66a06edce453fb843
SSDEEP 49152:srd8iraSX1DadBSNiGV5hV4s+fDOwEv9EKUdpEvy/MqfEFVkNwa7HMaQRo2PI2T6:srfX1ABSNQKPEy6J0I2o9j
TLSH
T13606DF8BA9D597E3FF693A38CC489F6C85BF54B02FA546A683A705432DD31E2D93404C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3236	apprt4336.exe
2596	apprt4336.exe
4492	svc4336.exe
4036	svc4336.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppRt4336 = "C:\\Users\\Admin\\AppData\\Local\\AppRt4336\\apprt4336.exe"	2026-05-22_1322673e36efc93a414979635f9cd9ae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppSvc4336 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\4336\\svc4336.exe"	apprt4336.exe

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
70	ip-api.com
76	checkip.amazonaws.com
77	checkip.amazonaws.com
78	checkip.amazonaws.com
8	checkip.amazonaws.com
9	checkip.amazonaws.com
66	api.ipify.org
67	api.ipify.org

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	apprt4336.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	apprt4336.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	apprt4336.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svc4336.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svc4336.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svc4336.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-05-22_1322673e36efc93a414979635f9cd9ae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-05-22_1322673e36efc93a414979635f9cd9ae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	apprt4336.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svc4336.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4180	2026-05-22_1322673e36efc93a414979635f9cd9ae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4180	2026-05-22_1322673e36efc93a414979635f9cd9ae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3236	apprt4336.exe
3236	apprt4336.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
4180	2026-05-22_1322673e36efc93a414979635f9cd9ae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2596	apprt4336.exe
3236	apprt4336.exe
4492	svc4336.exe
4036	svc4336.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 3236	4180	2026-05-22_1322673e36efc93a414979635f9cd9ae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	102
PID 3236 wrote to memory of 4492	3236	apprt4336.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-05-22_1322673e36efc93a414979635f9cd9ae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_1322673e36efc93a414979635f9cd9ae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Users\Admin\AppData\Local\AppRt4336\apprt4336.exe
  "C:\Users\Admin\AppData\Local\AppRt4336\apprt4336.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Users\Admin\AppData\Local\Programs\4336\svc4336.exe
    "C:\Users\Admin\AppData\Local\Programs\4336\svc4336.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4492

C:\Users\Admin\AppData\Local\AppRt4336\apprt4336.exe
C:\Users\Admin\AppData\Local\AppRt4336\apprt4336.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:2596

C:\Users\Admin\AppData\Local\Programs\4336\svc4336.exe
C:\Users\Admin\AppData\Local\Programs\4336\svc4336.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:4036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8
Size 1KB
SHA256 602e1e5954aca716eb81f5cee9950e49a8971e29cd0170aec7cee80fefadd966
MD5 6d74ebed44a5a113e33c70eb0346999d
SHA1 5114bb32061f52bf5b4ff81796c187da70f124d8
SHA512 ba771e2a9494d147d6a00dc0cd4316e3a73c42928deb8a7b1670e1ba52a673a9336190f3ec253826a7681bbd0a2322ece5793407b515c3e8616aabf9065ebb6a
TLSH
T1BC21C6E60F683CD0AD922E9D25F8D23B7D30F6DCA6D18C2398354A5268843772B1905F
MD5 SHA1 SHA512 TLSH

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 1KB
SHA256 929e9b11bdf96347b23e884267928d4086ba750b0aea28fee90282282e0d54ba
MD5 f39cdf78e6f5b798ffc24d6a4b13d812
SHA1 527e092857c9d4f9745a302ac20480418844b6f5
SHA512 f73af496fae8af7a1fb8d707fef5938b2aab4016c293070fad82e58a4a5f00a8701924ebfec1cd8b854eda8f5e872791171843d07547423d310e854c17210f15
TLSH
T19E31E7EE0F351522AF85BD45EE8DD23A2C3197E874954C21F529C04298C0FF6AC8881E
MD5 SHA1 SHA512 TLSH

Submit Download

D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698
Size 471B
SHA256 b4c16e559d0086181f440703a6ae04b776a8e860209abcce70da596cb8c49403
MD5 e051d9040999c249f7555e3b402a60d4
SHA1 1180674185d75e277b7ed22c05bca3efbccc55a2
SHA512 c9836c0b63c4b1bc28fd7d310ccb5e4eb0cc2e42feeb07a59d97d56783bdc21fb68fc498d8ac8344fa42e379544f4d053ea45c1ca27dd0ffd70dea9af975dd8c
TLSH
T129F0DC97273ABD1117410DD622ECC776B96BD7021CD2AA81A0103A6B3A123A9DC23C12
MD5 SHA1 SHA512 TLSH

Submit Download

75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8
Size 438B
SHA256 ded2215252774a94cc3ba23e6dcd018fd49bf203606da477f52a9e8c8b98ff99
MD5 d876fe6c95b1329e48a1dc4547d6959d
SHA1 e3b34da5f87adcf215bfba761e33a413610e78a5
SHA512 058410212e513fc40100b11c55bf43703530e1c3b24977251346a0d4cfc05da4af8573ca4d2a99f8823087924a0ecc706240cc1878774bf83c02c32e43c59416
TLSH
T1E9F06828A6FF416DF137E9B51BDE5B30C82AF0364824A3F402F056197780E81AD22A13
MD5 SHA1 SHA512 TLSH

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 432B
SHA256 ce3b2cd9c0e443bdc3f4e18b7862fed4297a5e69026bcc3a4025dd8a80821bcc
MD5 a729c082a92fbf877ad358aa58709466
SHA1 54b879dde58f1b2f757b7a21da72689d8fa9965d
SHA512 7af714f2d368891b1ee17e1d679081eec1c57d972bb1d64faa56c94a98da6ae5b5d544953e7d2fdb5334e9973c1a769d79d1178712ac8e98e18c91c09823dfe0
TLSH
T19BE0C05526BE4309F1F1DB7A0BCD3811C07BF223104966A110A0570979458414C32A37
MD5 SHA1 SHA512 TLSH

Submit Download

BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
Size 432B
SHA256 d2a68e6135f27a61ee27874c0a518a7fbfecf62f9ee9583598b1c41e4f535e2f
MD5 8b6e28e10222f934c284e7011f4a0aaf
SHA1 1f2980333980b48430c8ea716a645ccac494e2bd
SHA512 6ffbdf6f102d30d5a0d692e17639bab3c8021f539d10be68a16936d5ce86abd52ca40bb73d0216662d2d1f290271f2fe730b4fba2b9a6781d9cc579e7affe1b7
TLSH
T1CDE0615525FD4309F2E1D77907CDBD52C07FF523105966A211A467097B554814D32536
MD5 SHA1 SHA512 TLSH

Submit Download

D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_D57CE96919754E8BF5FC12F0FA7A1698
Size 418B
SHA256 93518a4720f187c8f2a9eb4ec826b437f36d90cd6bcf89be8f77f896d22ded4f
MD5 04ccf80cf14a0f071bb1d03f606e1264
SHA1 a6ed271f7d7fe2c6b569c444134fc0525890336b
SHA512 c83906b4aabaca9b7a3872069e65d034bfb95cbfdb24adddea3bb8fd34d0eeb5be130c691e5d0e77e18f891e597fc7b254aa4889b7caf6fec18ad49b92f17f79
TLSH
T150E0C00522FE430EF179DBB80ADDF622DC0BF0179810A3B60173134CA522E009C16474
MD5 SHA1 SHA512 TLSH

Submit Download

apprt4336.exe

Path C:\Users\Admin\AppData\Local\AppRt4336\apprt4336.exe
Size 3.8MB
SHA256 7b785ecae1e4dedf6fafef755ee9c7f79ccd312bdf5693e6943d7975cc47e487
MD5 13f820f658911dc0e92a766f6e8f8920
SHA1 32384d9da84c0d226cb07a3a1a734fc35cfd235c
SHA512 80ec4e29744d3649726634c392e6dcc23c1702521ddd47196df19b4160f7f80ac03dbe1733fbe12f16c54937dee6634b37f4af1ec0b4e91f8fe4b327720139f4
SSDEEP 49152:Hrd8iraSX1DadBSNiGV5hV4s+fDOwEv9EKUdpEvy/MqfEFVkNwa7HMaQRo2PI2T4:HrfX1ABSNQKPEy6J0I2o9x
TLSH
T12606DF8BA9D597E3FF693A38CC489F6C85BF54B02FA546A683A705432DD31E2D93404C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc4336.exe

Path C:\Users\Admin\AppData\Local\Programs\4336\svc4336.exe
Size 3.8MB
SHA256 92658acd760b07b6d31a9aef12d0b2935460c496c24507969479eeb43c1a4b71
MD5 20fcc6f689b81f2f4d5692b6245995d0
SHA1 101b482567075fd00ff6facab8593ee4d99c9dd7
SHA512 712b89a36fefd274963ebabfa2863945d935f4b5f12edb03647aaf2018d35be8480b74dab54d1d5eec5e03191fffc2bf41273cfd434dfecf77cdc8ba3d67fb96
SSDEEP 49152:Brd8iraSX1DadBSNiGV5hV4s+fDOwEv9EKUdpEvy/MqfEFVkNwa7HMaQRo2PI2TF:BrfX1ABSNQKPEy6J0I2o98
TLSH
T1AC06DF8BA9D597E3FF693A38CC489F6C85BF54B02FA546A683A705432DD31E2D93404C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_2026-05_2596.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_2596.txt
Size 463B
SHA256 cc93b8afe338eb3987a3a558d801caf7d8bb6c6f1d605969515d88d7f5dd3bcf
MD5 520cd0a2ba4b12c8b054635e0588cdd1
SHA1 2f5e6518425e7189215896b0a42e877c4c74bbd2
SHA512 1ce025fd1a68f29f43091a69b5a3ccd8609608af3bb59a60f80f08a92b28ed61b6c013e4eda7c70c1bbf38781993b6b144a55b120dcdab3e0a91b52fb7c9f379
TLSH
T1E1F0E2BB71F9785F06A4EB4EE6E86E839C50F3429D422690F100409C3470472ABED288
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_2596.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_2596.txt
Size 1KB
SHA256 afcf0d9e2c9e4ccaa1f480af09b0ad5b12d3903d7716940c761718c05e89a6f3
MD5 3f2a7ced7ce7af389a219099896fed77
SHA1 188af0d134a197d53e9beb0ed19209c7cd0d6b7b
SHA512 9e9545da3bcc71617840c7638c6262242da86fc5d4f4c0397dbcc167fa65a5e4bc1d96202c7dbece5d3eedccf1a66f9f5bd6b7266d443f6bc5a758e2f52a5487
TLSH
T14021E6BF61FD788F0268E60ED66D7EC2AC04F24949654A85F300409C74B45B2B7EA69C
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_3236.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_3236.txt
Size 657B
SHA256 5a9daaa74416b8324ea7ef8a8d678f548fdf64a3d2652228340a19fea044c350
MD5 3d66fb4cb6f8d6c95ce4a92ca97f4864
SHA1 4f84beb663b712b7fee8f2d030226e88fdc55a71
SHA512 deadfd2fc92c95b21809f4cf81f8d588b2e4319b9c225cb0eb606aa84553bf2273f9f29002b2fbfef44d934351701c501d46898c69d11b87152aa7c657f92c84
TLSH
T16301267B71FD7C0E03B6D74BE5FC7AA1ACC07307A6911A81B621506C207042677C839C
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_3236.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_3236.txt
Size 1KB
SHA256 c0c2a5a3789dbe91fa05f83272701986cc4d6466ba0dacb9ad64c35d7d8fb8c6
MD5 68fc0721b8ddda76ee5d41c7b5808f10
SHA1 1bbcb00f571aa33db9e187f0e2b59b944fecb549
SHA512 4eb8a7264006c72237e33628a992db6d759830f659403cc2dc56f03ea3e9d30a1623060c0d23b678eb4f706231f3dccae1772db60e9a77bb7642944fde282004
TLSH
T14E217C3F61FD7C4A037AF607D6FC7AE1BC80B24961694A817721415D60A453A37CC79C
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_4036.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_4036.txt
Size 463B
SHA256 6a807a6682161fb1634a0dfc430ad0c12ac5df99f14d38112a5529232e52460b
MD5 6d0f4c2f9b8540a71fc3e1632074c8b2
SHA1 f87edc2d4707294c20a5331f27216230a133cc88
SHA512 e8693bdb595cae90ee8240c7f2e32fb55c1429f82dc41cf460d00cba3e2b1f9c98688b9026b3e753cfb15e64f13379c604fe39f7b9325480f4cf171460ba6eec
TLSH
T192F0272B73F97C1B04F0EA5BE7E0FA82BC503206998225D0B000805C1460A236BCEA8C
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_4492.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_4492.txt
Size 463B
SHA256 f27ea0e50594d25b0ffac9f00e6f0f9168d33bf31cb1da64e071837c5d898601
MD5 d0a3fdea2a4434433b575f73de1bda9d
SHA1 ce2bb5356f8e213cc0830114650a526e76d36899
SHA512 7b53d647161520dcb74efef242cb42a1f19ee2333bf3923c8cbe7da6b0dc757c2955dbd594aa4018f75c18b280a86a1a6eed3debb26dd16c8e6cc6e108ccd6fe
TLSH
T11DF0272A71FD741B04D0EE4BEBD478C26C51330A9D8226D0B00182DC1850672ABCDF88
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4180-0-0x0000000180000000-0x0000000180480000-memory.dmp

Download