7631a8b380d63192d69a9b9500eb12bfc802e5bb9e362c6978670bef1d6d1c74

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/05/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 3.8MB
Sample260525-rbaqwadv21
SHA256 7631a8b380d63192d69a9b9500eb12bfc802e5bb9e362c6978670bef1d6d1c74
MD5 b9a6d860542de8c5979ac03bfc9daaf2
SHA1 7b439be4554fb487f892f46e765636fadf5e5750
SHA512 1b6b77ad563f564d7fa9d32d4c226b56625f6e8608dc3989707d8a981d3dfb52770bdc80208f153ae3dcd723d20860d5615dd71195f510764ae9df83c8682b41
SSDEEP 98304:m+0Qqc39sxNkb6TVke27tdmobQ9FZF+6TF/KgeUUDJU4yeKLA:m+0QD394NkOTVke27+5FZF+65/IUUDJD
TLSH
T17006E00BDFBE20C1C7B0D438A423A4256C3EF67D8A9C815777D9F6D42A5F652288B352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1208	apprt4336.exe
3452	apprt4336.exe
1816	svc4336.exe
1712	svc4336.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppRt4336 = "C:\\Users\\Admin\\AppData\\Local\\AppRt4336\\apprt4336.exe"	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppSvc4336 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\4336\\svc4336.exe"	apprt4336.exe

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
56	ip-api.com
27	checkip.amazonaws.com
29	api.ipify.org
39	ipinfo.io
40	ipinfo.io
52	icanhazip.com
53	icanhazip.com

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	apprt4336.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	apprt4336.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svc4336.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svc4336.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	apprt4336.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	apprt4336.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svc4336.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svc4336.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3924	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3924	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3924	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3924	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1208	apprt4336.exe
1208	apprt4336.exe
1208	apprt4336.exe
1208	apprt4336.exe
3452	apprt4336.exe
3452	apprt4336.exe
3924	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3924	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1712	svc4336.exe
1712	svc4336.exe
1816	svc4336.exe
1816	svc4336.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
3924	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1208	apprt4336.exe
3452	apprt4336.exe
1712	svc4336.exe
1816	svc4336.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 1208	3924	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	103
PID 1208 wrote to memory of 1816	1208	apprt4336.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Users\Admin\AppData\Local\AppRt4336\apprt4336.exe
  "C:\Users\Admin\AppData\Local\AppRt4336\apprt4336.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Users\Admin\AppData\Local\Programs\4336\svc4336.exe
    "C:\Users\Admin\AppData\Local\Programs\4336\svc4336.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1816

C:\Users\Admin\AppData\Local\AppRt4336\apprt4336.exe
C:\Users\Admin\AppData\Local\AppRt4336\apprt4336.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3452

C:\Users\Admin\AppData\Local\Programs\4336\svc4336.exe
C:\Users\Admin\AppData\Local\Programs\4336\svc4336.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt4336.exe

Path C:\Users\Admin\AppData\Local\AppRt4336\apprt4336.exe
Size 3.8MB
SHA256 06636f0e60a7a4445cacc2c051b47bef47526a75625d0659fccddd74cf0a5ac7
MD5 6e0c24c4efaee08b15ef533f9850bca4
SHA1 e2a3a350c67f78fc0abe97a05271b201b4cc9021
SHA512 f56dc2f5fc4285376b22028552ee7ccda1e062399eff206eab385903a5d548f684615d5312dbc0a706a8eb175767a6b568b3407274e30d475c3f9a100bb83bbb
SSDEEP 98304:i+0Qqc39sxNkb6TVke27tdmobQ9FZF+6TF/KgeUUDJU4yeKL5:i+0QD394NkOTVke27+5FZF+65/IUUDJ+
TLSH
T1F906E00BDFBE20C1C7B0D438A423A4256C3EF67D8A9C815777D9F6D42A5F652288B352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc4336.exe

Path C:\Users\Admin\AppData\Local\Programs\4336\svc4336.exe
Size 3.8MB
SHA256 cc495e022c67a1ab2565f49022b0da3ce6027c545f22426ccd7c46f2dbf71885
MD5 cc7c07aa471f333b43126273045bf9f9
SHA1 0700735825d848e1ac070beef981de94cb524f0e
SHA512 c04b7be3f39dff08d81af20ff188e0d4f2c7f37309c9a2e0ad59c012552b8d115ea7be35b13db76370ade40e283dabc46d1e4ef8c523f507a2b25746e924bbbb
SSDEEP 98304:l+0Qqc39sxNkb6TVke27tdmobQ9FZF+6TF/KgeUUDJU4yeKLZ:l+0QD394NkOTVke27+5FZF+65/IUUDJi
TLSH
T12D06E00BDFBE20C1C7B0D438A423A4256C3EF67D8A9C815777D9F6D42A5F652288B352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_2026-05_1208.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_1208.txt
Size 846B
SHA256 ad7d73d005bec2414d8d1f0a8ded9223b2ea0fe02b86eb200a30a9667d48e95b
MD5 07f9c1f2e3b4c772c1263c69785b4877
SHA1 39c1862391fa3cf1025f2583b7b41eaabf959041
SHA512 6e36713d94d6e1a1b19c3617e4ffa1b2482fa441c6beea911c307fdf5b8bfd30b88fbc19f0b727970cdeaca6c9271f14afc12de3247ac8f2cc51a12a4c17006c
TLSH
T1B8010C63B7EB380F0B76A752FED06E27194A710F868538317234605C6177911B7CCADA
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_1208.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_1208.txt
Size 1KB
SHA256 9cc3e1df852503f83469c8186d778738993694c5e7bd68a070a2c0f2b9d090e7
MD5 e7c7a71f676b58b903191aee280607d4
SHA1 f3f4352b28fd41e0f6dbfc593976b42bd7599c91
SHA512 c8a9fc3e950cb8b3e89dd57ec72f03176207e44c2fa4422387f04c077d7e37c516f2e19609260b7310eef7ebc47dc312eb8feca86d86715809a0193688230d65
TLSH
T184212863ABFB344B0B62B621FED05E67260A710F81897C317334A05851A7D12B7C8F9A
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_1712.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_1712.txt
Size 463B
SHA256 d038cd40fd68feddc68def4fcfbf1e504ff4a58db6890be0ef2cae3f8d9a1cd8
MD5 48d43caec2ec0ad2f9e16daa7d665d39
SHA1 bce4f7bd375c48bd8d329482e8fe5b6db1605858
SHA512 7cfbf0a8ef5459821293a661559a2a58fb3b4f02f5678e5f655952b9b519a50d3a0293bbe83d15e2539a80164008f9d475a64e0f8839557bac982433f4389544
TLSH
T1D9F0E26376EF342A1AA8B745E6D15B071941330BA9CF2E58B100405D2A7840297CC78C
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_1816.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_1816.txt
Size 463B
SHA256 9513e7fdd021adee6c04c1004c17c8f27de38aca388811f2cab2c38a1f900469
MD5 aa7d32165da2a1b1cf49d1c3fcebf51a
SHA1 939708b21e84cec678854cf05ae844a77da3ee58
SHA512 ff432a279192cf56da3f2bff05a6202ab3ab678633e79560d2d11857bdfc058dd87c031c917f86bc97286baefceefcfecabb2a76a5f133bd7f61c01b1487c063
TLSH
T108F027A373AF341F16E8F745E6E15B0B1940230B9D873E58B004405D227882397CC68C
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_3452.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_3452.txt
Size 657B
SHA256 32c7fa1d2bf34b17fef492155d2259e1220d3bc56b53501dacc772e676fba363
MD5 1951ed4032daaa921a98356ae85c00f1
SHA1 b6ff1875f1a8ee2920ddb3714b4d00bd043a9b5d
SHA512 2e430089e8bab630ada6430cf933240d6dea15748aa183b0039ea9e97e0cd67d8ab1da6b36d3b9a70d6efcc5aaa60f435c7c549a1a319868b7220abd3aa794bd
TLSH
T17601F963B3EB380F03A09B42F6D86F071946730F96C11D01F221626C69B4525B7CABD8
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_3452.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_3452.txt
Size 1KB
SHA256 26a229e4de5de805e2776e3ddcd756a5f3aeba89b4d9feb83d1cb03ee85895d3
MD5 0409eeceb39ef3907594c0c614e8cf77
SHA1 137537dac760790b8f97682913e0bc9ec694288c
SHA512 e4e4640ac32b313d39a9c9d38157d1b848cc61e3b76e385d813e573fdab77145f04a0110bac05fe555e81658ca3081f2c6f79aad799296c4f6bbb913e0b8b616
TLSH
T13421D863A3FB344B0364AE11F6DC5F57260A720F85854D01B321A25859A492AB7CAF98
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3924-0-0x0000000180000000-0x0000000180483000-memory.dmp

Download