7631a8b380d63192d69a9b9500eb12bfc802e5bb9e362c6978670bef1d6d1c74

General

Target
2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 3.8MB
Sample260525-rbaqwadv21
SHA256 7631a8b380d63192d69a9b9500eb12bfc802e5bb9e362c6978670bef1d6d1c74
MD5 b9a6d860542de8c5979ac03bfc9daaf2
SHA1 7b439be4554fb487f892f46e765636fadf5e5750
SHA512 1b6b77ad563f564d7fa9d32d4c226b56625f6e8608dc3989707d8a981d3dfb52770bdc80208f153ae3dcd723d20860d5615dd71195f510764ae9df83c8682b41
SSDEEP 98304:m+0Qqc39sxNkb6TVke27tdmobQ9FZF+6TF/KgeUUDJU4yeKLA:m+0QD394NkOTVke27+5FZF+65/IUUDJD
TLSH
T17006E00BDFBE20C1C7B0D438A423A4256C3EF67D8A9C815777D9F6D42A5F652288B352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4408	apprt6c3b.exe
4056	apprt6c3b.exe
460	svc6c3b.exe
1084	svc6c3b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt6c3b = "C:\\Users\\Admin\\AppData\\Local\\AppRt6c3b\\apprt6c3b.exe"	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvc6c3b = "C:\\Users\\Admin\\AppData\\Local\\Programs\\6c3b\\svc6c3b.exe"	apprt6c3b.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org
3	checkip.amazonaws.com
3	api.ipify.org
3	ip-api.com

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svc6c3b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svc6c3b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svc6c3b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	apprt6c3b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svc6c3b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	apprt6c3b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	apprt6c3b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	apprt6c3b.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1248	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1248	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1248	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1248	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4408	apprt6c3b.exe
4408	apprt6c3b.exe
4408	apprt6c3b.exe
4408	apprt6c3b.exe
4056	apprt6c3b.exe
4056	apprt6c3b.exe
1248	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1248	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
460	svc6c3b.exe
460	svc6c3b.exe
1084	svc6c3b.exe
1084	svc6c3b.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
1248	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4408	apprt6c3b.exe
4056	apprt6c3b.exe
460	svc6c3b.exe
1084	svc6c3b.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 4408	1248	2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	81
PID 4408 wrote to memory of 460	4408	apprt6c3b.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-25_b9a6d860542de8c5979ac03bfc9daaf2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Users\Admin\AppData\Local\AppRt6c3b\apprt6c3b.exe
  "C:\Users\Admin\AppData\Local\AppRt6c3b\apprt6c3b.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Users\Admin\AppData\Local\Programs\6c3b\svc6c3b.exe
    "C:\Users\Admin\AppData\Local\Programs\6c3b\svc6c3b.exe"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    PID:460

C:\Users\Admin\AppData\Local\AppRt6c3b\apprt6c3b.exe
C:\Users\Admin\AppData\Local\AppRt6c3b\apprt6c3b.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:4056

C:\Users\Admin\AppData\Local\Programs\6c3b\svc6c3b.exe
C:\Users\Admin\AppData\Local\Programs\6c3b\svc6c3b.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt6c3b.exe

Path C:\Users\Admin\AppData\Local\AppRt6c3b\apprt6c3b.exe
Size 3.8MB
SHA256 d63720af9bf460496ec112843a9fd58fbb045619385560ded4309a9604f005aa
MD5 97bacbafb7f6da76d635d1b549e758ee
SHA1 a4ec695e78e91faf78394bddbb53fed80acb409b
SHA512 c0c4bee7430497b16d1c06784457d97581975d3482874fcedc2ac44aebc28e90d3f54917d96af316aa5c84ad374c80f8b271248176a0d8b2fcf99db02b8f495e
SSDEEP 98304:W+0Qqc39sxNkb6TVke27tdmobQ9FZF+6TF/KgeUUDJU4yeKLH:W+0QD394NkOTVke27+5FZF+65/IUUDJE
TLSH
T1FD06E00BDFBE20C1C7B0D438A423A4256C3EF67D8A9C815777D9F6D42A5F652288B352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc6c3b.exe

Path C:\Users\Admin\AppData\Local\Programs\6c3b\svc6c3b.exe
Size 3.8MB
SHA256 f4448b62a491ba4a837e6e2bd0b5acf07e568735a619945faae0b1749f1a5b1d
MD5 a704833caeb6c6eb278b0539694200fe
SHA1 14fe10477b803007ee4286d3a1f4051cd9eaa643
SHA512 022ff49c390d796d21a7e65c99d149e5327f9153e678884b56947dd62a7eb494406c73d06f1768f3195f8d47ec843942fc6165bfc23c43b879bb253b0ae3fd9a
SSDEEP 98304:v+0Qqc39sxNkb6TVke27tdmobQ9FZF+6TF/KgeUUDJU4yeKLw:v+0QD394NkOTVke27+5FZF+65/IUUDJz
TLSH
T19806E00BDFBE20C1C7B0D438A423A4256C3EF67D8A9C815777D9F6D42A5F652288B352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_2026-05_1084.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_1084.txt
Size 463B
SHA256 20de0ecaf020b6c7d8d6352bd376f63c70a8cb9b370870023bb41b15e3ed4b61
MD5 a4cd7d1805cc66aa735ee06af5bfb6fd
SHA1 16b44c75a04832a0278360ad73a7d7c3000dfd29
SHA512 d97de1b536b0e1646f5e8941ad84578ccfb33837c0674dd3bd566c84c0baffefa51c79195d1995e096c16647f3b892bd42e829fbd0150ebe80f31a5de73811cf
TLSH
T1C7F0276373EA3C1F06E8B649E2DC7B0719402323D5C63910B0E6445C30B0409AFCD784
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_1248.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_1248.txt
Size 657B
SHA256 790bf1f476f31e6da59a429e99bf981198f200bea5360d81fed4a0107c37c0dc
MD5 9fd22e6a7cb42b5095e2181217913161
SHA1 2362e3ca374e9fed7b1548156b1c16168dc80a25
SHA512 d3d3c53512c3aecbd0393d06af8bef1f2dd0a9f1455c179110b95e7ebe3fadb0673360693e483b94e0b79132b4f3a58ccbbe9ec54452f4c3a7b556f16f05fab8
TLSH
T15601D66373B9340E0AE2ABC2E6D07E0719602207D6C52989F02450AC61F550DB7C8BDB
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_4056.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_4056.txt
Size 657B
SHA256 f423b6f295fa12e00db5094e5ba6638eb1f118cab49f9536e1bfa94df82785c6
MD5 8d6d35e5c6f8a886fc307eaf422aa0b7
SHA1 e369e1a3ff71fc6d57713ca56373a59c26470a74
SHA512 655527a618958d48f0decc4d24fc42f8f70459e5aa47d6deae15f44d0a1f75e9e722528dbda8fa88e3f97d68fd5362a3d5fab9a71d73e92b3e32dfe45bc2259d
TLSH
T11401A26363AE340F02F09B5AF6E07F272948230BD6C11D42A210906C61F4902B7C9B98
MD5 SHA1 SHA512 TLSH

Submit Download

log_2026-05_4408.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-05_4408.txt
Size 657B
SHA256 761e648c28c07a480d09bec0b2e091acacc8db2f46a8bb5a66b790dbed501000
MD5 8a80d77888784c1afb63594ae92f3ff9
SHA1 c5618c4896e234c4dce6ee70350e2d6d0aa116b4
SHA512 f527267fb832767402430a2b4adf4dfde59423c6ffdc63f52a54d12ea30fe4a0477b4d5bdc1edae8b93800a6ae54ab2d10f57b296418793b8b4e65aebf0d2eb0
TLSH
T1D301D66373AA340F01B09F42E7D07E0B1D54220B96CD2E01B414566C61B5902BBC8B9E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1248-0-0x0000000180000000-0x0000000180483000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads