Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/05/2026, 10:39
General
- Target 2026-05-27_bfcf7109ebd231488aee35741904e3bb_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
- Size 3.7MB
- Sample260527-mp45esdx9v
- SHA256 8381bb02aa12b465bd40484fae65678bb1cd1f0bba501fbcd91384cb1bd463b4
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-27_bfcf7109ebd231488aee35741904e3bb_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-27_bfcf7109ebd231488aee35741904e3bb_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\AppRtc172\apprtc172.exe"C:\Users\Admin\AppData\Local\AppRtc172\apprtc172.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\AppRtc172\apprtc172.exeC:\Users\Admin\AppData\Local\AppRtc172\apprtc172.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
apprtc172.exe
log_2026-05_4852.txt