e5857202b88afb5140dd09703ad18aca6d9ff0957d22890ee8b66f34df3dfffb

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_0393dcf658842947f77c2d37153bab74_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 3.7MB
Sample260528-cbex9sds2l
SHA256 e5857202b88afb5140dd09703ad18aca6d9ff0957d22890ee8b66f34df3dfffb
MD5 0393dcf658842947f77c2d37153bab74
SHA1 b69c20db33a96da334aaa5b63b9d3f785c1ecd4d
SHA512 9d9545897328620ea0df50fe8413057be7be4be614189d816d9c5d3402b7e3056109223656b53aeecda9c1c3bfd33c8c7cb37f0bc01b6403eda3af3c5c065ae9
SSDEEP 49152:8GDgqkLPHmQCDnm7wnfdEyeayb2JnSzbqr76O/A0UN76ZTjut30Ya1dtX8:8qQCDnm0nf2yUUZ58
TLSH
T13106AE4AA2AB01ECC1A794BCC5299613E334741D13D04FF746E885A61F57AE4BF7EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4260	apprt6933.exe
1120	apprt6933.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt6933 = "C:\\Users\\Admin\\AppData\\Local\\AppRt6933\\apprt6933.exe"	2026-05-28_0393dcf658842947f77c2d37153bab74_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1528	2026-05-28_0393dcf658842947f77c2d37153bab74_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
1528	2026-05-28_0393dcf658842947f77c2d37153bab74_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 4260	1528	2026-05-28_0393dcf658842947f77c2d37153bab74_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-05-28_0393dcf658842947f77c2d37153bab74_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_0393dcf658842947f77c2d37153bab74_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
  "C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe"
  2⤵
  - Executes dropped EXE
  PID:4260

C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
1⤵
- Executes dropped EXE
PID:1120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt6933.exe

Path C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
Size 3.7MB
SHA256 eef2cf35a3b560cbecbd3cbf7f20bc2d2986c631e075d5b655885c54d6397178
MD5 a40c4a05a1c5bf1af12ac2f43adb8886
SHA1 9c70bb6e0af2fce378b60a33a596bd293406fab1
SHA512 1de0adf26c7a41d6db129372ace583d99f35b27ec73f96b20c831c28be6f12957c589a2909facb70f377e928f9f5057ca9f28c9d7fb8af87bef0099adaa1eddb
SSDEEP 49152:2GDgqkLPHmQCDnm7wnfdEyeayb2JnSzbqr76O/A0UN76ZTjut30YaHdzX3:2qQCDnm0nf2yUUZJ3
TLSH
T19406AE4AA2AB01ECC1A794BCC5299613E334741D13D04FF746E885A61F57AE4BF7EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download