2ebf1160f5ebd9c77df96585e1ff9c40e552f5dc20c6982908ef3927dd513498

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-31_62b9bb8e73b86a76b6ed4b5ffe2ce8a4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 316KB
Sample260531-xtcwvaew3w
SHA256 2ebf1160f5ebd9c77df96585e1ff9c40e552f5dc20c6982908ef3927dd513498
MD5 62b9bb8e73b86a76b6ed4b5ffe2ce8a4
SHA1 307e7475c304dc299ab4d6312f3f4028eaa2985b
SHA512 c5ffb5d3787884a2d26cb50659b9534d8f13b2cf6e858d89ad0c53593a9aded009123447919f45b59c26f997831b34987820ab0b1a40cecf0d996219ccc293d9
SSDEEP 6144:EQ8OyYvc36AVuc7DQd/5zlgBR4JDBye8bSeirOw:Ej16Qu15yBRCDYXirl
TLSH
T143648D5AF3A904F9F9B7923CC8529507E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2448	apprtf607.exe
1620	apprtf607.exe
5024	svcf607.exe
1936	svcf607.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRtf607 = "C:\\Users\\Admin\\AppData\\Local\\AppRtf607\\apprtf607.exe"	2026-05-31_62b9bb8e73b86a76b6ed4b5ffe2ce8a4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvcf607 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\f607\\svcf607.exe"	apprtf607.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
916	2026-05-31_62b9bb8e73b86a76b6ed4b5ffe2ce8a4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
916	2026-05-31_62b9bb8e73b86a76b6ed4b5ffe2ce8a4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2448	apprtf607.exe
2448	apprtf607.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 2448	916	2026-05-31_62b9bb8e73b86a76b6ed4b5ffe2ce8a4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	78
PID 2448 wrote to memory of 5024	2448	apprtf607.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-31_62b9bb8e73b86a76b6ed4b5ffe2ce8a4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-31_62b9bb8e73b86a76b6ed4b5ffe2ce8a4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:916
- C:\Users\Admin\AppData\Local\AppRtf607\apprtf607.exe
  "C:\Users\Admin\AppData\Local\AppRtf607\apprtf607.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Users\Admin\AppData\Local\Programs\f607\svcf607.exe
    "C:\Users\Admin\AppData\Local\Programs\f607\svcf607.exe"
    3⤵
    - Executes dropped EXE
    PID:5024

C:\Users\Admin\AppData\Local\AppRtf607\apprtf607.exe
C:\Users\Admin\AppData\Local\AppRtf607\apprtf607.exe
1⤵
- Executes dropped EXE
PID:1620

C:\Users\Admin\AppData\Local\Programs\f607\svcf607.exe
C:\Users\Admin\AppData\Local\Programs\f607\svcf607.exe
1⤵
- Executes dropped EXE
PID:1936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprtf607.exe

Path C:\Users\Admin\AppData\Local\AppRtf607\apprtf607.exe
Size 316KB
SHA256 edde258730873bf65431dc708d77c29544144855caaec735e63e8fc34772a55c
MD5 5c31e5f0160889eef225f3a4a14860b6
SHA1 734a132965221a79653d3baa8237849a1d426a15
SHA512 9fd418e8ed4765aba22775457de33027a5f3a2ea6a24efab0041da0f069d1099490414b292105285cea6cfb6705c238d0a49f13ca1103a73ce1176ef5bdbe146
SSDEEP 6144:0Q8OyYvc36AVuc7DQd/5zlgBR4JDoyeibSBDrOQ:0j16Qu15yBRCDb6Dr1
TLSH
T127648D5AF3A914F9F977923CC8529507E772BC160760D78F27A0466A3F232A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svcf607.exe

Path C:\Users\Admin\AppData\Local\Programs\f607\svcf607.exe
Size 316KB
SHA256 dfdca9d29824a191bdebe6bd43c5c58ee0531486fd9356e941d89b9756082a9e
MD5 87f2e7f09fbc8a41d5080b48e28f842d
SHA1 b96b4521ca1decf5f69e7ee5fb83b8034e098770
SHA512 070a98d61fad2a17050728c37feb8b478d5492ce4a78e0be9fc613f120f2730f0552885a9c4b1f3ef32f63e451af0969fb1fc341348ea5a31f877a138f258325
SSDEEP 6144:+Q8OyYvc36AVuc7DQd/5zlgBR4JDGyebbSjjrBj:+j16Qu15yBRCDVfjrd
TLSH
T1D4648D5AF3A904F9F977923CC9529507F672BC160760D78F27A0466A3F232A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download