2f7c2cc0f1029b373c19e1318ccb664b95a656de47e6fd4a370efd63739a27f6

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_223734dd5dd425bc62ad4ed60aab8ee8_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 3.7MB
Sample260601-hhsetsd17z
SHA256 2f7c2cc0f1029b373c19e1318ccb664b95a656de47e6fd4a370efd63739a27f6
MD5 223734dd5dd425bc62ad4ed60aab8ee8
SHA1 abc6bf9e3189053c489ed2413fc5397297b8ee5d
SHA512 413d9056ad21f3975a2da84109dde720b3adedcf3d202feca7f4b0dd16131c4880082d1e799afaa4d793281c196c84083c3739d0e04128e0e453270866dd7345
SSDEEP 49152:4GDgqkLPHmQCDnm7wnfdEyeayb2JnSzbqr76O/A0UN76ZTjut30YaqdlX4:4qQCDnm0nf2yUUZ84
TLSH
T11206AE4AA2AB01ECC1A794BCC5299613E334741D13D04FF746E885A61F57AE4BF7EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4708	apprt6933.exe
2632	apprt6933.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt6933 = "C:\\Users\\Admin\\AppData\\Local\\AppRt6933\\apprt6933.exe"	2026-06-01_223734dd5dd425bc62ad4ed60aab8ee8_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4168	2026-06-01_223734dd5dd425bc62ad4ed60aab8ee8_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
4168	2026-06-01_223734dd5dd425bc62ad4ed60aab8ee8_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 4708	4168	2026-06-01_223734dd5dd425bc62ad4ed60aab8ee8_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-06-01_223734dd5dd425bc62ad4ed60aab8ee8_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_223734dd5dd425bc62ad4ed60aab8ee8_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
  "C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe"
  2⤵
  - Executes dropped EXE
  PID:4708

C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
1⤵
- Executes dropped EXE
PID:2632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt6933.exe

Path C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
Size 3.7MB
SHA256 ea78bf1471ee486991ea53bb5c2e1acc4e5d2f648caa062c24c7f0fb2b8a9f0c
MD5 1709c851d8d47b51d742f703467ba6f0
SHA1 61498da64ac4cf0b89766d9211ceabee29f74165
SHA512 a1e62bf775939bae6ae956151d94980213d91d96fbd7544c52b34cff735259c126bd84b02516c608f0b859dd53261bb8ad4f50ac70c7f7393781f52e9cdf2114
SSDEEP 49152:TGDgqkLPHmQCDnm7wnfdEyeayb2JnSzbqr76O/A0UN76ZTjut30YaMdcXg:TqQCDnm0nf2yUUZ9g
TLSH
T1B006AE4AA2AB01ECC1A794BCC5299613E334741D13D04FF746E885A61F57AE4BF7EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_2026-06_4168.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-06_4168.txt
Size 571B
SHA256 d8dffccc5459b9120f51e40fe971d7d90f2bd595acfaa848ca076a5c457d39be
MD5 2d80c7adb1c84827a82ee299186713f3
SHA1 2661c99d58d1b13f5a1fd9304ddc2a1bb609d66f
SHA512 f927ac8926fba36a03059fa46044a0ce0c29385211dafa89ba570847e22b3911460881d9ffc3144ac6d4380dd25d53fcb9f8c440920769126dc92849be0dfde7
TLSH
T184F02B80AF76F5BD94A2A6CDD9C4FDC71820219307031D717B94214F80D990F1BCC529
MD5 SHA1 SHA512 TLSH

Submit Download