7d9355dfa630ba4d86ecf25305193bbe8dd5ecdb2e51f401714f5ec6d3ef437b

Analysis

max time kernel
149s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 11:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_13e702e84c2e47bea6272b552d135657_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 3.7MB
Sample260602-nz3vsadt6n
SHA256 7d9355dfa630ba4d86ecf25305193bbe8dd5ecdb2e51f401714f5ec6d3ef437b
MD5 13e702e84c2e47bea6272b552d135657
SHA1 7ab61536725190e0b21c79eb916bc20fcb0c138d
SHA512 b52ac619a2cc8a058ded794047299b2797fa49335a0f0d2b19aad04f289050e4ded1f30689e92169f2ef647d797b10a3321a52a9904560af58b77f62ba80335c
SSDEEP 49152:uGDgqkLPHmQCDnm7wnfdEyeayb2JnSzbqr76O/A0UN76ZTjut30YardnXy:uqQCDnm0nf2yUUZpy
TLSH
T17F06AE4AA2AB01ECC1A794BCC5295613E334741D13D04FF74AE885A61F57AE4BF7EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
464	apprt4c74.exe
3628	apprt4c74.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt4c74 = "C:\\Users\\Admin\\AppData\\Local\\AppRt4c74\\apprt4c74.exe"	2026-06-02_13e702e84c2e47bea6272b552d135657_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2484	2026-06-02_13e702e84c2e47bea6272b552d135657_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
2484	2026-06-02_13e702e84c2e47bea6272b552d135657_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 464	2484	2026-06-02_13e702e84c2e47bea6272b552d135657_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-02_13e702e84c2e47bea6272b552d135657_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_13e702e84c2e47bea6272b552d135657_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
  "C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe"
  2⤵
  - Executes dropped EXE
  PID:464

C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
1⤵
- Executes dropped EXE
PID:3628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt4c74.exe

Path C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
Size 3.7MB
SHA256 43a4efcdc99c3c0aa8830f1d7abc99b9cf5b11cc4d52a9ad3e6bb7003629059b
MD5 3fbff4cc570edffd56f10ab8850e42ec
SHA1 514d6ff0336181c3afe6745b2e52ad109dd90074
SHA512 11874dbfc86f2febdbe1680cf4b39d2ac345fbf1d7faec506a7c5be065d33fa2e2a67b37ec6299057e0b10d8a50ffc7e4b629117dd9fa2950d79ba9403babfaf
SSDEEP 49152:bGDgqkLPHmQCDnm7wnfdEyeayb2JnSzbqr76O/A0UN76ZTjut30Ya/ddXL:bqQCDnm0nf2yUUZPL
TLSH
T14806AE4AA2AB01ECC1A794BCC5295613E334741D13D04FF74AE885A61F57AE4BF7EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_2026-06_2484.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-06_2484.txt
Size 861B
SHA256 9db0714ee79570043076e89089a8aaea2d5363479f2654edd941c6ed691fa514
MD5 d3ba1812b2752f38195207a050e985f5
SHA1 15ba2cd80b401ce6ddf7511feddebfe69d015c1a
SHA512 fbaaddd307e09a7cb6daada79ebad0d059a3b4a99617d831bf741a023a6331aca8a7bb03df01f80600d51c5423bf3811536c49ec2b1f000817a95d0b9bb9a32a
TLSH
T18D116B23E7A97EEF63757A8EE1CC6C854844720987AB151A67E1314EB0F4407778C328
MD5 SHA1 SHA512 TLSH

Submit Download