01b89eb22203cb453cf0ae8f9b5ac469686c2498b540a6598f5e3b6516a1e2fe

Analysis

max time kernel
149s
max time network
125s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_6967cda8489dddb4d466032fe12389eb_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 3.7MB
Sample260604-eksa3ahx4y
SHA256 01b89eb22203cb453cf0ae8f9b5ac469686c2498b540a6598f5e3b6516a1e2fe
MD5 6967cda8489dddb4d466032fe12389eb
SHA1 d62113ce08d8ff1f49a2298f4b358bc757d2c561
SHA512 67398a2d4180ecbc55d126de63eb43abc79f1507be4d3adaf7614c5c0e0687fc58607e862f6995f41a6a729f385828bca6ecbdf4f2a872ed92ab86ba3ce27bea
SSDEEP 49152:BGDgqkLPHmQCDnm7wnfdEyeayb2JnSzbqr76O/A0UN76ZTjut30YaYd0Xo:BqQCDnm0nf2yUUZZo
TLSH
T11206AE4AA2AB01ECC1A794BCC5299613E334741D13D04FF746E885A61F57AE4BF7EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2728	apprt1d6e.exe
4944	apprt1d6e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt1d6e = "C:\\Users\\Admin\\AppData\\Local\\AppRt1d6e\\apprt1d6e.exe"	2026-06-04_6967cda8489dddb4d466032fe12389eb_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3676	2026-06-04_6967cda8489dddb4d466032fe12389eb_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
3676	2026-06-04_6967cda8489dddb4d466032fe12389eb_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 2728	3676	2026-06-04_6967cda8489dddb4d466032fe12389eb_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-06-04_6967cda8489dddb4d466032fe12389eb_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_6967cda8489dddb4d466032fe12389eb_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Users\Admin\AppData\Local\AppRt1d6e\apprt1d6e.exe
  "C:\Users\Admin\AppData\Local\AppRt1d6e\apprt1d6e.exe"
  2⤵
  - Executes dropped EXE
  PID:2728

C:\Users\Admin\AppData\Local\AppRt1d6e\apprt1d6e.exe
C:\Users\Admin\AppData\Local\AppRt1d6e\apprt1d6e.exe
1⤵
- Executes dropped EXE
PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt1d6e.exe

Path C:\Users\Admin\AppData\Local\AppRt1d6e\apprt1d6e.exe
Size 3.7MB
SHA256 7ffe30ed625b06fae08bcbf3f2459ee12c3e0c9fbf71c6fa86dae024e18fdbd7
MD5 80082f74968a0bc83dbc1186c51a0953
SHA1 8751a7efb1acc4ff9eca57d7b785696ed1166031
SHA512 218e244ecfee1b3f0ad9c209600acbcf5ef5a8f645542b36b84a3e5cb9e0a2f56e96064d32d033d2c3282822a69f47fa76a50f0a60fa52e72b95523cbea0e161
SSDEEP 49152:/GDgqkLPHmQCDnm7wnfdEyeayb2JnSzbqr76O/A0UN76ZTjut30YaNd3Xk:/qQCDnm0nf2yUUZ/k
TLSH
T11906AE4AA2AB01ECC1A794BCC5299613E334741D13D04FF746E885A61F57AE4BF7EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_2026-06_3676.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-06_3676.txt
Size 861B
SHA256 0fc44946c426307709ee247a3f16cdadabc0501fedb899d4e56ef139f243acaf
MD5 eeef6448fbeacf38b612a21a15ab954f
SHA1 9e705ec3832649f1a9ecafdec5ebc5df6fea1a1a
SHA512 b36bf929afecd934b72757c570e74de541c8e5b5d307d7b56eb688bc11639fde8c4b97f78d3cd2e65af8a45a5b79f4362b20dcae35442c002fa580e77e833780
TLSH
T1D6114C03F77B75FCD162528EF2E07F872A00B1CB8B8A15127672658EC4D560DAB48369
MD5 SHA1 SHA512 TLSH

Submit Download