d007241688226af8ca1fc60c4e00679dea08c5c779cd7383d4c183b536711ef1

Analysis

max time kernel
149s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_65fd125849eae0971e5da7924c92df0d_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 3.6MB
Sample260604-jmsrtscs9j
SHA256 d007241688226af8ca1fc60c4e00679dea08c5c779cd7383d4c183b536711ef1
MD5 65fd125849eae0971e5da7924c92df0d
SHA1 db00a1f94c0cabb11fa1658344e03665c132a78f
SHA512 d0e1c0fbfe8888b411daef0b46a7e53d14c7001bbf15c0b821e37707eb3604438b493725069d2b8a208352c05718da402031978e6ce1f114b22bca17dededd43
SSDEEP 49152:20U1exH3PH0oBcg4bV0voXdM6/J4/Hu5ZqvAqz531WzLvZm5z54d4BA7sV03l:2JoBIVwUqFjaZl
TLSH
T13406AE96A2A641EEC167D078C52A9B17E7B4345F03E05EFB56D0CA642F13FE02E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1948	apprt6933.exe
3900	apprt6933.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt6933 = "C:\\Users\\Admin\\AppData\\Local\\AppRt6933\\apprt6933.exe"	2026-06-04_65fd125849eae0971e5da7924c92df0d_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3308	2026-06-04_65fd125849eae0971e5da7924c92df0d_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
3308	2026-06-04_65fd125849eae0971e5da7924c92df0d_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 1948	3308	2026-06-04_65fd125849eae0971e5da7924c92df0d_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-06-04_65fd125849eae0971e5da7924c92df0d_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_65fd125849eae0971e5da7924c92df0d_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
  "C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe"
  2⤵
  - Executes dropped EXE
  PID:1948

C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
1⤵
- Executes dropped EXE
PID:3900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt6933.exe

Path C:\Users\Admin\AppData\Local\AppRt6933\apprt6933.exe
Size 3.6MB
SHA256 6c8671eba34f9d5435bd893f4cf34ae1121c01415a57b9d3579eb27e220a5d58
MD5 3043f89ebf992b2d0dc8ce27c06f67d8
SHA1 1711d1019bd13ee9a5ef375b3b219a797ae78ce7
SHA512 63845b0d56833dad0f25606ba1de7783ab4cb9e5a278d97c5c2e5928ac94e39d4aea9fdd77e4a68a1740068f25a9d7e9eef6ad2a74d5675d52366e06c9aa4430
SSDEEP 49152:M0U1exH3PH0oBcg4bV0voXdM6/J4/Hu5ZqvAqz531WzLvZm5z54d4BA7jj03w:MJoBIVwUqFjaAw
TLSH
T1E406AE96A2A641EEC167D078C52A9B17E7B4345F03E05EFB56D0CA642F13FE02E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_2026-06_3308.txt

Path C:\Users\Admin\AppData\Local\Temp\log_2026-06_3308.txt
Size 854B
SHA256 ca59f32a03c2dd19a489076bdfdb9184cf82edcf9be443d68b0cb69d95a0be82
MD5 73540cdc4a6b581fdc097eff7d1c37c8
SHA1 f8c139484b401a92c6be24b7cb024e006e2738ae
SHA512 77a431ce2cc0d3b03f0a29b5e091e4d5e9a0bce9381a3dc063226eb19c2c733e82038026ea11065648f0e857f1f6b783bc8daff36947d92007c73e10ccd0260d
TLSH
T19D01890367BA76EE5165E2DEE1E18F859D007307490BB40077F621CCA8E7C0E1B8836A
MD5 SHA1 SHA512 TLSH

Submit Download