33476ca593ca55603a55e5c7db66ec81a568e9882565fa9e2d7f2355f068b5cf

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/06/2026, 10:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_8e7a6d817b23c7e7a66ca11b85544351_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 316KB
Sample260604-l8a51scv3w
SHA256 33476ca593ca55603a55e5c7db66ec81a568e9882565fa9e2d7f2355f068b5cf
MD5 8e7a6d817b23c7e7a66ca11b85544351
SHA1 112be5e9905f19f13429c23ebd5089e6ad5318a0
SHA512 7ac2b311de8385ad2c62cd7b7a77e66f170b7281fe749119cc3dffaecd40ecdee3d1e789b4481bdb374cce732716999240816c6526aed61db8eb0211441a982e
SSDEEP 6144:VQ8OyYvc36AVuc7DQd/5zlgBR4JDkye5bSgKrnm:Vj16Qu15yBRCD3iKrnm
TLSH
T190648D5AF3A814F9F977923CC8529507E7B2BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4832	apprt6365.exe
4928	apprt6365.exe
2084	svc6365.exe
1956	svc6365.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppRt6365 = "C:\\Users\\Admin\\AppData\\Local\\AppRt6365\\apprt6365.exe"	2026-06-04_8e7a6d817b23c7e7a66ca11b85544351_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppSvc6365 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\6365\\svc6365.exe"	apprt6365.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4248	2026-06-04_8e7a6d817b23c7e7a66ca11b85544351_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4248	2026-06-04_8e7a6d817b23c7e7a66ca11b85544351_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4832	apprt6365.exe
4832	apprt6365.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 4832	4248	2026-06-04_8e7a6d817b23c7e7a66ca11b85544351_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	109
PID 4832 wrote to memory of 2084	4832	apprt6365.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-06-04_8e7a6d817b23c7e7a66ca11b85544351_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_8e7a6d817b23c7e7a66ca11b85544351_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Users\Admin\AppData\Local\AppRt6365\apprt6365.exe
  "C:\Users\Admin\AppData\Local\AppRt6365\apprt6365.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Users\Admin\AppData\Local\Programs\6365\svc6365.exe
    "C:\Users\Admin\AppData\Local\Programs\6365\svc6365.exe"
    3⤵
    - Executes dropped EXE
    PID:2084

C:\Users\Admin\AppData\Local\AppRt6365\apprt6365.exe
C:\Users\Admin\AppData\Local\AppRt6365\apprt6365.exe
1⤵
- Executes dropped EXE
PID:4928

C:\Users\Admin\AppData\Local\Programs\6365\svc6365.exe
C:\Users\Admin\AppData\Local\Programs\6365\svc6365.exe
1⤵
- Executes dropped EXE
PID:1956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt6365.exe

Path C:\Users\Admin\AppData\Local\AppRt6365\apprt6365.exe
Size 316KB
SHA256 3acc02da0a3de1b3a7e0eda11caa61bf7cc39c24a68ce85a631d7b0496902805
MD5 6fa8518a27626ba6a1b5690d35bb1b32
SHA1 301a4be4ff6c28c6ecaa4c655a5f09f98285ca1c
SHA512 69a4fd8d27ceab9bf6621a6e46bbbeb399e11b1ccbe0e5fb616e6b89ee9575bd96dcdc008d2f80c12723f1ca25cc57fb36245e2d4f9a913590017cb5f610a4b3
SSDEEP 6144:DQ8OyYvc36AVuc7DQd/5zlgBR4JD5yeMbS/erve:Dj16Qu15yBRCDQqerve
TLSH
T17F648D5AF3A814F9F977923CC8529507E7B2BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc6365.exe

Path C:\Users\Admin\AppData\Local\Programs\6365\svc6365.exe
Size 317KB
SHA256 146ba8e08e0a5ac74842748797ea89dc5ed20c0f21470053f03fcfd8b5120aa1
MD5 f4c4d03f20b42fd862951e11490048fd
SHA1 b5e292468aa266d7ce56c77fbafdfe2cabf32058
SHA512 d28dd6c2f7162eb3d52f2ca768830285f226248459d5186acf0671b90cd9585cefe504d4b8384c185ee0a3d6620c0d5887888af9e2d56b42b854868d3cc05f1c
SSDEEP 6144:lQ8OyYvc36AVuc7DQd/5zlgBR4JDXyeVbS2Vrxq:lj16Qu15yBRCDisVrxq
TLSH
T153648D5AF3A904F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download