b0eb96ee350ef401475528d3b1cbaee91f6d4fe80536ecd8c4a4c1a98afd09af

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/06/2026, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_817dcc17e9746b45e65a3d59b8bc1e9c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 317KB
Sample260604-zedkyad16w
SHA256 b0eb96ee350ef401475528d3b1cbaee91f6d4fe80536ecd8c4a4c1a98afd09af
MD5 817dcc17e9746b45e65a3d59b8bc1e9c
SHA1 cf2b847afc78b56c9e87433c1de58684e6280193
SHA512 d48ef31ad31921ee356e09fdcf08b722fbcd3bc1c0c48adf4d0bd2f695812023ba0d672cf547cf6179392107142d7ae4bcc7e70c353846854ff54a704b13bcf4
SSDEEP 6144:PQ8OyYvc36AVuc7DQd/5zlgBR4JDVyeubSU2r5/:Pj16Qu15yBRCD8b2r5/
TLSH
T1EE648D5AF3A814F9F977923CC8529507E772BC160760D78F27A046663F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
816	apprtd000.exe
3564	apprtd000.exe
1392	svcd000.exe
1280	svcd000.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppRtd000 = "C:\\Users\\Admin\\AppData\\Local\\AppRtd000\\apprtd000.exe"	2026-06-04_817dcc17e9746b45e65a3d59b8bc1e9c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AppSvcd000 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\d000\\svcd000.exe"	apprtd000.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4184	2026-06-04_817dcc17e9746b45e65a3d59b8bc1e9c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4184	2026-06-04_817dcc17e9746b45e65a3d59b8bc1e9c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
816	apprtd000.exe
816	apprtd000.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 816	4184	2026-06-04_817dcc17e9746b45e65a3d59b8bc1e9c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	102
PID 816 wrote to memory of 1392	816	apprtd000.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-06-04_817dcc17e9746b45e65a3d59b8bc1e9c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_817dcc17e9746b45e65a3d59b8bc1e9c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Users\Admin\AppData\Local\AppRtd000\apprtd000.exe
  "C:\Users\Admin\AppData\Local\AppRtd000\apprtd000.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Users\Admin\AppData\Local\Programs\d000\svcd000.exe
    "C:\Users\Admin\AppData\Local\Programs\d000\svcd000.exe"
    3⤵
    - Executes dropped EXE
    PID:1392

C:\Users\Admin\AppData\Local\AppRtd000\apprtd000.exe
C:\Users\Admin\AppData\Local\AppRtd000\apprtd000.exe
1⤵
- Executes dropped EXE
PID:3564

C:\Users\Admin\AppData\Local\Programs\d000\svcd000.exe
C:\Users\Admin\AppData\Local\Programs\d000\svcd000.exe
1⤵
- Executes dropped EXE
PID:1280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprtd000.exe

Path C:\Users\Admin\AppData\Local\AppRtd000\apprtd000.exe
Size 318KB
SHA256 f6c81e06fcd2cf5d059a734f9860c81823b1aacf21f5a2bcc9f814a5800b9a6c
MD5 e275b7adfe62b87c3d7f9a3c59ba5c85
SHA1 2d7af7b4b4a64fd4276d37a3be1a2ca273c592ea
SHA512 cf5d6566de427185243c917b88e67e675ac6c0368b060d92922d2a1f25fb5bd46a4eabe006f895d9728a260e557f8a6fd87fdd9e2cf4526b155a7e44dfea0e7e
SSDEEP 6144:/Q8OyYvc36AVuc7DQd/5zlgBR4JDWyeYgbS2jr+U:/j16Qu15yBRCDlcjr+U
TLSH
T1C1648D5AF3A814F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svcd000.exe

Path C:\Users\Admin\AppData\Local\Programs\d000\svcd000.exe
Size 318KB
SHA256 8240a9b9a4049df0c19903ea6894044bb3f424cfe5ceeb9c9f671b8b507b1bc0
MD5 83f5bf8b0dd15772f4cbeb65d3192a7e
SHA1 5f590a582a1b7c65bd1fcf137226c09846d69c38
SHA512 108867d115dc778f5f8ffefd91c1bd6a7c04defe54b2c46a4b697205b7ddf8f34d149a140847027b19b969a20abd2ed12ffa83095a23d2e1ef32d212a305ccad
SSDEEP 6144:mQ8OyYvc36AVuc7DQd/5zlgBR4JDryeabSQ2rE0:mj16Qu15yBRCD2b2rE0
TLSH
T1BD648D5AF3A804F9F977923CC8529607E772BC160760D78F27A046663F236A19D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download