b0eb96ee350ef401475528d3b1cbaee91f6d4fe80536ecd8c4a4c1a98afd09af

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_817dcc17e9746b45e65a3d59b8bc1e9c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 317KB
Sample260604-zedkyad16w
SHA256 b0eb96ee350ef401475528d3b1cbaee91f6d4fe80536ecd8c4a4c1a98afd09af
MD5 817dcc17e9746b45e65a3d59b8bc1e9c
SHA1 cf2b847afc78b56c9e87433c1de58684e6280193
SHA512 d48ef31ad31921ee356e09fdcf08b722fbcd3bc1c0c48adf4d0bd2f695812023ba0d672cf547cf6179392107142d7ae4bcc7e70c353846854ff54a704b13bcf4
SSDEEP 6144:PQ8OyYvc36AVuc7DQd/5zlgBR4JDVyeubSU2r5/:Pj16Qu15yBRCD8b2r5/
TLSH
T1EE648D5AF3A814F9F977923CC8529507E772BC160760D78F27A046663F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
8	apprt4c74.exe
2096	apprt4c74.exe
4116	svc4c74.exe
1404	svc4c74.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt4c74 = "C:\\Users\\Admin\\AppData\\Local\\AppRt4c74\\apprt4c74.exe"	2026-06-04_817dcc17e9746b45e65a3d59b8bc1e9c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvc4c74 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\4c74\\svc4c74.exe"	apprt4c74.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3224	2026-06-04_817dcc17e9746b45e65a3d59b8bc1e9c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3224	2026-06-04_817dcc17e9746b45e65a3d59b8bc1e9c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
8	apprt4c74.exe
8	apprt4c74.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 8	3224	2026-06-04_817dcc17e9746b45e65a3d59b8bc1e9c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	80
PID 8 wrote to memory of 4116	8	apprt4c74.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-06-04_817dcc17e9746b45e65a3d59b8bc1e9c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_817dcc17e9746b45e65a3d59b8bc1e9c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
  "C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe
    "C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe"
    3⤵
    - Executes dropped EXE
    PID:4116

C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
1⤵
- Executes dropped EXE
PID:2096

C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe
C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe
1⤵
- Executes dropped EXE
PID:1404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt4c74.exe

Path C:\Users\Admin\AppData\Local\AppRt4c74\apprt4c74.exe
Size 318KB
SHA256 0ccf1ceccf04c8e8d55417ca6fd1efeceea0a4cd898706b4c68b75c32ab2a203
MD5 db64717ae0dc46e573a2a82244722ee6
SHA1 323fbcae0a6020129262b16a362d4f4241107756
SHA512 15a89ac1272cebcdae39da94588806f0e6d0a032d9dda7e49f4e6ed0b09b21e300a70c3cfd507d3fb5e760ad2c9533e4bf998e710eba30d26781306c3a017c0f
SSDEEP 6144:OQ8OyYvc36AVuc7DQd/5zlgBR4JDxyeJbSMBr8x:Oj16Qu15yBRCDIOBr8x
TLSH
T120648D5AF3A814F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc4c74.exe

Path C:\Users\Admin\AppData\Local\Programs\4c74\svc4c74.exe
Size 318KB
SHA256 ff3c51ed2ad18c9bc413151558f0cbe13d1baaabf598238a3956247fe421420f
MD5 2c26457937e8dff41c1fc79e79a42aff
SHA1 066aac277cdcb01e41c35b7cfe715cf1cb0170a3
SHA512 2c87a3929bc5da986f95f195611c9f104364bb12320fa51dde783eb642f3fd3da2d27de12385003d1f3fd66b06c76412e98d3be935b51a1a24ee4bde90071a0c
SSDEEP 6144:WQ8OyYvc36AVuc7DQd/5zlgBR4JDBye2bS5PrEc:Wj16Qu15yBRCDYGPrEc
TLSH
T163648D5AF3A804F9F977923CC9529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download