992ef131de3ce2237b2bf4367a24ea04245f0e7d02274f7ea9e68d40110877c4

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 10:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_994aae8590cfdc3dfd801e34749e8378_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 317KB
Sample260707-l774csfv71
SHA256 992ef131de3ce2237b2bf4367a24ea04245f0e7d02274f7ea9e68d40110877c4
MD5 994aae8590cfdc3dfd801e34749e8378
SHA1 0f4e9fc1c4b5f7108f154af2de8868bd61c571c9
SHA512 760c02b3487287fe5f5583ac7bf5a8bc4de9e980b19a1723103428b64bfda0a87773d38bc2d513b94d138daad80c1f78514a230f003482f96a12072754f1a5ab
SSDEEP 6144:SQ8OyYvc36AVuc7DQd/5zlgBR4JDUyeAbSlqrQ:Sj16Qu15yBRCDnsqrQ
TLSH
T1EC648D5AF3A814F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3892	apprt8070.exe
2772	apprt8070.exe
1640	svc8070.exe
3508	svc8070.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt8070 = "C:\\Users\\Admin\\AppData\\Local\\AppRt8070\\apprt8070.exe"	2026-07-07_994aae8590cfdc3dfd801e34749e8378_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvc8070 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\8070\\svc8070.exe"	apprt8070.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3524	2026-07-07_994aae8590cfdc3dfd801e34749e8378_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3524	2026-07-07_994aae8590cfdc3dfd801e34749e8378_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3892	apprt8070.exe
3892	apprt8070.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 3892	3524	2026-07-07_994aae8590cfdc3dfd801e34749e8378_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	87
PID 3892 wrote to memory of 1640	3892	apprt8070.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-07_994aae8590cfdc3dfd801e34749e8378_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_994aae8590cfdc3dfd801e34749e8378_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Users\Admin\AppData\Local\AppRt8070\apprt8070.exe
  "C:\Users\Admin\AppData\Local\AppRt8070\apprt8070.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3892
- - C:\Users\Admin\AppData\Local\Programs\8070\svc8070.exe
    "C:\Users\Admin\AppData\Local\Programs\8070\svc8070.exe"
    3⤵
    - Executes dropped EXE
    PID:1640

C:\Users\Admin\AppData\Local\AppRt8070\apprt8070.exe
C:\Users\Admin\AppData\Local\AppRt8070\apprt8070.exe
1⤵
- Executes dropped EXE
PID:2772

C:\Users\Admin\AppData\Local\Programs\8070\svc8070.exe
C:\Users\Admin\AppData\Local\Programs\8070\svc8070.exe
1⤵
- Executes dropped EXE
PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt8070.exe

Path C:\Users\Admin\AppData\Local\AppRt8070\apprt8070.exe
Size 317KB
SHA256 7bcf5b2e3b170a57e051553b8b8fa79acabed33e20ff0d20beb68bd0ca5bc467
MD5 916f28c11e30e3db375e426cfcc789e9
SHA1 078bc32d0d3c3af32cb3ab512e3aa2a90ea1ba7b
SHA512 be3d0c404bcac7245d0ac318573a9325ca735d7d56102618cd67d9548a2135b64536e9faa6a168faec35ead036fe76fe87eb52414d5760b2394dacf5c5a09918
SSDEEP 6144:HQ8OyYvc36AVuc7DQd/5zlgBR4JD2ye/bS51rU:Hj16Qu15yBRCDFB1rU
TLSH
T14A648D5AF3A814F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc8070.exe

Path C:\Users\Admin\AppData\Local\Programs\8070\svc8070.exe
Size 317KB
SHA256 216eefaf014c1cbc70f99be35c0ee0358aeb40aebb0983de3f4af9379fd10257
MD5 dc937f5292fe2274d284b83d8f1607bd
SHA1 26a1827dedf0e4dcc17381033488c61f1d366fd0
SHA512 ecf692c27eb3d68f25bb59de99b653bfe42e70945873e91151bb43083813a7d3a0b5aa9e007b44564523be1b249323fa2b7a285bcb5b7ec6ac3626470576d21f
SSDEEP 6144:3Q8OyYvc36AVuc7DQd/5zlgBR4JDQyekbSubrz:3j16Qu15yBRCDDHbrz
TLSH
T1CC648D5AF3A904F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download