28ef4201d77cfd46289fe1d3394e9c5911d5236eb8043700764293d84083d74d

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_68003d73c5ad29e0ff09265935e3ec34_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 316KB
Sample260707-mggddsfy2t
SHA256 28ef4201d77cfd46289fe1d3394e9c5911d5236eb8043700764293d84083d74d
MD5 68003d73c5ad29e0ff09265935e3ec34
SHA1 1aff33fecd94722688b6b960431107c65dc47548
SHA512 4c44c9c75a5219e5a732951bfe74689f26698f468f6b8bc8abed980bc633f9058ca0c45c1c129524e8c12c34cfb5c33a3c40843bb197408a41bf3a49e7e60c0f
SSDEEP 6144:4Q8OyYvc36AVuc7DQd/5zlgBR4JDZyemubSnmrmh:4j16Qu15yBRCDwnmrm
TLSH
T192648D5AF3A814F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3104	apprtce2f.exe
1540	apprtce2f.exe
4340	svcce2f.exe
4052	svcce2f.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRtce2f = "C:\\Users\\Admin\\AppData\\Local\\AppRtce2f\\apprtce2f.exe"	2026-07-07_68003d73c5ad29e0ff09265935e3ec34_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvcce2f = "C:\\Users\\Admin\\AppData\\Local\\Programs\\ce2f\\svcce2f.exe"	apprtce2f.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
424	2026-07-07_68003d73c5ad29e0ff09265935e3ec34_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
424	2026-07-07_68003d73c5ad29e0ff09265935e3ec34_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3104	apprtce2f.exe
3104	apprtce2f.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 424 wrote to memory of 3104	424	2026-07-07_68003d73c5ad29e0ff09265935e3ec34_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89
PID 3104 wrote to memory of 4340	3104	apprtce2f.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-07_68003d73c5ad29e0ff09265935e3ec34_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_68003d73c5ad29e0ff09265935e3ec34_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:424
- C:\Users\Admin\AppData\Local\AppRtce2f\apprtce2f.exe
  "C:\Users\Admin\AppData\Local\AppRtce2f\apprtce2f.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Users\Admin\AppData\Local\Programs\ce2f\svcce2f.exe
    "C:\Users\Admin\AppData\Local\Programs\ce2f\svcce2f.exe"
    3⤵
    - Executes dropped EXE
    PID:4340

C:\Users\Admin\AppData\Local\AppRtce2f\apprtce2f.exe
C:\Users\Admin\AppData\Local\AppRtce2f\apprtce2f.exe
1⤵
- Executes dropped EXE
PID:1540

C:\Users\Admin\AppData\Local\Programs\ce2f\svcce2f.exe
C:\Users\Admin\AppData\Local\Programs\ce2f\svcce2f.exe
1⤵
- Executes dropped EXE
PID:4052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprtce2f.exe

Path C:\Users\Admin\AppData\Local\AppRtce2f\apprtce2f.exe
Size 316KB
SHA256 c29669769f4d773db322eda07a7023e32f0ed61e14e62726d0352a5552f92ae9
MD5 b9a8afa238e3f48adec3c1bc0c998da7
SHA1 b6c3186d3a0a8ed14062300e866aa44dfdea3487
SHA512 098eb535693e01b59cebbdf8bd31fe46dff8bb1210ce482b518d12523c96624217bebf8f6b2d7ece5aa920cc6bc64ce8e3cfc67b5b698fed7f2b8975432f3829
SSDEEP 6144:VQ8OyYvc36AVuc7DQd/5zlgBR4JDIyeJbSKyrYK:Vj16Qu15yBRCD7UyrX
TLSH
T114648D5AF3A904F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svcce2f.exe

Path C:\Users\Admin\AppData\Local\Programs\ce2f\svcce2f.exe
Size 316KB
SHA256 a873e1da9698ee09089504a6d3b49e0a499f37770925de52a34ebc95820da06d
MD5 f417808a734550a8342f3f53abd518fe
SHA1 03e06754a262fb7dfb881f98d60c9b18e9547e7f
SHA512 08c00bffd377bdf403005247412b15dd512ee36e57de7145f7184c5891396312bc2984a77c66f5af0cacd884e434a7b69e51b0e4cad9eb9c3f6a96b5c8b92345
SSDEEP 6144:rQ8OyYvc36AVuc7DQd/5zlgBR4JDDyeybSu2rtt:rj16Qu15yBRCDu52rb
TLSH
T1F5648D5AF3A814F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download