fb56692a683cea2b7a8a7ddccbfb73e3d5fc9b0f604bd8c812318eabf861ae92

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_30da6232b29f7a21b14c1930b04fd03a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 316KB
Sample260710-cle11sb15r
SHA256 fb56692a683cea2b7a8a7ddccbfb73e3d5fc9b0f604bd8c812318eabf861ae92
MD5 30da6232b29f7a21b14c1930b04fd03a
SHA1 f1e995d7f9e2cbaf55771fbc4a03062ead03bb26
SHA512 9e2f6b088863b86bc53f4198c2833a6095214c4bd86d01952f0d2b7d24e06490b9542f304bf3213cd3ccf3253d2352272e2dace8a82f353a1acf2c7dca149161
SSDEEP 6144:PQ8OyYvc36AVuc7DQd/5zlgBR4JD+yedbSxrrrm:Pj16Qu15yBRCDtDrrrm
TLSH
T1FF648D5AF3A904F9F9B7923CC8529507E672BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3752	apprtb89e.exe
1984	apprtb89e.exe
4332	svcb89e.exe
2168	svcb89e.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRtb89e = "C:\\Users\\Admin\\AppData\\Local\\AppRtb89e\\apprtb89e.exe"	2026-07-10_30da6232b29f7a21b14c1930b04fd03a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvcb89e = "C:\\Users\\Admin\\AppData\\Local\\Programs\\b89e\\svcb89e.exe"	apprtb89e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3876	2026-07-10_30da6232b29f7a21b14c1930b04fd03a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3876	2026-07-10_30da6232b29f7a21b14c1930b04fd03a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
3752	apprtb89e.exe
3752	apprtb89e.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 3752	3876	2026-07-10_30da6232b29f7a21b14c1930b04fd03a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	86
PID 3752 wrote to memory of 4332	3752	apprtb89e.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-10_30da6232b29f7a21b14c1930b04fd03a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_30da6232b29f7a21b14c1930b04fd03a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Users\Admin\AppData\Local\AppRtb89e\apprtb89e.exe
  "C:\Users\Admin\AppData\Local\AppRtb89e\apprtb89e.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Users\Admin\AppData\Local\Programs\b89e\svcb89e.exe
    "C:\Users\Admin\AppData\Local\Programs\b89e\svcb89e.exe"
    3⤵
    - Executes dropped EXE
    PID:4332

C:\Users\Admin\AppData\Local\AppRtb89e\apprtb89e.exe
C:\Users\Admin\AppData\Local\AppRtb89e\apprtb89e.exe
1⤵
- Executes dropped EXE
PID:1984

C:\Users\Admin\AppData\Local\Programs\b89e\svcb89e.exe
C:\Users\Admin\AppData\Local\Programs\b89e\svcb89e.exe
1⤵
- Executes dropped EXE
PID:2168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprtb89e.exe

Path C:\Users\Admin\AppData\Local\AppRtb89e\apprtb89e.exe
Size 316KB
SHA256 5aa4cd7b8c62d57521332fd9872444a6e1412fd08c37680ade655c79a958ab09
MD5 872d10c8d149fb6cb21475df56f1b6f1
SHA1 b22df4283f010cd749e364be34c80adc0b5d29c7
SHA512 fd5956a32e65dafb65e4bf364d584a3aa8c6a3209150953746b5f7735ee4fd5ba8ff1a52bcb510be4f7d1d7d85b466ea744197771233caa4974ac3b9773cea33
SSDEEP 6144:7Q8OyYvc36AVuc7DQd/5zlgBR4JDZyeDbSsMr6m:7j16Qu15yBRCDw0Mr6m
TLSH
T186648D5AF3A814F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svcb89e.exe

Path C:\Users\Admin\AppData\Local\Programs\b89e\svcb89e.exe
Size 316KB
SHA256 e313c3d51e2ee2c30612f8f84dec78ec7cfea6ba12e080719411ca5e1feb1bbc
MD5 4792bece05db09070e26264060c10688
SHA1 677c3556a94e65434b5067e1c60d1ad59acf5d24
SHA512 d3e621c8cd70fc68c978052020ebddfd857ea6fac27621ac6a59aab670248cbe1569b8104ae11a71f30ab847c442dcb2aa60be7a477776711467594d5f1c1f1d
SSDEEP 6144:+UQ8OyYvc36AVuc7DQd/5zlgBR4JDxyeWbSlErKSt:+Uj16Qu15yBRCDIyErpt
TLSH
T1D7648D5AF3A914F9F977923CC8529507E7B2BC160760D78F27A0466A3F232A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download