86a6d944e278081620c6e8e1b8bf119fab3f97092d8e130c6078b38f81384e98

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_0fb91c9f50addc7b5c49fb67d2f2ba99_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 317KB
Sample260716-tpryescy9w
SHA256 86a6d944e278081620c6e8e1b8bf119fab3f97092d8e130c6078b38f81384e98
MD5 0fb91c9f50addc7b5c49fb67d2f2ba99
SHA1 de6e42d961940066536fa43af4d59e4fb1c763bd
SHA512 31191c159686e2c9aa87250e744c275cdaeb96cc802db70bcbade77db3d43c361d0581693b7083afa59d5e898adc3a739fd5005c0e40a95bb2e9faae1aec2951
SSDEEP 6144:vQ8OyYvc36AVuc7DQd/5zlgBR4JD8yeRbSdMrUk:vj16Qu15yBRCDP7MrUk
TLSH
T167648D5AF3A814F9F977923CC8529507E7B2BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4960	apprt6265.exe
2692	apprt6265.exe
2724	svc6265.exe
2640	svc6265.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt6265 = "C:\\Users\\Admin\\AppData\\Local\\AppRt6265\\apprt6265.exe"	2026-07-16_0fb91c9f50addc7b5c49fb67d2f2ba99_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvc6265 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\6265\\svc6265.exe"	apprt6265.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1776	2026-07-16_0fb91c9f50addc7b5c49fb67d2f2ba99_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1776	2026-07-16_0fb91c9f50addc7b5c49fb67d2f2ba99_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4960	apprt6265.exe
4960	apprt6265.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 4960	1776	2026-07-16_0fb91c9f50addc7b5c49fb67d2f2ba99_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	88
PID 4960 wrote to memory of 2724	4960	apprt6265.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-16_0fb91c9f50addc7b5c49fb67d2f2ba99_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_0fb91c9f50addc7b5c49fb67d2f2ba99_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Users\Admin\AppData\Local\AppRt6265\apprt6265.exe
  "C:\Users\Admin\AppData\Local\AppRt6265\apprt6265.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Users\Admin\AppData\Local\Programs\6265\svc6265.exe
    "C:\Users\Admin\AppData\Local\Programs\6265\svc6265.exe"
    3⤵
    - Executes dropped EXE
    PID:2724

C:\Users\Admin\AppData\Local\AppRt6265\apprt6265.exe
C:\Users\Admin\AppData\Local\AppRt6265\apprt6265.exe
1⤵
- Executes dropped EXE
PID:2692

C:\Users\Admin\AppData\Local\Programs\6265\svc6265.exe
C:\Users\Admin\AppData\Local\Programs\6265\svc6265.exe
1⤵
- Executes dropped EXE
PID:2640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt6265.exe

Path C:\Users\Admin\AppData\Local\AppRt6265\apprt6265.exe
Size 317KB
SHA256 79d46b681d06b1443c9572a52bc0ae73f0b9f60dd945480c32e6eaed59e0d4d2
MD5 369ea68fc9771f9b43ea8354d992503f
SHA1 7a06e54b3757f90ac2c5600fd27ee8a320f8c16a
SHA512 4a8d985b9d0e94b46d1c497d7b7445fe23b6f7ad853eac42ab99e65fc67e87757d5511e718f992bd467ab7f9a4c2a98853e8b46ba65180a5fdbd3f37093c34d0
SSDEEP 6144:UQ8OyYvc36AVuc7DQd/5zlgBR4JD8ye+SbSuSrPq:Uj16Qu15yBRCDP4SrPq
TLSH
T126648D5AF3A814F9F9B7923CC8529507E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc6265.exe

Path C:\Users\Admin\AppData\Local\Programs\6265\svc6265.exe
Size 318KB
SHA256 bd56653cdbbee69eaa814d98e87e36cb172b466aee317eb8cf957954b3d9fe16
MD5 fbc43e85c49d20cfe9db09b3875333df
SHA1 c6e6a40b6f90d6360cffe199913a6bfadcc31b27
SHA512 4da0a0a0173ee6cb7878d6c49b79388fc7a438d94959b59900be5622276cc10eaff39136921d34a1fbdb4d61d8fbc40cb85adef881b7f77fa44182c3c465f445
SSDEEP 6144:MQ8OyYvc36AVuc7DQd/5zlgBR4JDRyeEbSXwr1r:Mj16Qu15yBRCDoewr1r
TLSH
T127648D5AF3A814F9F9B7923CC8529507E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download