58913e0c0552e12a6e7d61a73b741512f983b625147cc2559389010f394f1042

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_8cd5c3147434e03fdea959b87fac25bd_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar_win-beast.exe
Size 2.6MB
Sample260718-dg72nsd15m
SHA256 58913e0c0552e12a6e7d61a73b741512f983b625147cc2559389010f394f1042
MD5 8cd5c3147434e03fdea959b87fac25bd
SHA1 67657ac93612987c185d93438e48095e3a471b89
SHA512 7e1bf5981b957330f3c9dba5e696ddf745a17d5fb60535679accd45189f859bd7b0b2c68d848c64485bd84c8b498823c1be19c549cfa8a45e6672031e35f0abf
SSDEEP 49152:nywqD4JmJJy0V8grWoO8lAmsuVuxzlV/m:ywqD4cfJElV/
TLSH
T14BC5BF1662D601ECD0B7A47CC5594A42E735B00AC760CBE706FC86E91FBBAE49B7E701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3824	powershell.exe
2724	powershell.exe
2804	powershell.exe
3824	powershell.exe
2724	powershell.exe
2804	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5152	apprt9f01.exe
3560	hostcfg9f01.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvc9f01 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\HCfg9f01\\hostcfg9f01.exe"	hostcfg9f01.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt9f01 = "C:\\Users\\Admin\\AppData\\Local\\AppRt9f01\\apprt9f01.exe"	2026-07-17_8cd5c3147434e03fdea959b87fac25bd_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar_win-beast.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvc9f01 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\HCfg9f01\\hostcfg9f01.exe"	2026-07-17_8cd5c3147434e03fdea959b87fac25bd_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar_win-beast.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt9f01 = "C:\\Users\\Admin\\AppData\\Local\\AppRt9f01\\apprt9f01.exe"	apprt9f01.exe

Power Settings 1 TTPs 12 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5204	powercfg.exe
4620	powercfg.exe
4104	powercfg.exe
4668	powercfg.exe
4212	powercfg.exe
1944	powercfg.exe
5980	powercfg.exe
4816	powercfg.exe
3352	powercfg.exe
1284	powercfg.exe
1972	powercfg.exe
924	powercfg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3824	powershell.exe
3824	powershell.exe
2724	powershell.exe
2724	powershell.exe
2724	powershell.exe
2804	powershell.exe
2804	powershell.exe
2804	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3824	powershell.exe
Token: SeIncreaseQuotaPrivilege	3824	powershell.exe
Token: SeSecurityPrivilege	3824	powershell.exe
Token: SeTakeOwnershipPrivilege	3824	powershell.exe
Token: SeLoadDriverPrivilege	3824	powershell.exe
Token: SeSystemProfilePrivilege	3824	powershell.exe
Token: SeSystemtimePrivilege	3824	powershell.exe
Token: SeProfSingleProcessPrivilege	3824	powershell.exe
Token: SeIncBasePriorityPrivilege	3824	powershell.exe
Token: SeCreatePagefilePrivilege	3824	powershell.exe
Token: SeBackupPrivilege	3824	powershell.exe
Token: SeRestorePrivilege	3824	powershell.exe
Token: SeShutdownPrivilege	3824	powershell.exe
Token: SeDebugPrivilege	3824	powershell.exe
Token: SeSystemEnvironmentPrivilege	3824	powershell.exe
Token: SeRemoteShutdownPrivilege	3824	powershell.exe
Token: SeUndockPrivilege	3824	powershell.exe
Token: SeManageVolumePrivilege	3824	powershell.exe
Token: 33	3824	powershell.exe
Token: 34	3824	powershell.exe
Token: 35	3824	powershell.exe
Token: 36	3824	powershell.exe
Token: SeIncreaseQuotaPrivilege	3824	powershell.exe
Token: SeSecurityPrivilege	3824	powershell.exe
Token: SeTakeOwnershipPrivilege	3824	powershell.exe
Token: SeLoadDriverPrivilege	3824	powershell.exe
Token: SeSystemProfilePrivilege	3824	powershell.exe
Token: SeSystemtimePrivilege	3824	powershell.exe
Token: SeProfSingleProcessPrivilege	3824	powershell.exe
Token: SeIncBasePriorityPrivilege	3824	powershell.exe
Token: SeCreatePagefilePrivilege	3824	powershell.exe
Token: SeBackupPrivilege	3824	powershell.exe
Token: SeRestorePrivilege	3824	powershell.exe
Token: SeShutdownPrivilege	3824	powershell.exe
Token: SeDebugPrivilege	3824	powershell.exe
Token: SeSystemEnvironmentPrivilege	3824	powershell.exe
Token: SeRemoteShutdownPrivilege	3824	powershell.exe
Token: SeUndockPrivilege	3824	powershell.exe
Token: SeManageVolumePrivilege	3824	powershell.exe
Token: 33	3824	powershell.exe
Token: 34	3824	powershell.exe
Token: 35	3824	powershell.exe
Token: 36	3824	powershell.exe
Token: SeShutdownPrivilege	4212	powercfg.exe
Token: SeCreatePagefilePrivilege	4212	powercfg.exe
Token: SeShutdownPrivilege	1944	powercfg.exe
Token: SeCreatePagefilePrivilege	1944	powercfg.exe
Token: SeShutdownPrivilege	5980	powercfg.exe
Token: SeCreatePagefilePrivilege	5980	powercfg.exe
Token: SeShutdownPrivilege	5204	powercfg.exe
Token: SeCreatePagefilePrivilege	5204	powercfg.exe
Token: SeShutdownPrivilege	5204	powercfg.exe
Token: SeCreatePagefilePrivilege	5204	powercfg.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeIncreaseQuotaPrivilege	2724	powershell.exe
Token: SeSecurityPrivilege	2724	powershell.exe
Token: SeTakeOwnershipPrivilege	2724	powershell.exe
Token: SeLoadDriverPrivilege	2724	powershell.exe
Token: SeSystemProfilePrivilege	2724	powershell.exe
Token: SeSystemtimePrivilege	2724	powershell.exe
Token: SeProfSingleProcessPrivilege	2724	powershell.exe
Token: SeIncBasePriorityPrivilege	2724	powershell.exe
Token: SeCreatePagefilePrivilege	2724	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 3824	3008	2026-07-17_8cd5c3147434e03fdea959b87fac25bd_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar_win-beast.exe	89
PID 3824 wrote to memory of 4212	3824	powershell.exe	92
PID 3824 wrote to memory of 1944	3824	powershell.exe	93
PID 3824 wrote to memory of 5980	3824	powershell.exe	94
PID 3824 wrote to memory of 5204	3824	powershell.exe	96
PID 5152 wrote to memory of 2724	5152	apprt9f01.exe	98
PID 3560 wrote to memory of 2804	3560	hostcfg9f01.exe	102
PID 2724 wrote to memory of 4816	2724	powershell.exe	104
PID 2724 wrote to memory of 3352	2724	powershell.exe	105
PID 2724 wrote to memory of 4620	2724	powershell.exe	106
PID 2724 wrote to memory of 4104	2724	powershell.exe	107
PID 2804 wrote to memory of 4668	2804	powershell.exe	108
PID 2804 wrote to memory of 1284	2804	powershell.exe	109
PID 2804 wrote to memory of 1972	2804	powershell.exe	110
PID 2804 wrote to memory of 924	2804	powershell.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-07-17_8cd5c3147434e03fdea959b87fac25bd_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar_win-beast.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_8cd5c3147434e03fdea959b87fac25bd_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar_win-beast.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -EP Bypass -WindowStyle Hidden -C "Add-MpPreference -ExclusionPath $env:LOCALAPPDATA; Add-MpPreference -ExclusionPath $env:ProgramData"; powercfg /change standby-timeout-ac 0; powercfg /change standby-timeout-dc 0; powercfg /change hibernate-timeout-ac 0; powercfg /hibernate off
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /change standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4212
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /change standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1944
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /change hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:5980
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /hibernate off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:5204

C:\Users\Admin\AppData\Local\AppRt9f01\apprt9f01.exe
C:\Users\Admin\AppData\Local\AppRt9f01\apprt9f01.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -EP Bypass -WindowStyle Hidden -C "Add-MpPreference -ExclusionPath $env:LOCALAPPDATA; Add-MpPreference -ExclusionPath $env:ProgramData"; powercfg /change standby-timeout-ac 0; powercfg /change standby-timeout-dc 0; powercfg /change hibernate-timeout-ac 0; powercfg /hibernate off
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /change standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:4816
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /change standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:3352
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /change hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:4620
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /hibernate off
    3⤵
    - Power Settings
    PID:4104

C:\Users\Admin\AppData\Local\Programs\HCfg9f01\hostcfg9f01.exe
C:\Users\Admin\AppData\Local\Programs\HCfg9f01\hostcfg9f01.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -EP Bypass -WindowStyle Hidden -C "Add-MpPreference -ExclusionPath $env:LOCALAPPDATA; Add-MpPreference -ExclusionPath $env:ProgramData"; powercfg /change standby-timeout-ac 0; powercfg /change standby-timeout-dc 0; powercfg /change hibernate-timeout-ac 0; powercfg /hibernate off
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /change standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:4668
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /change standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:1284
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /change hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:1972
- - C:\Windows\system32\powercfg.exe
    "C:\Windows\system32\powercfg.exe" /hibernate off
    3⤵
    - Power Settings
    PID:924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt9f01.exe

Path C:\Users\Admin\AppData\Local\AppRt9f01\apprt9f01.exe
Size 2.6MB
SHA256 58913e0c0552e12a6e7d61a73b741512f983b625147cc2559389010f394f1042
MD5 8cd5c3147434e03fdea959b87fac25bd
SHA1 67657ac93612987c185d93438e48095e3a471b89
SHA512 7e1bf5981b957330f3c9dba5e696ddf745a17d5fb60535679accd45189f859bd7b0b2c68d848c64485bd84c8b498823c1be19c549cfa8a45e6672031e35f0abf
SSDEEP 49152:nywqD4JmJJy0V8grWoO8lAmsuVuxzlV/m:ywqD4cfJElV/
TLSH
T14BC5BF1662D601ECD0B7A47CC5594A42E735B00AC760CBE706FC86E91FBBAE49B7E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e86ea29d5aaa9164cc3269e41b61e7ae574db7ed89ad3391ac83a29aee93c4ab
MD5 4f4141deb177e2882826a41b775aa5a5
SHA1 602ecf03a83d9c4835a7ae257fed6cd9aae1bfb6
SHA512 18a614a19c815d98632afd8ec9409c0ce4638e3c600766861bbb6998dd404c25c3e8faeea15e2b79cf31d45a46c148501eff6b36f5910e4762a339481f95db21
TLSH
T145219833F3CC8624C89A013A10CDAC1036B6C7CB40DECFAB6B80E659A43F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_e2lmq4io.xaz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e2lmq4io.xaz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3824-19-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/3824-22-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/3824-11-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/3824-14-0x000001F311C90000-0x000001F311CAE000-memory.dmp

Download

memory/3824-16-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/3824-17-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/3824-15-0x000001F32A150000-0x000001F32A202000-memory.dmp

Download

memory/3824-18-0x000001F311CB0000-0x000001F311CBA000-memory.dmp

Download

memory/3824-3-0x00007FFDCD86F000-0x00007FFDCD870000-memory.dmp

Download

memory/3824-20-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/3824-21-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/3824-10-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/3824-23-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/3824-24-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/3824-25-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/3824-26-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/3824-32-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/3824-9-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/3824-8-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/3824-7-0x000001F311AC0000-0x000001F311AE2000-memory.dmp

Download

memory/3824-4-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download