8f535848ba6f8fb3b0f52dc4e7a35f0cd928fed2a4cce4523a441693af30e7c1

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 00:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_2c6eda6b862471a41d139fbe324172ae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 318KB
Sample260723-ahx2babl3w
SHA256 8f535848ba6f8fb3b0f52dc4e7a35f0cd928fed2a4cce4523a441693af30e7c1
MD5 2c6eda6b862471a41d139fbe324172ae
SHA1 e74ab63d9f288a340e8b60ba60b1ff4e92eb93f8
SHA512 65a1b5662d0e4129acc5201f963007fc53cea80d0db220c9e2aa2530670f01ba90f2053de62275e316ff3c1a82be2869474f5da34d37337ca4de27ebcc38fafb
SSDEEP 6144:eQ8OyYvc36AVuc7DQd/5zlgBR4JDGyekbSNLrHPtOU:ej16Qu15yBRCDVsLrHVOU
TLSH
T114648D5AF3A904F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5484	apprt6265.exe
1600	apprt6265.exe
3004	svc6265.exe
1144	svc6265.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt6265 = "C:\\Users\\Admin\\AppData\\Local\\AppRt6265\\apprt6265.exe"	2026-07-22_2c6eda6b862471a41d139fbe324172ae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvc6265 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\6265\\svc6265.exe"	apprt6265.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4828	2026-07-22_2c6eda6b862471a41d139fbe324172ae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4828	2026-07-22_2c6eda6b862471a41d139fbe324172ae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5484	apprt6265.exe
5484	apprt6265.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 5484	4828	2026-07-22_2c6eda6b862471a41d139fbe324172ae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89
PID 5484 wrote to memory of 3004	5484	apprt6265.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-22_2c6eda6b862471a41d139fbe324172ae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_2c6eda6b862471a41d139fbe324172ae_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Users\Admin\AppData\Local\AppRt6265\apprt6265.exe
  "C:\Users\Admin\AppData\Local\AppRt6265\apprt6265.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Users\Admin\AppData\Local\Programs\6265\svc6265.exe
    "C:\Users\Admin\AppData\Local\Programs\6265\svc6265.exe"
    3⤵
    - Executes dropped EXE
    PID:3004

C:\Users\Admin\AppData\Local\AppRt6265\apprt6265.exe
C:\Users\Admin\AppData\Local\AppRt6265\apprt6265.exe
1⤵
- Executes dropped EXE
PID:1600

C:\Users\Admin\AppData\Local\Programs\6265\svc6265.exe
C:\Users\Admin\AppData\Local\Programs\6265\svc6265.exe
1⤵
- Executes dropped EXE
PID:1144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt6265.exe

Path C:\Users\Admin\AppData\Local\AppRt6265\apprt6265.exe
Size 318KB
SHA256 edb60320d3764ae3e267fba2efc871ba71a674d0ed602f10bd1ae649ff2dead4
MD5 ca388f443eeea7a5dff1f416fe3a49d8
SHA1 2824349e52625b85ddd5040fef491cea7c262d23
SHA512 3fc2fb87237e3250d7ff7648630a624ef005fdfab5f82201d727572377f3f93f2ba4a9ea8473e84cd8d0564828548d14aed3b0ba7628a75c13f344540f43a54d
SSDEEP 6144:9Q8OyYvc36AVuc7DQd/5zlgBR4JDLye1bS1GzraPtOu:9j16Qu15yBRCDWfsraVOu
TLSH
T155648D5AF3A804F9F977923CC9529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc6265.exe

Path C:\Users\Admin\AppData\Local\Programs\6265\svc6265.exe
Size 319KB
SHA256 b5885ebb80a4c4b5f4ff81ded433d5f6c9306d4a4e9313eca26a77c28231de1f
MD5 4780a2a997d57a07033407ca466a4dba
SHA1 abdc4c71e2bc7924736a9313ea217e140a4713c5
SHA512 11a5bca07a77dc0546a44f68ee0ab11d7ffed7baec73276124831a3eb8f8bdbb9c091a9bab5abdde9d7fd7e05ca9a17692614010e906b43951f44ad9268f36fa
SSDEEP 6144:TQ8OyYvc36AVuc7DQd/5zlgBR4JDJyecbSTdrnPtOEL:Tj16Qu15yBRCDgKdrnVOq
TLSH
T125648D5AF3A904F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download