c62d023b07e40629584af01901d62708421bf20db988ab017e2e7091b40c7d4f

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_88395f1bcc188e9b4810c7306adf0fcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 318KB
Sample260812-a77baaswf1
SHA256 c62d023b07e40629584af01901d62708421bf20db988ab017e2e7091b40c7d4f
MD5 88395f1bcc188e9b4810c7306adf0fcb
SHA1 852e38193829c8bb9d81852b07dd66af0415e91c
SHA512 62d641793533b5277418b20d7a06f110ca99cb6f49dd4472fe40a733ee16295e0f68655461efab93b0d31e7ac6f791c9e3cf4afbeaeba679a738850fdf1b7815
SSDEEP 6144:hQ8OyYvc36AVuc7DQd/5zlgBR4JDwye9bST/r8:hj16Qu15yBRCDjF/r8
TLSH
T189648D5AF3A904F9F977923CC8529507F672BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1596	apprtb89e.exe
1144	apprtb89e.exe
1608	svcb89e.exe
556	svcb89e.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRtb89e = "C:\\Users\\Admin\\AppData\\Local\\AppRtb89e\\apprtb89e.exe"	2026-08-11_88395f1bcc188e9b4810c7306adf0fcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvcb89e = "C:\\Users\\Admin\\AppData\\Local\\Programs\\b89e\\svcb89e.exe"	apprtb89e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4380	2026-08-11_88395f1bcc188e9b4810c7306adf0fcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4380	2026-08-11_88395f1bcc188e9b4810c7306adf0fcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
1596	apprtb89e.exe
1596	apprtb89e.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 1596	4380	2026-08-11_88395f1bcc188e9b4810c7306adf0fcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89
PID 1596 wrote to memory of 1608	1596	apprtb89e.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-11_88395f1bcc188e9b4810c7306adf0fcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_88395f1bcc188e9b4810c7306adf0fcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Users\Admin\AppData\Local\AppRtb89e\apprtb89e.exe
  "C:\Users\Admin\AppData\Local\AppRtb89e\apprtb89e.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Users\Admin\AppData\Local\Programs\b89e\svcb89e.exe
    "C:\Users\Admin\AppData\Local\Programs\b89e\svcb89e.exe"
    3⤵
    - Executes dropped EXE
    PID:1608

C:\Users\Admin\AppData\Local\AppRtb89e\apprtb89e.exe
C:\Users\Admin\AppData\Local\AppRtb89e\apprtb89e.exe
1⤵
- Executes dropped EXE
PID:1144

C:\Users\Admin\AppData\Local\Programs\b89e\svcb89e.exe
C:\Users\Admin\AppData\Local\Programs\b89e\svcb89e.exe
1⤵
- Executes dropped EXE
PID:556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprtb89e.exe

Path C:\Users\Admin\AppData\Local\AppRtb89e\apprtb89e.exe
Size 318KB
SHA256 791605ff7b4bbc49a4883c83ea4d21c5cb4668b86702532624e7410d29e8b0f8
MD5 38a7f4c2c1cd22ce6128878d79409b4d
SHA1 4b3c180cc2f693a6684a3d8cb9411eebb90f6939
SHA512 446743964ed2e13cd8242d496e79d3efa0351e6d990319d0e1637d9e10e38fb0edca0b35e924d7907c14a88205d13ca386ef7d9cac9075ab68606e63339fed4e
SSDEEP 6144:/Q8OyYvc36AVuc7DQd/5zlgBR4JDcyeEbSHnra:/j16Qu15yBRCDv6nra
TLSH
T194648D5AF3A814F9F977923CC8529507F672BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svcb89e.exe

Path C:\Users\Admin\AppData\Local\Programs\b89e\svcb89e.exe
Size 318KB
SHA256 22b55c3dfb9e021706314e9dd2e2641ab777530917c1fe4d4e2a77162af0349f
MD5 c3aee243b7f9d91e6e98b655ec26dda1
SHA1 f802d910d168dd8447c229c15f211949f218bb58
SHA512 362cb3ac2445d30fdc9b24093f22fe2a3e25f4c232c3e1c152f3e836f6e843e933e271e06a955ac8a7527915ad4017c7144acb87272fb179f848196cbee306e0
SSDEEP 6144:8Q8OyYvc36AVuc7DQd/5zlgBR4JDAyeAbSW8rm:8j16Qu15yBRCDzP8rm
TLSH
T10E648D5AF3A814F9F977923CC8529507F672BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download