3e13f1b428df81810c34d5eb620775d0f89acff81e25137cc8321b1cbfc7a678

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_a8ed43325de440d24659a8638bd1035b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 316KB
Sample260819-fd6qjsda73
SHA256 3e13f1b428df81810c34d5eb620775d0f89acff81e25137cc8321b1cbfc7a678
MD5 a8ed43325de440d24659a8638bd1035b
SHA1 22d9cacd830e7de231c37d79fc4d5dab52b93553
SHA512 18fff7467d652a563a5d0765c993c1005c211d58c43b11cb41972699121971bfb5526238641035c774937372b5fbf075f8882fa6044dee51b52d9325a85f400e
SSDEEP 6144:xQ8OyYvc36AVuc7DQd/5zlgBR4JDcyeBbSTcrI:xj16Qu15yBRCDvFcrI
TLSH
T106648D5AF3A814F9E977923CC8529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4648	apprtb86c.exe
6028	apprtb86c.exe
6356	svcb86c.exe
4284	svcb86c.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRtb86c = "C:\\Users\\Admin\\AppData\\Local\\AppRtb86c\\apprtb86c.exe"	2026-08-19_a8ed43325de440d24659a8638bd1035b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvcb86c = "C:\\Users\\Admin\\AppData\\Local\\Programs\\b86c\\svcb86c.exe"	apprtb86c.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2508	2026-08-19_a8ed43325de440d24659a8638bd1035b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2508	2026-08-19_a8ed43325de440d24659a8638bd1035b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4648	apprtb86c.exe
4648	apprtb86c.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 4648	2508	2026-08-19_a8ed43325de440d24659a8638bd1035b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89
PID 4648 wrote to memory of 6356	4648	apprtb86c.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-19_a8ed43325de440d24659a8638bd1035b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_a8ed43325de440d24659a8638bd1035b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\AppRtb86c\apprtb86c.exe
  "C:\Users\Admin\AppData\Local\AppRtb86c\apprtb86c.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Users\Admin\AppData\Local\Programs\b86c\svcb86c.exe
    "C:\Users\Admin\AppData\Local\Programs\b86c\svcb86c.exe"
    3⤵
    - Executes dropped EXE
    PID:6356

C:\Users\Admin\AppData\Local\AppRtb86c\apprtb86c.exe
C:\Users\Admin\AppData\Local\AppRtb86c\apprtb86c.exe
1⤵
- Executes dropped EXE
PID:6028

C:\Users\Admin\AppData\Local\Programs\b86c\svcb86c.exe
C:\Users\Admin\AppData\Local\Programs\b86c\svcb86c.exe
1⤵
- Executes dropped EXE
PID:4284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprtb86c.exe

Path C:\Users\Admin\AppData\Local\AppRtb86c\apprtb86c.exe
Size 316KB
SHA256 2e7b5053527017fe55911e3f142af0a000e0ae0a9cec7d0c28aa103fd772caec
MD5 1dcfbf3de7dc84f126b7b8fc71a4f9d7
SHA1 63f299c05540fefb58be752b08f23af88a8b3f79
SHA512 bf23e170bce4f215ba37207e654f9cdc0f5a4dc13fc626b936265c378beedcebacbd6891ff749772988daf47bdb315cb93e18d2f690180368765fd57e61eab44
SSDEEP 6144:MQ8OyYvc36AVuc7DQd/5zlgBR4JDZyeMbSAQrv:Mj16Qu15yBRCDwdQrv
TLSH
T1A6648D5AF3A814F9F9B7923CC8529507E772BC160760D78F27A046663F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svcb86c.exe

Path C:\Users\Admin\AppData\Local\Programs\b86c\svcb86c.exe
Size 316KB
SHA256 bb496da4a467cfd40e73b29c97d555836af99c7327a65080b897e99ed620bca0
MD5 c8603b82dbb728003ef35ed599e9c778
SHA1 1321f189ee7362e4f31f8236320d996a97454eba
SHA512 6412fd13284e3bbde3cdc99905668cb735a9513f5d70bfd00fb96ab5459abdacee7c3ea3bfd0e6115350394c62265877c9f0bf01c1978d19d804a8cd8c8f45e5
SSDEEP 6144:hQ8OyYvc36AVuc7DQd/5zlgBR4JD6yexbS5wrE:hj16Qu15yBRCDpTwrE
TLSH
T11D648D5AF3A814F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download