2d7f86e272773b0a943d8e6613949bd8cf8e35ee2e04b3e7dc0569ca4d8b0be9

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_964f51f30a501956c2644ead39fe8043_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 318KB
Sample260930-ld4tvas17k
SHA256 2d7f86e272773b0a943d8e6613949bd8cf8e35ee2e04b3e7dc0569ca4d8b0be9
MD5 964f51f30a501956c2644ead39fe8043
SHA1 0fdb4dafd260683adfe902bc3b8c09fca3c984ff
SHA512 dd3bf954d8187ca7a35c5db86843f6f1dfe89da2ceb076b79f0c10e0a8db5af7787ae8f7f828111ea7653d693d53ab9bbed5b7b559b1602866c0eececb4880c1
SSDEEP 6144:VQ8OyYvc36AVuc7DQd/5zlgBR4JDMye1bSy0rK:Vj16Qu15yBRCDfA0rK
TLSH
T116648D5AF3A904F9F977923CC8529507E772BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4796	apprt4d03.exe
2012	apprt4d03.exe
2560	svc4d03.exe
4468	svc4d03.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRt4d03 = "C:\\Users\\Admin\\AppData\\Local\\AppRt4d03\\apprt4d03.exe"	2026-09-30_964f51f30a501956c2644ead39fe8043_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvc4d03 = "C:\\Users\\Admin\\AppData\\Local\\Programs\\4d03\\svc4d03.exe"	apprt4d03.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2600	2026-09-30_964f51f30a501956c2644ead39fe8043_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2600	2026-09-30_964f51f30a501956c2644ead39fe8043_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4796	apprt4d03.exe
4796	apprt4d03.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 4796	2600	2026-09-30_964f51f30a501956c2644ead39fe8043_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	90
PID 4796 wrote to memory of 2560	4796	apprt4d03.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-09-30_964f51f30a501956c2644ead39fe8043_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_964f51f30a501956c2644ead39fe8043_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\AppRt4d03\apprt4d03.exe
  "C:\Users\Admin\AppData\Local\AppRt4d03\apprt4d03.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Users\Admin\AppData\Local\Programs\4d03\svc4d03.exe
    "C:\Users\Admin\AppData\Local\Programs\4d03\svc4d03.exe"
    3⤵
    - Executes dropped EXE
    PID:2560

C:\Users\Admin\AppData\Local\AppRt4d03\apprt4d03.exe
C:\Users\Admin\AppData\Local\AppRt4d03\apprt4d03.exe
1⤵
- Executes dropped EXE
PID:2012

C:\Users\Admin\AppData\Local\Programs\4d03\svc4d03.exe
C:\Users\Admin\AppData\Local\Programs\4d03\svc4d03.exe
1⤵
- Executes dropped EXE
PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprt4d03.exe

Path C:\Users\Admin\AppData\Local\AppRt4d03\apprt4d03.exe
Size 318KB
SHA256 932ec1b8a5e11020599407dd161c9a3535517e9c79d0795261223509d51a086b
MD5 25a111ce251519fe7da157020956ac19
SHA1 8d54f1a837821159725e3c56ce109e75a0e56c9a
SHA512 0d377c5a8d1528f4d56207444490e5aa16845fd1269a9676b0acf6df951e476019c8432435fd257b641c6a7be4941ae07ede4ffeabbc5ce170535f1f09a6e431
SSDEEP 6144:kQ8OyYvc36AVuc7DQd/5zlgBR4JDxyeXbS2XrS:kj16Qu15yBRCDIeXrS
TLSH
T1BB648D5AF3A814F9F977923CC8529507F672BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc4d03.exe

Path C:\Users\Admin\AppData\Local\Programs\4d03\svc4d03.exe
Size 318KB
SHA256 ceee686372c5592e2eba15156dee7a53f1350b5ee97c879e4323db23e056ebd0
MD5 913bb27ad7ffe26331ab8cfee2c8c2e7
SHA1 2c7a22b206bf1f7bb5b0acf946e786948e42468f
SHA512 d3cf5677b25803fe4f0121dcaf37a5ecee0756c06c3206c5d5e55f57597a26b1db3e1c2c9ca862b896045c58d9513ed28db2bb4b9387d3c7aff27734f578879e
SSDEEP 6144:JQ8OyYvc36AVuc7DQd/5zlgBR4JDJye6bSslrl:Jj16Qu15yBRCDgrlrl
TLSH
T1D5648D5AF3A814F9F977923CC8529507F672BC160760D78F27A0466A3F236A09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download