550a25695c59339a304ff1159ca28e5f0ca77574c92650d24b0d27fd7b2cacaf

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_39362d930124d3e7f758e2f683acfecd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 317KB
Sample261024-tw1txacx2j
SHA256 550a25695c59339a304ff1159ca28e5f0ca77574c92650d24b0d27fd7b2cacaf
MD5 39362d930124d3e7f758e2f683acfecd
SHA1 834c1fe2a2ea518be773bd2dd324e696a6612373
SHA512 27cab57accaea39a457dc88df95b4e825d3fd692ea0ddc7b96e9d5e6f639419b120b2531a601bf0805960407d5a7291a242bd1afdfbc323361465119fc39ab87
SSDEEP 6144:+Q8OyYvc36AVuc7DQd/5zlgBR4JD1ye+bSvnrfbA:+j16Qu15yBRCDc4nrfbA
TLSH
T1DE648D5AF3A814F9F977923CC8529607E7B2BC160760D78F27A046663F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4840	apprtfb4a.exe
1908	apprtfb4a.exe
4944	svcfb4a.exe
2512	svcfb4a.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppSvcfb4a = "C:\\Users\\Admin\\AppData\\Local\\Programs\\fb4a\\svcfb4a.exe"	apprtfb4a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppRtfb4a = "C:\\Users\\Admin\\AppData\\Local\\AppRtfb4a\\apprtfb4a.exe"	2026-10-22_39362d930124d3e7f758e2f683acfecd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5700	2026-10-22_39362d930124d3e7f758e2f683acfecd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
5700	2026-10-22_39362d930124d3e7f758e2f683acfecd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4840	apprtfb4a.exe
4840	apprtfb4a.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5700 wrote to memory of 4840	5700	2026-10-22_39362d930124d3e7f758e2f683acfecd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	90
PID 4840 wrote to memory of 4944	4840	apprtfb4a.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-10-22_39362d930124d3e7f758e2f683acfecd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_39362d930124d3e7f758e2f683acfecd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5700
- C:\Users\Admin\AppData\Local\AppRtfb4a\apprtfb4a.exe
  "C:\Users\Admin\AppData\Local\AppRtfb4a\apprtfb4a.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Users\Admin\AppData\Local\Programs\fb4a\svcfb4a.exe
    "C:\Users\Admin\AppData\Local\Programs\fb4a\svcfb4a.exe"
    3⤵
    - Executes dropped EXE
    PID:4944

C:\Users\Admin\AppData\Local\AppRtfb4a\apprtfb4a.exe
C:\Users\Admin\AppData\Local\AppRtfb4a\apprtfb4a.exe
1⤵
- Executes dropped EXE
PID:1908

C:\Users\Admin\AppData\Local\Programs\fb4a\svcfb4a.exe
C:\Users\Admin\AppData\Local\Programs\fb4a\svcfb4a.exe
1⤵
- Executes dropped EXE
PID:2512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apprtfb4a.exe

Path C:\Users\Admin\AppData\Local\AppRtfb4a\apprtfb4a.exe
Size 318KB
SHA256 0eaa818e0900d2a395293b5260dc11f695e3338a1fbbaab87e2bae9b2c63bd53
MD5 4bf65f7c82b74dab284a4310540d1a35
SHA1 cfff80359d48c6085a9187a4acd4085a460e18b3
SHA512 b55e9090097c3f1ed0e08762a4b7310943e9cc0b7bcdcda1d580e1ad199c8e12df75b9fdc51f3cbff6aa6856e6878fcf3fef26d944d35e01010b63ad33bc12b4
SSDEEP 6144:1Q8OyYvc36AVuc7DQd/5zlgBR4JDyyebbSatrNV:1j16Qu15yBRCDhKtrNV
TLSH
T1B2648D5AF3A814F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svcfb4a.exe

Path C:\Users\Admin\AppData\Local\Programs\fb4a\svcfb4a.exe
Size 318KB
SHA256 258ff547bfd427063e7383db4c69bb582c58f8d515f6150ade2312c6b10a03ea
MD5 f8c4fdbfbe7cd69c65c52b5b4130938f
SHA1 0704746a563bb13c2e4ec7fc371a61e6dc5facb7
SHA512 1dc508ad684f849a7253ceed33593c38c4e6f5d1decbc9ad7323bc760a26a076909d3002707f9b97f2d5f383a47eee20be194d4a951ec679c0c43ac28ffd3f58
SSDEEP 6144:UQ8OyYvc36AVuc7DQd/5zlgBR4JDWPyembSmgr92M:Uj16Qu15yBRCD19gr92M
TLSH
T1EA648D5AF3A814F9F977923CC8529607E772BC160760D78F27A0466A3F236A09D3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download