Overview

overview

10

Static

static

10

2026-01-05...ed.exe

windows10-2004-x64

10

2026-01-05...ed.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows11-21h2_x64
  • resource
    win11-20251231-en
  • resource tags

    arch:x64arch:x86image:win11-20251231-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05/01/2026, 04:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-01-05_d2739a449608861835b2e89f8401cf6b_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_med.exe
  • Size 678KB
  • Sample260105-ex3bssam3x
  • SHA256 09dcbaee19a8302f4e9319a8ebc148d50b6ddf31d7e9b9c34850237b3afa682a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
defense_evasiondiscoverymedusalockerransomwarespywarestealertrojan

Malware Config

Extracted

Path

  • C:\Recovery\WindowsRE\Recovery_Instructions.html

Ransom Note
  • <html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">70B7507C4EEEAEAF8EDF66BBC32EF7ED1FCC6655375582D06D0C63BD95F9192299FBA81B7D1EC369E0F0E3A5758B613E58D8087A890E0189FE5BC6775B414805<br>0CB0900E5907FEB16BE1E380B7FA78460DB3E25190B4BC38909C8C7E501D563B03C726A9F249EA50EAA35780D6C9729374F16374CA2A93F988B09CA055AD<br>82C5EB554602929EF89147495473E732B4DFD4AA290032B6FE152A9603944307DEA7A12B3FAA8ED14F34E6A196893FB574D95B0AFB5A4ADF585083B2A9A8<br>AE15F41F7B77F2AED6C33E091AB5E066F2A5859A934DD89CAC32E8C7EC25A05AABB000DCB0FD5748C774708BCD1BD616277AA1954EDF43CC38F32D53C2E0<br>947BFCF91F01F79EBCB8DFE0F1B3926E50FA7C6D35DB163E765C435438AAB803F43E336147D1F97A7C60D220CD5647C504F3190535492FDB3972BD283669<br>6E336E4F06458A0E60367A0750FD8633F51E0DBF021CF7672530BF40B1822851D7EC125153EFAAA3B1E306E8D26A06A9229EB64E49B34618961E48720F63<br>E79FDEFD44E1F76D2B99A0B02B5B26229A248C93BC7E9702FA8FB01E11784C9D938FE1E3B495E345BBCD47C7BBF5756809C522127B210445344EEF6A0A8B<br>824F4143AF03C9CAF161402CA8BC068733F5F706EEA6E337775B1F74386622FB9850F236F39894B54A7C5C17871F36E83E099AE17E63CEAF6FE8FB875C81<br>EE8C40BDA88C44CF6AE50E595761</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED!</b><br><br> YOUR FILES ARE SAFE! JUST MODIFIED ONLY. (RSA+AES) <br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMENANTLY DESTROY YOUR FILE.<br> DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES.<br><br> NO SOFTWARE AVAILABLE ON INTERNET CAN HELP YOU. WE ONLY HAVE<br> SOLUTION TO YOUR PROBLEM.<br><br> WE GATHERED HIGHLY CONFIDENTIAL/PERSORNAL DATA. THESE DATA<br> ARE CURRENTLY STORED ON A PRIVATE SERVER. THIS SERVER WILL BE<br> IMMEDIATELY DESTROYED AFTER YOUR PAYMENT. WE ONLY SEEK MONEY<br> AND DO NOT WANT TO DAMAGE YOUR REPUTATION. IF YOU DECIDE TO<br> NOT PAY, WE WILL RELEASE THIS DATA TO PUBLIC OR RE-SELLER.<br><br> YOU WILL CAN SEND US 2-3 NON-IMPORTANT FILES AND WE WILL<br> DECRYPT IT FOR FREE TO PROVE WE ARE ABLE TO GIVE YOUR FILES<br> BACK.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a href="">http://gvlay6u4g53rxdi5.onion/8-BEr5s2CLhrmCqH4xxg229SZxlkjCyDmc-VFEM52hctVwOagS5Qljp83g20C6mOHQ7</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br> 4. Start a chat and follow the further instructions. <br><br> <b>If you can't use the above link, use the email:</b><br> <a href=" [email protected] ? "> [email protected] </a> <hr> <a href=" [email protected] ? ">[email protected] </a> <hr> MAKE CONTACT AS SOON AS POSSIBLE. YOUR DECRYPTION KEY IS ONLY STORED <br> TEMPORARLY. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER. </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Signatures

  • MedusaLocker

    Ransomware with several variants first seen in September 2019.

    ransomwaremedusalocker
  • MedusaLocker payload 4 IoCs
  • Medusalocker family
    medusalocker
  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Renames multiple (129) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-01-05_d2739a449608861835b2e89f8401cf6b_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_med.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-01-05_d2739a449608861835b2e89f8401cf6b_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_med.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3488
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:576
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4552
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic.exe SHADOWCOPY /nointeractive
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2404
  • C:\Users\Admin\AppData\Roaming\svhost.exe
    C:\Users\Admin\AppData\Roaming\svhost.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:804
  • C:\Users\Admin\AppData\Roaming\svhost.exe
    C:\Users\Admin\AppData\Roaming\svhost.exe
    1⤵
    • Executes dropped EXE
    PID:4652

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Recovery_Instructions.html
        • Path C:\Recovery\WindowsRE\Recovery_Instructions.html
        • Size 4KB
        • SHA256 3990d90b9d82ec4295e8265d5a3c0ffab7a7cc245d501f4541a47beada0300a3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        svhost.exe
        • Path C:\Users\Admin\AppData\Roaming\svhost.exe
        • Size 678KB
        • SHA256 09dcbaee19a8302f4e9319a8ebc148d50b6ddf31d7e9b9c34850237b3afa682a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ntuser.dat.LOG2
        • Path C:\Users\Default\ntuser.dat.LOG2
        • Size 536B
        • SHA256 66ea0ff736392d8ca6d56ee9923a3d2b713d0614e4661e946d2833c756872821
        • MD5 SHA1 SHA512
        Submit Download

        desktop.ini
        • Path \Device\HarddiskVolume3\$RECYCLE.BIN\S-1-5-21-1515280268-2995654546-3579040828-1000\desktop.ini
        • Size 129B
        • SHA256 e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
        • MD5 SHA1 SHA512
        Submit Download

        memory/804-10-0x0000000000340000-0x00000000003EE000-memory.dmp
        Download

        memory/3488-0-0x0000000000780000-0x000000000082E000-memory.dmp
        Download

        memory/4652-418-0x0000000000340000-0x00000000003EE000-memory.dmp
        Download