94bd56a0a059a60ec2ff5109274f5142c7ed84d611276014ad41e89b528ec7e8

Analysis

max time kernel
149s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_a7280978bc641eed278062c81c1e4bfb_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Size 9.0MB
Sample260420-e6wwdacz41
SHA256 94bd56a0a059a60ec2ff5109274f5142c7ed84d611276014ad41e89b528ec7e8
MD5 a7280978bc641eed278062c81c1e4bfb
SHA1 13fd4578357dbca7e82dd150abf50f3d01453184
SHA512 d50a780b69f563eaa6496b582edf7444dab48001c57c5647eada92e77de0ed7eea3f5fe370451d46716deb3b5dba77ea68ce507595c8fa82761e134c50f5c02d
SSDEEP 98304:LSERbwp79UKjKWQckVgtev5mnlNLu2cPK8x07pq7pjfUb0vOU/jIEeQfoR/IuOFo:c3KWQc0gEYnvLhCK8fU4FIF0wuF1yGq
TLSH
T179969D1177E58131F5B316329E7992645A7ABC615F32C6CF73C81A2E1F70AC09A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0004000000025a90-6.dat	autoit_exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\HelpPane.exe	2026-04-20_a7280978bc641eed278062c81c1e4bfb_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
File created	C:\Windows\hh.exe	2026-04-20_a7280978bc641eed278062c81c1e4bfb_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
File created	C:\Windows\splwow64.exe	2026-04-20_a7280978bc641eed278062c81c1e4bfb_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
File created	C:\Windows\bfsvc.exe	2026-04-20_a7280978bc641eed278062c81c1e4bfb_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
File created	C:\Windows\explorer.exe	2026-04-20_a7280978bc641eed278062c81c1e4bfb_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
File created	C:\Windows\notepad.exe	2026-04-20_a7280978bc641eed278062c81c1e4bfb_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
File created	C:\Windows\regedit.exe	2026-04-20_a7280978bc641eed278062c81c1e4bfb_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
File created	C:\Windows\winhlp32.exe	2026-04-20_a7280978bc641eed278062c81c1e4bfb_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
File created	C:\Windows\write.exe	2026-04-20_a7280978bc641eed278062c81c1e4bfb_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1276	notepad.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 1276	5004	2026-04-20_a7280978bc641eed278062c81c1e4bfb_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-20_a7280978bc641eed278062c81c1e4bfb_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_a7280978bc641eed278062c81c1e4bfb_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\WELEB4A.tmp
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 9.5MB
SHA256 53454fb2ed599a27f77ea6639345e040f54f59aab2a847a8c22bc21776db4589
MD5 9a863a0c4f20d467989477ea1bcc04ce
SHA1 3209ba620a38e95bfd745eae081af8b7ae08bbdd
SHA512 53b4765fcb5febc75ee22025b9252779b2472b460b96b3d6807b8c62e4c2ef43af5b07369e70c55e9b6932221618d8300b4aa235bcfe6e6e69733f1fa4652d16
SSDEEP 196608:c3KWQc0gEYnvLhCK8fU4FIF0wuF1yGIP:5cZEIvUDxzyG
TLSH
T10CA69D1177E58032F5B316329E7992605A7ABD615F31C6DF73C81A2E2F706C09A36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WELEB4A.tmp

Path C:\Users\Admin\AppData\Local\Temp\WELEB4A.tmp
Size 52B
SHA256 be0909be27235c36586ceb9b7e37d8d74c423d9460c4dbf0e2417fcf58b96caa
MD5 17ddbb82a40e2ac704e1045da8fb1cf6
SHA1 a570cdbc16483567fe1439903b212e33b15343b7
SHA512 031adfce17522c42262d40acb75f1db7a1942e4965ab505ee3a5b7001e07a3f16182a4093a3e9a3b99b50860bbc66205a9956b4d8da76adb823054aae6598da2
TLSH
T1449002F35491D6301587051611E8118616566D9675199405E00811251AB56520515DDA
MD5 SHA1 SHA512 TLSH