5d7802973e8b6505375dfed086fe7a9926168444770237f8392840ddf22977e8

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_5828c918a15b4ecfacf611b5d0092de4_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_hawke.exe
Size 6.5MB
Sample260424-bf3pfsaz3k
SHA256 5d7802973e8b6505375dfed086fe7a9926168444770237f8392840ddf22977e8
MD5 5828c918a15b4ecfacf611b5d0092de4
SHA1 b587c3b620c7d3ac99ee775f0da87507eb93ed67
SHA512 b99609b5fa4a8c31632477b3cbf0b6e86b99cf304ded95d422f8d8b80eac443f39ddfb9417b8e06e342d9aab0b52a9b59a04da723077613a48c3dc3e9a793e87
SSDEEP 98304:xllR35B2cPK8x07ppA+4jxllR35B2cPK8x07ppA+4j5p7V:v/35YCKzujv/35YCKzujfV
TLSH
T1A0668C0273E48575FAB756318A7592219A7B7C214F31C7CF23946E2D3E326D0AA39723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0004000000025a90-6.dat	autoit_exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\HelpPane.exe	2026-04-24_5828c918a15b4ecfacf611b5d0092de4_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_hawke.exe
File created	C:\Windows\hh.exe	2026-04-24_5828c918a15b4ecfacf611b5d0092de4_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_hawke.exe
File created	C:\Windows\regedit.exe	2026-04-24_5828c918a15b4ecfacf611b5d0092de4_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_hawke.exe
File created	C:\Windows\splwow64.exe	2026-04-24_5828c918a15b4ecfacf611b5d0092de4_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_hawke.exe
File created	C:\Windows\winhlp32.exe	2026-04-24_5828c918a15b4ecfacf611b5d0092de4_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_hawke.exe
File created	C:\Windows\bfsvc.exe	2026-04-24_5828c918a15b4ecfacf611b5d0092de4_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_hawke.exe
File created	C:\Windows\explorer.exe	2026-04-24_5828c918a15b4ecfacf611b5d0092de4_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_hawke.exe
File created	C:\Windows\notepad.exe	2026-04-24_5828c918a15b4ecfacf611b5d0092de4_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_hawke.exe
File created	C:\Windows\write.exe	2026-04-24_5828c918a15b4ecfacf611b5d0092de4_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_hawke.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4988	notepad.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 4988	3024	2026-04-24_5828c918a15b4ecfacf611b5d0092de4_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_hawke.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-24_5828c918a15b4ecfacf611b5d0092de4_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_hawke.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_5828c918a15b4ecfacf611b5d0092de4_agent-tesla_amadey_cobalt-strike_darkgate_fabookie_hawke.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\WELDCE3.tmp
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 7.0MB
SHA256 de06b25f2c664d19366d5a09a0bff58273620a751055889217db4d57b90802c8
MD5 f0ac1e6ca3a867bb3d96acd0a1b168af
SHA1 07c35c7fb6d61da3d7b39748aebbfa3d88e71a19
SHA512 b7857bbd2e88584ca45d784a990f2ec8bc9e8c466c3e07ad144161c99df8771ceff6435acb2c94d77c0c33f0f3491e3233fd1c134b11b0e82bd37bcc195eb657
SSDEEP 98304:xllR35B2cPK8x07ppA+4jxllR35B2cPK8x07ppA+4j5p7VPF:v/35YCKzujv/35YCKzujfVP
TLSH
T11A768C1173E48575FAB746318A759221AE7A7C205F31C7CF23946E2D3E326D0AA39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WELDCE3.tmp

Path C:\Users\Admin\AppData\Local\Temp\WELDCE3.tmp
Size 52B
SHA256 be0909be27235c36586ceb9b7e37d8d74c423d9460c4dbf0e2417fcf58b96caa
MD5 17ddbb82a40e2ac704e1045da8fb1cf6
SHA1 a570cdbc16483567fe1439903b212e33b15343b7
SHA512 031adfce17522c42262d40acb75f1db7a1942e4965ab505ee3a5b7001e07a3f16182a4093a3e9a3b99b50860bbc66205a9956b4d8da76adb823054aae6598da2
TLSH
T1449002F35491D6301587051611E8118616566D9675199405E00811251AB56520515DDA
MD5 SHA1 SHA512 TLSH