aa45b46ddfe4c02c0689936eeec815266d35bfbc33ffb4fd58af066cdf31010b

General

Target
2026-04-24_0773f451dcbe39d45b847242f1ac3429_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawk.exe
Size 14.6MB
Sample260424-e934vse14z
SHA256 aa45b46ddfe4c02c0689936eeec815266d35bfbc33ffb4fd58af066cdf31010b
MD5 0773f451dcbe39d45b847242f1ac3429
SHA1 19bd3a762c3b5991c48178f041af08a32fc9aa0c
SHA512 e08634c70c1ac9dd54ca1f1046d5a56b93fa8bb5c913a528f6b5a6dd48f12768aaf705af58f1add5a22f84c9fb6287dc4501bf02f67e2428d19e8abdcff6a6f7
SSDEEP 393216:AwQhcZEIv0wQhcZEIvIydcZEIvxcZEIvIyn:AwnEIv0wnEIvIHEIvYEIvI2
TLSH
T1CAF6CF1133F84925F5F756329AB495518A77BC715F31C2CF23901A6E2E32BD09A3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000f000000025f8f-6.dat	UPX

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000f000000025f8f-6.dat	autoit_exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DebugUpdate.exe	2026-04-24_0773f451dcbe39d45b847242f1ac3429_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawk.exe
File opened for modification	C:\Program Files\RevokeSubmit.exe	2026-04-24_0773f451dcbe39d45b847242f1ac3429_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawk.exe
File opened for modification	C:\Program Files\ConnectDismount.exe	2026-04-24_0773f451dcbe39d45b847242f1ac3429_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawk.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\notepad.exe	2026-04-24_0773f451dcbe39d45b847242f1ac3429_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawk.exe
File created	C:\Windows\regedit.exe	2026-04-24_0773f451dcbe39d45b847242f1ac3429_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawk.exe
File created	C:\Windows\winhlp32.exe	2026-04-24_0773f451dcbe39d45b847242f1ac3429_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawk.exe
File created	C:\Windows\bfsvc.exe	2026-04-24_0773f451dcbe39d45b847242f1ac3429_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawk.exe
File created	C:\Windows\hh.exe	2026-04-24_0773f451dcbe39d45b847242f1ac3429_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawk.exe
File created	C:\Windows\splwow64.exe	2026-04-24_0773f451dcbe39d45b847242f1ac3429_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawk.exe
File created	C:\Windows\write.exe	2026-04-24_0773f451dcbe39d45b847242f1ac3429_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawk.exe
File created	C:\Windows\explorer.exe	2026-04-24_0773f451dcbe39d45b847242f1ac3429_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawk.exe
File created	C:\Windows\HelpPane.exe	2026-04-24_0773f451dcbe39d45b847242f1ac3429_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5272	notepad.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 5272	1360	2026-04-24_0773f451dcbe39d45b847242f1ac3429_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawk.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-04-24_0773f451dcbe39d45b847242f1ac3429_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_0773f451dcbe39d45b847242f1ac3429_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_hawk.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\WELBB3.tmp
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 15.0MB
SHA256 bfc08c04a2ad6b1f65ee77625ac40ce18ced81c262d9cb7736c8903aa5c7fc27
MD5 4638c29d302dab0ae8dbc52c790a44c2
SHA1 49c9d3e0a54f997df9597b56405a2e97c31e838c
SHA512 eb6ae966fc21f697c57d4f2dc4ccfa8e20551010a07aa29cc6fa5789e79a0adb0d29afa16ef792d5026c48a790f686aeadf2923f11fb40f391cbcfbc4ecbf732
SSDEEP 393216:AwQhcZEIv0wQhcZEIvIydcZEIvxcZEIvIy:AwnEIv0wnEIvIHEIvYEIvI
TLSH
T133F6CF1173F84526F5F75632AA7491519A77BC711F31C2CF23901A6E3E32AD09A3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WELBB3.tmp

Path C:\Users\Admin\AppData\Local\Temp\WELBB3.tmp
Size 52B
SHA256 be0909be27235c36586ceb9b7e37d8d74c423d9460c4dbf0e2417fcf58b96caa
MD5 17ddbb82a40e2ac704e1045da8fb1cf6
SHA1 a570cdbc16483567fe1439903b212e33b15343b7
SHA512 031adfce17522c42262d40acb75f1db7a1942e4965ab505ee3a5b7001e07a3f16182a4093a3e9a3b99b50860bbc66205a9956b4d8da76adb823054aae6598da2
TLSH
T1449002F35491D6301587051611E8118616566D9675199405E00811251AB56520515DDA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1360-44-0x0000019EB6550000-0x0000019EB6581000-memory.dmp

Download

memory/5272-45-0x000002CB25760000-0x000002CB25791000-memory.dmp