734f82b2c0d461acd7e9d780bbbd77e2fe93a5a957c913f69594d4c671f09470

General

Target
2026-04-25_d56e828995111b0b65b9d5a817154286_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_icedid_remcos_satacom_vidar.exe
Size 3.0MB
Sample260425-ngcwmsgv6z
SHA256 734f82b2c0d461acd7e9d780bbbd77e2fe93a5a957c913f69594d4c671f09470
MD5 d56e828995111b0b65b9d5a817154286
SHA1 30672c64e7be800de3d0fb3747d9898b99c7bdc7
SHA512 0ec79e6e8867d4f4bc03eb5df950802393cd9ebc9740b25ad57e2392d475f486c12e1dfc80a577cb466155cb6a40dcd061e117bd72f357a0135ee9e455315a39
SSDEEP 49152:gh+ZkldoPK8YahFHRmM/ev6LpO4q7rHbBSUldP0v7f8IUhabas4f7mTT:B2cPK8xtjO4q75Av7fbUhabg0T
TLSH
T176E55C286EA441B6E4728631C5A1B5CDE6317811AB034ECF11D11BCEAFBBBD26D34E35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	2026-04-25_d56e828995111b0b65b9d5a817154286_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_icedid_remcos_satacom_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000500000001e5b2-6.dat	autoit_exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\HelpPane.exe	2026-04-25_d56e828995111b0b65b9d5a817154286_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_icedid_remcos_satacom_vidar.exe
File created	C:\Windows\hh.exe	2026-04-25_d56e828995111b0b65b9d5a817154286_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_icedid_remcos_satacom_vidar.exe
File created	C:\Windows\regedit.exe	2026-04-25_d56e828995111b0b65b9d5a817154286_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_icedid_remcos_satacom_vidar.exe
File created	C:\Windows\splwow64.exe	2026-04-25_d56e828995111b0b65b9d5a817154286_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_icedid_remcos_satacom_vidar.exe
File created	C:\Windows\winhlp32.exe	2026-04-25_d56e828995111b0b65b9d5a817154286_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_icedid_remcos_satacom_vidar.exe
File created	C:\Windows\write.exe	2026-04-25_d56e828995111b0b65b9d5a817154286_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_icedid_remcos_satacom_vidar.exe
File created	C:\Windows\explorer.exe	2026-04-25_d56e828995111b0b65b9d5a817154286_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_icedid_remcos_satacom_vidar.exe
File created	C:\Windows\notepad.exe	2026-04-25_d56e828995111b0b65b9d5a817154286_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_icedid_remcos_satacom_vidar.exe
File created	C:\Windows\bfsvc.exe	2026-04-25_d56e828995111b0b65b9d5a817154286_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_icedid_remcos_satacom_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5080	notepad.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 5080	860	2026-04-25_d56e828995111b0b65b9d5a817154286_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_icedid_remcos_satacom_vidar.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-25_d56e828995111b0b65b9d5a817154286_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_icedid_remcos_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_d56e828995111b0b65b9d5a817154286_agent-tesla_amadey_cobalt-strike_darkgate_hawkeye_icedid_remcos_satacom_vidar.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\WEL5975.tmp
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 3.4MB
SHA256 9183b950b617a636f45477538610a6a04c5ecdc9a8d579df9a5cf657e279d5b4
MD5 7ddc6a8ad08272cb41f2c3beb8607d9a
SHA1 3991191022ae55afe31ba51a4b8a5519b7fb3ac9
SHA512 7f87d0c98af65f9c9dcc1bed078f03d362f3e69411f0e1decec2f9ade7924083f93e897c6eacf2c770658ca071bebafcfe20004931371c1bae4a0d9cb41ae28c
SSDEEP 49152:gh+ZkldoPK8YahFHRmM/ev6LpO4q7rHbBSUldP0v7f8IUhabas4f7mTLUasqc:B2cPK8xtjO4q75Av7fbUhabg0LPF
TLSH
T10BF58D286EA440B6D4728631C561A58CFA357811AB034ECF11D01FCEAFBBBD26D75E36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WEL5975.tmp

Path C:\Users\Admin\AppData\Local\Temp\WEL5975.tmp
Size 52B
SHA256 be0909be27235c36586ceb9b7e37d8d74c423d9460c4dbf0e2417fcf58b96caa
MD5 17ddbb82a40e2ac704e1045da8fb1cf6
SHA1 a570cdbc16483567fe1439903b212e33b15343b7
SHA512 031adfce17522c42262d40acb75f1db7a1942e4965ab505ee3a5b7001e07a3f16182a4093a3e9a3b99b50860bbc66205a9956b4d8da76adb823054aae6598da2
TLSH
T1449002F35491D6301587051611E8118616566D9675199405E00811251AB56520515DDA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/860-43-0x000001DADDFD0000-0x000001DADE70F000-memory.dmp

Download

memory/5080-44-0x00000280F2960000-0x00000280F309F000-memory.dmp