Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/05/2026, 04:08
Behavioral task
behavioral1
Sample
2026-05-05_92cd62c8ec617237ede899d204655f22_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-05_92cd62c8ec617237ede899d204655f22_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-05-05_92cd62c8ec617237ede899d204655f22_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
- Size 5.6MB
- Sample260505-eqjacab18p
- SHA256 b3ecfe461eab2ff945946ed1402be0edc9c03bac369a2d144fcd651caa64f952
- MD5 92cd62c8ec617237ede899d204655f22
- SHA1 e3e34636acfdb1b34598055b8d3e0ecea167426f
- SHA512 fb66ea95e056734837a757f797d1a66d97bf4873c2463ebe7ef4d921f08ae84324a72e8658db875981de71e39c6001e9c9ff51e55a315dbb25042779ba9ec385
- SSDEEP 98304:tUm8UyBv78HEFfNHX5rpiD0BTa3aLkBoJLapI:z8U9EFfHp7B2scI
- TLSH T18B469E2271964479E24D8071EF1A9B31C6C87C794BF041E77780BAD52FB2AC23B36B56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Fesber payload 9 IoCs
resource yara_rule behavioral1/files/0x0008000000023618-3.dat family_fesber behavioral1/files/0x0003000000022b7e-19.dat family_fesber behavioral1/memory/1504-1217-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/1504-2246-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/1504-2247-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/1504-2248-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/1504-2249-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/1504-2253-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/1504-2257-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" tmp240645390.exe - Executes dropped EXE 2 IoCs
pid Process 1504 tmp240645390.exe 5064 tmp240645437.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsb.stb tmp240645390.exe File created C:\Windows\SysWOW64\fsb.tmp tmp240645390.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240645390.exe -
resource yara_rule behavioral1/memory/1512-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1512-13-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x0003000000022b7e-19.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE tmp240645390.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe tmp240645390.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_93281\javaw.exe tmp240645390.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe tmp240645390.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- tmp240645390.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe tmp240645390.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe tmp240645390.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- tmp240645390.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe tmp240645390.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- tmp240645390.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe tmp240645390.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe tmp240645390.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe tmp240645390.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- tmp240645390.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe tmp240645390.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- tmp240645390.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe tmp240645390.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe tmp240645390.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- tmp240645390.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- tmp240645390.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\144.0.3719.93\elevation_service.exe- tmp240645390.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe- tmp240645390.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe tmp240645390.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe tmp240645390.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE tmp240645390.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe tmp240645390.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe tmp240645390.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{B6A73AB1-30BD-4092-AEB0-C52DA4776C17}\MicrosoftEdge_X64_139.0.3405.125.exe- tmp240645390.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe tmp240645390.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- tmp240645390.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- tmp240645390.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe tmp240645390.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe tmp240645390.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe tmp240645390.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe tmp240645390.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe tmp240645390.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- tmp240645390.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe tmp240645390.exe File created C:\Program Files\Internet Explorer\ielowutil.exe tmp240645390.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe tmp240645390.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- tmp240645390.exe File created C:\Program Files\7-Zip\7z.exe- tmp240645390.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- tmp240645390.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- tmp240645390.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe tmp240645390.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE tmp240645390.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe tmp240645390.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe- tmp240645390.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- tmp240645390.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe tmp240645390.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe tmp240645390.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- tmp240645390.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe tmp240645390.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe tmp240645390.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE tmp240645390.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe tmp240645390.exe File created C:\Program Files\Internet Explorer\iexplore.exe tmp240645390.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- tmp240645390.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe tmp240645390.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- tmp240645390.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- tmp240645390.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe tmp240645390.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe tmp240645390.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- tmp240645390.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240645390.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-05_92cd62c8ec617237ede899d204655f22_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1512 wrote to memory of 1504 1512 2026-05-05_92cd62c8ec617237ede899d204655f22_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe 86 PID 1512 wrote to memory of 5064 1512 2026-05-05_92cd62c8ec617237ede899d204655f22_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-05_92cd62c8ec617237ede899d204655f22_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-05_92cd62c8ec617237ede899d204655f22_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\tmp240645390.exeC:\Users\Admin\AppData\Local\Temp\tmp240645390.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1504
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240645437.exeC:\Users\Admin\AppData\Local\Temp\tmp240645437.exe2⤵
- Executes dropped EXE
PID:5064
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 4.5MB
- SHA256 9020d2a54c6cce8f08615ecc98e1a9c11b898f9cc449db62f5901d989cce8bb9
- MD5 be58035f9d5ecbd4e85275479a4c6069
- SHA1 846a799b090face06fa930545bcc0ab60a304e01
- SHA512 9d5d90758bd21d734bae3add0eed4a6318d0f9b13d4f6990b343adf7951ea3fa5cc67a92df460f9e55a052d0e661d36ffbdee3be821440d6819c2f3e47f2ac31
- SSDEEP 98304:tUm8UyBv78HEFfNHX5rpiD0BTa3aLkBoVjo:z8U9EFfHp7B2qo
- TLSH T1C6269F21B5058278F15980B0A55EABB6C81CBD65037444CB77D0FE266EB2FC35B36FA2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240645390.exe
- Size 4.0MB
- SHA256 a76f0ed796fea980a685ac632ff056ca396c770dfe177129b83508459098786d
- MD5 1ab1b55ecfc428558427dd714c8cf593
- SHA1 7a99014201cb9686c3d91684ca71423e0a76897c
- SHA512 271c62bf87917e3e5184c4ae008b6bab8cb1f3ff7345960c20bbeb0235d9def53f3fa3a8b202256f9e3c05ed628c6c3d1d7c881e42974ed89b9151692366f23c
- SSDEEP 98304:5Um8UyBv78HEFfNHX5rpiD0BTa3aLkBoh:H8U9EFfHp7B2Q
- TLSH T1CD169E21B5098578F24D40B0A65DAA76C80CBD75037454DB77D0FE226EB2EC32B36FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240645437.exe
- Size 1.6MB
- SHA256 52452d8cceba90889cf11e9ac12be930839606196fd61f0dc7da98c694d9d5e4
- MD5 7be1cbe3357f110cd18e7af2db40f03f
- SHA1 c36bd53bd5a286b71f4ee8ad75a95c3e7a66cf77
- SHA512 c639b8716a27a54898ead7af006c0bf0494820ad9ca1f7d6a75f8b08a8c8ed98bb7bb62ec99faa7af40b5ccafe38a672502cbd576f8b496f79bebdf0f8a0e9f7
- SSDEEP 12288:1KkhgjI45iKl98Pbw7nw/mMuhylcsd4a4p4++F+zzNXvDFT7cOO2kDpvoSer5+nF:rgjI45bl9Mbonwap41+zzPTThwv3EJY
- TLSH T12D75B23271E2049AC68D9072DF46963597D13CBD8FF193F7B14572C92B729D03A3AA0A
- MD5 SHA1 SHA512 SSDEEP TLSH