Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/05/2026, 04:08
Behavioral task
behavioral1
Sample
2026-05-05_92cd62c8ec617237ede899d204655f22_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-05_92cd62c8ec617237ede899d204655f22_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-05-05_92cd62c8ec617237ede899d204655f22_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
- Size 5.6MB
- Sample260505-eqjacab18p
- SHA256 b3ecfe461eab2ff945946ed1402be0edc9c03bac369a2d144fcd651caa64f952
- MD5 92cd62c8ec617237ede899d204655f22
- SHA1 e3e34636acfdb1b34598055b8d3e0ecea167426f
- SHA512 fb66ea95e056734837a757f797d1a66d97bf4873c2463ebe7ef4d921f08ae84324a72e8658db875981de71e39c6001e9c9ff51e55a315dbb25042779ba9ec385
- SSDEEP 98304:tUm8UyBv78HEFfNHX5rpiD0BTa3aLkBoJLapI:z8U9EFfHp7B2scI
- TLSH T18B469E2271964479E24D8071EF1A9B31C6C87C794BF041E77780BAD52FB2AC23B36B56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Fesber payload 9 IoCs
resource yara_rule behavioral2/files/0x000e000000028e7a-4.dat family_fesber behavioral2/files/0x000300000002a19d-19.dat family_fesber behavioral2/memory/1820-1609-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1820-2201-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1820-2204-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1820-2207-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1820-2210-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1820-2222-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1820-2234-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" tmp240652421.exe - Executes dropped EXE 2 IoCs
pid Process 1820 tmp240652421.exe 3160 tmp240652437.exe - Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240652421.exe File created C:\Windows\SysWOW64\fsb.stb tmp240652421.exe File created C:\Windows\SysWOW64\fsb.tmp tmp240652421.exe -
resource yara_rule behavioral2/memory/4968-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4968-11-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x000300000002a19d-19.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe tmp240652421.exe File created C:\Program Files\Internet Explorer\ielowutil.exe tmp240652421.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe tmp240652421.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe tmp240652421.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe tmp240652421.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe tmp240652421.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe tmp240652421.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- tmp240652421.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe tmp240652421.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- tmp240652421.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe- tmp240652421.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe tmp240652421.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe tmp240652421.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- tmp240652421.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe tmp240652421.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- tmp240652421.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- tmp240652421.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe tmp240652421.exe File created C:\Program Files\dotnet\dotnet.exe- tmp240652421.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- tmp240652421.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- tmp240652421.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- tmp240652421.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- tmp240652421.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- tmp240652421.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe tmp240652421.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe tmp240652421.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe tmp240652421.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe tmp240652421.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe tmp240652421.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe tmp240652421.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe tmp240652421.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- tmp240652421.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe tmp240652421.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe tmp240652421.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE tmp240652421.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe tmp240652421.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe tmp240652421.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- tmp240652421.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe- tmp240652421.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- tmp240652421.exe File created C:\Program Files\Internet Explorer\iexplore.exe tmp240652421.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- tmp240652421.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe tmp240652421.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- tmp240652421.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- tmp240652421.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164515\java.exe tmp240652421.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- tmp240652421.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe tmp240652421.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe tmp240652421.exe File created C:\Program Files\Internet Explorer\ieinstal.exe tmp240652421.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- tmp240652421.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe tmp240652421.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE tmp240652421.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe- tmp240652421.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- tmp240652421.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- tmp240652421.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe tmp240652421.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- tmp240652421.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- tmp240652421.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- tmp240652421.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- tmp240652421.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe tmp240652421.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe tmp240652421.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- tmp240652421.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-05_92cd62c8ec617237ede899d204655f22_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240652421.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4968 wrote to memory of 1820 4968 2026-05-05_92cd62c8ec617237ede899d204655f22_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe 78 PID 4968 wrote to memory of 3160 4968 2026-05-05_92cd62c8ec617237ede899d204655f22_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-05_92cd62c8ec617237ede899d204655f22_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-05_92cd62c8ec617237ede899d204655f22_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\tmp240652421.exeC:\Users\Admin\AppData\Local\Temp\tmp240652421.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1820
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240652437.exeC:\Users\Admin\AppData\Local\Temp\tmp240652437.exe2⤵
- Executes dropped EXE
PID:3160
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 4.5MB
- SHA256 9020d2a54c6cce8f08615ecc98e1a9c11b898f9cc449db62f5901d989cce8bb9
- MD5 be58035f9d5ecbd4e85275479a4c6069
- SHA1 846a799b090face06fa930545bcc0ab60a304e01
- SHA512 9d5d90758bd21d734bae3add0eed4a6318d0f9b13d4f6990b343adf7951ea3fa5cc67a92df460f9e55a052d0e661d36ffbdee3be821440d6819c2f3e47f2ac31
- SSDEEP 98304:tUm8UyBv78HEFfNHX5rpiD0BTa3aLkBoVjo:z8U9EFfHp7B2qo
- TLSH T1C6269F21B5058278F15980B0A55EABB6C81CBD65037444CB77D0FE266EB2FC35B36FA2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240652421.exe
- Size 4.0MB
- SHA256 a76f0ed796fea980a685ac632ff056ca396c770dfe177129b83508459098786d
- MD5 1ab1b55ecfc428558427dd714c8cf593
- SHA1 7a99014201cb9686c3d91684ca71423e0a76897c
- SHA512 271c62bf87917e3e5184c4ae008b6bab8cb1f3ff7345960c20bbeb0235d9def53f3fa3a8b202256f9e3c05ed628c6c3d1d7c881e42974ed89b9151692366f23c
- SSDEEP 98304:5Um8UyBv78HEFfNHX5rpiD0BTa3aLkBoh:H8U9EFfHp7B2Q
- TLSH T1CD169E21B5098578F24D40B0A65DAA76C80CBD75037454DB77D0FE226EB2EC32B36FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240652437.exe
- Size 1.6MB
- SHA256 52452d8cceba90889cf11e9ac12be930839606196fd61f0dc7da98c694d9d5e4
- MD5 7be1cbe3357f110cd18e7af2db40f03f
- SHA1 c36bd53bd5a286b71f4ee8ad75a95c3e7a66cf77
- SHA512 c639b8716a27a54898ead7af006c0bf0494820ad9ca1f7d6a75f8b08a8c8ed98bb7bb62ec99faa7af40b5ccafe38a672502cbd576f8b496f79bebdf0f8a0e9f7
- SSDEEP 12288:1KkhgjI45iKl98Pbw7nw/mMuhylcsd4a4p4++F+zzNXvDFT7cOO2kDpvoSer5+nF:rgjI45bl9Mbonwap41+zzPTThwv3EJY
- TLSH T12D75B23271E2049AC68D9072DF46963597D13CBD8FF193F7B14572C92B729D03A3AA0A
- MD5 SHA1 SHA512 SSDEEP TLSH