Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 14:18
Behavioral task
behavioral1
Sample
2026-05-11_ed15c826aa90769c7ee8d0de618a1166_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_ed15c826aa90769c7ee8d0de618a1166_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-05-11_ed15c826aa90769c7ee8d0de618a1166_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
- Size 10.1MB
- Sample260511-rmgnkacs2z
- SHA256 9ab1b5f6c0786c2afb03c4b2332db3ce8ea45a9c98e16bcf404c409fbc5d71b5
- MD5 ed15c826aa90769c7ee8d0de618a1166
- SHA1 a8515fa83a27f370fe615d69054b9f8e22222227
- SHA512 d20873bd173f3f93c818ce0c1dde5bf6318ee7e2ad247093523247eb4fd71739f03675193f95a3dcf8d36526d71a79171daba87befeb818cf7fdaa1a9208e516
- SSDEEP 98304:mRPRRdXddmi78gkwodIo6qzBPxNSslf5maDjo:mFRnXdUyqzBHzoano
- TLSH T1D5B60911B5A88FA9C06FD074C98265A69A333C464F319FCF0580BE293E766E55E3532F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Fesber payload 12 IoCs
resource yara_rule behavioral2/files/0x000e000000028e1b-3.dat family_fesber behavioral2/files/0x001900000002b46a-15.dat family_fesber behavioral2/files/0x000400000002a198-18.dat family_fesber behavioral2/memory/2612-903-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2612-1786-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2612-2192-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2612-2193-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2612-2194-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2612-2198-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2612-2200-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2612-2201-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2612-2202-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" tmp240663421.exe - Executes dropped EXE 2 IoCs
pid Process 2612 tmp240663421.exe 1656 tmp240663437.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsb.stb tmp240663421.exe File created C:\Windows\SysWOW64\fsb.tmp tmp240663421.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240663421.exe -
resource yara_rule behavioral2/memory/1176-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1176-10-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x000400000002a198-18.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe tmp240663421.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe tmp240663421.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE tmp240663421.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- tmp240663421.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- tmp240663421.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE tmp240663421.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe tmp240663421.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe tmp240663421.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- tmp240663421.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- tmp240663421.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe tmp240663421.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- tmp240663421.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- tmp240663421.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- tmp240663421.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- tmp240663421.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe tmp240663421.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- tmp240663421.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe tmp240663421.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- tmp240663421.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe tmp240663421.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe tmp240663421.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- tmp240663421.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- tmp240663421.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- tmp240663421.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- tmp240663421.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe tmp240663421.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_166656\java.exe- tmp240663421.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- tmp240663421.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe tmp240663421.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- tmp240663421.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- tmp240663421.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- tmp240663421.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- tmp240663421.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- tmp240663421.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- tmp240663421.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe tmp240663421.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe tmp240663421.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- tmp240663421.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe tmp240663421.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe tmp240663421.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe tmp240663421.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe tmp240663421.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe tmp240663421.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- tmp240663421.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE tmp240663421.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- tmp240663421.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe tmp240663421.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe- tmp240663421.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe tmp240663421.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- tmp240663421.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe- tmp240663421.exe File created C:\Program Files\Internet Explorer\ExtExport.exe tmp240663421.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- tmp240663421.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- tmp240663421.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe- tmp240663421.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe tmp240663421.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe tmp240663421.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe- tmp240663421.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- tmp240663421.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- tmp240663421.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- tmp240663421.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe- tmp240663421.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- tmp240663421.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- tmp240663421.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_ed15c826aa90769c7ee8d0de618a1166_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240663421.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1176 wrote to memory of 2612 1176 2026-05-11_ed15c826aa90769c7ee8d0de618a1166_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe 80 PID 1176 wrote to memory of 1656 1176 2026-05-11_ed15c826aa90769c7ee8d0de618a1166_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_ed15c826aa90769c7ee8d0de618a1166_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_ed15c826aa90769c7ee8d0de618a1166_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\tmp240663421.exeC:\Users\Admin\AppData\Local\Temp\tmp240663421.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2612
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240663437.exeC:\Users\Admin\AppData\Local\Temp\tmp240663437.exe2⤵
- Executes dropped EXE
PID:1656
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 10.1MB
- SHA256 9ab1b5f6c0786c2afb03c4b2332db3ce8ea45a9c98e16bcf404c409fbc5d71b5
- MD5 ed15c826aa90769c7ee8d0de618a1166
- SHA1 a8515fa83a27f370fe615d69054b9f8e22222227
- SHA512 d20873bd173f3f93c818ce0c1dde5bf6318ee7e2ad247093523247eb4fd71739f03675193f95a3dcf8d36526d71a79171daba87befeb818cf7fdaa1a9208e516
- SSDEEP 98304:mRPRRdXddmi78gkwodIo6qzBPxNSslf5maDjo:mFRnXdUyqzBHzoano
- TLSH T1D5B60911B5A88FA9C06FD074C98265A69A333C464F319FCF0580BE293E766E55E3532F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240663421.exe
- Size 9.5MB
- SHA256 af9c0f9034a49150bcc64a612f0bbd111cf5b4fcd6e4e2ec59bbf3193c85f029
- MD5 25c1b054cca3b7a456ec2372d5fda7ab
- SHA1 368629ad7c223c18e4721cf76d08f4c094af9fe6
- SHA512 fa38cfb2eca94ec0aa2b1ae8f80cfa8e924cd719a361c0a7225bbf0893180f48f2f509cc98d0a7fc9f331b072e9a0c52806dc36ada7c378f324deed9dfbf3cfb
- SSDEEP 98304:IRPRRdXddmi78gkwodIo6qzBPxNSslf5ma:IFRnXdUyqzBHzoa
- TLSH T17EA6081175A88FA9C06FD074C98265A69A337C468F319FCF0580BE293E766E45E3532F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240663437.exe
- Size 549KB
- SHA256 707f415d7d581edd9bce99a0429ad4629d3be0316c329e8b9ebd576f7ab50b71
- MD5 0b24892597dcb0257cdb78b5ed165218
- SHA1 5fe5d446406ff1e34d2fe3ee347769941636e323
- SHA512 24ea9e0f10a283e67850070976c81ae4b2d4d9bb92c6eb41b2557ad3ae02990287531a619cf57cd257011c6770d4c25dd19c3c0e46447eb4d0984d50d869e56f
- SSDEEP 6144:vXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4zrr8:vXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
- TLSH T1C1C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\fsb.tmp
- Size 9.5MB
- SHA256 f9c205ac0350b27e6e2c9055194ecb3d8fd6efac952fe8a0eaf871f1dcca7fe4
- MD5 4b98261d7f1da3bcbdebcaa5c2556312
- SHA1 85bc2792162c4dc17d2a9f848f70fe3176534459
- SHA512 424f952752f88fb1f2f5519848efe4125007369c815a6a42c504fac24985ad225de3b09c527f9acb8aea78934aa768d3c8ecef7483bdc17448b6f5272e289520
- SSDEEP 98304:IRPRRdXddmi78gkwodIo6qzBPxNSslf3ma:IFRnXdUyqzBHz2a
- TLSH T109A6081175A88FA9C06FD074C98265A69A337C468F319FCF0580BE293E766E45E3532F
- MD5 SHA1 SHA512 SSDEEP TLSH