941a8c5da5d9cb23be26b98a1b6cba17695dfed85ee15900097b920cea58ffd1

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_81330e5fd65e6ff63f7d98785a24d645_amadey_cobalt-strike_darkgate_satacom_stealc_stop_vidar.exe
Size 2.3MB
Sample260523-aefymabv2x
SHA256 941a8c5da5d9cb23be26b98a1b6cba17695dfed85ee15900097b920cea58ffd1
MD5 81330e5fd65e6ff63f7d98785a24d645
SHA1 d4c9137d2d70735e9d6e8667be29c1dda7bfd4c1
SHA512 f27840bbf7d4c6d200bd97ff9ad32a8f1f237ce22a33cbe51a4f6f9f65a29021bbc5c9e270847058842c12451629d92192e217e4f63dbf0ff925a72945a05abf
SSDEEP 24576:/j9jiUfj9jiUwenbtkJxdmvgLGj9jiUfj9jiUwenbtkJxdmvgLPafDd70iTWC7:4b7enbYdmI7b7enbYdmIwDd79WC7
TLSH
T1E4B55B11EBE89277F1B25630C97681619E327C659B7096CF3384B96E2F336C09DB4B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

ransomware spyware stealer

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x000d000000026018-6.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\bfsvc.exe	2026-05-22_81330e5fd65e6ff63f7d98785a24d645_amadey_cobalt-strike_darkgate_satacom_stealc_stop_vidar.exe
File created	C:\Windows\explorer.exe	2026-05-22_81330e5fd65e6ff63f7d98785a24d645_amadey_cobalt-strike_darkgate_satacom_stealc_stop_vidar.exe
File created	C:\Windows\HelpPane.exe	2026-05-22_81330e5fd65e6ff63f7d98785a24d645_amadey_cobalt-strike_darkgate_satacom_stealc_stop_vidar.exe
File created	C:\Windows\hh.exe	2026-05-22_81330e5fd65e6ff63f7d98785a24d645_amadey_cobalt-strike_darkgate_satacom_stealc_stop_vidar.exe
File created	C:\Windows\notepad.exe	2026-05-22_81330e5fd65e6ff63f7d98785a24d645_amadey_cobalt-strike_darkgate_satacom_stealc_stop_vidar.exe
File created	C:\Windows\regedit.exe	2026-05-22_81330e5fd65e6ff63f7d98785a24d645_amadey_cobalt-strike_darkgate_satacom_stealc_stop_vidar.exe
File created	C:\Windows\write.exe	2026-05-22_81330e5fd65e6ff63f7d98785a24d645_amadey_cobalt-strike_darkgate_satacom_stealc_stop_vidar.exe
File created	C:\Windows\splwow64.exe	2026-05-22_81330e5fd65e6ff63f7d98785a24d645_amadey_cobalt-strike_darkgate_satacom_stealc_stop_vidar.exe
File created	C:\Windows\winhlp32.exe	2026-05-22_81330e5fd65e6ff63f7d98785a24d645_amadey_cobalt-strike_darkgate_satacom_stealc_stop_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
800	notepad.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 800	1656	2026-05-22_81330e5fd65e6ff63f7d98785a24d645_amadey_cobalt-strike_darkgate_satacom_stealc_stop_vidar.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-22_81330e5fd65e6ff63f7d98785a24d645_amadey_cobalt-strike_darkgate_satacom_stealc_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_81330e5fd65e6ff63f7d98785a24d645_amadey_cobalt-strike_darkgate_satacom_stealc_stop_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\WEL3C29.tmp
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 2.8MB
SHA256 e438b243af754dda5a6452ab54167640fe29a1f2efbf58eff53b3a655e96bac1
MD5 1e89c280273cf0ecd3d051b93d4384c9
SHA1 37ff07807a7aabe51615063c63e088c68ee78467
SHA512 68fa59aa6ae45a241ff1d0361e3299887286fd51f52501bc0ab9ed69f3e1adb903e23c9b78ee56832e1af561804bef0b74f329b6faa8694115d5198475da8ceb
SSDEEP 49152:4b7enbYdmI7b7enbYdmIwDd79WCzUasqc:5p7VPF
TLSH
T16DD57D11EBE48237E1B24630C9768161AE327C655B30C6DF3384BD6E2F766D09EB5B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WEL3C29.tmp

Path C:\Users\Admin\AppData\Local\Temp\WEL3C29.tmp
Size 52B
SHA256 be0909be27235c36586ceb9b7e37d8d74c423d9460c4dbf0e2417fcf58b96caa
MD5 17ddbb82a40e2ac704e1045da8fb1cf6
SHA1 a570cdbc16483567fe1439903b212e33b15343b7
SHA512 031adfce17522c42262d40acb75f1db7a1942e4965ab505ee3a5b7001e07a3f16182a4093a3e9a3b99b50860bbc66205a9956b4d8da76adb823054aae6598da2
TLSH
T1449002F35491D6301587051611E8118616566D9675199405E00811251AB56520515DDA
MD5 SHA1 SHA512 TLSH