c4a607e0c565f611fb11bd410d360c7fedbe8848a872c32c876bff11fc34b338

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 16:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_466067c1a82460e0ae5a168dc7ed1e4c_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
Size 8.0MB
Sample260711-t3vapsfs4j
SHA256 c4a607e0c565f611fb11bd410d360c7fedbe8848a872c32c876bff11fc34b338
MD5 466067c1a82460e0ae5a168dc7ed1e4c
SHA1 5732b3757966576ec29baf7b4a564ea4d1fdf2cc
SHA512 83e727d5101191677d490eb6f1eba930e19a6cc1d8273f1c171be69f5f2cd86f129a7412a8fbeb2ca9f1974d20a42f31deaa451a720fff661296fd40d1ebd252
SSDEEP 98304:uKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUvybl7PLA4TM:uquFIF0wuPlCKrjR+zAD
TLSH
T19386AF1273D84135F1B31631DA3592556A3ABCA55F33CA8F32882D5E6BB1680CE3A737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

ransomware spyware stealer

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/files/0x000b0000000170ab-6.dat	INDICATOR_EXE_Packed_Fody

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000b0000000170ab-6.dat	autoit_exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\HelpPane.exe	2026-07-11_466067c1a82460e0ae5a168dc7ed1e4c_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
File created	C:\Windows\hh.exe	2026-07-11_466067c1a82460e0ae5a168dc7ed1e4c_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
File created	C:\Windows\notepad.exe	2026-07-11_466067c1a82460e0ae5a168dc7ed1e4c_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
File created	C:\Windows\regedit.exe	2026-07-11_466067c1a82460e0ae5a168dc7ed1e4c_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
File created	C:\Windows\splwow64.exe	2026-07-11_466067c1a82460e0ae5a168dc7ed1e4c_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
File created	C:\Windows\winhlp32.exe	2026-07-11_466067c1a82460e0ae5a168dc7ed1e4c_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
File created	C:\Windows\bfsvc.exe	2026-07-11_466067c1a82460e0ae5a168dc7ed1e4c_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
File created	C:\Windows\explorer.exe	2026-07-11_466067c1a82460e0ae5a168dc7ed1e4c_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5696	notepad.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5888 wrote to memory of 5696	5888	2026-07-11_466067c1a82460e0ae5a168dc7ed1e4c_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-11_466067c1a82460e0ae5a168dc7ed1e4c_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_466067c1a82460e0ae5a168dc7ed1e4c_agent-tesla_amadey_cobalt-strike_darkgate_glassworm_hawk.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\WEL8C87.tmp
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 8.4MB
SHA256 ad9f29da95376f5ae406446975357e4952e4932625675a74676f14d334fcef85
MD5 f50e05b84707fca51375fede834c0f51
SHA1 70fb3698afb2ec7ef68489f6df80d2a96a8e1ea8
SHA512 70f4c0dcb84ef1b79a9218359e31b24df88e1a839361733be87476bf765d7011dc336ad9feb3331b75f60c822f23d52140833e755a92fdd2d669f9734b38c92d
SSDEEP 98304:uKRuy5a/OU/jIEeQfoR/IuOFVjUu55K2cPK8xi+4jR4TUvybl7PLA4TCPF:uquFIF0wuPlCKrjR+zAbP
TLSH
T1CD96AF1273D84035F1B31631DA3592556A7ABCA95F32C99F32882D5E2FB1680CE3A737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WEL8C87.tmp

Path C:\Users\Admin\AppData\Local\Temp\WEL8C87.tmp
Size 52B
SHA256 be0909be27235c36586ceb9b7e37d8d74c423d9460c4dbf0e2417fcf58b96caa
MD5 17ddbb82a40e2ac704e1045da8fb1cf6
SHA1 a570cdbc16483567fe1439903b212e33b15343b7
SHA512 031adfce17522c42262d40acb75f1db7a1942e4965ab505ee3a5b7001e07a3f16182a4093a3e9a3b99b50860bbc66205a9956b4d8da76adb823054aae6598da2
TLSH
T1449002F35491D6301587051611E8118616566D9675199405E00811251AB56520515DDA
MD5 SHA1 SHA512 TLSH