Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 07:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe
- Size 13.3MB
- Sample260718-jqvqlags8x
- SHA256 8561abacea0328f5b57fac12ea79d7a61bea21f77f08dc3139367da12a0d8a78
- MD5 5d4e87e815e2623d8a003c01ad13457a
- SHA1 38e8ea83bcb3635de2a4575e447185e9a3783ce5
- SHA512 d33c52329ddf70ff3b22f3b1b6fd5f29c7d4176d9ca313af2399805e82e2f9cd9d06e8972ff0db5f413cff07a7098e8c55741784bb8515aa7d535f1d13d77c5f
- SSDEEP 196608:cEfXTakjrdoHVpCEucu0IyHVoHQ+Gg3+h8idkg3DU/0MXbp6XR/OrfqjYS4O7NAs:cmX9d0pCEAHh+j/3woh/N7r
- TLSH T1E2E6C0107A4E407AD4A25170892BAE7BE3BDFC600B3545DB52947B2E2F337C31A3A756
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing many IR and analysis tools 2 IoCs
resource yara_rule behavioral2/files/0x000d00000001c4ed-16.dat INDICATOR_SUSPICIOUS_References_SecTools behavioral2/files/0x000e00000001c4e5-21.dat INDICATOR_SUSPICIOUS_References_SecTools - Executes dropped EXE 6 IoCs
pid Process 3376 LFPD.exe 5124 LFPD64.exe 5324 Process not Found 5100 Process not Found 2624 Process not Found 3744 Process not Found - Loads dropped DLL 3 IoCs
pid Process 3376 LFPD.exe 5124 LFPD64.exe 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFPD.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe Token: SeRestorePrivilege 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe Token: SeSecurityPrivilege 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe Token: SeBackupPrivilege 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe Token: SeTakeOwnershipPrivilege 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe Token: SeRestorePrivilege 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe Token: SeSecurityPrivilege 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe Token: SeBackupPrivilege 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe Token: SeDebugPrivilege 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe Token: SeAssignPrimaryTokenPrivilege 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe Token: SeDebugPrivilege 3376 LFPD.exe Token: SeAssignPrimaryTokenPrivilege 3376 LFPD.exe Token: SeBackupPrivilege 3376 LFPD.exe Token: SeChangeNotifyPrivilege 3376 LFPD.exe Token: SeCreateGlobalPrivilege 3376 LFPD.exe Token: 35 3376 LFPD.exe Token: SeSecurityPrivilege 3376 LFPD.exe Token: SeCreateTokenPrivilege 3376 LFPD.exe Token: SeImpersonatePrivilege 3376 LFPD.exe Token: SeTakeOwnershipPrivilege 3376 LFPD.exe Token: SeRestorePrivilege 3376 LFPD.exe Token: SeManageVolumePrivilege 3376 LFPD.exe Token: SeLoadDriverPrivilege 3376 LFPD.exe Token: SeSystemtimePrivilege 3376 LFPD.exe Token: SeShutdownPrivilege 3376 LFPD.exe Token: SeRemoteShutdownPrivilege 3376 LFPD.exe Token: SeDebugPrivilege 5124 LFPD64.exe Token: SeAssignPrimaryTokenPrivilege 5124 LFPD64.exe Token: SeBackupPrivilege 5124 LFPD64.exe Token: SeChangeNotifyPrivilege 5124 LFPD64.exe Token: SeCreateGlobalPrivilege 5124 LFPD64.exe Token: 35 5124 LFPD64.exe Token: SeSecurityPrivilege 5124 LFPD64.exe Token: SeCreateTokenPrivilege 5124 LFPD64.exe Token: SeImpersonatePrivilege 5124 LFPD64.exe Token: SeTakeOwnershipPrivilege 5124 LFPD64.exe Token: SeRestorePrivilege 5124 LFPD64.exe Token: SeManageVolumePrivilege 5124 LFPD64.exe Token: SeLoadDriverPrivilege 5124 LFPD64.exe Token: SeSystemtimePrivilege 5124 LFPD64.exe Token: SeShutdownPrivilege 5124 LFPD64.exe Token: SeRemoteShutdownPrivilege 5124 LFPD64.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe 3376 LFPD.exe 5124 LFPD64.exe 3376 LFPD.exe 3376 LFPD.exe 3376 LFPD.exe 3376 LFPD.exe 3376 LFPD.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe 5124 LFPD64.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4976 wrote to memory of 3376 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe 89 PID 4976 wrote to memory of 5124 4976 2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_5d4e87e815e2623d8a003c01ad13457a_amadey_cobalt-strike_darkgate_elex_icedid_luca-stealer_m.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\LFPD.exe"C:\Users\Admin\AppData\Local\Temp\LFPD.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3376
-
-
C:\Users\Admin\AppData\Local\Temp\LFPD64.exe"C:\Users\Admin\AppData\Local\Temp\LFPD64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5124
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\LFPD.exe
- Size 883KB
- SHA256 322f4fab4279c0785a79f6a7f7cc54699083e26a7e3f602f6c374acaa21404aa
- MD5 331a4c36aaca21389daab1e7185c5521
- SHA1 5bc6edadc431a4e2b2d084559161eece421c8a94
- SHA512 035a1b844ed08b0ed78add98f5996c6734ab3952454d5fe0c0fd92d8dc072984d5a5a45d3fc623e7b534e15631865d3e48d79b75386c5714102b6910e769fbd8
- SSDEEP 24576:OEGhorYdp2fbIq+XWfuTR0m+gZPpa2R04S9mjmy:MhorYd4fbOmfudPrMO
- TLSH T12C159D29B612F47AC47146F06C2CEEAA712FBC240F755ADBB3C47B2D09702D05B35A66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\LFPD64.exe
- Size 986KB
- SHA256 7533e44cc09f775a9f3be894552457391dcc722cf7049d2f5914532f9f7380c2
- MD5 756d106f778c34f564cdc4a3d53e852b
- SHA1 235b144dfc2150359f7961322b144217e2dd198b
- SHA512 9c9a5e9921b1046488f62d94bfc52353930c552a1eb03a986316b746332f91b4622283c7f5801af7cccda83249a2b304a2602237424c76934c92c7e2ec0b36e3
- SSDEEP 24576:V4ZFGDmlDVyoXWypiQdv+AdzWh2R04Bm7mA:QFtZNziQ7f6
- TLSH T12E257C1AB79801ECE066D1399942496AF7B67C161B70A7CF22907B6E1F7B2D04E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\fphd.dll
- Size 2.2MB
- SHA256 7aca130c165fee3525ec3bb9f1708573fd6e92059dac5b825bf24149371ae55e
- MD5 2a29711730809209198d432115518ca2
- SHA1 a4acede24f9510180288e1114ea9af6b7af2c9f5
- SHA512 86d2ad6530d4c69eae91db7900851d1bf9d3028e6002b13f654d2a355dea4591de8d162a3d69845cb0a61f4e35dabe7f9fb0e1d81460ac1f8cbbf6c1199941b5
- SSDEEP 49152:m0Lf/KGg0xcksTuxN2+YpUp74iACkJto1vF3twUMeVtU/0MXMe5du:d+Gg0LsTKk+YpUp74idkg9XJVtU/0MXW
- TLSH T130B59EA037480C67D16B77704538BBBBE2EC6170873941F7D29A963D3E314837A256AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\fphd64.dll
- Size 2.7MB
- SHA256 2546e1ef289bafed1dffa2b5094a56529e3e076e038eb2b35e55654ecec463c6
- MD5 be45271335a70522ac2288ac7ea8e825
- SHA1 4541df16815b59021480f5232b3a473dc59c96b4
- SHA512 4840a140ade24318d87c658203291073f4aff836a247bd26d5a49eade7ea8cfe155f0e4a328ba8576fc79017d09ccbf38c4b10721eaf0d92d7d4f95cf4697248
- SSDEEP 49152:KLUDBedqGQ9YoOhJOml73nUYnuUcMFFGB1efL5ddBWLTvvLGcFsYoc8tL:qy0l5dETGcXR4
- TLSH T197D55B49A2ED4096E5A6E078C9274D2FD7F2FC410274C3CF11669B5E5FB3BA2062E352
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\AddDisk\Logs\2026-07-18.log
- Size 185B
- SHA256 0036d6fe6055dd25b5c32253285f5e9067fc16fa858db99f3b8f5ea81e769e63
- MD5 e40a07caa8c56f7f4143a5dd5837897c
- SHA1 8debda6ce8127752dddf00b7e9bd55939829aab6
- SHA512 33d55981d8ce67d9d7bc1337055109fe2abc8c2eab927e949227be455c9b50a5c3da1cbf86802802f5b2fb629c072b0b27bacb5798cca5fd4561f39955c77e2b
- TLSH T150C012D9325A611156D805678EE41B45D9EDF033B54A44F0FBD464060781C0607AC5B0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\File-Protection-System\Logs\2026-07-18.log
- Size 76B
- SHA256 7f495672088b5d83e084f1d7721944919330e8e83f931b5847d5467cc42979b0
- MD5 4459a8461b909d16051c6ed2686c2cf8
- SHA1 2f03245c6491227830e5257c5e158d551a54f940
- SHA512 c48bbd280b2267c96fb08e24ff8f3c0458fe73d299dcb11448012cea69b6da4666ccaf61f172235789ab8a139d0b8b889cc68ecd5d76e7904fb79d641e4a646c
- TLSH T144A0028A30A342200080064AC8202A0AC8CFF4A3F2CC023DF3E8301303CAC42E9882A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\File-Protection-System\Logs\2026-07-18.log
- Size 370B
- SHA256 f01b180bc731602dfc7a6aac2ac281492b00552cc0785326e1620a91e9b50901
- MD5 47a6cf229743cda1d4f739f5be613c58
- SHA1 4cfc4df2636fa32bc92ee69d1a5953a84d30d95f
- SHA512 72c7950477b6ed99c901f267a25a3dbdca6b6bb2b60e3143f718cff43ed3de7b4fbbd834f87c8ac28be33ceab56afb5fe03d885a710220848951e8ebed5c6411
- TLSH T1BAE0B68A647383200281065AD9612E4BD9CEF4A3F29D877DB7F4350A47C6D067988795
- MD5 SHA1 SHA512 TLSH