Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 05:03
Behavioral task
behavioral1
Sample
2026-08-01_8502ab04a2ace45b8138bdb3174fd919_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_8502ab04a2ace45b8138bdb3174fd919_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-01_8502ab04a2ace45b8138bdb3174fd919_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 8.2MB
- Sample260801-fpr2jaybrf
- SHA256 63c8004f450691eca0c12d8ba4a3eb372e2d392a98fa67fcb517ac72ead173a9
- MD5 8502ab04a2ace45b8138bdb3174fd919
- SHA1 5808be6b34bcb85f75ccce7e7d15ef0d5d094685
- SHA512 7cabf653b7d34975bfbcfc0d2f8a764caf04c4f9d02fa2d4eca34fd0c305757765c37e40874499afbca7e598d37b76efb7e79a302e09aab1456d48127a9d5cef
- SSDEEP 196608:q18Uhjok2S9+ULdNPtbuPZOOmnqogHh/:e6k2SlLdNPt6ROOmqZ
- TLSH T1EC96DF2EFB944076D02B817689549226E972FC6197349BCB1384B71CBF366C36F36362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Fesber payload 10 IoCs
resource yara_rule behavioral2/files/0x0009000000019cc0-4.dat family_fesber behavioral2/files/0x000c00000001c5e0-12.dat family_fesber behavioral2/memory/2380-639-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2380-1072-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2380-1289-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2380-1290-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2380-1291-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2380-1292-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2380-1295-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2380-1299-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" tmp240738031.exe - Executes dropped EXE 2 IoCs
pid Process 2380 tmp240738031.exe 252 tmp240738093.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsb.stb tmp240738031.exe File created C:\Windows\SysWOW64\fsb.tmp tmp240738031.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240738031.exe -
resource yara_rule behavioral2/memory/4628-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x000c00000001c5e0-12.dat upx behavioral2/memory/4628-19-0x0000000000400000-0x000000000041F000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe tmp240738031.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe tmp240738031.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- tmp240738031.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- tmp240738031.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe tmp240738031.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- tmp240738031.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe tmp240738031.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- tmp240738031.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- tmp240738031.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe tmp240738031.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe tmp240738031.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- tmp240738031.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE tmp240738031.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE tmp240738031.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe tmp240738031.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- tmp240738031.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe tmp240738031.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{9A8DEEB6-1F0A-4CF4-BD83-A8EC662094A8}\MicrosoftEdge_X64_139.0.3405.125.exe tmp240738031.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe tmp240738031.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- tmp240738031.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe tmp240738031.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe tmp240738031.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- tmp240738031.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe tmp240738031.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe tmp240738031.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- tmp240738031.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- tmp240738031.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe tmp240738031.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- tmp240738031.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- tmp240738031.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- tmp240738031.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- tmp240738031.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe tmp240738031.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe tmp240738031.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- tmp240738031.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe tmp240738031.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- tmp240738031.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- tmp240738031.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- tmp240738031.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- tmp240738031.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- tmp240738031.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe tmp240738031.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe- tmp240738031.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- tmp240738031.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe- tmp240738031.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- tmp240738031.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- tmp240738031.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- tmp240738031.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe tmp240738031.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe tmp240738031.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe tmp240738031.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe tmp240738031.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe tmp240738031.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- tmp240738031.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- tmp240738031.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe tmp240738031.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe tmp240738031.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe- tmp240738031.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE tmp240738031.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- tmp240738031.exe File created C:\Program Files\7-Zip\7z.exe tmp240738031.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- tmp240738031.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- tmp240738031.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE tmp240738031.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2744 252 WerFault.exe 90 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_8502ab04a2ace45b8138bdb3174fd919_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240738031.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240738093.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4628 wrote to memory of 2380 4628 2026-08-01_8502ab04a2ace45b8138bdb3174fd919_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe 88 PID 4628 wrote to memory of 252 4628 2026-08-01_8502ab04a2ace45b8138bdb3174fd919_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_8502ab04a2ace45b8138bdb3174fd919_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_8502ab04a2ace45b8138bdb3174fd919_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\tmp240738031.exeC:\Users\Admin\AppData\Local\Temp\tmp240738031.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2380
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240738093.exeC:\Users\Admin\AppData\Local\Temp\tmp240738093.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:252 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 252 -s 4723⤵
- Program crash
PID:2744
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 252 -ip 2521⤵PID:1368
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 2.6MB
- SHA256 8de8ece50a61d5502f96bbed39b6ec8dafaa2321a60260d14fed0cf6378d961d
- MD5 5e9e4e8922b6758edf36c521424c7896
- SHA1 a868c8e99dfecce54e3a1ec8db7732931bfcc910
- SHA512 cf517d1c4978f7a54d7106db9b5a5eeb421e17710eea7b0cfa18064175b401b1cd32f8295b5813edb7630aa0883ecf3fe6c9375de85c0818812e443c764a1de4
- SSDEEP 49152:b0/7t0i0FZaUm8cikLRPji0nPji0AjTPji0Aj:qnUm8UVjnjoHjo
- TLSH T100C55C16F6A443B5D077C0B9C6D2965AE9723C4217309ACB0291F76C2F37AE58B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240738031.exe
- Size 2.0MB
- SHA256 9a73f693d8ea50a58e8792f6d3a73e84d12061255faadff542b63ca9bd85a0c5
- MD5 45d7d338f1a5173f306728ba9569ba56
- SHA1 823729f2a3d8fe6a4fdcf631d140b3740b04ddcf
- SHA512 b79a9dad3bc756a8746211bc93a0324744ccf6b213d92ff6b368088fe04cc620b5b1c0744396d20523b7f22be2094d01e0378b4a380fa14c0369c19758821cfa
- SSDEEP 24576:B9u/7t0ib+UiF7ACE/UmafSLi4euLHAg0Le5ji0hV0Le5ji0hmxNrM:B0/7t0i0FZaUm8cikLRPji0nPji0Aj
- TLSH T1C7A57E17F6A442B9D07AC079C692926AE9723C42173096CF0391B76C2F37AE55B3E731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240738093.exe
- Size 6.2MB
- SHA256 15ac52a5aec8e688aa34ddc707b8bd4d42efea8eaf9fe9c5600b56c70e255f2a
- MD5 f1e82d254e13a870fbf61316b1769d71
- SHA1 f593a3c5c116fffb99e67f32bbf01add71bcb384
- SHA512 a5869b53cca1aa85b2cee7b50399b9a0fb065492b891c7df21681d88086fe98500bf324cf7a8a268c3a053c5477936b2f6d752910441d9ae12d08153a785c3d6
- SSDEEP 98304:12UgXq9ouFkULGyqobNq1Mft5rG6uPO276HoVNmnolMsFiHtGh1hN5DTlF01ADN:12S9+ULdNPtbuPZOOmnqogHh/f
- TLSH T10D66E02FFB944036D65B127398289321D5AAF574E3298FD72388971DFB742C32E32196
- MD5 SHA1 SHA512 SSDEEP TLSH