Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/08/2026, 06:59
Behavioral task
behavioral1
Sample
2026-08-16_99c3c6ec09422440a9db98ebd9eefbaa_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_99c3c6ec09422440a9db98ebd9eefbaa_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-08-16_99c3c6ec09422440a9db98ebd9eefbaa_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
- Size 6.5MB
- Sample260816-hr4jfssape
- SHA256 0571f46aa480f7a66a3ca8c5b2066f75467c30645ba828ab2653a15836297cc2
- MD5 99c3c6ec09422440a9db98ebd9eefbaa
- SHA1 b694bf052bd907fdb6b24f852d655142e24d2993
- SHA512 955ebfae55ca0cd17840c061604417985a38e0a2aaa18a2539278b74e3b48d172940d9a3a7d82f44501a523b2722dc33ca277890ef8b6311153dc76919570929
- SSDEEP 98304:NnUm8UikB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0E:N18U6JEul4szEonqt
- TLSH T15C667C327D86C179E252407049A9BFF5C19DAC364B7104CB7AC07B6A9A723C76E31F26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Fesber payload 10 IoCs
resource yara_rule behavioral1/files/0x000b0000000242c8-3.dat family_fesber behavioral1/files/0x0003000000022b20-19.dat family_fesber behavioral1/memory/4788-1123-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/4788-2107-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/4788-2227-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/4788-2228-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/4788-2229-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/4788-2230-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/4788-2233-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/4788-2237-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" tmp240693875.exe - Executes dropped EXE 3 IoCs
pid Process 4788 tmp240693875.exe 1944 tmp240694031.exe 1724 tmp240694031.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsb.tmp tmp240693875.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240693875.exe File created C:\Windows\SysWOW64\fsb.stb tmp240693875.exe -
resource yara_rule behavioral1/memory/2624-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x0003000000022b20-19.dat upx behavioral1/memory/2624-13-0x0000000000400000-0x000000000041F000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe tmp240693875.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe- tmp240693875.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe tmp240693875.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- tmp240693875.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE tmp240693875.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe tmp240693875.exe File created C:\Program Files\Mozilla Firefox\updater.exe tmp240693875.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe tmp240693875.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe- tmp240693875.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- tmp240693875.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE tmp240693875.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- tmp240693875.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe tmp240693875.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- tmp240693875.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- tmp240693875.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe tmp240693875.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- tmp240693875.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe tmp240693875.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe tmp240693875.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe tmp240693875.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- tmp240693875.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE tmp240693875.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE tmp240693875.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe tmp240693875.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe tmp240693875.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- tmp240693875.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- tmp240693875.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe tmp240693875.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe- tmp240693875.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe tmp240693875.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- tmp240693875.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe- tmp240693875.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe- tmp240693875.exe File created C:\Program Files\Internet Explorer\iexplore.exe tmp240693875.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe tmp240693875.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe tmp240693875.exe File created C:\Program Files\7-Zip\7zG.exe tmp240693875.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- tmp240693875.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe tmp240693875.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe tmp240693875.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- tmp240693875.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- tmp240693875.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe tmp240693875.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe tmp240693875.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe tmp240693875.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe tmp240693875.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- tmp240693875.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe tmp240693875.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe tmp240693875.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe- tmp240693875.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe- tmp240693875.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe tmp240693875.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe tmp240693875.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- tmp240693875.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe tmp240693875.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe tmp240693875.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe tmp240693875.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe tmp240693875.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- tmp240693875.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- tmp240693875.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- tmp240693875.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe tmp240693875.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe tmp240693875.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe tmp240693875.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240694031.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240694031.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-16_99c3c6ec09422440a9db98ebd9eefbaa_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240693875.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1944 tmp240694031.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1944 tmp240694031.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2624 wrote to memory of 4788 2624 2026-08-16_99c3c6ec09422440a9db98ebd9eefbaa_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe 85 PID 2624 wrote to memory of 1944 2624 2026-08-16_99c3c6ec09422440a9db98ebd9eefbaa_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe 86 PID 1944 wrote to memory of 1724 1944 tmp240694031.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_99c3c6ec09422440a9db98ebd9eefbaa_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_99c3c6ec09422440a9db98ebd9eefbaa_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\tmp240693875.exeC:\Users\Admin\AppData\Local\Temp\tmp240693875.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4788
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240694031.exeC:\Users\Admin\AppData\Local\Temp\tmp240694031.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\tmp240694031.exeC:\Users\Admin\AppData\Local\Temp\tmp240694031.exe --type=collab-renderer --proc=19443⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1724
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 e682a65bda676a9ef0615051ba55c3f11a46ad4c3ee407e8878af7ca4da77b8d
- MD5 eb2ad074746a679201566d74bcfb9df9
- SHA1 8aa45b74efccc9da3f68b4fb240c6aa78e207667
- SHA512 a207eeaed679684b58f540c947201baff5f3d2586ae1b1f39c787f966f16b656de44a7a151348250ebeb207ce1e163b9ca66e2f39c3a850657621eb0b1bb850d
- SSDEEP 24576:Zz/7t0ib+UiF7ACE/UmafSLi4euLHz0Le5ji0hmxNrM:Zz/7t0i0FZaUm8cikLTPji0Aj
- TLSH T1C0858F17F6A442F9D03BC079C6929266E9727C410B309ACF0291B76D2F37BE55B3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240693875.exe
- Size 1.2MB
- SHA256 f1da5ef1b267fcc82773fd68fc04fda5e239e03ddc2b937dd0bfa8034ad9db08
- MD5 dee2398a03743efcaa0e6ecdd7c52e84
- SHA1 07b2a62338fa42249b5b40d757902c9c6bf8715e
- SHA512 9c89b727f99a0e74bbf751e0a4b842cbdcaa7b673eda4546e2d5f8e5783b18b444d21a7d5a2f3b840d6702f269418e66c8a3b9526ab26e0c7cf9790ec2f44dcf
- SSDEEP 12288:fKHP5NXb/7t0iUk2E+UiOS/osQbCP+V/7h0L6unnOPl4jK7en3mawkfd8PzH4qLd:yz/7t0ib+UiF7ACE/UmafSLi4euLH
- TLSH T1CD559D17B79941F8D02ED1788B458276EA72BC520B74BADF0690B3192E37AE45F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240694031.exe
- Size 5.3MB
- SHA256 9797daecfaf430aacddcd2f51f8336c90683eccfaf44dd7f2aa17c0495587ea0
- MD5 197035bcdf81ed0e15ff1b56ecb0e1d0
- SHA1 72dd9d7e774e57cc1f4314370afc22973b2e0eec
- SHA512 e4e1c8df0f4bee0a9207ed40164695628362bdc486fc67b2dc05d02966f6eed102db75524d116cf3aa3c4c52a3b73e904c8d71a2087951b2c1c3efc8162eca61
- SSDEEP 98304:rkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0EB:PJEul4szEonqtB
- TLSH T185465A317C86C179E252007159A9BFF5C19DD8364BB204C77AC06F6A9A613CB7E31F2A
- MD5 SHA1 SHA512 SSDEEP TLSH