Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 06:59
Behavioral task
behavioral1
Sample
2026-08-16_99c3c6ec09422440a9db98ebd9eefbaa_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_99c3c6ec09422440a9db98ebd9eefbaa_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-08-16_99c3c6ec09422440a9db98ebd9eefbaa_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
- Size 6.5MB
- Sample260816-hr4jfssape
- SHA256 0571f46aa480f7a66a3ca8c5b2066f75467c30645ba828ab2653a15836297cc2
- MD5 99c3c6ec09422440a9db98ebd9eefbaa
- SHA1 b694bf052bd907fdb6b24f852d655142e24d2993
- SHA512 955ebfae55ca0cd17840c061604417985a38e0a2aaa18a2539278b74e3b48d172940d9a3a7d82f44501a523b2722dc33ca277890ef8b6311153dc76919570929
- SSDEEP 98304:NnUm8UikB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0E:N18U6JEul4szEonqt
- TLSH T15C667C327D86C179E252407049A9BFF5C19DAC364B7104CB7AC07B6A9A723C76E31F26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Fesber payload 12 IoCs
resource yara_rule behavioral2/files/0x000a000000019cb5-4.dat family_fesber behavioral2/files/0x000d00000001c4e3-12.dat family_fesber behavioral2/memory/692-561-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/692-1018-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/692-1283-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/692-1284-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/692-1285-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/692-1286-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/692-1287-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/692-1289-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/692-1291-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/692-1293-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" tmp240703406.exe - Executes dropped EXE 3 IoCs
pid Process 692 tmp240703406.exe 1416 tmp240703484.exe 908 tmp240703484.exe - Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240703406.exe File created C:\Windows\SysWOW64\fsb.stb tmp240703406.exe File created C:\Windows\SysWOW64\fsb.tmp tmp240703406.exe -
resource yara_rule behavioral2/memory/1584-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x000d00000001c4e3-12.dat upx behavioral2/memory/1584-17-0x0000000000400000-0x000000000041F000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe tmp240703406.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe tmp240703406.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe- tmp240703406.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- tmp240703406.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- tmp240703406.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- tmp240703406.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE tmp240703406.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- tmp240703406.exe File created C:\Program Files\7-Zip\7zFM.exe tmp240703406.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe tmp240703406.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE tmp240703406.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- tmp240703406.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- tmp240703406.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe tmp240703406.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe tmp240703406.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- tmp240703406.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe tmp240703406.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe tmp240703406.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe tmp240703406.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe tmp240703406.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe- tmp240703406.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- tmp240703406.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- tmp240703406.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE tmp240703406.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- tmp240703406.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- tmp240703406.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- tmp240703406.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- tmp240703406.exe File created C:\Program Files\7-Zip\Uninstall.exe tmp240703406.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe tmp240703406.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- tmp240703406.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe tmp240703406.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- tmp240703406.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe tmp240703406.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- tmp240703406.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe tmp240703406.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- tmp240703406.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe tmp240703406.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- tmp240703406.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- tmp240703406.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe tmp240703406.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- tmp240703406.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe tmp240703406.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- tmp240703406.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe tmp240703406.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- tmp240703406.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE tmp240703406.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe tmp240703406.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- tmp240703406.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- tmp240703406.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- tmp240703406.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- tmp240703406.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe tmp240703406.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe- tmp240703406.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- tmp240703406.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe tmp240703406.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- tmp240703406.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe tmp240703406.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- tmp240703406.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe tmp240703406.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe tmp240703406.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe- tmp240703406.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe tmp240703406.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- tmp240703406.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-16_99c3c6ec09422440a9db98ebd9eefbaa_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240703406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240703484.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240703484.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid 4 4 - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1416 tmp240703484.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1416 tmp240703484.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1584 wrote to memory of 692 1584 2026-08-16_99c3c6ec09422440a9db98ebd9eefbaa_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe 89 PID 1584 wrote to memory of 1416 1584 2026-08-16_99c3c6ec09422440a9db98ebd9eefbaa_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe 90 PID 1416 wrote to memory of 908 1416 tmp240703484.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_99c3c6ec09422440a9db98ebd9eefbaa_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_99c3c6ec09422440a9db98ebd9eefbaa_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\tmp240703406.exeC:\Users\Admin\AppData\Local\Temp\tmp240703406.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:692
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240703484.exeC:\Users\Admin\AppData\Local\Temp\tmp240703484.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\tmp240703484.exeC:\Users\Admin\AppData\Local\Temp\tmp240703484.exe --type=collab-renderer --proc=14163⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:908
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 1.8MB
- SHA256 e682a65bda676a9ef0615051ba55c3f11a46ad4c3ee407e8878af7ca4da77b8d
- MD5 eb2ad074746a679201566d74bcfb9df9
- SHA1 8aa45b74efccc9da3f68b4fb240c6aa78e207667
- SHA512 a207eeaed679684b58f540c947201baff5f3d2586ae1b1f39c787f966f16b656de44a7a151348250ebeb207ce1e163b9ca66e2f39c3a850657621eb0b1bb850d
- SSDEEP 24576:Zz/7t0ib+UiF7ACE/UmafSLi4euLHz0Le5ji0hmxNrM:Zz/7t0i0FZaUm8cikLTPji0Aj
- TLSH T1C0858F17F6A442F9D03BC079C6929266E9727C410B309ACF0291B76D2F37BE55B3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240703406.exe
- Size 1.2MB
- SHA256 f1da5ef1b267fcc82773fd68fc04fda5e239e03ddc2b937dd0bfa8034ad9db08
- MD5 dee2398a03743efcaa0e6ecdd7c52e84
- SHA1 07b2a62338fa42249b5b40d757902c9c6bf8715e
- SHA512 9c89b727f99a0e74bbf751e0a4b842cbdcaa7b673eda4546e2d5f8e5783b18b444d21a7d5a2f3b840d6702f269418e66c8a3b9526ab26e0c7cf9790ec2f44dcf
- SSDEEP 12288:fKHP5NXb/7t0iUk2E+UiOS/osQbCP+V/7h0L6unnOPl4jK7en3mawkfd8PzH4qLd:yz/7t0ib+UiF7ACE/UmafSLi4euLH
- TLSH T1CD559D17B79941F8D02ED1788B458276EA72BC520B74BADF0690B3192E37AE45F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240703484.exe
- Size 5.3MB
- SHA256 9797daecfaf430aacddcd2f51f8336c90683eccfaf44dd7f2aa17c0495587ea0
- MD5 197035bcdf81ed0e15ff1b56ecb0e1d0
- SHA1 72dd9d7e774e57cc1f4314370afc22973b2e0eec
- SHA512 e4e1c8df0f4bee0a9207ed40164695628362bdc486fc67b2dc05d02966f6eed102db75524d116cf3aa3c4c52a3b73e904c8d71a2087951b2c1c3efc8162eca61
- SSDEEP 98304:rkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0EB:PJEul4szEonqtB
- TLSH T185465A317C86C179E252007159A9BFF5C19DD8364BB204C77AC06F6A9A613CB7E31F2A
- MD5 SHA1 SHA512 SSDEEP TLSH