Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/08/2026, 15:16
Behavioral task
behavioral1
Sample
2026-08-20_7758782ac7ac151e33d7375e502872a5_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_7758782ac7ac151e33d7375e502872a5_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-20_7758782ac7ac151e33d7375e502872a5_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
- Size 5.5MB
- Sample260820-snm3eaeb59
- SHA256 21796df90b9658126112d0b040cfba9d238c9359124362b71cf23dc102553dc1
- MD5 7758782ac7ac151e33d7375e502872a5
- SHA1 950cc0a529a589005afb88702408b04e91b92241
- SHA512 a6f9ca783827d02a82142556db0ffa57f1354f4dbe53c628bf76d62ccb99678299adb5bf49e3775897530f6b2c4a3cb9b15418cd114c33c9f0b85f30b32285d9
- SSDEEP 49152:kmTAGOmeo9TI6Ou+bXsPNIULkmp1/j6AeXZG78IP9z5WuHC4O8b8ITDnl27PLhGO:tTAG9bSbXsPN5kicaZ5LjoHjoHjo
- TLSH T16646D521B6E4CFE1D06F9070CCA6B6F99527BC108F654FCB6A807E1939326D2993161F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Fesber payload 12 IoCs
resource yara_rule behavioral1/files/0x000600000001e6c2-3.dat family_fesber behavioral1/files/0x0003000000022c06-18.dat family_fesber behavioral1/memory/4580-974-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/4580-1755-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/4580-2267-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/4580-2268-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/4580-2269-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/4580-2270-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/4580-2273-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/4580-2275-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/4580-2276-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/4580-2277-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" tmp240664406.exe - Executes dropped EXE 2 IoCs
pid Process 4580 tmp240664406.exe 1364 tmp240664421.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsb.stb tmp240664406.exe File created C:\Windows\SysWOW64\fsb.tmp tmp240664406.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240664406.exe -
resource yara_rule behavioral1/memory/812-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/812-10-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x0003000000022c06-18.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- tmp240664406.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- tmp240664406.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe tmp240664406.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe- tmp240664406.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe tmp240664406.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- tmp240664406.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- tmp240664406.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe tmp240664406.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- tmp240664406.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- tmp240664406.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe tmp240664406.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe tmp240664406.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE tmp240664406.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE tmp240664406.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe- tmp240664406.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe tmp240664406.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe tmp240664406.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- tmp240664406.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- tmp240664406.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe tmp240664406.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\identity_helper.exe tmp240664406.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- tmp240664406.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe tmp240664406.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe tmp240664406.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe tmp240664406.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe tmp240664406.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe- tmp240664406.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe tmp240664406.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe tmp240664406.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- tmp240664406.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE tmp240664406.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- tmp240664406.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE tmp240664406.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE tmp240664406.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- tmp240664406.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- tmp240664406.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe tmp240664406.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\elevation_service.exe tmp240664406.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE tmp240664406.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- tmp240664406.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe tmp240664406.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- tmp240664406.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe tmp240664406.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe tmp240664406.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- tmp240664406.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe tmp240664406.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- tmp240664406.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- tmp240664406.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- tmp240664406.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe tmp240664406.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe tmp240664406.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe tmp240664406.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe tmp240664406.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- tmp240664406.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- tmp240664406.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe- tmp240664406.exe File created C:\Program Files\Internet Explorer\ielowutil.exe tmp240664406.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- tmp240664406.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe tmp240664406.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- tmp240664406.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- tmp240664406.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{E3C293D9-92A2-430F-A573-2511CDB7A4F8}\MicrosoftEdge_X64_139.0.3405.125.exe- tmp240664406.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe tmp240664406.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- tmp240664406.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_7758782ac7ac151e33d7375e502872a5_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240664406.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 812 wrote to memory of 4580 812 2026-08-20_7758782ac7ac151e33d7375e502872a5_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe 87 PID 812 wrote to memory of 1364 812 2026-08-20_7758782ac7ac151e33d7375e502872a5_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_7758782ac7ac151e33d7375e502872a5_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_7758782ac7ac151e33d7375e502872a5_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\tmp240664406.exeC:\Users\Admin\AppData\Local\Temp\tmp240664406.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4580
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240664421.exeC:\Users\Admin\AppData\Local\Temp\tmp240664421.exe2⤵
- Executes dropped EXE
PID:1364
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 5.5MB
- SHA256 21796df90b9658126112d0b040cfba9d238c9359124362b71cf23dc102553dc1
- MD5 7758782ac7ac151e33d7375e502872a5
- SHA1 950cc0a529a589005afb88702408b04e91b92241
- SHA512 a6f9ca783827d02a82142556db0ffa57f1354f4dbe53c628bf76d62ccb99678299adb5bf49e3775897530f6b2c4a3cb9b15418cd114c33c9f0b85f30b32285d9
- SSDEEP 49152:kmTAGOmeo9TI6Ou+bXsPNIULkmp1/j6AeXZG78IP9z5WuHC4O8b8ITDnl27PLhGO:tTAG9bSbXsPN5kicaZ5LjoHjoHjo
- TLSH T16646D521B6E4CFE1D06F9070CCA6B6F99527BC108F654FCB6A807E1939326D2993161F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240664406.exe
- Size 5.0MB
- SHA256 7bb411004a9f73127f4fcac3d8d10b5a6657ea290f88c9dabe6ba9b50f84d20c
- MD5 90277122e6f7450edd2bd5f8b6a570f3
- SHA1 2ce9c55b0dea0e2b33fe7d13ba18e517e6f0834a
- SHA512 07ce66dfd3a698ac45ef2077cdf943d42f8754e898152620272d54c8dbf545d36ca40f7dfafa1c1561c7a79fe092fe60d55ef899e45cfd8ea11c6be1e700598f
- SSDEEP 49152:BmTAGOmeo9TI6Ou+bXsPNIULkmp1/j6AeXZG78IP9z5WuHC4O8b8ITDnl27PLhG7:sTAG9bSbXsPN5kicaZ5LjoHjo
- TLSH T1F336C32176E4CFE1D06F5070CCA6B6F99527AC108F654FCB6E807E1939316D2AA31A1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240664421.exe
- Size 549KB
- SHA256 707f415d7d581edd9bce99a0429ad4629d3be0316c329e8b9ebd576f7ab50b71
- MD5 0b24892597dcb0257cdb78b5ed165218
- SHA1 5fe5d446406ff1e34d2fe3ee347769941636e323
- SHA512 24ea9e0f10a283e67850070976c81ae4b2d4d9bb92c6eb41b2557ad3ae02990287531a619cf57cd257011c6770d4c25dd19c3c0e46447eb4d0984d50d869e56f
- SSDEEP 6144:vXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4zrr8:vXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
- TLSH T1C1C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH