Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 15:16
Behavioral task
behavioral1
Sample
2026-08-20_7758782ac7ac151e33d7375e502872a5_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_7758782ac7ac151e33d7375e502872a5_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-20_7758782ac7ac151e33d7375e502872a5_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe
- Size 5.5MB
- Sample260820-snm3eaeb59
- SHA256 21796df90b9658126112d0b040cfba9d238c9359124362b71cf23dc102553dc1
- MD5 7758782ac7ac151e33d7375e502872a5
- SHA1 950cc0a529a589005afb88702408b04e91b92241
- SHA512 a6f9ca783827d02a82142556db0ffa57f1354f4dbe53c628bf76d62ccb99678299adb5bf49e3775897530f6b2c4a3cb9b15418cd114c33c9f0b85f30b32285d9
- SSDEEP 49152:kmTAGOmeo9TI6Ou+bXsPNIULkmp1/j6AeXZG78IP9z5WuHC4O8b8ITDnl27PLhGO:tTAG9bSbXsPN5kicaZ5LjoHjoHjo
- TLSH T16646D521B6E4CFE1D06F9070CCA6B6F99527BC108F654FCB6A807E1939326D2993161F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Fesber payload 13 IoCs
resource yara_rule behavioral2/files/0x000a000000011371-4.dat family_fesber behavioral2/files/0x000c00000001c5fb-17.dat family_fesber behavioral2/memory/5592-530-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5592-961-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5592-1285-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5592-1286-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5592-1287-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5592-1288-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5592-1289-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5592-1291-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5592-1293-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5592-1295-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5592-1296-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" tmp240746531.exe - Executes dropped EXE 2 IoCs
pid Process 5592 tmp240746531.exe 2972 tmp240746656.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsb.stb tmp240746531.exe File created C:\Windows\SysWOW64\fsb.tmp tmp240746531.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240746531.exe -
resource yara_rule behavioral2/memory/5568-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5568-12-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x000c00000001c5fb-17.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe tmp240746531.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- tmp240746531.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- tmp240746531.exe File created C:\Program Files\Mozilla Firefox\updater.exe- tmp240746531.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- tmp240746531.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- tmp240746531.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE tmp240746531.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- tmp240746531.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- tmp240746531.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- tmp240746531.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- tmp240746531.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- tmp240746531.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- tmp240746531.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- tmp240746531.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe tmp240746531.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- tmp240746531.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe- tmp240746531.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe tmp240746531.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- tmp240746531.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe tmp240746531.exe File created C:\Program Files\Internet Explorer\ieinstal.exe tmp240746531.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- tmp240746531.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE tmp240746531.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- tmp240746531.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe tmp240746531.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe- tmp240746531.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe tmp240746531.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- tmp240746531.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- tmp240746531.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- tmp240746531.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- tmp240746531.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe tmp240746531.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe tmp240746531.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe tmp240746531.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe tmp240746531.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe tmp240746531.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe tmp240746531.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- tmp240746531.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- tmp240746531.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- tmp240746531.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- tmp240746531.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE tmp240746531.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe tmp240746531.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe tmp240746531.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe tmp240746531.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe tmp240746531.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- tmp240746531.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- tmp240746531.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- tmp240746531.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe tmp240746531.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- tmp240746531.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe tmp240746531.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe tmp240746531.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe tmp240746531.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- tmp240746531.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe tmp240746531.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- tmp240746531.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe tmp240746531.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe tmp240746531.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe tmp240746531.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- tmp240746531.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe tmp240746531.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe- tmp240746531.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- tmp240746531.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_7758782ac7ac151e33d7375e502872a5_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240746531.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid 4 4 - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5568 wrote to memory of 5592 5568 2026-08-20_7758782ac7ac151e33d7375e502872a5_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe 90 PID 5568 wrote to memory of 2972 5568 2026-08-20_7758782ac7ac151e33d7375e502872a5_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_7758782ac7ac151e33d7375e502872a5_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_7758782ac7ac151e33d7375e502872a5_amadey_coinminer_darkgate_elex_hijackloader_icedid_luca-.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Users\Admin\AppData\Local\Temp\tmp240746531.exeC:\Users\Admin\AppData\Local\Temp\tmp240746531.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5592
-
-
C:\Users\Admin\AppData\Local\Temp\tmp240746656.exeC:\Users\Admin\AppData\Local\Temp\tmp240746656.exe2⤵
- Executes dropped EXE
PID:2972
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 5.5MB
- SHA256 21796df90b9658126112d0b040cfba9d238c9359124362b71cf23dc102553dc1
- MD5 7758782ac7ac151e33d7375e502872a5
- SHA1 950cc0a529a589005afb88702408b04e91b92241
- SHA512 a6f9ca783827d02a82142556db0ffa57f1354f4dbe53c628bf76d62ccb99678299adb5bf49e3775897530f6b2c4a3cb9b15418cd114c33c9f0b85f30b32285d9
- SSDEEP 49152:kmTAGOmeo9TI6Ou+bXsPNIULkmp1/j6AeXZG78IP9z5WuHC4O8b8ITDnl27PLhGO:tTAG9bSbXsPN5kicaZ5LjoHjoHjo
- TLSH T16646D521B6E4CFE1D06F9070CCA6B6F99527BC108F654FCB6A807E1939326D2993161F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240746531.exe
- Size 5.0MB
- SHA256 7bb411004a9f73127f4fcac3d8d10b5a6657ea290f88c9dabe6ba9b50f84d20c
- MD5 90277122e6f7450edd2bd5f8b6a570f3
- SHA1 2ce9c55b0dea0e2b33fe7d13ba18e517e6f0834a
- SHA512 07ce66dfd3a698ac45ef2077cdf943d42f8754e898152620272d54c8dbf545d36ca40f7dfafa1c1561c7a79fe092fe60d55ef899e45cfd8ea11c6be1e700598f
- SSDEEP 49152:BmTAGOmeo9TI6Ou+bXsPNIULkmp1/j6AeXZG78IP9z5WuHC4O8b8ITDnl27PLhG7:sTAG9bSbXsPN5kicaZ5LjoHjo
- TLSH T1F336C32176E4CFE1D06F5070CCA6B6F99527AC108F654FCB6E807E1939316D2AA31A1F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240746656.exe
- Size 549KB
- SHA256 707f415d7d581edd9bce99a0429ad4629d3be0316c329e8b9ebd576f7ab50b71
- MD5 0b24892597dcb0257cdb78b5ed165218
- SHA1 5fe5d446406ff1e34d2fe3ee347769941636e323
- SHA512 24ea9e0f10a283e67850070976c81ae4b2d4d9bb92c6eb41b2557ad3ae02990287531a619cf57cd257011c6770d4c25dd19c3c0e46447eb4d0984d50d869e56f
- SSDEEP 6144:vXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4zrr8:vXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
- TLSH T1C1C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH