Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 14:54
Behavioral task
behavioral1
Sample
2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
- Size 5.1MB
- Sample260831-sada2sthmd
- SHA256 4894877aeec9abaef182fbfc8a8b5ed1d8aad972e3f6d285d8dec553853785c1
- MD5 c524dc5b83b67a955e7273d48b7d8c54
- SHA1 bc1ac554aa3f2917827aac9fcfa51fb968c4559f
- SHA512 78ac1427b9431d520b3fd438f5aab8bf3ac8f90086edf99ee091a24100917f0064c471cc242d45a4a73f1ccb1fe80c07e9ed3201be677b0f26996f9017f05c29
- SSDEEP 98304:YnUm8Uyfv78HEF3rpiD0BTa3aLkBo6DjD7d:Y18U3EFbp7B2NDjD7d
- TLSH T113467C227846C078F35581B16A9D6FB1C84CAC76477104CB6B90BF329A727D72E34FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Fesber payload 12 IoCs
resource yara_rule behavioral2/files/0x000c00000001c60b-4.dat family_fesber behavioral2/memory/5492-542-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5492-1000-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5492-1264-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5492-1265-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5492-1266-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5492-1267-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5492-1268-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5492-1270-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5492-1272-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5492-1274-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/5492-1275-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsb.stb 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Windows\SysWOW64\fsb.tmp 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe -
resource yara_rule behavioral2/files/0x000c00000001c60b-4.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe- 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe - Suspicious behavior: LoadsDriver 4 IoCs
pid 4 4 4 4
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-31_c524dc5b83b67a955e7273d48b7d8c54_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5492
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 5.7MB
- SHA256 440649c0779b0621addd2f6812591c618fb1b468d7e070a73198ef3e096ca013
- MD5 294462a765dce00cc93688ceda5c72cf
- SHA1 24bc474c9086e74797b50b0130fab91d25facd39
- SHA512 61bf423913a7c83ab6cb784db22f16d538177bc05162a42a0011db62610e9d70f90eaa4a1accc0071af64e471cde31101a122e79f5eacb7048367e3b9763236e
- SSDEEP 98304:enUm8Uyfv78HEF3rpiD0BTa3aLkBo6DjD7dJjo:e18U3EFbp7B2NDjD7d9o
- TLSH T16E569D22B816C178F25580B159DEABB2C8587C66477104CB6B80BF366A737D72E34FB1
- MD5 SHA1 SHA512 SSDEEP TLSH