Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/09/2026, 04:31
Behavioral task
behavioral1
Sample
2026-09-11_c8e9ef03d941dd139aba9106c89c3cae_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-11_c8e9ef03d941dd139aba9106c89c3cae_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-09-11_c8e9ef03d941dd139aba9106c89c3cae_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe
- Size 7.4MB
- Sample260912-e5mw3syflg
- SHA256 bb0263fb2339f6416896827b1462d2a0c12796022ac701df9b38f3162a6199c7
- MD5 c8e9ef03d941dd139aba9106c89c3cae
- SHA1 131242e977d419fbd90f87041f90c22e3f0d5dcd
- SHA512 f77a8422d233210793165af8fd82e55d27a804df8e7feb6b021d39e21405a150c4066f9cf923618f4866b738c01ddaacec16df81cf4605e7dc01b640c696e44e
- SSDEEP 98304:hnUm8UyBv78HEF3rpiD0BTa3aLkBo6DjD7dijoHjojKjo:h18U9EFbp7B2NDjD7dUoDojso
- TLSH T1BC768C22F865C238E122C0B589DAABB6C8757C66073045CB1780FB396E737D76A35B71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Fesber payload 12 IoCs
resource yara_rule behavioral2/files/0x001100000001b846-4.dat family_fesber behavioral2/files/0x000d00000001c4bf-16.dat family_fesber behavioral2/memory/1220-638-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1220-1151-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1220-1276-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1220-1277-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1220-1278-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1220-1279-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1220-1282-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1220-1284-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1220-1286-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/1220-1287-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" tmp240758984.exe - Executes dropped EXE 1 IoCs
pid Process 1220 tmp240758984.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsb.stb tmp240758984.exe File created C:\Windows\SysWOW64\fsb.tmp tmp240758984.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240758984.exe -
resource yara_rule behavioral2/memory/2464-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2464-12-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x000d00000001c4bf-16.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe tmp240758984.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- tmp240758984.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe tmp240758984.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- tmp240758984.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe tmp240758984.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe tmp240758984.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe tmp240758984.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE tmp240758984.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- tmp240758984.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE tmp240758984.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- tmp240758984.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe tmp240758984.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe tmp240758984.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- tmp240758984.exe File created C:\Program Files\dotnet\dotnet.exe tmp240758984.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe tmp240758984.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- tmp240758984.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- tmp240758984.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE tmp240758984.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE tmp240758984.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe tmp240758984.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- tmp240758984.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- tmp240758984.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe tmp240758984.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe tmp240758984.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe tmp240758984.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- tmp240758984.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- tmp240758984.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- tmp240758984.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe tmp240758984.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- tmp240758984.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe tmp240758984.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe tmp240758984.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe tmp240758984.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe tmp240758984.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe tmp240758984.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- tmp240758984.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- tmp240758984.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- tmp240758984.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- tmp240758984.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe tmp240758984.exe File created C:\Program Files\Internet Explorer\iexplore.exe tmp240758984.exe File created C:\Program Files\Mozilla Firefox\updater.exe tmp240758984.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- tmp240758984.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- tmp240758984.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- tmp240758984.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe tmp240758984.exe File created C:\Program Files\7-Zip\7z.exe- tmp240758984.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- tmp240758984.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- tmp240758984.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe tmp240758984.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE tmp240758984.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe tmp240758984.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- tmp240758984.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe tmp240758984.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe tmp240758984.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe tmp240758984.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- tmp240758984.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE tmp240758984.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- tmp240758984.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- tmp240758984.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE tmp240758984.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- tmp240758984.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- tmp240758984.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240758984.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-11_c8e9ef03d941dd139aba9106c89c3cae_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid 4 4 - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2464 wrote to memory of 1220 2464 2026-09-11_c8e9ef03d941dd139aba9106c89c3cae_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-11_c8e9ef03d941dd139aba9106c89c3cae_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-11_c8e9ef03d941dd139aba9106c89c3cae_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\tmp240758984.exeC:\Users\Admin\AppData\Local\Temp\tmp240758984.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1220
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 7.9MB
- SHA256 0791df32291785a424592318f46f006439b2baa20b7c9fdac031d8ecd9e8e5f7
- MD5 fcaf1f7b3e23e97622a6e753b0872a2c
- SHA1 3d266a173ef91e367fd6d5a212a6827175dc40ed
- SHA512 c5f71cb19cfb9660edabbd4e559861c73ba9feed206f5b5e3633689585b8018ae1f9602a0353428d8636c24076f98642f07beec5252541e628556ba49ad4f1dc
- SSDEEP 98304:hnUm8UyBv78HEF3rpiD0BTa3aLkBo6DjD7dijoHjojKjoHjo:h18U9EFbp7B2NDjD7dUoDojsoDo
- TLSH T1BF867C22F965C234E122C0B589DAABBAD8753C62073045CB1780FB396E737D75A36B71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240758984.exe
- Size 7.4MB
- SHA256 fc0ef2b45914ee97e9f56161bc49fb8d09da7f0e15691f4b68c82339eb90235c
- MD5 cc2b23c645788bbd6e657de8cc61c7f0
- SHA1 3ae4ffb1ef9f15b006fea87b564375ef7507b6ee
- SHA512 60b2ab8c9a4dddd5dfedfd8c0de6438d4d258c6de7f75c3f0ebb82622347934b56c826a6cd813da336187b8d6bdcdd40fd5f6d8c59ff4530d2f2cf0d31bb01c0
- SSDEEP 98304:YnUm8UyBv78HEF3rpiD0BTa3aLkBo6DjD7dijoHjojKjo:Y18U9EFbp7B2NDjD7dUoDojso
- TLSH T149768C22F865C238E122C0B189DAABB6C8757C66073045CB5780FB396E737D76A35B71
- MD5 SHA1 SHA512 SSDEEP TLSH