Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 01:07
Behavioral task
behavioral1
Sample
2026-10-01_d75705c1a381a4b1ec043789b7f6a325_amadey_elex_hijackloader_icedid_luca-stealer_njrat_stop_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_d75705c1a381a4b1ec043789b7f6a325_amadey_elex_hijackloader_icedid_luca-stealer_njrat_stop_vidar.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-10-01_d75705c1a381a4b1ec043789b7f6a325_amadey_elex_hijackloader_icedid_luca-stealer_njrat_stop_vidar.exe
- Size 1.3MB
- Sample261002-bgph8asbre
- SHA256 6ea4a68b45e72b77eb39cc0cc7e8d5dcb8b5a3629c02d79da90df3caa4315486
- MD5 d75705c1a381a4b1ec043789b7f6a325
- SHA1 6efa69f1441a2f6507cb5b563d299be9438dccf6
- SHA512 b13ecb79ee6f5b51101edc9ac3b75f165e2a51a117842e2c3e6640209c60f6b0f22af8d71a2e2b18985c2d3f13e4036caca43d920aeefddafc3921beb936bf08
- SSDEEP 24576:0ziTAbD+Omeo9ZZhqeiGnBIut4bXsIV/w8EZIUywtkm:0mTAGOmeo9TI6Ou+bXsPNIULkm
- TLSH T1B455AE217780C175E86140B59EBEDB76D13DB8300B7985CBA3C41B3A1E726D26A3AF17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Fesber payload 9 IoCs
resource yara_rule behavioral2/files/0x000d000000006908-4.dat family_fesber behavioral2/files/0x000400000001b8ac-14.dat family_fesber behavioral2/memory/4272-689-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/4272-1278-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/4272-1279-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/4272-1280-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/4272-1281-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/4272-1285-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/4272-1289-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" tmp240733984.exe - Executes dropped EXE 1 IoCs
pid Process 4272 tmp240733984.exe - Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240733984.exe File created C:\Windows\SysWOW64\fsb.stb tmp240733984.exe File created C:\Windows\SysWOW64\fsb.tmp tmp240733984.exe -
resource yara_rule behavioral2/memory/4108-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4108-10-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x000400000001b8ac-14.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- tmp240733984.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- tmp240733984.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- tmp240733984.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105218\javaw.exe- tmp240733984.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe tmp240733984.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe tmp240733984.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- tmp240733984.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE tmp240733984.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe tmp240733984.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe tmp240733984.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe tmp240733984.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe tmp240733984.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- tmp240733984.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- tmp240733984.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe tmp240733984.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe tmp240733984.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe tmp240733984.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- tmp240733984.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- tmp240733984.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe- tmp240733984.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- tmp240733984.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe tmp240733984.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- tmp240733984.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- tmp240733984.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe tmp240733984.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- tmp240733984.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe tmp240733984.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- tmp240733984.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105218\java.exe tmp240733984.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- tmp240733984.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- tmp240733984.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- tmp240733984.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- tmp240733984.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe tmp240733984.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- tmp240733984.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- tmp240733984.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe- tmp240733984.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- tmp240733984.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe tmp240733984.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE tmp240733984.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe tmp240733984.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe tmp240733984.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe tmp240733984.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe tmp240733984.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- tmp240733984.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe tmp240733984.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe tmp240733984.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe tmp240733984.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- tmp240733984.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe tmp240733984.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe tmp240733984.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- tmp240733984.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE tmp240733984.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- tmp240733984.exe File created C:\Program Files\Mozilla Firefox\updater.exe- tmp240733984.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- tmp240733984.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe tmp240733984.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- tmp240733984.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe- tmp240733984.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe tmp240733984.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- tmp240733984.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- tmp240733984.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- tmp240733984.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe- tmp240733984.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname tmp240733984.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain tmp240733984.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_d75705c1a381a4b1ec043789b7f6a325_amadey_elex_hijackloader_icedid_luca-stealer_njrat_stop_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240733984.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4108 wrote to memory of 4272 4108 2026-10-01_d75705c1a381a4b1ec043789b7f6a325_amadey_elex_hijackloader_icedid_luca-stealer_njrat_stop_vidar.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_d75705c1a381a4b1ec043789b7f6a325_amadey_elex_hijackloader_icedid_luca-stealer_njrat_stop_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_d75705c1a381a4b1ec043789b7f6a325_amadey_elex_hijackloader_icedid_luca-stealer_njrat_stop_vidar.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\tmp240733984.exeC:\Users\Admin\AppData\Local\Temp\tmp240733984.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4272
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 1.9MB
- SHA256 81f72856ffd833d7b61ad5a497ec8324d660e0793ffd85686063fec083241eb6
- MD5 938738b0c3849407cf7b9f0941b7b2f5
- SHA1 c47ea8080bff2f9715c18f485a0085a2ebb8ac65
- SHA512 24bc8609fea236229f8c13c9415d1a0932b15646dec37ecd1816db67da178904069562c5bb1a3402b8230d7bc33dcd3ed75f532ca5d59adc9fc255f79b932754
- SSDEEP 49152:0mTAGOmeo9TI6Ou+bXsPNIULkmGPji0Aj:dTAG9bSbXsPN5kTjo
- TLSH T103959E21F7908235E472C0B5C9FB9B6AD53974510B3485CB53C49B392E73AD29A3BB23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240733984.exe
- Size 1.3MB
- SHA256 c3f41d51daf476e9a64513f21102384b6a8402612000bf00b4cffd71c9cfce2d
- MD5 a3b71d711f2628ce8ac514033621672b
- SHA1 60ee02f2514008069af5ee7b29fb9c11caf8d345
- SHA512 90325429f3460fc75ce00d52023e838f2bc43de731e38348b85526098d1c5f27f2db3b2e4a6ac373aa421508e6923e7dbbed160582dad6a469801bef3f6feab8
- SSDEEP 24576:BziTAbD+Omeo9ZZhqeiGnBIut4bXsIV/w8EZIUywtkm8:BmTAGOmeo9TI6Ou+bXsPNIULkm8
- TLSH T1EB559E217780C175E86140B58EBEDB76D13DB8340B7985CBA3C41B3A1E726D26A3AF17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240734031.exe
- Size 4KB
- SHA256 7f1b74b4ad71a3d4d82ab12312e7ddc6daeea22497c718f275d9aec1cc82a368
- MD5 047b525db8282ddbe91bcf4627e24167
- SHA1 457174560d5a92b79fb7fe10aca973bbdb33a6de
- SHA512 ea01fef5be78b52019a5e935f90f3a14954465dbff4111b278c86526b6ad69db4103a66d006982699470f6bf259a13d2c8978fccc3b37ff0850496e4414e94f6
- SSDEEP 96:bjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjv:H
- TLSH T1E19112955F7A7FCAFD907979BB36B0F2E1501E5353BC71A811C2994B01C80D7AD842D2
- MD5 SHA1 SHA512 SSDEEP TLSH