Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/11/2026, 03:55
Behavioral task
behavioral1
Sample
2026-11-03_eb5bac49f4841b98202fd46de4cb78a7_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-03_eb5bac49f4841b98202fd46de4cb78a7_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-11-03_eb5bac49f4841b98202fd46de4cb78a7_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_vidar_wannacry.exe
- Size 7.8MB
- Sample261104-eg92pse12v
- SHA256 55cc29bddd96dd611d2bbf01cb98dd3949f16e0c9776066f107eeee2830b4b56
- MD5 eb5bac49f4841b98202fd46de4cb78a7
- SHA1 12df601df405f320758d3d4a45cfb77e4b1b58cb
- SHA512 fb664b218ad1ee80d0d3817fc2a69b7f4cc3d2ff592fa031b64d766e7e66556cb57162de05f45a8ff00327993a726cc3ed87063097f5881b498f83f1f23860c8
- SSDEEP 98304:3DIkC69LapI2jidkB/qoHMdnJE7hAlKnsd2C2PYdhIqHpne0E:e69cIAidJEul4sdEonet
- TLSH T1DA869D31B995C175E22280B489D9BFF5C1A9B8360B7144CB57C0AF3A5E223D76E31F26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Fesber payload 4 IoCs
resource yara_rule behavioral1/files/0x001900000001e58d-3.dat family_fesber behavioral1/memory/876-5-0x0000000000400000-0x000000000041E000-memory.dmp family_fesber behavioral1/files/0x00070000000242f0-17.dat family_fesber behavioral1/memory/876-609-0x0000000000400000-0x000000000041E000-memory.dmp family_fesber - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" tmp240681375.exe - Executes dropped EXE 1 IoCs
pid Process 876 tmp240681375.exe - Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240681375.exe File created C:\Windows\SysWOW64\fsb.stb tmp240681375.exe File created C:\Windows\SysWOW64\fsb.tmp tmp240681375.exe -
resource yara_rule behavioral1/memory/2024-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x001900000001e58d-3.dat upx behavioral1/memory/876-5-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2024-10-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/files/0x00070000000242f0-17.dat upx behavioral1/memory/876-609-0x0000000000400000-0x000000000041E000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ieinstal.exe tmp240681375.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- tmp240681375.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- tmp240681375.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- tmp240681375.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe tmp240681375.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- tmp240681375.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- tmp240681375.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- tmp240681375.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- tmp240681375.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- tmp240681375.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- tmp240681375.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- tmp240681375.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe tmp240681375.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- tmp240681375.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe tmp240681375.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106062\javaw.exe tmp240681375.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe tmp240681375.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- tmp240681375.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe tmp240681375.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe tmp240681375.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- tmp240681375.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE tmp240681375.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE tmp240681375.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- tmp240681375.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe tmp240681375.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe tmp240681375.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE tmp240681375.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe tmp240681375.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe tmp240681375.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- tmp240681375.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe tmp240681375.exe File created C:\Program Files\7-Zip\7zG.exe tmp240681375.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- tmp240681375.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- tmp240681375.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- tmp240681375.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- tmp240681375.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- tmp240681375.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE tmp240681375.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe tmp240681375.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe tmp240681375.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe tmp240681375.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe tmp240681375.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- tmp240681375.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- tmp240681375.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- tmp240681375.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- tmp240681375.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- tmp240681375.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- tmp240681375.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe tmp240681375.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- tmp240681375.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe tmp240681375.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- tmp240681375.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe tmp240681375.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe tmp240681375.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe tmp240681375.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe tmp240681375.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe tmp240681375.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- tmp240681375.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe tmp240681375.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- tmp240681375.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe tmp240681375.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe tmp240681375.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- tmp240681375.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- tmp240681375.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname tmp240681375.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain tmp240681375.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-03_eb5bac49f4841b98202fd46de4cb78a7_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240681375.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2024 wrote to memory of 876 2024 2026-11-03_eb5bac49f4841b98202fd46de4cb78a7_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_vidar_wannacry.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_eb5bac49f4841b98202fd46de4cb78a7_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_eb5bac49f4841b98202fd46de4cb78a7_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_vidar_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\tmp240681375.exeC:\Users\Admin\AppData\Local\Temp\tmp240681375.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:876
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 8.4MB
- SHA256 7f7de5e30d1cfcb43054fe2722948b25e3c2b500d609104c07a4233dd27c3069
- MD5 f65835b0b8c1d7f603ce9dce03876176
- SHA1 ab94dab8439df3bf460e258ca13a4a0a5a907fa2
- SHA512 22eb2a425994545d9e056ffcc8ffbf8389e6f001878c4b337b912142f8787b869bd931e3e11c2968eb5676d69668be1b2ee5ad686631f7327a740c94d43cabf4
- SSDEEP 98304:3DIkC69LapI2jidkB/qoHMdnJE7hAlKnsd2C2PYdhIqHpne0EBjo:e69cIAidJEul4sdEonetFo
- TLSH T169968D31B995C275E12280B489D9BFF5C1A9B8360B7145CB17C0AB3A5E233D76E35B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240681375.exe
- Size 7.8MB
- SHA256 6400ede728ff34949cfcc10d77aa86a1517d04f392077b60f9c9498a3dc9b88d
- MD5 75e9d83c8aa17bb9586fc76ffc11f5d4
- SHA1 766a872234a5e2628b79c76dc8d6d8a84821f9f8
- SHA512 ce5b4fd41a9951366d34e673218c4c624f5a01722fe14a1f3fd1a3e2bc7477fd351623979cfc46f67e5afe67b6012ebe73ed39039561bc325b721efdc7cef790
- SSDEEP 98304:zDIkC69LapI2jidkB/qoHMdnJE7hAlKnsd2C2PYdhIqHpne0E:y69cIAidJEul4sdEonet
- TLSH T134868D31B995C175E22280B489D9BFF5C1A9B8360B7144CB57C0AF3A5E223D76E31F26
- MD5 SHA1 SHA512 SSDEEP TLSH