Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 03:55
Behavioral task
behavioral1
Sample
2026-11-03_eb5bac49f4841b98202fd46de4cb78a7_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-03_eb5bac49f4841b98202fd46de4cb78a7_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-11-03_eb5bac49f4841b98202fd46de4cb78a7_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_vidar_wannacry.exe
- Size 7.8MB
- Sample261104-eg92pse12v
- SHA256 55cc29bddd96dd611d2bbf01cb98dd3949f16e0c9776066f107eeee2830b4b56
- MD5 eb5bac49f4841b98202fd46de4cb78a7
- SHA1 12df601df405f320758d3d4a45cfb77e4b1b58cb
- SHA512 fb664b218ad1ee80d0d3817fc2a69b7f4cc3d2ff592fa031b64d766e7e66556cb57162de05f45a8ff00327993a726cc3ed87063097f5881b498f83f1f23860c8
- SSDEEP 98304:3DIkC69LapI2jidkB/qoHMdnJE7hAlKnsd2C2PYdhIqHpne0E:e69cIAidJEul4sdEonet
- TLSH T1DA869D31B995C175E22280B489D9BFF5C1A9B8360B7144CB57C0AF3A5E223D76E31F26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Fesber payload 4 IoCs
resource yara_rule behavioral2/memory/4112-6-0x0000000000400000-0x000000000041E000-memory.dmp family_fesber behavioral2/files/0x000c000000016d03-7.dat family_fesber behavioral2/files/0x000c00000001c565-13.dat family_fesber behavioral2/memory/4112-311-0x0000000000400000-0x000000000041E000-memory.dmp family_fesber - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" tmp240728328.exe - Executes dropped EXE 1 IoCs
pid Process 4112 tmp240728328.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsb.stb tmp240728328.exe File created C:\Windows\SysWOW64\fsb.tmp tmp240728328.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp tmp240728328.exe -
resource yara_rule behavioral2/memory/2312-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4112-6-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/files/0x000c000000016d03-7.dat upx behavioral2/files/0x000c00000001c565-13.dat upx behavioral2/memory/2312-17-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4112-311-0x0000000000400000-0x000000000041E000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe tmp240728328.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe tmp240728328.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- tmp240728328.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe tmp240728328.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe tmp240728328.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- tmp240728328.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe tmp240728328.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe tmp240728328.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- tmp240728328.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- tmp240728328.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE tmp240728328.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe tmp240728328.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe tmp240728328.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe tmp240728328.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- tmp240728328.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe tmp240728328.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- tmp240728328.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe tmp240728328.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe tmp240728328.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe tmp240728328.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe tmp240728328.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- tmp240728328.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- tmp240728328.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- tmp240728328.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe tmp240728328.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- tmp240728328.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE tmp240728328.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe tmp240728328.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe tmp240728328.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe tmp240728328.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe tmp240728328.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- tmp240728328.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe- tmp240728328.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe tmp240728328.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe tmp240728328.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe tmp240728328.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE tmp240728328.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- tmp240728328.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe tmp240728328.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe tmp240728328.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe tmp240728328.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe tmp240728328.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- tmp240728328.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe tmp240728328.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe tmp240728328.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe tmp240728328.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe tmp240728328.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe tmp240728328.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- tmp240728328.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- tmp240728328.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe tmp240728328.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe tmp240728328.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- tmp240728328.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- tmp240728328.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- tmp240728328.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe tmp240728328.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe tmp240728328.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe tmp240728328.exe File created C:\Program Files\7-Zip\7zFM.exe tmp240728328.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\java.exe- tmp240728328.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\javaw.exe- tmp240728328.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- tmp240728328.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8118963C-5722-40D8-B50C-68BE87CFBD4C}\MicrosoftEdge_X64_139.0.3405.125.exe- tmp240728328.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE tmp240728328.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname tmp240728328.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain tmp240728328.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-03_eb5bac49f4841b98202fd46de4cb78a7_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp240728328.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid 4 - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2312 wrote to memory of 4112 2312 2026-11-03_eb5bac49f4841b98202fd46de4cb78a7_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_vidar_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_eb5bac49f4841b98202fd46de4cb78a7_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_eb5bac49f4841b98202fd46de4cb78a7_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_vidar_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\tmp240728328.exeC:\Users\Admin\AppData\Local\Temp\tmp240728328.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4112
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 8.4MB
- SHA256 7f7de5e30d1cfcb43054fe2722948b25e3c2b500d609104c07a4233dd27c3069
- MD5 f65835b0b8c1d7f603ce9dce03876176
- SHA1 ab94dab8439df3bf460e258ca13a4a0a5a907fa2
- SHA512 22eb2a425994545d9e056ffcc8ffbf8389e6f001878c4b337b912142f8787b869bd931e3e11c2968eb5676d69668be1b2ee5ad686631f7327a740c94d43cabf4
- SSDEEP 98304:3DIkC69LapI2jidkB/qoHMdnJE7hAlKnsd2C2PYdhIqHpne0EBjo:e69cIAidJEul4sdEonetFo
- TLSH T169968D31B995C275E12280B489D9BFF5C1A9B8360B7145CB17C0AB3A5E233D76E35B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240728328.exe
- Size 7.8MB
- SHA256 6400ede728ff34949cfcc10d77aa86a1517d04f392077b60f9c9498a3dc9b88d
- MD5 75e9d83c8aa17bb9586fc76ffc11f5d4
- SHA1 766a872234a5e2628b79c76dc8d6d8a84821f9f8
- SHA512 ce5b4fd41a9951366d34e673218c4c624f5a01722fe14a1f3fd1a3e2bc7477fd351623979cfc46f67e5afe67b6012ebe73ed39039561bc325b721efdc7cef790
- SSDEEP 98304:zDIkC69LapI2jidkB/qoHMdnJE7hAlKnsd2C2PYdhIqHpne0E:y69cIAidJEul4sdEonet
- TLSH T134868D31B995C175E22280B489D9BFF5C1A9B8360B7144CB57C0AF3A5E223D76E31F26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp240728734.exe
- Size 6KB
- SHA256 ea87186593f18db75f24339d68d756bd5fb7dacf44b0b2723de72988de04e77c
- MD5 f31c1f04f45bc7aafcfbe62d948fb7c3
- SHA1 3690bdc3505014a94bd33b76209c200525629260
- SHA512 241153cda4bd22608776d4b71c08b2cafa539ff5234be0cbe3a60996c4317a7d0874e73e5aac0644a80f6d25de706041fde19c56bd20d116f078598862689386
- SSDEEP 192:8kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkf:8kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkK
- TLSH T162D180D932D0BBECD425752D9951508549D78494454523E954F0C2C409B46A95449146
- MD5 SHA1 SHA512 SSDEEP TLSH