Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/04/2026, 00:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe
- Size 18.1MB
- Sample260416-aak2saex91
- SHA256 ad3318a9d8e059ab21cdd208e8c6f75ab932bae8d92edbe0811d5d1065537c93
- MD5 6117bf89623f4ce79eb2be01d570bcc8
- SHA1 a522f77c4233446d701ddc242288d26d8a4ccab9
- SHA512 cb59e82b500aad363ce70a5de6c61ebffd1407b03be0a6ceb7a17cba1ca765fbcf93901f994132322fa87f98c8558b7a4d7a7e424578ece51b859b1c9e655aad
- SSDEEP 196608:Su5oaHOAoXvvO/qzBUdEcI/P7EU8IBtz8gTH2qBpu1QfLIqsuf0:6wOTKqzBQ+EU8IBJXTHNBpu1Qfc00
- TLSH T10617391672994AECC05FD074CE469562E6727C464FB09BDF1680BF693E736E02F3920A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dpapimig.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\label.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\setx.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\certreq.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\doskey.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\quickassist.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\systray.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\wscript.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\write.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\dccw.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\sort.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\replace.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\calc.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\7-Zip\7z.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_6b5eb3c4c1ffcde9\r\WerFaultSecure.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.22000.37_none_ac96ecb2523a6a01\r\InputSwitchToastHandler.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.22000.348_none_53ff6ed560767984\f\mighost.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.469_none_3038532b4b83a565\f\wowreg32.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\x86_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.22000.1_none_8289edcdf2ad65a4\cvtres.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_4.0.15806.0_none_faef98edc711143e\AddInProcess32.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.22000.120_none_2f2bb6f2a85481f2\pcalua.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.22000.1_none_70698255615a88a2\sdiagnhost.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.22000.120_none_0e11f85980658aa8\r\ShellAppRuntime.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.22000.1_none_7512c1e2929b66b7\mscorsvw.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\f\wmpshare.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.22000.120_none_bdd6ed7a5949f71c\r\FilePicker.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.22000.132_none_f836cc528422524b\f\ShellExperienceHost.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..-client-aggregators_31bf3856ad364e35_10.0.22000.318_none_701008567a383b30\f\AggregatorHost.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.22000.1_none_586a6bf4f6a07942\GameBarPresenceWriter.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.22000.1_none_d5126d2e75032b40\EASPolicyManagerBrokerHost.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\wow64_jsc_b03f5f7f11d50a3a_4.0.15806.0_none_2ca8c9f483ea58df\jsc.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.22000.1_none_a341a57910bc73cd\wabmig.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.22000.1_none_2a646c04920783d6\msfeedssync.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\r\AppVShNotify.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.22000.282_none_e0bcdfd0611d6514\f\WindowsSandboxClient.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..appserver-licensing_31bf3856ad364e35_10.0.22000.1_none_fcf9b91a40267bf0\tlsbln.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.22000.434_none_841ec22dd6bd92c4\curl.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_75b35e16f6608fe4\WerFaultSecure.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_ddb5359fa07e69e6\subst.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netsh_31bf3856ad364e35_10.0.22000.1_none_c0393e363102a7bd\netsh.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_4548a15e322e11ac\query.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.22000.1_none_909c5510a5987a0e\colorcpl.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.22000.469_none_403fa699a3654657\MDMAgent.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.22000.132_none_23ef129810e14356\RecoveryDrive.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.22000.1_none_502f03701a672d6b\takeown.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\msil_inspectvhddialog6.3_31bf3856ad364e35_10.0.22000.1_none_1e1cb41b23f7b2cb\InspectVhdDialog6.3.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\msil_jsc_b03f5f7f11d50a3a_10.0.22000.1_none_449dcae096165671\jsc.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.22000.434_none_841ec22dd6bd92c4\r\curl.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.22000.434_none_ae734c6bf20696b6\f\djoin.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.469_none_560fc7f19d1d3ed7\r\VSSVC.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.22000.282_none_da8c01e10676f001\sdbinst.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_3d11f25cbb74100a\msra.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_3d11f25cbb74100a\r\sdchange.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\x86_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.22000.1_none_5131b7cb34740693\LinqWebConfig.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.22000.120_none_aad7a0687fb44b43\DeviceCensus.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.22000.65_none_99e34b544b7754a7\r\provtool.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.22000.469_none_e574fa2e821169ac\SystemSettingsBroker.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.318_none_2da4853532607174\AuditShD.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.22000.469_none_8c502cfed26c810b\f\TrustedInstaller.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.22000.120_none_8faca973dc064b74\r\NarratorQuickStart.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.22000.1_none_c99cb41b228d2f61\SpeechModelDownload.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.22000.1_none_c8a8db7c509219cf\certreq.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.22000.41_none_1d0a15319901359b\f\PinEnrollmentBroker.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..monotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_618940d4a376d501\f\MoNotificationUx.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.22000.1_none_8ad2d5434aef8a0e\SrTasks.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.22000.1_none_c4fc5204471c8488\ttdinject.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.22000.282_none_ed4920c9a3fd8bd2\adamsync.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.22000.434_none_4f4ac04322f04123\PktMon.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\msil_datasvcutil_b77a5c561934e089_10.0.22000.1_none_c7f9dd62a8df7576\DataSvcUtil.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.22000.282_none_6ae954e75a4dd338\f\winlogon.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.22000.1_none_83943f096879c6b9\MigRegDB.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.282_none_d171f6f246e51c59\f\splwow64.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.22000.434_none_17cb2e5ad35a58c9\ksetup.exe- 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_6117bf89623f4ce79eb2be01d570bcc8_akira_amadey_cobalt-strike_coinminer_elex_eternalromance.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1712
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 18.7MB
- SHA256 4604d7263f1f7b49f91c4ed7d6fbbe5e55f7e22cf70df8eff9945ecd46568abd
- MD5 ececf9ec4c184c9dcb01b2b3731043e5
- SHA1 1bb2dc9f6eabedbb56b92434377ac166f20abceb
- SHA512 c86bd6a8451740f5f0c4dcb695860ac55c4fddccde468d178e79f9246bc6b5eb9aa3d8f9d2a3cf2f36ea0405715ba847a63f899d4917f2792942cc4f0a5d6390
- SSDEEP 196608:Su5oaHOAoXvvO/qzBUdEcI/P7EU8IBtz8gTH2qBpu1QfLIqsufeof:6wOTKqzBQ+EU8IBJXTHNBpu1Qfc0Zf
- TLSH T1F317391672994AECC05FD078CE469562E6727C464F709BDF1680BF693E736E02F3920A
- MD5 SHA1 SHA512 SSDEEP TLSH