da06d918b3fea77c2810c3bb8f617c80e2d3d3eda27e7c5cb91d9cafe4468f81

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-16_20c645178c8fddcf206790f913bc4b12_amadey_cobalt-strike_coinminer_hellokitty_hijackloader_i.exe
Size 7.2MB
Sample260416-ay91tadt2l
SHA256 da06d918b3fea77c2810c3bb8f617c80e2d3d3eda27e7c5cb91d9cafe4468f81
MD5 20c645178c8fddcf206790f913bc4b12
SHA1 be405e5ec115a1e78f0502da72ce60ac2f654f5a
SHA512 0778d59768c58e1787ec3bdb22d730c38fe6c114f593841cb2a56c0c49091a2aaa74b6651b52e4faa354593848922fd24ae7b7c0d4822f9ec51f89606dd5ffcf
SSDEEP 196608:2567nSo5X567nSo5f7KWQc0gEYnvLOKWQc0gEYnvL:25Cn5X5Cn5ScZEIvrcZEIv
TLSH
T1F276CE1937E414A5F5B39639C9AA8651EE72BC211B3093CF1394A63D1F336E0ED39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

ransomware spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000c000000026205-6.dat	UPX

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\bfsvc.exe	2026-04-16_20c645178c8fddcf206790f913bc4b12_amadey_cobalt-strike_coinminer_hellokitty_hijackloader_i.exe
File created	C:\Windows\explorer.exe	2026-04-16_20c645178c8fddcf206790f913bc4b12_amadey_cobalt-strike_coinminer_hellokitty_hijackloader_i.exe
File created	C:\Windows\hh.exe	2026-04-16_20c645178c8fddcf206790f913bc4b12_amadey_cobalt-strike_coinminer_hellokitty_hijackloader_i.exe
File created	C:\Windows\regedit.exe	2026-04-16_20c645178c8fddcf206790f913bc4b12_amadey_cobalt-strike_coinminer_hellokitty_hijackloader_i.exe
File created	C:\Windows\splwow64.exe	2026-04-16_20c645178c8fddcf206790f913bc4b12_amadey_cobalt-strike_coinminer_hellokitty_hijackloader_i.exe
File created	C:\Windows\HelpPane.exe	2026-04-16_20c645178c8fddcf206790f913bc4b12_amadey_cobalt-strike_coinminer_hellokitty_hijackloader_i.exe
File created	C:\Windows\notepad.exe	2026-04-16_20c645178c8fddcf206790f913bc4b12_amadey_cobalt-strike_coinminer_hellokitty_hijackloader_i.exe
File created	C:\Windows\winhlp32.exe	2026-04-16_20c645178c8fddcf206790f913bc4b12_amadey_cobalt-strike_coinminer_hellokitty_hijackloader_i.exe
File created	C:\Windows\write.exe	2026-04-16_20c645178c8fddcf206790f913bc4b12_amadey_cobalt-strike_coinminer_hellokitty_hijackloader_i.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5108	notepad.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 5108	2564	2026-04-16_20c645178c8fddcf206790f913bc4b12_amadey_cobalt-strike_coinminer_hellokitty_hijackloader_i.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-16_20c645178c8fddcf206790f913bc4b12_amadey_cobalt-strike_coinminer_hellokitty_hijackloader_i.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_20c645178c8fddcf206790f913bc4b12_amadey_cobalt-strike_coinminer_hellokitty_hijackloader_i.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\WEL7635.tmp
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 7.7MB
SHA256 74757a1895f09ebcf44ce11c20d01327224a8d3c5307878df6b1c11e6558dcd9
MD5 a8463f374c4f77e61192280ef3bb3b32
SHA1 3960d608c2d301768dcb94d5146e6d915feef9d8
SHA512 418fb5622d2abe4316dc4e907028f80baf3f37b62f809b82135cfaecc1a087d2e2b6bc11f128ff58fc92452fc8f3860ed4940084cbe7d6e029f7be148e6e6d85
SSDEEP 196608:2567nSo5X567nSo5f7KWQc0gEYnvLOKWQc0gEYnvLvP:25Cn5X5Cn5ScZEIvrcZEIv
TLSH
T17D86CE1977E410B5F5B35675C96A8211AE76BC211B3093DF1390AA3D2F336D0EE3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WEL7635.tmp

Path C:\Users\Admin\AppData\Local\Temp\WEL7635.tmp
Size 52B
SHA256 be0909be27235c36586ceb9b7e37d8d74c423d9460c4dbf0e2417fcf58b96caa
MD5 17ddbb82a40e2ac704e1045da8fb1cf6
SHA1 a570cdbc16483567fe1439903b212e33b15343b7
SHA512 031adfce17522c42262d40acb75f1db7a1942e4965ab505ee3a5b7001e07a3f16182a4093a3e9a3b99b50860bbc66205a9956b4d8da76adb823054aae6598da2
TLSH
T1449002F35491D6301587051611E8118616566D9675199405E00811251AB56520515DDA
MD5 SHA1 SHA512 TLSH