c9adad4339fcbf857aa61e0d066d554de02beacb2a65290019e33d6c4991ebb1

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-19_ffd5736d8e782f8751919d8d496c702e_amadey_cobalt-strike_coinminer_hijackloader_icedid_luca-.exe
Size 3.7MB
Sample260420-arprasev4k
SHA256 c9adad4339fcbf857aa61e0d066d554de02beacb2a65290019e33d6c4991ebb1
MD5 ffd5736d8e782f8751919d8d496c702e
SHA1 e997727a3dda00708f5b9dd269c38014c3ce1f34
SHA512 2abd48419fee9662db26da5db2ae6576acde1b36c161266bd2b2cd3e9a4597ff21dd2024ccde5b04f10052ae529a229206dc14c8bb049100b2ed9c5dc2d1a3d7
SSDEEP 98304:BllR0llRbn7OQh9n7OmdyYxHEvz3fOhgq://C/bnSQh9nSmHx6vOSq
TLSH
T1F1066B1136A86CB5D0B214304671969D4B39BC25C6239E8F22907EDEFFF26C27D25B72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

ransomware spyware stealer

Malware Config

Signatures

Custom signature

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x00090000000268e2-6.dat	UPX

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\explorer.exe	2026-04-19_ffd5736d8e782f8751919d8d496c702e_amadey_cobalt-strike_coinminer_hijackloader_icedid_luca-.exe
File created	C:\Windows\hh.exe	2026-04-19_ffd5736d8e782f8751919d8d496c702e_amadey_cobalt-strike_coinminer_hijackloader_icedid_luca-.exe
File created	C:\Windows\notepad.exe	2026-04-19_ffd5736d8e782f8751919d8d496c702e_amadey_cobalt-strike_coinminer_hijackloader_icedid_luca-.exe
File created	C:\Windows\write.exe	2026-04-19_ffd5736d8e782f8751919d8d496c702e_amadey_cobalt-strike_coinminer_hijackloader_icedid_luca-.exe
File created	C:\Windows\bfsvc.exe	2026-04-19_ffd5736d8e782f8751919d8d496c702e_amadey_cobalt-strike_coinminer_hijackloader_icedid_luca-.exe
File created	C:\Windows\HelpPane.exe	2026-04-19_ffd5736d8e782f8751919d8d496c702e_amadey_cobalt-strike_coinminer_hijackloader_icedid_luca-.exe
File created	C:\Windows\regedit.exe	2026-04-19_ffd5736d8e782f8751919d8d496c702e_amadey_cobalt-strike_coinminer_hijackloader_icedid_luca-.exe
File created	C:\Windows\splwow64.exe	2026-04-19_ffd5736d8e782f8751919d8d496c702e_amadey_cobalt-strike_coinminer_hijackloader_icedid_luca-.exe
File created	C:\Windows\winhlp32.exe	2026-04-19_ffd5736d8e782f8751919d8d496c702e_amadey_cobalt-strike_coinminer_hijackloader_icedid_luca-.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4256	notepad.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 4256	3028	2026-04-19_ffd5736d8e782f8751919d8d496c702e_amadey_cobalt-strike_coinminer_hijackloader_icedid_luca-.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-04-19_ffd5736d8e782f8751919d8d496c702e_amadey_cobalt-strike_coinminer_hijackloader_icedid_luca-.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-19_ffd5736d8e782f8751919d8d496c702e_amadey_cobalt-strike_coinminer_hijackloader_icedid_luca-.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\WELD88.tmp
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 4.2MB
SHA256 1c6af65908d43023e05bf82efc7177e052e33b3320a6eb66a4ab7498697d4103
MD5 a367d58b8c9fb6bf39e39053781c5ad1
SHA1 e38d1c26f39db0e7fea57c5043899930621db3e4
SHA512 1e04f9877833aeab5a8b30622eb512d6994b41845c5403d37df466370738522922735fab83cb8b02cf586259501308a34329eac00435fac6d7b601c285579590
SSDEEP 98304:BllR0llRbn7OQh9n7OmdyYxHEvz3fOhgIPF://C/bnSQh9nSmHx6vOSIP
TLSH
T1F6168D1176A85CB1D0B21431463196AD5B39BC25C6138E8F22907EDEFFF66C27E26732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WELD88.tmp

Path C:\Users\Admin\AppData\Local\Temp\WELD88.tmp
Size 52B
SHA256 be0909be27235c36586ceb9b7e37d8d74c423d9460c4dbf0e2417fcf58b96caa
MD5 17ddbb82a40e2ac704e1045da8fb1cf6
SHA1 a570cdbc16483567fe1439903b212e33b15343b7
SHA512 031adfce17522c42262d40acb75f1db7a1942e4965ab505ee3a5b7001e07a3f16182a4093a3e9a3b99b50860bbc66205a9956b4d8da76adb823054aae6598da2
TLSH
T1449002F35491D6301587051611E8118616566D9675199405E00811251AB56520515DDA
MD5 SHA1 SHA512 TLSH