Analysis
- max time kernel
85s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/04/2026, 18:05
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe
- Size 4.8MB
- Sample260422-wpdrxadv3j
- SHA256 68379dda23b90dcb357bf52f69714fe67353ef6a6aaea287c90d40cdc30f6e18
- MD5 f0ed86a003719e84c5d7feb8c3e2395d
- SHA1 2d46649f27c596dec546fa639ca520382d610706
- SHA512 5a8998acc9c4915fa09220081559df5891b25f1283018245397f58c5e58549d0148160e62d0bfe675cba9c4b86769c6ce8a1b4c4ddb2ff43298de56a33e8592b
- SSDEEP 98304:a4stJM9vAsNi9Xwgwfo4L9IW1dXg3S/MHmguzYcLzrX:a/vM9i9XwgwAqvLPX
- TLSH T112361781B1D68527CC6E4D7085419930F9253F9F3F2DB687EE447A29AB7F2C0A92D312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral1/memory/2740-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024414-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3824-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000229e5-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024419-144.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2740-796-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3824-797-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000006ff-864.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 3824 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2740 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe 3824 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2740
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3824
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.8MB
- SHA256 68379dda23b90dcb357bf52f69714fe67353ef6a6aaea287c90d40cdc30f6e18
- MD5 f0ed86a003719e84c5d7feb8c3e2395d
- SHA1 2d46649f27c596dec546fa639ca520382d610706
- SHA512 5a8998acc9c4915fa09220081559df5891b25f1283018245397f58c5e58549d0148160e62d0bfe675cba9c4b86769c6ce8a1b4c4ddb2ff43298de56a33e8592b
- SSDEEP 98304:a4stJM9vAsNi9Xwgwfo4L9IW1dXg3S/MHmguzYcLzrX:a/vM9i9XwgwAqvLPX
- TLSH T112361781B1D68527CC6E4D7085419930F9253F9F3F2DB687EE447A29AB7F2C0A92D312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 5.2MB
- SHA256 664ba68f98353f2d3e0145f60869879a9392f7f2fd6b53757fa1161b32d99072
- MD5 6e9c97d4ce4ca32b05d32c00f568378a
- SHA1 661aa30984cbeeca76f723f33e9204e0eaaf2e85
- SHA512 a8eb30468ff5c6256e023ed909ce156301150c73f9156a15639750c20121279f4099f12370b54790ba83ee61b05514dee4d7d04b3c57e0df3f8456be5842f2a3
- SSDEEP 98304:a4stJM9vAsNi9Xwgwfo4L9IW1dXg3S/MHmguzYcLzrTCqo:a/vM9i9XwgwAqvLPGqo
- TLSH T13C463881B1D68527CC6E4D7085519530F9313E9F3F2DB68BEE547A29AB3F2C0A92D312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.3MB
- SHA256 7c4e72c28cf6d13a690bfcdbf641b7620389f822a223425e167181517a79ab39
- MD5 53f0bb4c3cfb4a9a06add65f67a51225
- SHA1 5c544c22a7396a88c386337a72b154c3c210be08
- SHA512 be8331cfc875bb9f3fc27dc37fd7ff86a27183ddf4c196bdd6224dc5d0b057031269cdada901f6424706b46d641f89b3b77526dac3787514b8d0cc42f1163cc6
- SSDEEP 98304:a4stJM9vAsNi9Xwgwfo4L9IW1dXg3S/MHmguzYcLzrLjo:a/vM9i9XwgwAqvLP/o
- TLSH T102462991B1D68623CC6E4D7085819531F9313E9F3F2DB687EE447A29AB7F2C0A52D312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 4.9MB
- SHA256 7dab0b9cd2b41bf963c634818f84124a519c6831b063f8e669534415ccddcdc1
- MD5 2054aaa9794219ee3ca048139302d537
- SHA1 f0ca5634ef909cd010695b22c4d96cfb3faa9f42
- SHA512 96bdcd240f59a472fb65f172f686636003c789d7e8cd7ea39c0bf70976878f5b1b34686ca01c8cdee25c4a1891ae52d9020ab898192373aecc4cfa770adba803
- SSDEEP 98304:a4stJM9vAsNi9Xwgwfo4L9IW1dXg3S/MHmguzYcLzrU:a/vM9i9XwgwAqvLPU
- TLSH T152360781E1D68527CC6E4D7086419530F9263E9F3E1DB687EE84BA2DAB7F1C0692D313
- MD5 SHA1 SHA512 SSDEEP TLSH