Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 08:42
Behavioral task
behavioral1
Sample
2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
- Size 1.4MB
- Sample260423-kl25jsft2w
- SHA256 9c9ecf783e884abaadb4543b5ffe169bb744029f51bf56e983ebe5d501f30d16
- MD5 523732e8747246bd6a8f52e7fa3cdd3a
- SHA1 2677289e94c2529e000c3a955578893b6f26651f
- SHA512 b7039b128e0b8095cca41177ec9658fb2d3277cea792bfa654f8591273db3ad76c6de23f770b5a20881619a18bed944d8317d301247cbf36b7649a5a64c28c42
- SSDEEP 24576:8K2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCrX:12od+YBMF/XS/ezSC6vUzPvMCD
- TLSH T1F365186AE5684272D07ED07AC792A616F673348253B085CB03C2C77C1F276E599BA733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
pid Process 796 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.tmp 4428 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.mm 4996 YZH.exe 4964 YZH.exe 3700 YZH.sys - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe" 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.mm Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe" YZH.exe Set value (str) \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe" YZH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe" 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.mm - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened (read-only) \??\A: 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe -
resource yara_rule behavioral2/memory/1916-0-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4428-13-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/files/0x001b00000002b247-10.dat upx behavioral2/memory/4428-11-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-16-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-18-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4428-20-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4964-38-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4964-49-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/3700-52-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/3700-46-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/1916-88-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-89-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-90-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-93-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-97-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-101-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-105-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-109-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-113-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-117-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-121-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-125-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-129-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-133-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-137-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-141-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/4996-145-0x0000000000400000-0x000000000043F000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\YZH.exe YZH.exe File created C:\Windows\YZH.sys YZH.exe File opened for modification C:\Windows\YZH.sys YZH.exe File created C:\Windows\YZH.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.mm File opened for modification C:\Windows\YZH.exe 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.mm - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.mm Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YZH.sys Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1916 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe 1916 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4964 YZH.exe 4964 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe 4996 YZH.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4996 YZH.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1916 wrote to memory of 796 1916 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe 80 PID 1916 wrote to memory of 4428 1916 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe 81 PID 4428 wrote to memory of 4996 4428 2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.mm 83 PID 4964 wrote to memory of 3700 4964 YZH.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.tmpC:\Users\Admin\AppData\Local\Temp\2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.tmp2⤵
- Executes dropped EXE
PID:796
-
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.mmC:\Users\Admin\AppData\Local\Temp\2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.mm /zhj2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\YZH.exeC:\Windows\YZH.exe /zhj3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:4996
-
-
-
C:\Windows\YZH.exeC:\Windows\YZH.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\YZH.sysC:\Windows\YZH.sys /zhj2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3700
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.mm
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.mm
- Size 1.2MB
- SHA256 733dd71cbd1ba9aa8b28e672f73dfff834361301c72f4d6624e67b7291f7ad72
- MD5 687cfc246a0bc07079f8c0a9509dbd5a
- SHA1 8aaeb88cca30730b9da6360ed7a3105c1f94a770
- SHA512 491ab9517a350d67b8d4608ef6b63dd1ceba42e2a7a2db0b84795d418a3dd8b4654af0add7a1bc816468c40b5c79961054108376329cb7f6ee5e543af9b07feb
- SSDEEP 24576:8K2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC2:12od+YBMF/XS/ezSC6vUzPvMC2
- TLSH T1B5554C6AF5B88272D072D07AC6D2EB1AE5723482533085CF434787692F177E6D53AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.tmp
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-23_523732e8747246bd6a8f52e7fa3cdd3a_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.tmp
- Size 143KB
- SHA256 7ae20d0542a544b54730a5520a2c7b56dc9235be1a4dc1331763786a16fabed9
- MD5 7d4ea76b6e0659fdd36b34499f964aea
- SHA1 6b7700ed5632d176fc0efbc5611192644bc391d4
- SHA512 41ecf5f0a70828d114056bacd8fde364e2685e3c2f58a785540af7056e3698b027cd3bcce64ab840814ad3d2c5a0eac0a3528cdd88b737eb02671e816eff27cf
- SSDEEP 1536:8vJ9psmemUoXVpuoM+/7BUNs9OFVJqp+uIBQepE4XKF3QcOzm:8vJ9psmeIBcV8pQFq4XKF3QP6
- TLSH T1FBE3C31AD29802E8C06E6179C7568A41B7337C6687E1D3CB53D0F53E1F766909EEAB03
- MD5 SHA1 SHA512 SSDEEP TLSH