Analysis
- max time kernel
149s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 14:22
Behavioral task
behavioral1
Sample
2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
- Size 9.8MB
- Sample260423-rplejafz21
- SHA256 5489744146e23cb4159ec3f4333a7fddd87073b2029d66ba461f02fd8207456d
- MD5 57af442b27588f304c4d9c9e5c2cfe63
- SHA1 d481f70fe5e6914281c19a8f006ca3a88885a521
- SHA512 4fd0a51988fff6e120b88636443f5373c3ad63b62238056d84029f8209a51513cdbb184ec56cc55b18ac6a5614950ce45a0e4535844eab9dfbb39841f52552ec
- SSDEEP 98304:f7rUbYkN8f01iuciNu2zPnj/7pxXkpB6p:vULNwnYBzzXkpB6p
- TLSH T192A67E1AFFD45871D1B342308DB6B32DD6B97D620A30860F1254BB1E9F72F919929B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\certutil.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\msra.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\net.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\recover.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\logman.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\where.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\regedit.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\wscript.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\format.com 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\help.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\user.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe -
resource yara_rule behavioral2/memory/4428-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x001c00000002b1fd-5.dat upx behavioral2/memory/4428-622-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/4428-3178-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Windows Mail\wab.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.22000.1_none_3b89d92484239859\psr.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..-diagnosticsmanaged_31bf3856ad364e35_10.0.22000.1_none_c52a6f9591cae974\stordiag.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.22000.318_none_1e08617dd1895eb7\f\UtcDecoderHost.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.120_none_4d19d7f0fee9ee87\r\explorer.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.22000.1_none_9fc512728ae2f615\msiexec.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.22000.348_none_e2c7a9ab59285812\r\LockApp.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.22000.1_none_383fdbeacdabdb26\tcmsetup.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.120_none_576e8243334ab082\r\explorer.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.22000.348_none_160f000044fc4872\WmiPrvSE.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\x86_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15806.256_none_f3055d6fbd1168d8\ngen.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_bsdtar_31bf3856ad364e35_10.0.22000.434_none_5be11e6025939378\f\tar.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.22000.1_none_bd5081933d30392a\RemoteAppLifetimeManager.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\r\AppVStreamingUX.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.469_none_4cf7a08cff0239cf\explorer.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.22000.1_none_672d106ab99b6abc\aspnetca.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.22000.41_none_506d5972b4817c83\Magnify.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.22000.65_none_5df9e0d1a9b3658b\r\Spectrum.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.1_none_c080913c96973812\runas.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.22000.1_none_53b7d789a4e83f54\USRLOGON.CMD- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_6f399112972db672\f\MusNotificationUx.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.22000.120_none_1e850fa96c804e78\f\XBox.TCUI.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_product-containeros__windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_20c655d14680f9cf\f\SearchIndexer.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\r\SyncAppvPublishingServer.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\AppVNice.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.22000.1_none_7710d645449f5d1b\edpnotify.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.22000.1_none_b563dd17654ea05f\cmstp.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.22000.282_none_8beb92a45fb95e13\f\DataStoreCacheDumpTool.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.22000.434_none_ae734c6bf20696b6\f\djoin.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.22000.1_none_d4a473e8ed9480cf\smss.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_f698302c22284569\f\XGpuEjectDialog.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.22000.100_none_bac6834bfb16b20d\f\SecurityHealthSystray.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-proquota_31bf3856ad364e35_10.0.22000.1_none_885f3fcfcb8efd54\proquota.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.22000.120_none_a6af4a93eb065fad\f\RMActivate.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.22000.1_none_41d7e8fc138ead52\scrnsave.scr- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.22000.1_none_c40db8f2fa975bbd\RdpSaProxy.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.22000.1_none_7d7329085e7dbaf4\findstr.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.22000.1_none_0a202c45353b204d\plasrv.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_0f681b8c9b834caa\r\PinningConfirmationDialog.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15806.0_none_b2fe4627d47504a7\ngen.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.22000.1_none_a341a57910bc73cd\wab.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.22000.1_none_332b106ae1a116bd\cmdkey.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.22000.318_none_2c6abfb5896ecf7f\wininit.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\x86_microsoft-windows-csvde_31bf3856ad364e35_10.0.22000.1_none_55632d7a2ef05cc1\csvde.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.22000.120_none_e83cf4fa7871c56f\PkgMgr.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.22000.1_none_87d7d1a32f788c55\reg.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.434_none_b4a3a74a80427a96\f\CheckNetIsolation.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\winhlp32.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.22000.1_none_9454ea72d50a2bf6\bootim.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.22000.282_none_eb29ce0d02c88de7\ntprint.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.22000.434_none_dff7d1ca03eba43a\r\LsaIso.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.318_none_2da4853532607174\r\Setup.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_03b4c900a639c980\r\TpmTool.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.22000.434_none_a003f3391feff8a5\r\repadmin.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.22000.120_none_9c5aa041b6a59db2\f\RMActivate.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.22000.318_none_065139dac533d14e\f\SppExtComObj.Exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-bootsectortool_31bf3856ad364e35_10.0.22000.1_none_62d2023a9a53a0ea\bootsect.exe- 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_57af442b27588f304c4d9c9e5c2cfe63_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4428
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 10.3MB
- SHA256 0de0fbf01e332eef19bbc6e75be704bfd4cd41b8c4f497fb24275461a04e6946
- MD5 ea10e323afe6a61570ceac70cec2df2f
- SHA1 4feda514c15e15160d45a2082cebf37d5d49ad1e
- SHA512 73066a50b58f24a1e767bdb785d1dfbddd3a68f6b6f50472338b47d4fa5f78850e080a0334040fb0bf99de474ec3282d18f8a568328c13af0fb9109aa6cc815e
- SSDEEP 98304:f7rUbYkN8f01iuciNu2zPnj/7pxXkpB69jo/:vULNwnYBzzXkpB65o/
- TLSH T1BBB66C1AFFE45471D1B3823089B6B32DD6757C620A30864F1258BB1E9F72F919939B23
- MD5 SHA1 SHA512 SSDEEP TLSH