Analysis
- max time kernel
14s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/06/2026, 19:11
Behavioral task
behavioral1
Sample
2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe
- Size 6.0MB
- Sample260629-xvyvpsev3p
- SHA256 19bf82345d47af502adcf0552913d4e67424abd8c41b181769bfd615ae1444c7
- MD5 e9738d2f6f1a4e38b7d274f293f96f30
- SHA1 b9c3128575eaa43cab104fbe0c7f16415589623d
- SHA512 01d412369559cfbbcdf72a64a863d2ddbdec740569c69567775555b417e9aa46689cbf81227d453d874f73a1dfcfd9326a4a51267a4d1e761e8da69d3177ad06
- SSDEEP 49152:/DHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJWBqatglweW4SkZP4sM:wpGfQJdXN0B7+sitqLfkZcNtSX
- TLSH T1F1565C1AB2B88176D0B78175C6A69755FA727C211B7186CF23C0E73C2F336D19936B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 8 IoCs
resource yara_rule behavioral1/memory/5516-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/5460-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024562-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e6e7-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000001e6e7-460.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000226ff-796.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5516-1364-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/5460-1365-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 5460 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 34 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ patcher.exe File created C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NSIS installer 4 IoCs
resource yara_rule behavioral1/files/0x0007000000024562-6.dat nsis_installer_2 behavioral1/files/0x000300000001e6e7-12.dat nsis_installer_2 behavioral1/files/0x000400000001e6e7-460.dat nsis_installer_2 behavioral1/files/0x00020000000226ff-796.dat nsis_installer_2 - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5516 2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe 5460 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-25_e9738d2f6f1a4e38b7d274f293f96f30_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5516
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5460
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 6.0MB
- SHA256 19bf82345d47af502adcf0552913d4e67424abd8c41b181769bfd615ae1444c7
- MD5 e9738d2f6f1a4e38b7d274f293f96f30
- SHA1 b9c3128575eaa43cab104fbe0c7f16415589623d
- SHA512 01d412369559cfbbcdf72a64a863d2ddbdec740569c69567775555b417e9aa46689cbf81227d453d874f73a1dfcfd9326a4a51267a4d1e761e8da69d3177ad06
- SSDEEP 49152:/DHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJWBqatglweW4SkZP4sM:wpGfQJdXN0B7+sitqLfkZcNtSX
- TLSH T1F1565C1AB2B88176D0B78175C6A69755FA727C211B7186CF23C0E73C2F336D19936B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 6.5MB
- SHA256 27a90a78d83145b300d1e50a17893cfacc7a87fdd47989bc41b367462b4f5099
- MD5 ddf28cdcdbf2a546e2e613f85f540e34
- SHA1 e56486003b0924e11709d9dce9bc7f1d70b986ca
- SHA512 25931fa78ac95c2884418f2ad0a20c56866318569404e3c2ae7d180356c759ec738348f2bf2db5a70742b1d46ae18154b0ba9494e2813eb3df3fc4e78132e1ae
- SSDEEP 49152:/DHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJWBqatglweW4SkZP4su:wpGfQJdXN0B7+sitqLfkZcNtSXZjo
- TLSH T1DE665C1AF2B88276D0778175C6A69756FA727C611B3186CF1280E73C2F336D19936B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$
- Size 6.0MB
- SHA256 8c4387d5b481d31543fb0980c64758f1833e4c52a62708f8aba52add31f3d21d
- MD5 58858bd8ca2e0ba2e4f7e7d3d2dbac5e
- SHA1 8c7c178eeb898eb11369be896d03a1b3bc5209e2
- SHA512 ee851040ff05dccb87ad515dbf478aa6c3ed887d85bb456951f798a8513ff1009589ae69d8254006a0e17d3029674f714cccec2e4c963624bccb74a7035e0130
- SSDEEP 49152:/DHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJWBqatglweW4SkZP4sS:wpGfQJdXN0B7+sitqLfkZcNtSXo
- TLSH T1A3566C1AB2B88176D0B78175C6A69755FA727C211B7186CF23C0E73C2F336D19936B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
- Size 6.2MB
- SHA256 2fac6b02676a788c496f5237784fb8f950e367b21a67d6fd426b4a3865a689a4
- MD5 0e89445a6edfda33d937856987998913
- SHA1 31dc80168a9045fde129eb434eabaad9c2ce0b4e
- SHA512 3a6c2856359fc4ebdee70f7de8a528a57e1e33611258b70b59893b530dee363d02cdd628fc908fd8913f0eec64b43251b41ffcbf707b36a321bd6df19a05a50e
- SSDEEP 49152:/DHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJWBqatglweW4SkZP4si:wpGfQJdXN0B7+sitqLfkZcNtSX3TQ
- TLSH T179666C1AB2B88176D0B78175C6A69755FA727C211B3186CF13C0E73D2F336D1993AB22
- MD5 SHA1 SHA512 SSDEEP TLSH