Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/07/2026, 12:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
- Size 9.7MB
- Sample260703-pa79msgv7z
- SHA256 d06a3818d91512d74eb0a1b3c89bfc664920286b3f7775bab9fca4de50801665
- MD5 e179b436432811b0ef1eebbb19cd7915
- SHA1 309bbf55b9aea0337b5c4b5b0d37e81cdd10183c
- SHA512 672d0d7cdf43016234c9dad6b7d0e925b6e2843a70a9449952f77f6a3d832bd18edef2a2a63eb36cea0d87b0df85a684ae414da62a3c03ad957d0e040e6ea0e9
- SSDEEP 98304:kIOERqd/6hkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0E4jovLapID6J6e:SEYd/6ZJEul4szEonqtaovcID6J6e
- TLSH T1B3A68C31B9A1C175D1628070CED5AFA5C2A97C354BF146CB7284BBE91F322C27E35B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\esentutl.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\clip.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\fc.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\format.com 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\regini.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\secinit.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\findstr.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\fontdrvhost.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\getmac.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\more.com 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\dccw.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\instnm.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\print.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.844_none_c0d0cb934c1c1f17\DTUHandler.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.19041.1_none_ad76f6bb45d8f232\IMJPUEX.EXE- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.19041.1_none_fa9e6f40748daf14\colorcpl.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1_none_f03957c94950f5c5\raserver.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\PrintDialog\PrintDialog.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_8c45e6e8b672ffff\f\sxstrace.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.19041.746_none_7946fb11bf19dc87\coredpussvr.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_c67a7a982eedc4e8\r\explorer.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.264_none_098f3a6c3a48359d\r\printfilterpipelinesvc.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.19041.1202_none_e17f082b30dd9027\r\wifitask.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\f\wmpshare.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.423_none_bfcb7b02f95b1e52\r\PeopleExperienceHost.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\r\SgrmLpac.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.19041.1266_none_b2317523477fbd48\lsass.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.19041.1_none_a0a8212dcec26473\refsutil.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\WmiApSrv.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.746_none_f0e6f722ec2403d4\rrinstaller.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\msil_inspectvhddialog6.2_31bf3856ad364e35_10.0.19041.1_none_7dc923aebe8d0c7f\InspectVhdDialog6.2.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_ef39acce2648e404\WerFaultSecure.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\r\CloudExperienceHostBroker.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.19041.1_none_8dec776522fcecde\wbemtest.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.19041.1_none_b92a768e22c5262b\vbc.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVStreamingUX.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.19041.746_none_2c2bcd67e9d4665c\f\FileHistory.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.1_none_b89abd72d09ad54d\Utilman.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.264_none_e6d5f08988c6cb95\f\DWWIN.EXE- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.264_none_39eaf2470cfe88f0\f\explorer.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.19041.1_none_16a30fa92fe5e343\srdelayed.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\AppVShNotify.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseSampleUploader.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.1_none_59b1b1137e3c1ce3\control.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15805.0_none_de9b06e519e58d0f\vbc.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.84_none_90b92bf6be625d1b\f\dfrgui.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_c2a2211ad648e627\f\mstsc.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\msil_inspectvhddialog_31bf3856ad364e35_10.0.19041.1_none_cc14df174755d4a1\InspectVhdDialog.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.19041.746_none_11e04cec24452336\f\dwm.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.1_none_f58a3da76ed0f251\dsdbutil.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.19041.1165_none_a82485b8f343811f\r\WaaSMedicAgent.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.19041.1266_none_e488d49c8a22d21e\winlogon.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_c47fb20821633815\r\imecfmui.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.264_none_08acfd4a9926561a\r\wermgr.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\r\SearchProtocolHost.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\hvsirdpclient.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.84_none_809ebfa242fbf368\r\wimserv.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Boot\PCAT\memtest.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3563a6b72868b6d9\r\wmprph.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_multipoint-logcollector_31bf3856ad364e35_10.0.19041.1_none_56138d203a7fc4cf\LogCollector.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_bd769d14dfd7d29d\f\sdbinst.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_949b3f6674b404fa\r\PasswordOnWakeSettingFlyout.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_aee92417063babbe\r\WinRTNetMUAHostServer.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.1_none_8a237828132e61da\Pester.bat- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_wcf-wsatconfig_b03f5f7f11d50a3a_10.0.19041.1_none_c45aa783f860ee61\WsatConfig.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.746_none_556ec3cb05e3ec5a\OpenWith.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.84_none_40bd4149a6d52edb\AppVClient.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.1151_none_b46b739f71bbb8b7\r\bash.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_324ea383dbfddeb9\r\mavinject.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\f\hvax64.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.746_none_6ba9668b45cb4938\IcsEntitlementHost.exe- 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_e179b436432811b0ef1eebbb19cd7915_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4168
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 10.2MB
- SHA256 48ec8d1ac50f22cb31fad5d3d45dddd7a59d4b9eae55c2563a931a9c1a64ef59
- MD5 cc16138a7c4d3b12f3d0e49e19212d00
- SHA1 b649e978e3c3b9b67750b5802f57857af166b87c
- SHA512 ca62a8a74c9627fe764f02ddebe8442031206048af585dd6f0f1d500daa128c1e42520478599eb4fb76732c1b0833e4f9d46ee35d42a3b485d7d020aa9f5e53f
- SSDEEP 98304:kIOERqd/6hkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0E4jovLapID6J6yjoL:SEYd/6ZJEul4szEonqtaovcID6J6koL
- TLSH T1A2B68C31B9A5C135D1628070CED5ABA5C6A57C354BF086CB7284BBE91F323C27E35B26
- MD5 SHA1 SHA512 SSDEEP TLSH