Analysis
- max time kernel
148s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 01:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe
- Size 4.9MB
- Sample260802-bkt8wabk41
- SHA256 253eff03acf7430c9b9246a8637ee81acf906e2895dfba1cda5f2b334d7ec008
- MD5 1d54ef39cbdfa39db2c6e0d99849a9c0
- SHA1 a72bcfc27f5fa9a0c9e3f7ce6e96e7c18b10989f
- SHA512 34ef380b0ff02333257c5e094abdbb866848d18978ed909270ca28b9e648f554206f74a6e54785bd0dd1efa8bb4ed3b6f50219939c370de4ed00c91915f1438c
- SSDEEP 98304:EcRGTJNjoyxQeMjLsAAa/7JNzJwjI5klUigAQ:3GTJJoReGZF6bUpB
- TLSH T15D36DF12F9A4C13AC07385B589A6CBB9AA317D515F2099C763C0FF6D3F326C29536326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe smrss.exe" 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe - Executes dropped EXE 1 IoCs
pid Process 3008 21020.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\smrss.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Windows Defender\MpDefenderCoreService.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21020.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 852 wrote to memory of 3008 852 2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_1d54ef39cbdfa39db2c6e0d99849a9c0_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:852 -
C:\windows\temp\21020.exe"C:\windows\temp\21020.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3008
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 7.0MB
- SHA256 66b9614725c88ee9c86db14e6f30a8188e07bdb75c77858adc7c6e201e77c10c
- MD5 27d0b64c0c2af1c70da3a50117b1a8ba
- SHA1 83d9cd3998058422923ba8718556d8d7612e17be
- SHA512 7980472579a2798f92b7eedbf5803322f066500c8448f6092f54a55e11a5f1f74bbb954674dbef662f8a8985475097a46258bd7ca36971617c389bc17f716c1b
- SSDEEP 98304:EcRGTJNjoyxQeMjLsAAa/7JNzJwjI5klUigA8oq2Vjnmv:3GTJJoReGZF6bUphGnW
- TLSH T1E076CF15B6A8C1B5C0B3C67885A2C7A6F7317C114F3096EF5395BB5E2E33AD1893A321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\21020.exe
- Size 530KB
- SHA256 3c4a68070f3d7f14e488ae4f7ede8e7add0f8029995dc800833126ca062a2c6c
- MD5 a87236e214f6d42a65f5dedac816aec8
- SHA1 601f4e8cd6b1c5fcd8f0be4acf01a08261a07b94
- SHA512 5db8f065c02ac6a014ee407e3d64ae68fc9c9ae814532e58ea3aa27491baed8a15b5b1f90369eff37fb399c0ee96a92b3640110e3730084d3f0687734c41cf18
- SSDEEP 6144:AaUmLSekeqrdlveC8ox0zpYAd4i1DHgM4yvKlgsfs1I7z24NMUEV6pWWKl:AaYeiveC8omNZHsyClgmw6z2V7rl
- TLSH T1E9C4D822B595E03EC4B75AB49929CBF56838AF611E51A8D377C03F9D3F71982C02532B
- MD5 SHA1 SHA512 SSDEEP TLSH