Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 08:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe
- Size 5.4MB
- Sample260802-j3gphayapf
- SHA256 116b7a2697dcd923adcecab90b038d65e0d36b224aa699cc5d823078a6683fde
- MD5 a9122fa3f38fa524ed2d969773872197
- SHA1 3c7cdc31cd7c03e5ee5f87043bedece5e369d6c7
- SHA512 7b28ed3acd3ec793dfde5a6a4f736ca9cbbade822eda78966bf0d038f3d62c5af867fb9025d7a81f20418c0432977f8497698a4a3895dd233df702a4f982fae7
- SSDEEP 98304:EcRGTJNjoyxQeMjLsAAa/7JNzJwjI5klUigAWjo/:3GTJJoReGZF6bUpjo/
- TLSH T1E246BE12F564C235D07385B9C9A69BBAEA313D525B3089C76381FB6D2F336D28536332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe smrss.exe" 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe - Executes dropped EXE 1 IoCs
pid Process 3492 23141.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\smrss.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3788 wrote to memory of 3492 3788 2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_a9122fa3f38fa524ed2d969773872197_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\windows\temp\23141.exe"C:\windows\temp\23141.exe"2⤵
- Executes dropped EXE
PID:3492
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 7.6MB
- SHA256 0a404c8b5492d2e84e944b61af3ce111501afe5963f25b357bdf6e4e10d8bfdf
- MD5 c8fd8c0c753a61e68966db788f1c6437
- SHA1 257f79b4217ddb0173cc9e275e47665410fd2b70
- SHA512 fe9bf13609746145bbc9e7fef5aad45977d990fab80346a429cad4268b3fd4a578cc39ff555ae63717f8167b0091bdb20279c29c840a1f72c30fb8d4d7a9f093
- SSDEEP 98304:EcRGTJNjoyxQeMjLsAAa/7JNzJwjI5klUigAWjozoq2Vjnm7:3GTJJoReGZF6bUpjozGn6
- TLSH T14A86BF15B6A8C275D0B3C678C5A2C7A6F6313C114F309ADB5295BB6D2F33AD1893A331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\23141.exe
- Size 549KB
- SHA256 707f415d7d581edd9bce99a0429ad4629d3be0316c329e8b9ebd576f7ab50b71
- MD5 0b24892597dcb0257cdb78b5ed165218
- SHA1 5fe5d446406ff1e34d2fe3ee347769941636e323
- SHA512 24ea9e0f10a283e67850070976c81ae4b2d4d9bb92c6eb41b2557ad3ae02990287531a619cf57cd257011c6770d4c25dd19c3c0e46447eb4d0984d50d869e56f
- SSDEEP 6144:vXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4zrr8:vXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
- TLSH T1C1C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH