Analysis
- max time kernel
101s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 03:09
Behavioral task
behavioral1
Sample
2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe
- Size 5.7MB
- Sample260804-dngs3a1cle
- SHA256 951fd0c0fc6b40e8238fd4acceef0608f2f85b223a6bc22cd2cb14773c3aff7c
- MD5 2a9b79d3cf0d232a3b068a1d6f50f451
- SHA1 bf1020c4413a729e0040722d96130dc76fc7974f
- SHA512 8f88dedb64e30d8ba5965e44af42711441e0cb4d289a717bef19aecfc8c32affc8ba8cd5c80a12d5df07e84be60acf91e1309f1cabb63adb21bac0fec973a5fa
- SSDEEP 49152:gDHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJfogA2eQJeYcLGqJtbB:VpGfQJdXN0B7+sitq2eQYYcLGaJr+
- TLSH T1F9566C16B2E886B5E077C179C9A29645EA727C611F30C7CF1284963D2F337D1993AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 7 IoCs
resource yara_rule behavioral2/memory/4960-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c55f-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000170b9-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000a000000019ccf-1011.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000900000001893b-1464.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4960-1953-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4196-1954-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 4196 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x000d00000001c55f-5.dat nsis_installer_2 behavioral2/files/0x00030000000170b9-11.dat nsis_installer_2 behavioral2/files/0x000a000000019ccf-1011.dat nsis_installer_2 behavioral2/files/0x000900000001893b-1464.dat nsis_installer_2 - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4960 2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe 4196 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_2a9b79d3cf0d232a3b068a1d6f50f451_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4960
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4196
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 5.7MB
- SHA256 951fd0c0fc6b40e8238fd4acceef0608f2f85b223a6bc22cd2cb14773c3aff7c
- MD5 2a9b79d3cf0d232a3b068a1d6f50f451
- SHA1 bf1020c4413a729e0040722d96130dc76fc7974f
- SHA512 8f88dedb64e30d8ba5965e44af42711441e0cb4d289a717bef19aecfc8c32affc8ba8cd5c80a12d5df07e84be60acf91e1309f1cabb63adb21bac0fec973a5fa
- SSDEEP 49152:gDHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJfogA2eQJeYcLGqJtbB:VpGfQJdXN0B7+sitq2eQYYcLGaJr+
- TLSH T1F9566C16B2E886B5E077C179C9A29645EA727C611F30C7CF1284963D2F337D1993AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 5.9MB
- SHA256 935a4f446fa8cbceb7de2348c34f18da5513333e5f9dec45ec72cb7ef6c87eb8
- MD5 741122fa829d5da4ca4f5c81d65998ee
- SHA1 ae76be9ce89562a7d3a4af4c32cfc57ce812a4ff
- SHA512 6ba45816fe417ef6dc2560cb28217a19aa04f5bff526c9f473319c338f16a77d37dab785e26bf46fb249c64a66d8c65175dd69ebe22de81d8398cf520967cbec
- SSDEEP 49152:gDHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJfogA2eQJeYcLGqJtbn:VpGfQJdXN0B7+sitq2eQYYcLGaJr+a
- TLSH T12A566C26B2E88675E0778175C9E2965AE9727C211F30C6CF1284973D2F337D1993AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 6.2MB
- SHA256 184c840604e2056cacfdb3bd03f915491636a206573c417b9eddbad54853b115
- MD5 f28b2a0ca6abca549700daeef6821060
- SHA1 f44b4ad151efced7fd8839d1f5aa146972a6e9b9
- SHA512 99c5a1e2089871a1b10a0b47dc12d48355dbeb0cfa74d1b0bfcc4ab0c1d9ad518d32df2e767db69cf24c4e70788ffb4da7c317ef8acb2dee028ca51f597e9a30
- SSDEEP 98304:VpGfQJdXN0B7+sitq2eQYYcLGaJr+Zjo:Vpa2ErQ2LGa9+No
- TLSH T182666C16B2A88775E077C179C9E2964AEA7278511F30C6CF1285973D2F337D1893AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 5.7MB
- SHA256 753d381a06f0e98190ee7cf3482e8b4e8c0ddfb953c8cab9a4481a8c4b51a88c
- MD5 8f1898eba846f866d90cdf5ad871e197
- SHA1 bf630aa586644c8cdaec9f56acc07e136788e40f
- SHA512 f406dfc32404de0744b8bd9d5cfbb34e57a220e94b39a47bd515e01046f123430ff3208af4d8ea8277d694d53b544437cf1a6e3a37f59fb8d5c36933baab2ee4
- SSDEEP 49152:gDHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJfogA2eQJeYcLGqJtbf:VpGfQJdXN0B7+sitq2eQYYcLGaJr+W
- TLSH T1BC566C16B2E886B5E077C179C9A29655EA727C211F30C7CF1284963D2F337D1993AB32
- MD5 SHA1 SHA512 SSDEEP TLSH