Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 11:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
- Size 9.8MB
- Sample260804-m7le2aaa76
- SHA256 dc8af7bb80e240593e2ae2464b8ab17a68b1ef2283945297abd1ccb85568584f
- MD5 819fcb7d4cf92ad6bdfdd3116e340569
- SHA1 c2a791a8707be45dbda80420c46028079536f988
- SHA512 0785463bb20edfe2490105e0bac1d6b34cefe97aceae89a1052e63a0f6136351b196b95c907f26aa4fa6d0084145adb385d6f65f227953b4121fe21e4d3896d0
- SSDEEP 98304:kIOERqd/6hkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0E4jovLapID6/joU:SEYd/6ZJEul4szEonqtaovcID6LoU
- TLSH T1F0A68C31B9A5C175D1628070CED5ABA5C2A97C354BF186C77280BBE91F323C27E35B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\expand.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\curl.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\sort.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\tree.com- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\notepad.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\autochk.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\PING.EXE 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\control.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\logagent.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\msra.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\user.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\logman.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\whoami.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\compact.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deploymentcsps_31bf3856ad364e35_10.0.26100.1150_none_09f77181ae5e3bb1\deploymentcsphelper.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.1591_none_986e62d788c2c027\charmap.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.26100.1_none_38dc86afc79cd565\reg.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.26100.1_none_a19933cd034a9aa0\repadmin.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.26100.1591_none_cf86813ad32dd96e\r\pcalua.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_24124d3c551588ce\bcdedit.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_38f087fa4098616b\r\ctfmon.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.26100.1_none_ada7adeacc9ba8d6\aspnet_regbrowsers.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\x86_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15912.146_none_9f891aedaabbca5a\ilasm.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.26100.1150_none_b8541704fe1248c2\ksetup.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.26100.1150_none_c24c8b338d2c21f3\r\wksprt.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_10.0.26100.1591_none_1754f2ff6760d03e\r\WinSAT.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.26100.1_none_9c81814c454e23f1\vbc.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\msil_inspectvhddialog_31bf3856ad364e35_10.0.26100.1_none_131779f41084e8ab\InspectVhdDialog.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.26100.1_none_ae9fddaa60638ed8\PresentationFontCache.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.26100.1301_none_248cf2c6018a558d\r\curl.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.26100.1_none_f3687062f0231686\efsui.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.26100.1150_none_b6d5fc573e6d363a\r\dccw.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1591_none_d0b554d77644b199\wowreg32.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.26100.1150_none_59491cddd00c2dba\r\smartscreen.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.26100.1000_none_6715fee261171762\wevtutil.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_4345324c74f92366\ctfmon.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.26100.1_none_af81c311f4c11a95\attrib.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.26100.1150_none_090eab20b35405f2\r\PresentationSettings.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_8feeb08b8bdf7ddb\regedit.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.26100.1_none_50fd5fe72912c2cf\Fondue.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\WMIADAP.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.26100.1150_none_5ce3f0df6c2eb9bb\verifier.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_1dc1d4ed10ca2d5c\r\pcaui.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..microsoftedgebchost_31bf3856ad364e35_10.0.26100.1150_none_faa81bed523ab303\r\MicrosoftEdgeBCHost.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_10.0.26100.1_none_fd15047085b284f0\SMConfigInstaller.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.26100.1_none_1f279d758fbcb0c0\msdtcvtr.bat- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.26100.1591_none_e0a0e7a383989b03\r\IMEPADSV.EXE- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\AppVShNotify.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1150_none_bcce913ab8bc643d\r\ldifde.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\r\sdchange.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.26100.1150_none_ff5cc17171576ed5\r\RdpSaProxy.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\containerworker.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_80f34faace9aed01\ChsIME.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.26100.1150_none_0d9d250a9ce416ba\ExtExport.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.26100.1591_none_0904540289bfb971\agentactivationruntimestarter.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.26100.1742_none_d23b4ab50f085fd0\r\vmms.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.26100.1150_none_a3d1faf3bbc1c7d8\r\rekeywiz.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\cmstp.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\r\immersivetpmvscmgrsvr.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.26100.1_none_4b6c4168906f5df6\dllhst3g.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_9345e45e568242fb\IMJPUEX.EXE- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runas_31bf3856ad364e35_10.0.26100.1_none_67309bf6fa5abf27\runas.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\x86_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.26100.1_none_f9312521dc249ba4\WFServicesReg.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.26100.1591_none_461a2040b9fd2031\r\FaceFodUninstaller.exe- 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_819fcb7d4cf92ad6bdfdd3116e340569_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2580
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 10.7MB
- SHA256 e842c8e323ccae92e9b27a129ff03bee128846014ebc5f5f0512ba789c533fb6
- MD5 08cb66931fed2240f4e31346f007f770
- SHA1 88f088e53143cc322e6572432e149976c1440d15
- SHA512 7aa947796f933976951d270cdf7e8e3767327c4f1fc3b095ce2b69e52911051163dee29071ff565ba175529d19bc9effd6ecb2a059185bb95be43e7e798368e3
- SSDEEP 98304:kIOERqd/6hkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0E4jovLapID6/jotezSC68:SEYd/6ZJEul4szEonqtaovcID6LoKT
- TLSH T178B69D31B9A5C235D1628070CED5ABA5D6B57C354BF085CB6280BBAD1E333C27E35B26
- MD5 SHA1 SHA512 SSDEEP TLSH