Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 11:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
- Size 10.1MB
- Sample260804-ntw52sad86
- SHA256 3ddad1728a78cead3b8470454c8df8ebd1674c617ef93308c66e7e1a13a5e954
- MD5 6042254fd9bab8cfa1e5d25a6701ba3e
- SHA1 82bf332ac868529bd5824546018a8dc2e84a5dad
- SHA512 56f29e5642377a03b95bfd1b1333da0c0496a3ac84d1133c549525dcaea5fae501a69ee283e1714828ccb8ae0e2f1126d307135e5a3bad5b6170e85546b2521b
- SSDEEP 98304:kIOERqd/6hkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0E4jovLapID6lfkZc7:SEYd/6ZJEul4szEonqtaovcID6BP7
- TLSH T11EB68C31B9A5C235D1628070CED9AFA5D2A57C354BF046C77284BBE91E323C27E35B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\curl.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\fc.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\mode.com 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\PING.EXE 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\compact.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\cscript.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\at.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\comp.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\more.com- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.26100.1_none_14d2f3235b5beec5\msdtcvtr.bat- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.26100.1150_none_ced6ba8820394f22\r\fodhelper.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.26100.1591_none_71da000f2a392039\IMCCPHR.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sysinfo_31bf3856ad364e35_10.0.26100.1_none_f69d03cd957c2a05\systeminfo.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.26100.1150_none_c8dd030624b7f968\OOBENetworkConnectionFlow.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_10.0.26100.1591_none_e980cb58b559b151\RelPost.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_caspol_b03f5f7f11d50a3a_4.0.15912.0_none_f28dd746997c1837\CasPol.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\containerworker.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_80f34faace9aed01\ChsIME.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsavailux_31bf3856ad364e35_10.0.26100.1_none_a7bc2b43865e8120\fsavailux.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_38f087fa4098616b\ctfmon.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-inputredirection_31bf3856ad364e35_10.0.26100.1591_none_9fe4b2d813f9a989\r\rdpinput.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.1_none_a05e61712d324fe9\dfrgui.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.26100.1_none_1ecd646959af4e74\auditpol.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\HOSTNAME.EXE- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\r\AccountsControlHost.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.26100.1150_none_1ab61fff20240053\r\EASPolicyManagerBrokerHost.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_fe803a2025222595\EaseOfAccessDialog.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_ee7cf88ee4c18aba\wscript.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.26100.1_none_e887f3b677523467\scrnsave.scr- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_ab86ca35f5ea21f3\CredDialogHost.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.26100.1_none_e6fd26a1f7fbb233\comrepl.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.26100.1742_none_43ffc3a787af4b46\r\IESettingSync.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.26100.1150_none_1ed5d4d47eca0768\wsl.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_73c54cb65af16a28\rundll32.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.26100.1150_none_df24b599b0c88e62\prevhost.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.26100.1591_none_d4e57f099acc84e0\appidtel.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.26100.1_none_2a4449c3cc3d4dce\MigRegDB.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.26100.1_none_d11ede0471c43ced\help.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-ping_31bf3856ad364e35_10.0.26100.1_none_9aadb670a9451e5d\RpcPing.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.26100.1_none_49f1b033747ffae2\wab.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\finger.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.26100.1_none_21c930510a00a526\AppLaunch.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\msil_addinutil_b77a5c561934e089_10.0.26100.1_none_b94f0eb8a758822f\AddInUtil.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.26100.1_none_1f279d758fbcb0c0\msdtcvtr.bat- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-managedwindowsvm_31bf3856ad364e35_10.0.26100.1591_none_4c3489b778790277\r\ManagedWindowsVM.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.26100.1591_none_9923bdb86c8e5db2\r\pnputil.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.26100.1150_none_8c544950ed549bc8\r\ThumbnailExtractionHost.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1_none_9e9d7dbf35638ca0\WMIC.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.26100.1591_none_e0a4647be01e0453\r\dispdiag.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.26100.1591_none_59ddd41753bfcf7d\Narrator.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_e4284e3cb060c8bf\cscript.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.26100.1_none_abdad67b1a4b2829\SecEdit.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh-pkcs11-helper.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_wcf-wsatconfig_b03f5f7f11d50a3a_10.0.26100.1_none_a7b1b2421ae9ec27\WsatConfig.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.26100.1742_none_32a8c94cc5f2eef2\ClipUp.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.26100.1_none_8fe1c356f34a19ca\msedgewebview2.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\adamuninstall.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.26100.1150_none_63632032763f629f\r\Defrag.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.26100.1150_none_5c8523a823214933\wmprph.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.26100.1591_none_77e8b53c81b6cf4f\r\userinit.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15912.0_none_d5e7146d665097c0\ngentask.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_afc2e5d4c65ca426\r\PinningConfirmationDialog.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\dtdump.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_ee7cf88ee4c18aba\r\cscript.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\TiFileFetcher.exe- 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_6042254fd9bab8cfa1e5d25a6701ba3e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2728
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 11.0MB
- SHA256 60394bf6ba1438fb4e2bd9216b3336e5cdae0b2e2480a33a28881a9b7731be15
- MD5 e1db8fcee83403152a219f9d09be9c57
- SHA1 f8682798452537501de60be4ea95af08b9f5c821
- SHA512 c04599da0432bc19e80ef3706999d8c14223956544a33e134670176a7e5fd41cd68a3cef105d06fd9389d58cc2d5e4603bce6e6e6e75fa59da9852de5dca7339
- SSDEEP 98304:kIOERqd/6hkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0E4jovLapID6lfkZcgezSa:SEYd/6ZJEul4szEonqtaovcID6BPnp
- TLSH T179C68D31B9A5C232D1628075CED6AFA5D6B57C254BF045CB2284B7AD1E333C27A31B36
- MD5 SHA1 SHA512 SSDEEP TLSH