9d0eed3dfbb99795fcad0875fc4c2982ca521722aa0d741deb6e76268d958d7b

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_9ad39f338347644caa3c90154f14846e_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe
Size 809KB
Sample260806-qdcsksaa25
SHA256 9d0eed3dfbb99795fcad0875fc4c2982ca521722aa0d741deb6e76268d958d7b
MD5 9ad39f338347644caa3c90154f14846e
SHA1 549304a9fc4fc1b04357a6e802db03ed8719fabf
SHA512 ea1811be6f91cb641aab09266b4f37e2650ed33753b6879af9f1639dcdaa9f432326c053c870190a2ca75a0f17a3149ebd76c2334fa5012d6ac97e473a696bc5
SSDEEP 12288:iLC6eB2TqaAmyO6M/2sd925Cdd5PE3nyb6chgZFUySxH4p:i2BeEmzusG3yecOZiySxY
TLSH
T159057C02B591C167E1F28630863786B44D74BE7067BAA5EFB390362E5E34AC11E35B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2752	3576	WerFault.exe	87
1160	3576	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_9ad39f338347644caa3c90154f14846e_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-06_9ad39f338347644caa3c90154f14846e_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_9ad39f338347644caa3c90154f14846e_amadey_cobalt-strike_coinminer_elex_hijackloader_luca-st.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 492
  2⤵
  - Program crash
  PID:2752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 536
  2⤵
  - Program crash
  PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3576 -ip 3576
1⤵
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3576 -ip 3576
1⤵
PID:2332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3576-0-0x0000000000710000-0x00000000007E2324-memory.dmp

Download

memory/3576-1-0x0000000000710000-0x00000000007E2324-memory.dmp