Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 18:13
Behavioral task
behavioral1
Sample
2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
- Size 8.9MB
- Sample260819-wt2drsfk4x
- SHA256 0384d28be933c41d889bd5fc346fa655538abd38b7ed41cad30dbcf855d589fd
- MD5 a10865e9142ee9ac05a400396516b8b2
- SHA1 1804ed80c553648adb82d6951c29ceca168bc568
- SHA512 d1d8246358f9ea9c711fe91456fda6c4e483c7c81cd166361998fd70d891214d3a993d3d2cb3e45540e4f04fb7a3ad35488270d2a79f5c657af0c1e9be88ad7e
- SSDEEP 98304:TakQiFizLapI6kB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0Erjo0:TD1MzcICJEul4szEonqtfo0
- TLSH T1AB968C317996C175D2524070CF99AFA4C2A9BC354FF182C776807BEA5E322C27E35B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\runonce.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\control.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\comp.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\label.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\net1.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\print.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\wextract.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\cacls.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\fontview.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe -
resource yara_rule behavioral2/memory/1056-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000200000001b313-5.dat upx behavioral2/memory/1056-488-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1056-2912-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Windows Defender\NisSrv.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Windows Defender\MsMpEng.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.26100.1742_none_934daed75bcea2ea\vmcompute.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.26100.1150_none_25a595b3a76ab6cf\r\ImeBroker.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.26100.1591_none_e0bca845ce26528b\MDMAgent.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.26100.1150_none_b5f3ecb264c23d6b\mcbuilder.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-voiceaccessstub_31bf3856ad364e35_10.0.26100.1591_none_129ee3df08a8deda\r\VoiceAccess.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicesetupmanagerapi_31bf3856ad364e35_10.0.26100.1150_none_139d0992bdcc4113\r\DsmUserTask.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\MiniSearchHost.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MsMpEng.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\msil_addinprocess_b77a5c561934e089_10.0.26100.1_none_98735c9942cd7928\AddInProcess.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_9345e45e568242fb\r\IMJPUEX.EXE- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.26100.1_none_829a5953e9a4b444\RdpSa.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\MRINFO.EXE- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_0f19119bcdcaf335\r\SpeechModelDownload.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15912.0_none_aa82bd90bcd50b03\AppLaunch.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.26100.1_none_dcab2356dc81387c\eventcreate.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mystify_31bf3856ad364e35_10.0.26100.1150_none_8bf8eb890f472d80\Mystify.scr- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\logman.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_userexperience-oobe_31bf3856ad364e35_10.0.26100.1591_none_54983d2d7a4908c4\OOBE\OobeHostApp.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.26100.1591_none_31216c35fec422ae\cmd.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.26100.1591_none_29b9b764bd0322b9\UserAccountControlSettings.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1_none_a8f2281169c44e9b\WMIC.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\r\mofcomp.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.26100.1150_none_a32ebc355a703318\LockScreenContentServer.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.26100.1150_none_69a15f49d214516d\Windows.WARP.JITService.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.26100.1150_none_bd2d71d23a70b85d\r\LanguageComponentsInstallerComHandler.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_10.0.26100.1591_none_e980cb58b559b151\r\RelPost.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.26100.1591_none_b17acfc36f0ec944\runonce.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\NETSTAT.EXE- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.26100.1_none_554fc0a594820cda\WFServicesReg.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DesktopStickerEditorWin32Exe\DesktopStickerEditorWin32Exe.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.26100.1591_none_41d04808d6b6d160\hnsdiag.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.26100.1591_none_5ae89417c15099f2\CompatTelRunner.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..pectedcodepathtasks_31bf3856ad364e35_10.0.26100.1591_none_99fc5c721ed12b35\UCConfigTask.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_winappsdk-cbs_31bf3856ad364e35_10.0.26100.1591_none_60aad032a4073cbd\r\DeploymentAgent.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.26100.1591_none_e06d5ce38536ffdd\colorcpl.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_9e1d25f83a6fdbc2\lodctr.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\x86_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.26100.1_none_c435ce459c01d610\mscorsvw.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.26100.1150_none_3d0419d754916346\r\wslconfig.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.26100.1591_none_763a39aa4dc6e7d5\r\msconfig.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-voiceaccessstub_31bf3856ad364e35_10.0.26100.1591_none_129ee3df08a8deda\VoiceAccess.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\r\uwfux.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-setuphelper_31bf3856ad364e35_10.0.26100.1150_none_83f057581aec64ac\OOBEFodSetup.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autofstx_31bf3856ad364e35_10.0.26100.1591_none_55245726ccbb616f\autofstx.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_regasm_b03f5f7f11d50a3a_4.0.15912.0_none_9dcb4fe8bf21aec2\RegAsm.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\bfsvc.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.26100.1_none_b0f749e1a65b338a\lpq.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_wpf-xamlviewer_31bf3856ad364e35_10.0.26100.1_none_5301f4e1e5797d14\XamlViewer_v0300.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.26100.1_none_4b6c4168906f5df6\dllhst3g.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.26100.1150_none_78cec33b8cc1ebd0\r\cmdkey.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.26100.1_none_1ecd646959af4e74\auditpol.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.26100.1_none_185461d0923a3215\RunLegacyCPLElevated.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.26100.1591_none_08d143c7d80566f8\r\oobeldr.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_ab86ca35f5ea21f3\r\CredDialogHost.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_cd32a881f6fe4738\r\ChtIME.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.26100.1150_none_8e0a1d6fce8b1d12\adamsync.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netcfg_31bf3856ad364e35_10.0.26100.1150_none_ac162c2f01636f98\netcfg.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_installutil_b03f5f7f11d50a3a_4.0.15912.0_none_022ec4a0cabdc41e\InstallUtil.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\r\AddSuggestedFoldersToLibraryDialog.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-userinit_31bf3856ad364e35_10.0.26100.1591_none_823d5f8eb617914a\userinit.exe- 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_a10865e9142ee9ac05a400396516b8b2_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1056
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 9.8MB
- SHA256 be2abf0c7910af20ea189cd64c3d922f254278a4dc1e3bf33f700607df632db5
- MD5 2ab529d7c40103a11f2db01a3e452365
- SHA1 271fe67adab7b28e377e7dedbca33c6bd4b66c61
- SHA512 c6c9e0b39d1c56cff1fe1e3616f688d78d8dad980363201123676db1b2e316e80013b7e96f304dd7d533fad1754296d4cb6080207ff38f5b8d22a8131b945bf4
- SSDEEP 98304:TakQiFizLapI6kB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0ErjoNezSC6v2XMHc:TD1MzcICJEul4szEonqtfoqX
- TLSH T1D6A68D31B9A5C175D1628071CE99ABA5C2A57C354FF085CB7280BBEE5E332C27D31B26
- MD5 SHA1 SHA512 SSDEEP TLSH