Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/10/2026, 16:13
Behavioral task
behavioral1
Sample
2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe
- Size 6.6MB
- Sample261007-tpadda1z8m
- SHA256 a106a3c91798a6b4c5b1a5cdd3fba55f8bf65a349e7274788c64b1b50fd9a217
- MD5 0a08e6caa0401ff34c5a9aefafd4dd36
- SHA1 b667c3a42821474a53f897f97abf291a9771a14d
- SHA512 ff690c940f1b0834f5b945d2cdcf3043133d3cd326ccb6f6a407c547ccdb9211e11ee53c22e336cb6aa7341e46ca06d7a5efa25c5fb608ad1c108833e342eee6
- SSDEEP 49152:BDFDKatm6nyEKQ5E3ieGR0PEtBFUov1b89eX61L+2xmepn/TRijbqYW3qkCbDypf:RVLtmuq9Peq9+2xl/SSaynjoHjo
- TLSH T1E2668E13F2F942A4E06BD1B8C6B25726EE727C465B3095CF0244B7292F77AD04B39762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Fesber payload 9 IoCs
resource yara_rule behavioral1/files/0x0007000000024397-6.dat family_fesber behavioral1/files/0x0007000000024396-9.dat family_fesber behavioral1/memory/836-936-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/836-1696-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/836-2214-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/836-2215-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/836-2216-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/836-2220-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral1/memory/836-2224-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsb.stb 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\fsb.tmp 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe -
resource yara_rule behavioral1/files/0x0007000000024397-6.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:836
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 7.2MB
- SHA256 09536969596ebbf38d212f9d3f159419bd2a68bf0795a386dce3f835249e0427
- MD5 895ea2eb7f2c4f7f4583c9a5a9dd62db
- SHA1 e8ad8d1e0709d9b4a34d78e9b841378179fb8127
- SHA512 e1f0cc46d14169448cbf2d569f36de08fe2a585e107077c8cc0f37969dc45c2490e881a9de22a24a073c72f3d27d3ccfd52fdd78d0fe928938fc053771295ec0
- SSDEEP 49152:iDFDKatm6nyEKQ5E3ieGR0PEtBFUov1b89eX61L+2xmepn/TRijbqYW3qkCbDypi:SVLtmuq9Peq9+2xl/SSaynjoHjoHjo
- TLSH T1F9767E13F6F842A4E067D1B8C6A29766EE727C465B3096CF0244B7282F77AD04B39771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\fsb.tmp
- Size 6.6MB
- SHA256 1a3f1472c0e27d2716b01d077d54d020ef514cefaa7f49335f23f1aedbaa62ce
- MD5 fab5f8ab13920302fa41fcfded322b36
- SHA1 49a693218a2e91672d92dd2dd8c7e1c0d2ae1c7c
- SHA512 9973182107e0922d1e55e996e71a4af05b750903faacc8191e77d4ebb7c5fe8a4d1f78a04c4736e9138c5ed150d982e974e5a24308df053fdf4c2f87b4d6c2f6
- SSDEEP 49152:BDFDKatm6nyEKQ5E3ieGR0PEtBFUov1b89eX61L+2xmepn/TRijbqYW3qkCbDypH:RVLtmuq9Peq9+2xl/SSaynjoHjoz
- TLSH T16D668E13F2F941A4E06BD1B8C6B29726EE727C465B3095CF0244B7292F77AD04B39762
- MD5 SHA1 SHA512 SSDEEP TLSH