Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/10/2026, 16:13
Behavioral task
behavioral1
Sample
2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe
- Size 6.6MB
- Sample261007-tpadda1z8m
- SHA256 a106a3c91798a6b4c5b1a5cdd3fba55f8bf65a349e7274788c64b1b50fd9a217
- MD5 0a08e6caa0401ff34c5a9aefafd4dd36
- SHA1 b667c3a42821474a53f897f97abf291a9771a14d
- SHA512 ff690c940f1b0834f5b945d2cdcf3043133d3cd326ccb6f6a407c547ccdb9211e11ee53c22e336cb6aa7341e46ca06d7a5efa25c5fb608ad1c108833e342eee6
- SSDEEP 49152:BDFDKatm6nyEKQ5E3ieGR0PEtBFUov1b89eX61L+2xmepn/TRijbqYW3qkCbDypf:RVLtmuq9Peq9+2xl/SSaynjoHjo
- TLSH T1E2668E13F2F942A4E06BD1B8C6B25726EE727C465B3095CF0244B7292F77AD04B39762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Fesber payload 10 IoCs
resource yara_rule behavioral2/files/0x000500000001b7fb-3.dat family_fesber behavioral2/memory/2888-645-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2888-1196-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2888-1264-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2888-1265-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2888-1266-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2888-1267-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2888-1271-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2888-1275-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber behavioral2/memory/2888-1276-0x0000000000400000-0x000000000041B000-memory.dmp family_fesber - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe fsb.exe" 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsb.stb 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\fsb.tmp 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File opened for modification C:\Windows\SysWOW64\fsb.tmp 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe -
resource yara_rule behavioral2/files/0x000500000001b7fb-3.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\7-Zip\7z.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaws.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid 4
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-07_0a08e6caa0401ff34c5a9aefafd4dd36_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2888
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5424
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 7.2MB
- SHA256 09536969596ebbf38d212f9d3f159419bd2a68bf0795a386dce3f835249e0427
- MD5 895ea2eb7f2c4f7f4583c9a5a9dd62db
- SHA1 e8ad8d1e0709d9b4a34d78e9b841378179fb8127
- SHA512 e1f0cc46d14169448cbf2d569f36de08fe2a585e107077c8cc0f37969dc45c2490e881a9de22a24a073c72f3d27d3ccfd52fdd78d0fe928938fc053771295ec0
- SSDEEP 49152:iDFDKatm6nyEKQ5E3ieGR0PEtBFUov1b89eX61L+2xmepn/TRijbqYW3qkCbDypi:SVLtmuq9Peq9+2xl/SSaynjoHjoHjo
- TLSH T1F9767E13F6F842A4E067D1B8C6A29766EE727C465B3096CF0244B7282F77AD04B39771
- MD5 SHA1 SHA512 SSDEEP TLSH