Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
07/07/2026, 07:33
General
- Target 2026-07-07_8cf7cbfacb2e8da2ac0ba4a0b17b5d65_amadey_cobalt-strike_coinminer_darkgate_glassworm_hellok.exe
- Size 115.8MB
- Sample260707-jdlbdscw7t
- SHA256 f590edfde8f622893d9fef39bfc1338daf76e9a4875b62209d3f9d02e1c738ca
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_8cf7cbfacb2e8da2ac0ba4a0b17b5d65_amadey_cobalt-strike_coinminer_darkgate_glassworm_hellok.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_8cf7cbfacb2e8da2ac0ba4a0b17b5d65_amadey_cobalt-strike_coinminer_darkgate_glassworm_hellok.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_8cf7cbfacb2e8da2ac0ba4a0b17b5d65_amadey_cobalt-strike_coinminer_darkgate_glassworm_hellok.exe"C:\Program Files\Directory Opus\dopus.exe"2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dummyTLS64.dll
memory/1664-10-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-9-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-13-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-32-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-33-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-40-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-38-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-37-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-36-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-35-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-31-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-30-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-29-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-28-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-27-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-26-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-25-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-24-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-23-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-21-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-19-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-18-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-16-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-14-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-22-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-17-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-12-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-8-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-7-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-0-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-56-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-60-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-72-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-74-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-73-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-71-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-70-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-68-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-67-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-65-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-64-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-92-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-110-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-113-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-115-0x000000007FD80000-0x000000007FD90000-memory.dmp
memory/1664-167-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-114-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-112-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-111-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-109-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-108-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-91-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-86-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-79-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-78-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-77-0x0000000001FF0000-0x0000000002004000-memory.dmp
memory/1664-76-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-75-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-62-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-61-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-58-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-57-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-55-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-54-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-53-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-52-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-51-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-50-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-49-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-47-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-46-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-45-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-44-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-41-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-69-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-66-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-63-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-59-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-48-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-43-0x000000007FD90000-0x000000007FFDE000-memory.dmp
memory/1664-42-0x000000007FD90000-0x000000007FFDE000-memory.dmp