Overview

overview

10

Static

static

10

2026-07-14...te.exe

windows10-2004-x64

2026-07-14...te.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    5s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/07/2026, 02:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    2026-07-14_f9f13960c7abf73205d6290c3c6ccd4d_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
  • Size 36.0MB
  • Sample260714-c63b2scx2r
  • SHA256 2831aaf2aebba7a057da147828dd973b3250d5627d406a6a0996f7dc718176b8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-14_f9f13960c7abf73205d6290c3c6ccd4d_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_f9f13960c7abf73205d6290c3c6ccd4d_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-ste.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3388
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4704
      • C:\Windows\system32\reg.exe
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable
        3⤵
          PID:4464
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5036
        • C:\Windows\system32\net.exe
          net session
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4992
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            4⤵
              PID:3216
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4164
          • C:\Windows\system32\tasklist.exe
            tasklist
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4424
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command -
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5160
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mfymxg0y\mfymxg0y.cmdline"
            3⤵
              PID:5964
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES70C1.tmp" "c:\Users\Admin\AppData\Local\Temp\mfymxg0y\CSCBAF9C04EA9624381BBBDF636B4724EC.TMP"
                4⤵
                  PID:2572
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -Property Model, Manufacturer | Format-List""
              2⤵
                PID:1400
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -Property Model, Manufacturer | Format-List"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4716
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "getmac"
                2⤵
                  PID:4568
                  • C:\Windows\system32\getmac.exe
                    getmac
                    3⤵
                      PID:3108
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                    2⤵
                      PID:5564
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        3⤵
                        • Enumerates processes with tasklist
                        PID:4196
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name""
                      2⤵
                        PID:4572
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name"
                          3⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:4944
                      • C:\Windows\system32\wscript.exe
                        wscript.exe //nologo C:\Users\Admin\AppData\Local\Temp\GN0ZeYK9.vbs
                        2⤵
                          PID:5924
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im svchost.exe"
                          2⤵
                            PID:4056
                            • C:\Windows\system32\taskkill.exe
                              taskkill /f /im svchost.exe
                              3⤵
                              • Kills process with taskkill
                              PID:4492

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              StartupProfileData-NonInteractive
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              GN0ZeYK9.vbs
                              • Path C:\Users\Admin\AppData\Local\Temp\GN0ZeYK9.vbs
                              • Size 145B
                              • SHA256 d9a972fab01777ceaad7cd6ea39db1acdc6e362f9dbd567ea0abc03911a9d137
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              RES70C1.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\RES70C1.tmp
                              • Size 1KB
                              • SHA256 50733d9869ad4f3c24bf6b49961371c4b4983a7332214b0b955a9b346b7289bd
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              __PSScriptPolicyTest_dxse21wk.hjp.ps1
                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dxse21wk.hjp.ps1
                              • Size 60B
                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              mfymxg0y.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\mfymxg0y\mfymxg0y.dll
                              • Size 3KB
                              • SHA256 caee08c74bb99516fc33243a7bf9ef9dfac195305cbf5dd8c81540f4d7b70f17
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              CSCBAF9C04EA9624381BBBDF636B4724EC.TMP
                              • Path \??\c:\Users\Admin\AppData\Local\Temp\mfymxg0y\CSCBAF9C04EA9624381BBBDF636B4724EC.TMP
                              • Size 652B
                              • SHA256 88e568ccab346ded2409d7ed21976e19ebd9be827cebf61e68d3df6992c79e12
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              mfymxg0y.0.cs
                              • Path \??\c:\Users\Admin\AppData\Local\Temp\mfymxg0y\mfymxg0y.0.cs
                              • Size 420B
                              • SHA256 53cb9811b76702330a10ba42de7799eac897ffa610ec709442af108b4deadbb2
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              mfymxg0y.cmdline
                              • Path \??\c:\Users\Admin\AppData\Local\Temp\mfymxg0y\mfymxg0y.cmdline
                              • Size 369B
                              • SHA256 876fdcaf03e97c2829489c3f050a2243a3149007408ca069f1cf26e3c3303803
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              memory/4716-23-0x0000024CBB650000-0x0000024CBB66E000-memory.dmp
                              Download

                              memory/4716-24-0x0000024CBB670000-0x0000024CBB722000-memory.dmp
                              Download

                              memory/4716-25-0x0000024CBB430000-0x0000024CBB43A000-memory.dmp
                              Download

                              memory/4716-26-0x0000024CBB9B0000-0x0000024CBB9DA000-memory.dmp
                              Download

                              memory/4716-27-0x0000024CBB9B0000-0x0000024CBB9D4000-memory.dmp
                              Download

                              memory/5160-1-0x00000230B59E0000-0x00000230B5A02000-memory.dmp
                              Download

                              memory/5160-17-0x00000230CDF60000-0x00000230CDF68000-memory.dmp
                              Download

                              memory/5160-4-0x00000230CDFB0000-0x00000230CDFF8000-memory.dmp
                              Download