Analysis
- max time kernel
148s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
14/07/2026, 04:31
General
- Target 2026-07-14_124877dbc100677754d1fa570dd496d5_amadey_cobalt-strike_coinminer_darkgate_gcleaner_glasswo.exe
- Size 80.3MB
- Sample260714-e5qyqset2l
- SHA256 3a5b6073efd68bdd289dc0afae29a5127f00292058056cfedb429aac95c2bc57
Malware Config
Signatures
- Detects executables referencing credit card regular expressions 1 IoCs
- UPX dump on OEP (original entry point) 3 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of FindShellTrayWindow 41 IoCs
- Suspicious use of SendNotifyMessage 40 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_124877dbc100677754d1fa570dd496d5_amadey_cobalt-strike_coinminer_darkgate_gcleaner_glasswo.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_124877dbc100677754d1fa570dd496d5_amadey_cobalt-strike_coinminer_darkgate_gcleaner_glasswo.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WYSIWYG Web Builder\WebBuilder.exe"C:\Users\Admin\AppData\Local\Temp\WYSIWYG Web Builder\WebBuilder.exe" /864A627C-C6B2-464A-AA13-25D62F282BD82⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WebBuilder.exe
WebBuilder.exe.__meta__
WebBuilder.exe
libwebp.dll
WebBuilder.exe_0x38b2e3b28d50d2d5d24aa6d8daaf85fd.1.manifest
xsandbox.bin
memory/1552-5-0x00007FFE0F910000-0x00007FFE0F912000-memory.dmp
memory/1552-195-0x00007FFE0FBB0000-0x00007FFE0FDA5000-memory.dmp
memory/1552-25-0x0000000000680000-0x0000000001017000-memory.dmp
memory/1552-232-0x00007FFE0FBB0000-0x00007FFE0FDA5000-memory.dmp
memory/1552-269-0x00007FFE0FBB0000-0x00007FFE0FDA5000-memory.dmp
memory/1552-308-0x00007FFE0FBB0000-0x00007FFE0FDA5000-memory.dmp
memory/1552-570-0x00007FFE0FBB0000-0x00007FFE0FDA5000-memory.dmp
memory/1552-569-0x0000000000680000-0x0000000001017000-memory.dmp
memory/1552-41-0x0000000001020000-0x00000000010BB000-memory.dmp
memory/1552-326-0x00007FFE0FBB0000-0x00007FFE0FDA5000-memory.dmp
memory/1552-4-0x00007FFE0FDB0000-0x00007FFE0FDB2000-memory.dmp
memory/1552-42-0x0000000001020000-0x00000000010BB000-memory.dmp
memory/1552-6-0x00007FFE0F910000-0x00007FFE0F912000-memory.dmp
memory/1552-7-0x00007FFE0E300000-0x00007FFE0E302000-memory.dmp
memory/1552-196-0x00007FFE0FBB0000-0x00007FFE0FDA5000-memory.dmp
memory/1552-35-0x00007FFE0FBB0000-0x00007FFE0FDA5000-memory.dmp
memory/1552-8-0x00007FFE0E300000-0x00007FFE0E302000-memory.dmp
memory/1552-9-0x00007FFE0E300000-0x00007FFE0E302000-memory.dmp
memory/1552-10-0x00007FFE0E300000-0x00007FFE0E302000-memory.dmp
memory/1552-11-0x00007FFE0E300000-0x00007FFE0E302000-memory.dmp
memory/1552-12-0x00007FFE0E300000-0x00007FFE0E302000-memory.dmp
memory/1552-13-0x0000000001020000-0x00000000010BB000-memory.dmp
memory/1552-20-0x0000000001020000-0x00000000010BB000-memory.dmp
memory/1552-38-0x00007FFE0FBB0000-0x00007FFE0FDA5000-memory.dmp
memory/1552-100-0x00007FFE0FBB0000-0x00007FFE0FDA5000-memory.dmp
memory/1552-111-0x00007FFE0FBB0000-0x00007FFE0FDA5000-memory.dmp
memory/1552-125-0x00007FFE0FBB0000-0x00007FFE0FDA5000-memory.dmp
memory/1552-28-0x00007FFE0FC4D000-0x00007FFE0FC4E000-memory.dmp
memory/1552-27-0x0000000001020000-0x00000000010BB000-memory.dmp
memory/1552-3-0x00007FFE0FDB0000-0x00007FFE0FDB2000-memory.dmp
memory/4384-150-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-110-0x00007FFE0E300000-0x00007FFE0E302000-memory.dmp
memory/4384-155-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-154-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-153-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-152-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-151-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-157-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-149-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-147-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-146-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-145-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-144-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-141-0x00000000004B0000-0x00000000004B2000-memory.dmp
memory/4384-139-0x00007FFE001B0000-0x00007FFE00260000-memory.dmp
memory/4384-138-0x00007FFE001B0000-0x00007FFE00260000-memory.dmp
memory/4384-137-0x00007FFE001B0000-0x00007FFE00260000-memory.dmp
memory/4384-136-0x00007FFE001B0000-0x00007FFE00260000-memory.dmp
memory/4384-133-0x0000000000480000-0x0000000000482000-memory.dmp
memory/4384-158-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-159-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-160-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-126-0x0000000001030000-0x00000000010CB000-memory.dmp
memory/4384-161-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-162-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-156-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-109-0x00007FFE0E300000-0x00007FFE0E302000-memory.dmp
memory/4384-108-0x00007FFE0E300000-0x00007FFE0E302000-memory.dmp
memory/4384-107-0x00007FFE0E300000-0x00007FFE0E302000-memory.dmp
memory/4384-106-0x00007FFE0E300000-0x00007FFE0E302000-memory.dmp
memory/4384-105-0x00007FFE0E300000-0x00007FFE0E302000-memory.dmp
memory/4384-104-0x00007FFE0F910000-0x00007FFE0F912000-memory.dmp
memory/4384-103-0x00007FFE0F910000-0x00007FFE0F912000-memory.dmp
memory/4384-102-0x00007FFE0FDB0000-0x00007FFE0FDB2000-memory.dmp
memory/4384-101-0x00007FFE0FDB0000-0x00007FFE0FDB2000-memory.dmp
memory/4384-163-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-164-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-165-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-166-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-167-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-168-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-170-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-171-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-172-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-327-0x0000000140000000-0x000000014287F000-memory.dmp
memory/4384-173-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-169-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-148-0x00007FFE0F670000-0x00007FFE0F74A000-memory.dmp
memory/4384-140-0x00007FFE001B0000-0x00007FFE00260000-memory.dmp
memory/4384-119-0x0000000001030000-0x00000000010CB000-memory.dmp
memory/4384-577-0x0000000140000000-0x000000014287F000-memory.dmp