Analysis
- max time kernel
151s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/07/2026, 04:31
General
- Target 2026-07-14_124877dbc100677754d1fa570dd496d5_amadey_cobalt-strike_coinminer_darkgate_gcleaner_glasswo.exe
- Size 80.3MB
- Sample260714-e5qyqset2l
- SHA256 3a5b6073efd68bdd289dc0afae29a5127f00292058056cfedb429aac95c2bc57
Malware Config
Signatures
- Detects executables referencing credit card regular expressions 2 IoCs
- UPX dump on OEP (original entry point) 3 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of FindShellTrayWindow 37 IoCs
- Suspicious use of SendNotifyMessage 36 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_124877dbc100677754d1fa570dd496d5_amadey_cobalt-strike_coinminer_darkgate_gcleaner_glasswo.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_124877dbc100677754d1fa570dd496d5_amadey_cobalt-strike_coinminer_darkgate_gcleaner_glasswo.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WYSIWYG Web Builder\WebBuilder.exe"C:\Users\Admin\AppData\Local\Temp\WYSIWYG Web Builder\WebBuilder.exe" /864A627C-C6B2-464A-AA13-25D62F282BD82⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WebBuilder.exe
WebBuilder.exe
libwebp.dll
WebBuilder.exe_0x38b2e3b28d50d2d5d24aa6d8daaf85fd.1.manifest
xsandbox.bin
memory/2520-153-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-137-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-559-0x0000000140000000-0x000000014287F000-memory.dmp
memory/2520-550-0x0000000140000000-0x000000014287F000-memory.dmp
memory/2520-106-0x00000000035F0000-0x000000000368B000-memory.dmp
memory/2520-83-0x00007FF80FD10000-0x00007FF80FD12000-memory.dmp
memory/2520-145-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-91-0x00007FF80E3D0000-0x00007FF80E3D2000-memory.dmp
memory/2520-90-0x00007FF80E3D0000-0x00007FF80E3D2000-memory.dmp
memory/2520-89-0x00007FF80E3D0000-0x00007FF80E3D2000-memory.dmp
memory/2520-88-0x00007FF80E3D0000-0x00007FF80E3D2000-memory.dmp
memory/2520-117-0x00000000010A0000-0x00000000010A2000-memory.dmp
memory/2520-125-0x0000000003570000-0x0000000003572000-memory.dmp
memory/2520-174-0x0000000003690000-0x0000000003763000-memory.dmp
memory/2520-149-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-84-0x00007FF80FD10000-0x00007FF80FD12000-memory.dmp
memory/2520-85-0x00007FF80EDA0000-0x00007FF80EDA2000-memory.dmp
memory/2520-86-0x00007FF80EDA0000-0x00007FF80EDA2000-memory.dmp
memory/2520-182-0x0000000003690000-0x0000000003763000-memory.dmp
memory/2520-87-0x00007FF80E3D0000-0x00007FF80E3D2000-memory.dmp
memory/2520-183-0x0000000003690000-0x0000000003763000-memory.dmp
memory/2520-181-0x0000000003690000-0x0000000003763000-memory.dmp
memory/2520-176-0x0000000003690000-0x0000000003763000-memory.dmp
memory/2520-175-0x0000000003690000-0x0000000003763000-memory.dmp
memory/2520-170-0x0000000003580000-0x0000000003582000-memory.dmp
memory/2520-173-0x0000000003690000-0x0000000003763000-memory.dmp
memory/2520-169-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-100-0x00000000035F0000-0x000000000368B000-memory.dmp
memory/2520-167-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-120-0x00007FFFF5CE0000-0x00007FFFF5D94000-memory.dmp
memory/2520-165-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-163-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-121-0x00007FFFF5CE0000-0x00007FFFF5D94000-memory.dmp
memory/2520-162-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-160-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-155-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-92-0x00007FF80E3D0000-0x00007FF80E3D2000-memory.dmp
memory/2520-151-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-159-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-123-0x00007FFFF5CE0000-0x00007FFFF5D94000-memory.dmp
memory/2520-124-0x00007FFFF5CE0000-0x00007FFFF5D94000-memory.dmp
memory/2520-143-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-142-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-140-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-147-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-134-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-132-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-129-0x00007FF80F0C0000-0x00007FF80F1AD000-memory.dmp
memory/2520-180-0x0000000003690000-0x0000000003763000-memory.dmp
memory/2520-179-0x0000000003690000-0x0000000003763000-memory.dmp
memory/2520-122-0x00007FFFF5CE0000-0x00007FFFF5D94000-memory.dmp
memory/3696-11-0x00007FF80E3D0000-0x00007FF80E3D2000-memory.dmp
memory/3696-557-0x0000000000670000-0x0000000001007000-memory.dmp
memory/3696-549-0x00007FF80FAA0000-0x00007FF80FD03000-memory.dmp
memory/3696-12-0x00007FF80E3D0000-0x00007FF80E3D2000-memory.dmp
memory/3696-541-0x00007FF80FAA0000-0x00007FF80FD03000-memory.dmp
memory/3696-30-0x00007FF80FBFF000-0x00007FF80FC00000-memory.dmp
memory/3696-254-0x00007FF80FAA0000-0x00007FF80FD03000-memory.dmp
memory/3696-107-0x00007FF80FAA0000-0x00007FF80FD03000-memory.dmp
memory/3696-108-0x00007FF80FAA0000-0x00007FF80FD03000-memory.dmp
memory/3696-79-0x00007FF80FAA0000-0x00007FF80FD03000-memory.dmp
memory/3696-40-0x0000000001DF0000-0x0000000001E8B000-memory.dmp
memory/3696-10-0x00007FF80E3D0000-0x00007FF80E3D2000-memory.dmp
memory/3696-33-0x00007FF80FAA0000-0x00007FF80FD03000-memory.dmp
memory/3696-20-0x0000000001DF0000-0x0000000001E8B000-memory.dmp
memory/3696-74-0x00007FF80FAA0000-0x00007FF80FD03000-memory.dmp
memory/3696-9-0x00007FF80E3D0000-0x00007FF80E3D2000-memory.dmp
memory/3696-7-0x00007FF80E3D0000-0x00007FF80E3D2000-memory.dmp
memory/3696-6-0x00007FF80EDA0000-0x00007FF80EDA2000-memory.dmp
memory/3696-5-0x00007FF80EDA0000-0x00007FF80EDA2000-memory.dmp
memory/3696-41-0x0000000001DF0000-0x0000000001E8B000-memory.dmp
memory/3696-4-0x00007FF80FD10000-0x00007FF80FD12000-memory.dmp
memory/3696-3-0x00007FF80FD10000-0x00007FF80FD12000-memory.dmp
memory/3696-13-0x0000000001DF0000-0x0000000001E8B000-memory.dmp
memory/3696-8-0x00007FF80E3D0000-0x00007FF80E3D2000-memory.dmp
memory/3696-27-0x0000000000670000-0x0000000001007000-memory.dmp
memory/3696-558-0x00007FF80FAA0000-0x00007FF80FD03000-memory.dmp
memory/3696-26-0x0000000001DF0000-0x0000000001E8B000-memory.dmp