Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 15:31
Behavioral task
behavioral1
Sample
2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe
- Size 12.1MB
- Sample260825-sye5jsbn41
- SHA256 71b652de56be831b1e44417cfb803f6c044acb984f5b94505c45f545e3599d42
- MD5 36e95e0f0be558160c09e69f9eeb5944
- SHA1 baa091d735826730c70bf36ae6058c4af16838dd
- SHA512 7d628c80ad192c7cd7fb6cf666867864e29b90146ba2476530dc311f4ad60a92e593b198ecf1644bc2dc0f8cc796642a7f93ffcd84dbe9b6d2257b92f601d10c
- SSDEEP 196608:u2XrSIqtPazmgL7uDbzVXUHXUXEOZmPOEDkfsLh3:uaWIPyquDBZtmPfkfu
- TLSH T1D7D69D27F4E200F9C57FD17086579772BA31B86942307BAB1F90EA752E12F906B2E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 7 IoCs
resource yara_rule behavioral2/files/0x000d00000001c46a-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4516-378-0x0000000000400000-0x00000000010B2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4516-834-0x0000000000400000-0x00000000010B2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4516-1245-0x0000000000400000-0x00000000010B2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4516-1696-0x0000000000400000-0x00000000010B2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4516-1801-0x0000000000400000-0x00000000010B2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/4516-1866-0x0000000000400000-0x00000000010B2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - XMRig Miner payload 7 IoCs
resource yara_rule behavioral2/files/0x000d00000001c46a-5.dat xmrig behavioral2/memory/4516-378-0x0000000000400000-0x00000000010B2000-memory.dmp xmrig behavioral2/memory/4516-834-0x0000000000400000-0x00000000010B2000-memory.dmp xmrig behavioral2/memory/4516-1245-0x0000000000400000-0x00000000010B2000-memory.dmp xmrig behavioral2/memory/4516-1696-0x0000000000400000-0x00000000010B2000-memory.dmp xmrig behavioral2/memory/4516-1801-0x0000000000400000-0x00000000010B2000-memory.dmp xmrig behavioral2/memory/4516-1866-0x0000000000400000-0x00000000010B2000-memory.dmp xmrig - Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\$Recycle.Bin\S-1-5-21-1738198120-2966725515-3980530802-1000\desktop.ini 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe - Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File created E:\autorun.inf 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File created F:\autorun.inf 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\kok-IN\tipresx.dll.mui 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\OUTLVBA.DLL 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\prism_common.dll 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\OOFL.ICO 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\manifest.json 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL022.XML 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File created C:\Program Files\Common Files\System\ado\msador28.tlb 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jsse.jar 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\el_NEUTER.pak 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MAPIR.DLL 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\DOC.CFG 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\bg.pak 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\POST.CFG 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-80.png 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8ES.LEX 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File created C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\awt.dll 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUTL.OLB 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\lcms.dll 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\openssl64.dlla.manifest 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\TALK21.COM.XML 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\SmallLogo.png 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pl_NEUTER.pak 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\REMOTES.ICO 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File created C:\Program Files\Common Files\System\msadc\msdaremr.dll 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ppd.xrm-ms 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ms_MASCULINE.pak 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\zh-CN_MASCULINE.pak 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 4516 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe Token: SeLockMemoryPrivilege 4516 2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_36e95e0f0be558160c09e69f9eeb5944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_quasar.exe"1⤵
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4516
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 12.3MB
- SHA256 3a3ff1d2d7009149fc92cb417082b64c259a21ef1524ca7836435408342129e5
- MD5 2600021b3293324bcb281f8c89198559
- SHA1 1ec37655731afe99b60ab0b9585050e741ee43c7
- SHA512 aa0e0e6d85b0a902ff41f47867d8d569511d05282e497f712cdaf9f9c84aed853bfde80055c7841cd64aa563119b54639194221767175655051e4ea0059e82b9
- SSDEEP 196608:u2XrSIqtPazmgL7uDbzVXUHXUXEOZmPOEDkfsLh3:uaWIPyquDBZtmPfkfu
- TLSH T12DD69D27F4E200F9C57FD17086579772BA31B86943307BAB1F90EA752A12F906B2E714
- MD5 SHA1 SHA512 SSDEEP TLSH