cobaltstrike | 2fedf277476d9040ecbd7adab1f29cf1697040e0bfb8c510ad749517f94aa1de

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/08/2026, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
Size 5.3MB
Sample260829-lfrx3axgpc
SHA256 2fedf277476d9040ecbd7adab1f29cf1697040e0bfb8c510ad749517f94aa1de
MD5 716275dd35fc43ad26b31fdf0112233c
SHA1 0356bc9f4169e3e43ac33302218045d5c120fb9b
SHA512 cf95e2c9f0b858cd57a3c68796b3922c3f8fa0eaf4f21e52be1a22211cf56cf255a6b03771119c24e49de61dfb3a8b87d7811ffc30d273a33d31d3fb19d53df2
SSDEEP 98304:aIZAxzp4OwEpjoyYRshEAlOw+Je5rFrmTox8psUX:aIZ4lrVBoyYRshEAlsefma4HX
TLSH
T12A46338678E0C4B6D467207DB307C2A2A5F9B8B82B43980637F4ADC4653B6933775B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner persistence trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000200000001b2fa-6.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
behavioral2/files/0x000200000001b2fa-6.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects executables containing URLs to raw contents of a Github gist 7 IoCs

resource	yara_rule
behavioral2/memory/4536-647-0x0000000000400000-0x00000000010B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4536-645-0x0000000000400000-0x00000000010B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4536-1511-0x0000000000400000-0x00000000010B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4536-2522-0x0000000000400000-0x00000000010B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4536-3498-0x0000000000400000-0x00000000010B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4536-4195-0x0000000000400000-0x00000000010B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4536-4387-0x0000000000400000-0x00000000010B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

UPX dump on OEP (original entry point) 10 IoCs

resource	yara_rule
behavioral2/memory/4536-0-0x0000000000400000-0x00000000010B6000-memory.dmp	UPX
behavioral2/files/0x000200000001b2fa-6.dat	UPX
behavioral2/memory/4536-647-0x0000000000400000-0x00000000010B6000-memory.dmp	UPX
behavioral2/memory/4536-645-0x0000000000400000-0x00000000010B6000-memory.dmp	UPX
behavioral2/memory/4536-1511-0x0000000000400000-0x00000000010B6000-memory.dmp	UPX
behavioral2/memory/4536-2522-0x0000000000400000-0x00000000010B6000-memory.dmp	UPX
behavioral2/memory/4536-3498-0x0000000000400000-0x00000000010B6000-memory.dmp	UPX
behavioral2/memory/4536-4195-0x0000000000400000-0x00000000010B6000-memory.dmp	UPX
behavioral2/memory/4536-4387-0x0000000000400000-0x00000000010B6000-memory.dmp	UPX
behavioral2/memory/4536-4390-0x0000000000400000-0x00000000010B6000-memory.dmp	UPX

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral2/memory/4536-647-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral2/memory/4536-645-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral2/memory/4536-1511-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral2/memory/4536-2522-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral2/memory/4536-3498-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral2/memory/4536-4195-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral2/memory/4536-4387-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral2/memory/4536-4388-0x0000000000401000-0x00000000010B5000-memory.dmp	xmrig

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IPwiCB = "c:\\Windows\\System32\\IPwiCB.exe"	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\$Recycle.Bin\S-1-5-21-3986082593-3624157295-3514260330-1000\desktop.ini	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\IPwiCB.exe	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4536-0-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral2/files/0x000200000001b2fa-6.dat	upx
behavioral2/memory/4536-647-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral2/memory/4536-645-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral2/memory/4536-1511-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral2/memory/4536-2522-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral2/memory/4536-3498-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral2/memory/4536-4195-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral2/memory/4536-4387-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral2/memory/4536-4390-0x0000000000400000-0x00000000010B6000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.DLL	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.POWERPNT.16.1033.hxn	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\et_FEMININE.pak	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lv_MASCULINE.pak	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\MOFL.DLL	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrome.7z	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lv.pak	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\he_MASCULINE.pak	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lv_NEUTER.pak	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogoSmall.contrast-black_scale-180.png	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.LEX	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\osmmui.msi.16.en-us.boot.tree.dat	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Microsoft.AnalysisServices.AzureClient.dll	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\tr_NEUTER.pak	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ppd.xrm-ms	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-pl.xrm-ms	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL102.XML	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\osmmui.msi.16.en-us.tree.dat	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\pt-BR_FEMININE.pak	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\PREVIEW.GIF	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\et.pak	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SECURL.ICO	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\LEELAWDB.TTF	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\as-IN\tipresx.dll.mui	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\sk_FEMININE.pak	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\prism_common.dll	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OutlookLogoSmall.contrast-black_scale-80.png	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL096.XML	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\pkeyconfig-office.xrm-ms	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4536	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
Token: SeLockMemoryPrivilege	4536	2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-29_716275dd35fc43ad26b31fdf0112233c_amadey_cobalt-strike_coinminer_smoke-loader.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7-zip.dll

Path C:\Program Files\7-Zip\7-zip.dll
Size 5.5MB
SHA256 3ec7836d272f0a3bedbdf8f28eda4a6d88b4beca34129dc16c95d8dee40e008a
MD5 a1db408548951eed6ef91e36c81cc7fa
SHA1 85b97738f2445e01b2dda8b631bdfb5b416d1cd8
SHA512 afb666aac56bc3ba7b66eaa47d60d7594792cdecc848694aa75929182d3b5aa91b92898053289df304d9d5045caaf978183f2c46a1ea5c67c71a42ce0bcacc5c
SSDEEP 98304:aIZAxzp4OwEpjoyYRshEAlOw+Je5rFrmTox8psUY:aIZ4lrVBoyYRshEAlsefma4HY
TLSH
T1A946238678D0C4F6D467203EB707C2A2A5F9B8B82B42980637F4ADC47537A973775B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4536-2522-0x0000000000400000-0x00000000010B6000-memory.dmp

Download

memory/4536-1-0x0000000001660000-0x0000000001670000-memory.dmp

Download

memory/4536-647-0x0000000000400000-0x00000000010B6000-memory.dmp

Download

memory/4536-645-0x0000000000400000-0x00000000010B6000-memory.dmp

Download

memory/4536-1511-0x0000000000400000-0x00000000010B6000-memory.dmp

Download

memory/4536-0-0x0000000000400000-0x00000000010B6000-memory.dmp

Download

memory/4536-3498-0x0000000000400000-0x00000000010B6000-memory.dmp

Download

memory/4536-4195-0x0000000000400000-0x00000000010B6000-memory.dmp

Download

memory/4536-4378-0x0000000000060000-0x0000000000062000-memory.dmp

Download

memory/4536-4387-0x0000000000400000-0x00000000010B6000-memory.dmp

Download

memory/4536-4388-0x0000000000401000-0x00000000010B5000-memory.dmp

Download

memory/4536-4390-0x0000000000400000-0x00000000010B6000-memory.dmp

Download

memory/4536-4391-0x0000000000401000-0x00000000010B5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads