Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/09/2026, 12:54
General
- Target 2026-09-05_8fcac9bddb9e3cdd7007e73667a0a020_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
- Size 5.7MB
- Sample260907-p5fswaam2x
- SHA256 ded0ee0e41d8e66cd997d245a42b5e5400d089b5572745166f6222006f1994f5
Malware Config
Extracted
-
cobaltstrike
-
0
-
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
- Detects Reflective DLL injection artifacts 21 IoCs
- XMRig Miner payload 43 IoCs
- Executes dropped EXE 21 IoCs
- Drops file in Windows directory 21 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-05_8fcac9bddb9e3cdd7007e73667a0a020_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-05_8fcac9bddb9e3cdd7007e73667a0a020_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\UatOsTk.exeC:\Windows\System\UatOsTk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cUKyTJf.exeC:\Windows\System\cUKyTJf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DiagjlW.exeC:\Windows\System\DiagjlW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\onmMkFo.exeC:\Windows\System\onmMkFo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gJifiEf.exeC:\Windows\System\gJifiEf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OGBieJG.exeC:\Windows\System\OGBieJG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DcPGYKt.exeC:\Windows\System\DcPGYKt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lOFAlWM.exeC:\Windows\System\lOFAlWM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mKLAYUm.exeC:\Windows\System\mKLAYUm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qoEXcfB.exeC:\Windows\System\qoEXcfB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cRssKJs.exeC:\Windows\System\cRssKJs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cXTvuTI.exeC:\Windows\System\cXTvuTI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HHCkdym.exeC:\Windows\System\HHCkdym.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kzEHKQQ.exeC:\Windows\System\kzEHKQQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LMDysjX.exeC:\Windows\System\LMDysjX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xIyplDE.exeC:\Windows\System\xIyplDE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\maxMFYe.exeC:\Windows\System\maxMFYe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YLJVdfX.exeC:\Windows\System\YLJVdfX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yVmRQdZ.exeC:\Windows\System\yVmRQdZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NtCNrQV.exeC:\Windows\System\NtCNrQV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bXVNMsU.exeC:\Windows\System\bXVNMsU.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
DcPGYKt.exe
DiagjlW.exe
HHCkdym.exe
LMDysjX.exe
NtCNrQV.exe
OGBieJG.exe
UatOsTk.exe
YLJVdfX.exe
bXVNMsU.exe
cRssKJs.exe
cUKyTJf.exe
cXTvuTI.exe
gJifiEf.exe
kzEHKQQ.exe
lOFAlWM.exe
mKLAYUm.exe
maxMFYe.exe
onmMkFo.exe
qoEXcfB.exe
xIyplDE.exe
yVmRQdZ.exe
memory/560-97-0x00007FF7BE2A0000-0x00007FF7BE5ED000-memory.dmp
memory/1220-61-0x00007FF67A2E0000-0x00007FF67A62D000-memory.dmp
memory/1324-67-0x00007FF71ED70000-0x00007FF71F0BD000-memory.dmp
memory/1348-85-0x00007FF621750000-0x00007FF621A9D000-memory.dmp
memory/1352-37-0x00007FF6DB960000-0x00007FF6DBCAD000-memory.dmp
memory/1676-43-0x00007FF79A1D0000-0x00007FF79A51D000-memory.dmp
memory/1772-73-0x00007FF697F40000-0x00007FF69828D000-memory.dmp
memory/1872-103-0x00007FF6E3B70000-0x00007FF6E3EBD000-memory.dmp
memory/1968-109-0x00007FF7BD980000-0x00007FF7BDCCD000-memory.dmp
memory/2328-19-0x00007FF717F90000-0x00007FF7182DD000-memory.dmp
memory/3084-7-0x00007FF6AE110000-0x00007FF6AE45D000-memory.dmp
memory/3172-55-0x00007FF636250000-0x00007FF63659D000-memory.dmp
memory/3236-91-0x00007FF620E80000-0x00007FF6211CD000-memory.dmp
memory/3412-49-0x00007FF782820000-0x00007FF782B6D000-memory.dmp
memory/3756-121-0x00007FF77D300000-0x00007FF77D64D000-memory.dmp
memory/3964-13-0x00007FF7DD3A0000-0x00007FF7DD6ED000-memory.dmp
memory/4604-31-0x00007FF6B8840000-0x00007FF6B8B8D000-memory.dmp
memory/4852-25-0x00007FF601C40000-0x00007FF601F8D000-memory.dmp
memory/5272-79-0x00007FF7276E0000-0x00007FF727A2D000-memory.dmp
memory/5768-0-0x00007FF7CF8C0000-0x00007FF7CFC0D000-memory.dmp
memory/5768-1-0x0000021203500000-0x0000021203510000-memory.dmp
memory/5928-115-0x00007FF74F920000-0x00007FF74FC6D000-memory.dmp
memory/6108-126-0x00007FF7DA3D0000-0x00007FF7DA71D000-memory.dmp