Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 03:11
General
- Target 2026-09-08_b85be094abaddb3142ea0022015ff2b2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
- Size 5.7MB
- Sample260910-dpwzdavgld
- SHA256 8803f5f77bcdd4232313769a812a9c3d60138b9e9a169fade5ca80bd8928291a
Malware Config
Extracted
-
cobaltstrike
-
0
-
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
- Custom signatureDetects Reflective DLL injection artifacts 21 IoCs
- XMRig Miner payload 43 IoCs
- Executes dropped EXE 21 IoCs
- Drops file in Windows directory 21 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_b85be094abaddb3142ea0022015ff2b2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_b85be094abaddb3142ea0022015ff2b2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\daklyjx.exeC:\Windows\System\daklyjx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HXsXlZj.exeC:\Windows\System\HXsXlZj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IRlrSLa.exeC:\Windows\System\IRlrSLa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GpHzgrM.exeC:\Windows\System\GpHzgrM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TkuuGMc.exeC:\Windows\System\TkuuGMc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NRgYFQQ.exeC:\Windows\System\NRgYFQQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\elJuWhv.exeC:\Windows\System\elJuWhv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kxLbKsg.exeC:\Windows\System\kxLbKsg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FMNdkXA.exeC:\Windows\System\FMNdkXA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GKaNGAm.exeC:\Windows\System\GKaNGAm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OyhIYsd.exeC:\Windows\System\OyhIYsd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kjNTAfR.exeC:\Windows\System\kjNTAfR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RLeDsGP.exeC:\Windows\System\RLeDsGP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FuwifWj.exeC:\Windows\System\FuwifWj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MHVpilT.exeC:\Windows\System\MHVpilT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WKgVaUZ.exeC:\Windows\System\WKgVaUZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wCgRqkb.exeC:\Windows\System\wCgRqkb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JqifShs.exeC:\Windows\System\JqifShs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TECPLGz.exeC:\Windows\System\TECPLGz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UHEmdMN.exeC:\Windows\System\UHEmdMN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mImGoOt.exeC:\Windows\System\mImGoOt.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
FMNdkXA.exe
FuwifWj.exe
GKaNGAm.exe
GpHzgrM.exe
HXsXlZj.exe
IRlrSLa.exe
JqifShs.exe
MHVpilT.exe
NRgYFQQ.exe
OyhIYsd.exe
RLeDsGP.exe
TECPLGz.exe
TkuuGMc.exe
UHEmdMN.exe
WKgVaUZ.exe
daklyjx.exe
elJuWhv.exe
kjNTAfR.exe
kxLbKsg.exe
mImGoOt.exe
wCgRqkb.exe
memory/296-55-0x00007FF7BD310000-0x00007FF7BD65D000-memory.dmp
memory/792-109-0x00007FF78CD10000-0x00007FF78D05D000-memory.dmp
memory/796-115-0x00007FF63F020000-0x00007FF63F36D000-memory.dmp
memory/1140-1-0x000001C7836B0000-0x000001C7836C0000-memory.dmp
memory/1140-0-0x00007FF7663A0000-0x00007FF7666ED000-memory.dmp
memory/1256-61-0x00007FF6E9650000-0x00007FF6E999D000-memory.dmp
memory/1592-73-0x00007FF691E80000-0x00007FF6921CD000-memory.dmp
memory/1796-103-0x00007FF62F2F0000-0x00007FF62F63D000-memory.dmp
memory/1904-85-0x00007FF60AFB0000-0x00007FF60B2FD000-memory.dmp
memory/2680-37-0x00007FF70A700000-0x00007FF70AA4D000-memory.dmp
memory/2696-31-0x00007FF669280000-0x00007FF6695CD000-memory.dmp
memory/3964-126-0x00007FF616400000-0x00007FF61674D000-memory.dmp
memory/4092-49-0x00007FF6D4FF0000-0x00007FF6D533D000-memory.dmp
memory/4156-25-0x00007FF79DAD0000-0x00007FF79DE1D000-memory.dmp
memory/4180-43-0x00007FF6B1D20000-0x00007FF6B206D000-memory.dmp
memory/4240-7-0x00007FF6D37C0000-0x00007FF6D3B0D000-memory.dmp
memory/4248-19-0x00007FF648540000-0x00007FF64888D000-memory.dmp
memory/4328-13-0x00007FF7FEA70000-0x00007FF7FEDBD000-memory.dmp
memory/4344-79-0x00007FF76DF30000-0x00007FF76E27D000-memory.dmp
memory/4536-97-0x00007FF79C430000-0x00007FF79C77D000-memory.dmp
memory/4720-91-0x00007FF781780000-0x00007FF781ACD000-memory.dmp
memory/5060-67-0x00007FF76A240000-0x00007FF76A58D000-memory.dmp
memory/5676-121-0x00007FF6F0E90000-0x00007FF6F11DD000-memory.dmp