Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 11:02
General
- Target 2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
- Size 8.3MB
- Sample260910-m5d8yagf43
- SHA256 bcb67a60f2ab8435f27e63f5cc544549190d631c6678ed1547007bb40ca751a5
Malware Config
Extracted
-
cobaltstrike
-
0
-
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
- Detects Reflective DLL injection artifacts 21 IoCs
- UPX dump on OEP (original entry point) 64 IoCs
- XMRig Miner payload 64 IoCs
- Executes dropped EXE 21 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 21 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ahNPSsI.exeC:\Windows\System\ahNPSsI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ngFIXSM.exeC:\Windows\System\ngFIXSM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oxYAkob.exeC:\Windows\System\oxYAkob.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OBzqPUP.exeC:\Windows\System\OBzqPUP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oSSBkyc.exeC:\Windows\System\oSSBkyc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wJKDwfG.exeC:\Windows\System\wJKDwfG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\giqKCSe.exeC:\Windows\System\giqKCSe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oNliJyE.exeC:\Windows\System\oNliJyE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ArpLAJn.exeC:\Windows\System\ArpLAJn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LvMqOsA.exeC:\Windows\System\LvMqOsA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZVqIVIk.exeC:\Windows\System\ZVqIVIk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mDhOoaZ.exeC:\Windows\System\mDhOoaZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dwwyPDq.exeC:\Windows\System\dwwyPDq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cPGQrfw.exeC:\Windows\System\cPGQrfw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KJlrEyC.exeC:\Windows\System\KJlrEyC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\euulbjd.exeC:\Windows\System\euulbjd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LYQiHXN.exeC:\Windows\System\LYQiHXN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uCBjDmU.exeC:\Windows\System\uCBjDmU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WozXSYy.exeC:\Windows\System\WozXSYy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ByfDDeK.exeC:\Windows\System\ByfDDeK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zfhusUL.exeC:\Windows\System\zfhusUL.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
ArpLAJn.exe
ByfDDeK.exe
KJlrEyC.exe
LYQiHXN.exe
LvMqOsA.exe
OBzqPUP.exe
WozXSYy.exe
ZVqIVIk.exe
ahNPSsI.exe
cPGQrfw.exe
dwwyPDq.exe
euulbjd.exe
giqKCSe.exe
mDhOoaZ.exe
ngFIXSM.exe
oNliJyE.exe
oSSBkyc.exe
oxYAkob.exe
uCBjDmU.exe
wJKDwfG.exe
zfhusUL.exe
memory/968-131-0x00007FF6F9EB0000-0x00007FF6FA202000-memory.dmp
memory/968-148-0x00007FF6F9EB0000-0x00007FF6FA202000-memory.dmp
memory/968-167-0x00007FF6F9EB0000-0x00007FF6FA202000-memory.dmp
memory/1348-117-0x00007FF783210000-0x00007FF783562000-memory.dmp
memory/1348-170-0x00007FF783210000-0x00007FF783562000-memory.dmp
memory/1348-146-0x00007FF783210000-0x00007FF783562000-memory.dmp
memory/2196-88-0x00007FF6826C0000-0x00007FF682A12000-memory.dmp
memory/2196-154-0x00007FF6826C0000-0x00007FF682A12000-memory.dmp
memory/2196-24-0x00007FF6826C0000-0x00007FF682A12000-memory.dmp
memory/2336-159-0x00007FF7F46D0000-0x00007FF7F4A22000-memory.dmp
memory/2336-75-0x00007FF7F46D0000-0x00007FF7F4A22000-memory.dmp
memory/2336-140-0x00007FF7F46D0000-0x00007FF7F4A22000-memory.dmp
memory/2352-156-0x00007FF7029B0000-0x00007FF702D02000-memory.dmp
memory/2352-48-0x00007FF7029B0000-0x00007FF702D02000-memory.dmp
memory/2352-116-0x00007FF7029B0000-0x00007FF702D02000-memory.dmp
memory/2688-161-0x00007FF6D2E60000-0x00007FF6D31B2000-memory.dmp
memory/2688-54-0x00007FF6D2E60000-0x00007FF6D31B2000-memory.dmp
memory/2688-123-0x00007FF6D2E60000-0x00007FF6D31B2000-memory.dmp
memory/2788-160-0x00007FF648F50000-0x00007FF6492A2000-memory.dmp
memory/2788-68-0x00007FF648F50000-0x00007FF6492A2000-memory.dmp
memory/2788-136-0x00007FF648F50000-0x00007FF6492A2000-memory.dmp
memory/3708-6-0x00007FF6F0970000-0x00007FF6F0CC2000-memory.dmp
memory/3708-67-0x00007FF6F0970000-0x00007FF6F0CC2000-memory.dmp
memory/3708-150-0x00007FF6F0970000-0x00007FF6F0CC2000-memory.dmp
memory/3964-89-0x00007FF613000000-0x00007FF613352000-memory.dmp
memory/3964-142-0x00007FF613000000-0x00007FF613352000-memory.dmp
memory/3964-163-0x00007FF613000000-0x00007FF613352000-memory.dmp
memory/3972-165-0x00007FF691B70000-0x00007FF691EC2000-memory.dmp
memory/3972-103-0x00007FF691B70000-0x00007FF691EC2000-memory.dmp
memory/3972-144-0x00007FF691B70000-0x00007FF691EC2000-memory.dmp
memory/4024-168-0x00007FF658170000-0x00007FF6584C2000-memory.dmp
memory/4024-110-0x00007FF658170000-0x00007FF6584C2000-memory.dmp
memory/4024-145-0x00007FF658170000-0x00007FF6584C2000-memory.dmp
memory/4148-155-0x00007FF6E1A20000-0x00007FF6E1D72000-memory.dmp
memory/4148-109-0x00007FF6E1A20000-0x00007FF6E1D72000-memory.dmp
memory/4148-42-0x00007FF6E1A20000-0x00007FF6E1D72000-memory.dmp
memory/4168-36-0x00007FF74CA90000-0x00007FF74CDE2000-memory.dmp
memory/4168-157-0x00007FF74CA90000-0x00007FF74CDE2000-memory.dmp
memory/4168-102-0x00007FF74CA90000-0x00007FF74CDE2000-memory.dmp
memory/4308-82-0x00007FF653350000-0x00007FF6536A2000-memory.dmp
memory/4308-162-0x00007FF653350000-0x00007FF6536A2000-memory.dmp
memory/4308-141-0x00007FF653350000-0x00007FF6536A2000-memory.dmp
memory/4352-12-0x00007FF6CB150000-0x00007FF6CB4A2000-memory.dmp
memory/4352-151-0x00007FF6CB150000-0x00007FF6CB4A2000-memory.dmp
memory/4352-74-0x00007FF6CB150000-0x00007FF6CB4A2000-memory.dmp
memory/4676-1-0x000002AA78F80000-0x000002AA78F90000-memory.dmp
memory/4676-0-0x00007FF7BD0A0000-0x00007FF7BD3F2000-memory.dmp
memory/4676-60-0x00007FF7BD0A0000-0x00007FF7BD3F2000-memory.dmp
memory/4768-149-0x00007FF72BB10000-0x00007FF72BE62000-memory.dmp
memory/4768-166-0x00007FF72BB10000-0x00007FF72BE62000-memory.dmp
memory/4768-137-0x00007FF72BB10000-0x00007FF72BE62000-memory.dmp
memory/4832-158-0x00007FF7531A0000-0x00007FF7534F2000-memory.dmp
memory/4832-61-0x00007FF7531A0000-0x00007FF7534F2000-memory.dmp
memory/4832-130-0x00007FF7531A0000-0x00007FF7534F2000-memory.dmp
memory/4992-143-0x00007FF76D370000-0x00007FF76D6C2000-memory.dmp
memory/4992-96-0x00007FF76D370000-0x00007FF76D6C2000-memory.dmp
memory/4992-164-0x00007FF76D370000-0x00007FF76D6C2000-memory.dmp
memory/5072-81-0x00007FF7EB600000-0x00007FF7EB952000-memory.dmp
memory/5072-18-0x00007FF7EB600000-0x00007FF7EB952000-memory.dmp
memory/5072-152-0x00007FF7EB600000-0x00007FF7EB952000-memory.dmp
memory/5464-169-0x00007FF7669E0000-0x00007FF766D32000-memory.dmp
memory/5464-124-0x00007FF7669E0000-0x00007FF766D32000-memory.dmp
memory/5464-147-0x00007FF7669E0000-0x00007FF766D32000-memory.dmp
memory/5584-30-0x00007FF660600000-0x00007FF660952000-memory.dmp
memory/5584-153-0x00007FF660600000-0x00007FF660952000-memory.dmp
memory/5584-95-0x00007FF660600000-0x00007FF660952000-memory.dmp