cobaltstrike | 2c1885b8b51bc176727c5dcede06a8e81bbfc795996517746abf733bd3d36fa7

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
Size 5.4MB
Sample260910-mw5drsvxhs
SHA256 2c1885b8b51bc176727c5dcede06a8e81bbfc795996517746abf733bd3d36fa7
MD5 c621a140d7138201e32464f4bca839f2
SHA1 e8f0bb4b5debe59c5caed8c064f22d9a1981a1f6
SHA512 d2ebfa339c791549c1878abbb16557d804612fe22801f82bd0f45df5e7f174b9d8e7ff22037f509dcff277851423f72242b5111dcd9bf8a1241c085612c04e10
SSDEEP 98304:aIZAxzp4OwEpjoyYRshEAlOw+Je5rFrmTox8psUk:aIZ4lrVBoyYRshEAlsefma4Hk
TLSH
T1FC46238678E0C4F6D467213EB707C2A1A5F9B8B82B42940237F4ADC43537A973779B46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 1 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x0007000000024464-6.dat	cobalt_reflective_dll

Custom signature

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024464-6.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

Custom signature

Detects executables containing URLs to raw contents of a Github gist 8 IoCs

resource	yara_rule
behavioral1/memory/4508-642-0x0000000000400000-0x00000000010B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/4508-651-0x0000000000400000-0x00000000010B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/4508-1685-0x0000000000400000-0x00000000010B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/4508-2657-0x0000000000400000-0x00000000010B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/4508-3718-0x0000000000400000-0x00000000010B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/4508-4430-0x0000000000400000-0x00000000010B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/4508-4493-0x0000000000400000-0x00000000010B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/4508-4496-0x0000000000400000-0x00000000010B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Custom signature

UPX dump on OEP (original entry point) 10 IoCs

resource	yara_rule
behavioral1/memory/4508-0-0x0000000000400000-0x00000000010B6000-memory.dmp	UPX
behavioral1/files/0x0007000000024464-6.dat	UPX
behavioral1/memory/4508-642-0x0000000000400000-0x00000000010B6000-memory.dmp	UPX
behavioral1/memory/4508-651-0x0000000000400000-0x00000000010B6000-memory.dmp	UPX
behavioral1/memory/4508-1685-0x0000000000400000-0x00000000010B6000-memory.dmp	UPX
behavioral1/memory/4508-2657-0x0000000000400000-0x00000000010B6000-memory.dmp	UPX
behavioral1/memory/4508-3718-0x0000000000400000-0x00000000010B6000-memory.dmp	UPX
behavioral1/memory/4508-4430-0x0000000000400000-0x00000000010B6000-memory.dmp	UPX
behavioral1/memory/4508-4493-0x0000000000400000-0x00000000010B6000-memory.dmp	UPX
behavioral1/memory/4508-4496-0x0000000000400000-0x00000000010B6000-memory.dmp	UPX

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/4508-642-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/4508-651-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/4508-1685-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/4508-2657-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/4508-3718-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/4508-4430-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/4508-4494-0x0000000000401000-0x00000000010B5000-memory.dmp	xmrig
behavioral1/memory/4508-4493-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/4508-4496-0x0000000000400000-0x00000000010B6000-memory.dmp	xmrig
behavioral1/memory/4508-4497-0x0000000000401000-0x00000000010B5000-memory.dmp	xmrig

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\$Recycle.Bin\S-1-5-21-1788976790-1541110888-1636651838-1000\desktop.ini	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4508-0-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/files/0x0007000000024464-6.dat	upx
behavioral1/memory/4508-642-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/4508-651-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/4508-1685-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/4508-2657-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/4508-3718-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/4508-4430-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/4508-4493-0x0000000000400000-0x00000000010B6000-memory.dmp	upx
behavioral1/memory/4508-4496-0x0000000000400000-0x00000000010B6000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\LibrarySquare150x150Logo.scale-100_contrast-black.png	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\es-419_FEMININE.pak	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable-dark.png	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\THMBNAIL.PNG	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\AppxSignature.p7x	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\SmallTile.scale-125.png	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC32.DLL	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\IRIS.ELM	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\te_FEMININE.pak	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL095.XML	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.tree.dat	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Speech.resources.dll	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\msvcr120.dll	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-phn.xrm-ms	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\REFSPCL.TTF	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\PICTIM32.FLT	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosSmallTile.contrast-black_scale-100.png	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\release	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark.png	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\WideTile.scale-125.png	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-time-l1-1-0.dll	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\BOLDSTRI.ELM	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\msasxpress.dll	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\MMSS.ICO	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\Program Files\7-Zip\7-zip.dll.exe	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\PREVIEW.GIF	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\130\Microsoft.AnalysisServices.AdomdClient.dll	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\jamendo.luac	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraLargeTile.contrast-white_scale-200.png	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4508	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
Token: SeLockMemoryPrivilege	4508	2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_c621a140d7138201e32464f4bca839f2_amadey_cobalt-strike_coinminer_smoke-loader.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

7-zip.dll.exe

Path C:\Program Files\7-Zip\7-zip.dll.exe
Size 5.6MB
SHA256 d0a417285c1d873fe6bd74e3e493fe3394184f30e93dca328fc773710dd0f750
MD5 bfa01288b8f20591299f1a1fc0330e28
SHA1 7205d548839200256d721fee3f37b2d1452be373
SHA512 df73de5ce911475618dabb2a428819ac76299aecd9cbdf2fbc4f502415bc37ead0864ac10fb9347345839a1cc19675c0861589f0986dd9d8531788ed2f0d4f86
SSDEEP 98304:aIZAxzp4OwEpjoyYRshEAlOw+Je5rFrmTox8psUs:aIZ4lrVBoyYRshEAlsefma4Hs
TLSH
T1FF5623867CD084F6D467207EB707C2A1A4F9B8B82B02940637F5ADC4353B99737B9B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4508-2657-0x0000000000400000-0x00000000010B6000-memory.dmp

Download

memory/4508-4430-0x0000000000400000-0x00000000010B6000-memory.dmp

Download

memory/4508-642-0x0000000000400000-0x00000000010B6000-memory.dmp

Download

memory/4508-651-0x0000000000400000-0x00000000010B6000-memory.dmp

Download

memory/4508-1685-0x0000000000400000-0x00000000010B6000-memory.dmp

Download

memory/4508-0-0x0000000000400000-0x00000000010B6000-memory.dmp

Download

memory/4508-3718-0x0000000000400000-0x00000000010B6000-memory.dmp

Download

memory/4508-1-0x00000000001E0000-0x00000000001F0000-memory.dmp

Download

memory/4508-4489-0x0000000000060000-0x0000000000062000-memory.dmp

Download

memory/4508-4492-0x00000000001F0000-0x0000000000200000-memory.dmp

Download

memory/4508-4494-0x0000000000401000-0x00000000010B5000-memory.dmp

Download

memory/4508-4493-0x0000000000400000-0x00000000010B6000-memory.dmp

Download

memory/4508-4496-0x0000000000400000-0x00000000010B6000-memory.dmp

Download

memory/4508-4497-0x0000000000401000-0x00000000010B5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads