Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 04:36
General
- Target 2026-09-29_1f68ee832928b0940d715e460276af76_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
- Size 5.7MB
- Sample260930-e8kwwsxfna
- SHA256 1f787f3925b0a2b5b628bb7f8d51acc2befaee20bce48f0e57be1df0a0c9601f
Malware Config
Extracted
-
cobaltstrike
-
0
-
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
- Detects Reflective DLL injection artifacts 21 IoCs
- XMRig Miner payload 43 IoCs
- Executes dropped EXE 21 IoCs
- Drops file in Windows directory 21 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_1f68ee832928b0940d715e460276af76_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_1f68ee832928b0940d715e460276af76_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\wYipwzo.exeC:\Windows\System\wYipwzo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HJzMJdQ.exeC:\Windows\System\HJzMJdQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EYDTwds.exeC:\Windows\System\EYDTwds.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RhuCcUd.exeC:\Windows\System\RhuCcUd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VxUnVIX.exeC:\Windows\System\VxUnVIX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aKtJlkF.exeC:\Windows\System\aKtJlkF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GlkqxSF.exeC:\Windows\System\GlkqxSF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qixeMQg.exeC:\Windows\System\qixeMQg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MmjPzjb.exeC:\Windows\System\MmjPzjb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SIKVhTi.exeC:\Windows\System\SIKVhTi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vlAOuGG.exeC:\Windows\System\vlAOuGG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XDJdNbb.exeC:\Windows\System\XDJdNbb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qBTNnUB.exeC:\Windows\System\qBTNnUB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZbiLpDT.exeC:\Windows\System\ZbiLpDT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qQzkCMZ.exeC:\Windows\System\qQzkCMZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TktKUiW.exeC:\Windows\System\TktKUiW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hnPuoGK.exeC:\Windows\System\hnPuoGK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OZmCnqx.exeC:\Windows\System\OZmCnqx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TFIGoIY.exeC:\Windows\System\TFIGoIY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gpNtGRf.exeC:\Windows\System\gpNtGRf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HKHJKOd.exeC:\Windows\System\HKHJKOd.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
EYDTwds.exe
GlkqxSF.exe
HJzMJdQ.exe
HKHJKOd.exe
MmjPzjb.exe
OZmCnqx.exe
RhuCcUd.exe
SIKVhTi.exe
TFIGoIY.exe
TktKUiW.exe
VxUnVIX.exe
XDJdNbb.exe
ZbiLpDT.exe
aKtJlkF.exe
gpNtGRf.exe
hnPuoGK.exe
qBTNnUB.exe
qQzkCMZ.exe
qixeMQg.exe
vlAOuGG.exe
wYipwzo.exe
memory/108-37-0x00007FF6F6850000-0x00007FF6F6B9D000-memory.dmp
memory/852-97-0x00007FF7F3810000-0x00007FF7F3B5D000-memory.dmp
memory/1156-103-0x00007FF7667A0000-0x00007FF766AED000-memory.dmp
memory/1432-55-0x00007FF7116E0000-0x00007FF711A2D000-memory.dmp
memory/2584-19-0x00007FF6E3110000-0x00007FF6E345D000-memory.dmp
memory/3136-109-0x00007FF62E0E0000-0x00007FF62E42D000-memory.dmp
memory/3416-25-0x00007FF638530000-0x00007FF63887D000-memory.dmp
memory/3440-126-0x00007FF6B06C0000-0x00007FF6B0A0D000-memory.dmp
memory/3528-85-0x00007FF6CE620000-0x00007FF6CE96D000-memory.dmp
memory/3532-61-0x00007FF6413E0000-0x00007FF64172D000-memory.dmp
memory/3580-73-0x00007FF752150000-0x00007FF75249D000-memory.dmp
memory/4168-1-0x0000022A17830000-0x0000022A17840000-memory.dmp
memory/4168-0-0x00007FF640C50000-0x00007FF640F9D000-memory.dmp
memory/4256-31-0x00007FF64E960000-0x00007FF64ECAD000-memory.dmp
memory/4560-7-0x00007FF659280000-0x00007FF6595CD000-memory.dmp
memory/4912-67-0x00007FF63B2A0000-0x00007FF63B5ED000-memory.dmp
memory/4992-49-0x00007FF617330000-0x00007FF61767D000-memory.dmp
memory/5088-13-0x00007FF7EDC50000-0x00007FF7EDF9D000-memory.dmp
memory/5256-121-0x00007FF601AC0000-0x00007FF601E0D000-memory.dmp
memory/5328-43-0x00007FF62C380000-0x00007FF62C6CD000-memory.dmp
memory/5704-115-0x00007FF716510000-0x00007FF71685D000-memory.dmp
memory/5928-91-0x00007FF7BA300000-0x00007FF7BA64D000-memory.dmp
memory/6060-79-0x00007FF62AE60000-0x00007FF62B1AD000-memory.dmp