Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
15/10/2026, 14:54
General
- Target 2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
- Size 5.9MB
- Sample261015-r9742agy21
- SHA256 028f91dbeb1dcbcdc73c8daa5a92ac0b81d0d773487a1ee6ad26f5af91caa7f8
Malware Config
Extracted
-
cobaltstrike
-
0
-
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
- Detects Reflective DLL injection artifacts 21 IoCs
- UPX dump on OEP (original entry point) 64 IoCs
- XMRig Miner payload 64 IoCs
- Executes dropped EXE 21 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 21 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\eXNLruF.exeC:\Windows\System\eXNLruF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xXypdfi.exeC:\Windows\System\xXypdfi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rLpamUR.exeC:\Windows\System\rLpamUR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ExCTTBk.exeC:\Windows\System\ExCTTBk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bkVVNAo.exeC:\Windows\System\bkVVNAo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fmiGTfX.exeC:\Windows\System\fmiGTfX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QwJoBAk.exeC:\Windows\System\QwJoBAk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sJAWNir.exeC:\Windows\System\sJAWNir.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IYcsYXR.exeC:\Windows\System\IYcsYXR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mPrKifR.exeC:\Windows\System\mPrKifR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tgFMVat.exeC:\Windows\System\tgFMVat.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HlRcwid.exeC:\Windows\System\HlRcwid.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SPdvNdo.exeC:\Windows\System\SPdvNdo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BOoaBxD.exeC:\Windows\System\BOoaBxD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tLtUFog.exeC:\Windows\System\tLtUFog.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xlClEaC.exeC:\Windows\System\xlClEaC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wfjUhor.exeC:\Windows\System\wfjUhor.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dVWaUNq.exeC:\Windows\System\dVWaUNq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gdUTNVi.exeC:\Windows\System\gdUTNVi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cSjLyKd.exeC:\Windows\System\cSjLyKd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zxleINP.exeC:\Windows\System\zxleINP.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
BOoaBxD.exe
ExCTTBk.exe
HlRcwid.exe
IYcsYXR.exe
QwJoBAk.exe
SPdvNdo.exe
bkVVNAo.exe
cSjLyKd.exe
dVWaUNq.exe
eXNLruF.exe
fmiGTfX.exe
gdUTNVi.exe
mPrKifR.exe
rLpamUR.exe
sJAWNir.exe
tLtUFog.exe
tgFMVat.exe
wfjUhor.exe
xXypdfi.exe
xlClEaC.exe
zxleINP.exe
memory/1160-48-0x00007FF7AA180000-0x00007FF7AA4D4000-memory.dmp
memory/1160-158-0x00007FF7AA180000-0x00007FF7AA4D4000-memory.dmp
memory/1160-116-0x00007FF7AA180000-0x00007FF7AA4D4000-memory.dmp
memory/1576-146-0x00007FF7E7A50000-0x00007FF7E7DA4000-memory.dmp
memory/1576-117-0x00007FF7E7A50000-0x00007FF7E7DA4000-memory.dmp
memory/1576-169-0x00007FF7E7A50000-0x00007FF7E7DA4000-memory.dmp
memory/1792-140-0x00007FF66C660000-0x00007FF66C9B4000-memory.dmp
memory/1792-75-0x00007FF66C660000-0x00007FF66C9B4000-memory.dmp
memory/1792-162-0x00007FF66C660000-0x00007FF66C9B4000-memory.dmp
memory/2084-68-0x00007FF7EFC00000-0x00007FF7EFF54000-memory.dmp
memory/2084-151-0x00007FF7EFC00000-0x00007FF7EFF54000-memory.dmp
memory/2084-12-0x00007FF7EFC00000-0x00007FF7EFF54000-memory.dmp
memory/2864-96-0x00007FF6F0020000-0x00007FF6F0374000-memory.dmp
memory/2864-143-0x00007FF6F0020000-0x00007FF6F0374000-memory.dmp
memory/2864-164-0x00007FF6F0020000-0x00007FF6F0374000-memory.dmp
memory/3092-166-0x00007FF66CB50000-0x00007FF66CEA4000-memory.dmp
memory/3092-142-0x00007FF66CB50000-0x00007FF66CEA4000-memory.dmp
memory/3092-89-0x00007FF66CB50000-0x00007FF66CEA4000-memory.dmp
memory/3264-61-0x00007FF70CC70000-0x00007FF70CFC4000-memory.dmp
memory/3264-6-0x00007FF70CC70000-0x00007FF70CFC4000-memory.dmp
memory/3264-150-0x00007FF70CC70000-0x00007FF70CFC4000-memory.dmp
memory/4224-156-0x00007FF7769B0000-0x00007FF776D04000-memory.dmp
memory/4224-42-0x00007FF7769B0000-0x00007FF776D04000-memory.dmp
memory/4224-109-0x00007FF7769B0000-0x00007FF776D04000-memory.dmp
memory/4288-0-0x00007FF6A49C0000-0x00007FF6A4D14000-memory.dmp
memory/4288-1-0x000001F2B6540000-0x000001F2B6550000-memory.dmp
memory/4288-55-0x00007FF6A49C0000-0x00007FF6A4D14000-memory.dmp
memory/4544-155-0x00007FF733E60000-0x00007FF7341B4000-memory.dmp
memory/4544-36-0x00007FF733E60000-0x00007FF7341B4000-memory.dmp
memory/4544-102-0x00007FF733E60000-0x00007FF7341B4000-memory.dmp
memory/4624-159-0x00007FF7C5970000-0x00007FF7C5CC4000-memory.dmp
memory/4624-62-0x00007FF7C5970000-0x00007FF7C5CC4000-memory.dmp
memory/4624-130-0x00007FF7C5970000-0x00007FF7C5CC4000-memory.dmp
memory/4860-131-0x00007FF738960000-0x00007FF738CB4000-memory.dmp
memory/4860-168-0x00007FF738960000-0x00007FF738CB4000-memory.dmp
memory/4860-148-0x00007FF738960000-0x00007FF738CB4000-memory.dmp
memory/4864-138-0x00007FF727E50000-0x00007FF7281A4000-memory.dmp
memory/4864-170-0x00007FF727E50000-0x00007FF7281A4000-memory.dmp
memory/4864-149-0x00007FF727E50000-0x00007FF7281A4000-memory.dmp
memory/5396-157-0x00007FF621720000-0x00007FF621A74000-memory.dmp
memory/5396-56-0x00007FF621720000-0x00007FF621A74000-memory.dmp
memory/5396-123-0x00007FF621720000-0x00007FF621A74000-memory.dmp
memory/5456-95-0x00007FF6BA190000-0x00007FF6BA4E4000-memory.dmp
memory/5456-31-0x00007FF6BA190000-0x00007FF6BA4E4000-memory.dmp
memory/5456-154-0x00007FF6BA190000-0x00007FF6BA4E4000-memory.dmp
memory/5480-144-0x00007FF631E90000-0x00007FF6321E4000-memory.dmp
memory/5480-163-0x00007FF631E90000-0x00007FF6321E4000-memory.dmp
memory/5480-103-0x00007FF631E90000-0x00007FF6321E4000-memory.dmp
memory/5520-160-0x00007FF60A7F0000-0x00007FF60AB44000-memory.dmp
memory/5520-141-0x00007FF60A7F0000-0x00007FF60AB44000-memory.dmp
memory/5520-82-0x00007FF60A7F0000-0x00007FF60AB44000-memory.dmp
memory/5536-137-0x00007FF61AA70000-0x00007FF61ADC4000-memory.dmp
memory/5536-69-0x00007FF61AA70000-0x00007FF61ADC4000-memory.dmp
memory/5536-161-0x00007FF61AA70000-0x00007FF61ADC4000-memory.dmp
memory/5724-145-0x00007FF738B80000-0x00007FF738ED4000-memory.dmp
memory/5724-110-0x00007FF738B80000-0x00007FF738ED4000-memory.dmp
memory/5724-165-0x00007FF738B80000-0x00007FF738ED4000-memory.dmp
memory/5728-167-0x00007FF6FEDF0000-0x00007FF6FF144000-memory.dmp
memory/5728-124-0x00007FF6FEDF0000-0x00007FF6FF144000-memory.dmp
memory/5728-147-0x00007FF6FEDF0000-0x00007FF6FF144000-memory.dmp
memory/5932-153-0x00007FF7E0F50000-0x00007FF7E12A4000-memory.dmp
memory/5932-88-0x00007FF7E0F50000-0x00007FF7E12A4000-memory.dmp
memory/5932-24-0x00007FF7E0F50000-0x00007FF7E12A4000-memory.dmp
memory/6056-152-0x00007FF7E3C70000-0x00007FF7E3FC4000-memory.dmp
memory/6056-81-0x00007FF7E3C70000-0x00007FF7E3FC4000-memory.dmp
memory/6056-18-0x00007FF7E3C70000-0x00007FF7E3FC4000-memory.dmp