Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
16/10/2026, 22:40
General
- Target 2026-10-15_1489cf39f76a07052bd4f21e5c29bbbc_cloudeye_coinminer_ghostweaver_glassworm_rhadamanthys_smoke-loader_stop.exe
- Size 63.6MB
- Sample261016-2ltlvaxy2j
- SHA256 d25aef4b1a8ad800cbf455dffdde4b83caa83f849ea49df3cb01d122a9b29c12
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-15_1489cf39f76a07052bd4f21e5c29bbbc_cloudeye_coinminer_ghostweaver_glassworm_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-15_1489cf39f76a07052bd4f21e5c29bbbc_cloudeye_coinminer_ghostweaver_glassworm_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-15_1489cf39f76a07052bd4f21e5c29bbbc_cloudeye_coinminer_ghostweaver_glassworm_rhadamanthys_smoke-loader_stop.exe"C:\Program Files\TurboFTP\TurboFTP.exe"2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dummyTLS64.dll
memory/4848-10-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-12-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-22-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-30-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-64-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-66-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-74-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-97-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-96-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-95-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-88-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-80-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-79-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-78-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-77-0x0000000000550000-0x0000000000564000-memory.dmp
memory/4848-76-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-75-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-73-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-72-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-71-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-70-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-69-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-68-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-67-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-63-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-61-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-60-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-59-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-58-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-57-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-56-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-55-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-54-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-53-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-52-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-51-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-50-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-49-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-48-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-47-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-46-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-40-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-44-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-43-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-41-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-39-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-38-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-37-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-36-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-35-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-34-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-33-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-32-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-31-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-29-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-28-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-26-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-25-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-24-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-20-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-18-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-15-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-16-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-27-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-23-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-17-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-14-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-11-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-9-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-1-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-8-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-7-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-166-0x000000007FD90000-0x000000007FFDC000-memory.dmp
memory/4848-182-0x000000007FD80000-0x000000007FD90000-memory.dmp