Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 23:17
Behavioral task
behavioral1
Sample
2026-10-22_014f6a7b83b74589ed353497e1563290_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-10-22_014f6a7b83b74589ed353497e1563290_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
- Size 8.8MB
- Sample261024-293vesxwfs
- SHA256 01729a3a4eb4fc1b8887a688a1c0fa518e10d18044a29b4e3126f38b3f9f540f
- MD5 014f6a7b83b74589ed353497e1563290
- SHA1 3f8373cfe5cb38285fd8632f884fe8f31441e81a
- SHA512 a840a25e5b76a40831c1db4e05d86a192545078d4808eff57fbbe0c2421c53e13959c76b28ffb237ca2b1131a3278900325bbf70201995cd1274935d2f2aa386
- SSDEEP 98304:bOAe/yVPKAWDgxC9Y5lpuG8lNaP+7nDdJJSYFwM3TsUrUpCjo:bOtQIG8yWLoqo
- TLSH T146967C1172F84175D0B382748A76DA8AE6367C105B31CACF12917A5E6F73BD1AE36332
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Soulclose 4 IoCs
resource yara_rule behavioral2/memory/1232-0-0x0000000000400000-0x0000000000435000-memory.dmp family_soulclose behavioral2/files/0x0004000000016b4d-9.dat family_soulclose behavioral2/memory/1232-16-0x0000000000400000-0x0000000000435000-memory.dmp family_soulclose behavioral2/memory/1788-17-0x0000000000400000-0x0000000000435000-memory.dmp family_soulclose - UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral2/memory/1232-0-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0004000000016b4d-9.dat UPX behavioral2/memory/1232-16-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/1788-17-0x0000000000400000-0x0000000000435000-memory.dmp UPX - Deletes itself 1 TTPs 1 IoCs
pid Process 3108 cmd.exe - Executes dropped EXE 1 IoCs
pid Process 1788 CCTV.exe - Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf CCTV.exe File created F:\autorun.inf CCTV.exe File opened for modification C:\autorun.inf CCTV.exe File created C:\autorun.inf CCTV.exe -
resource yara_rule behavioral2/memory/1232-0-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0004000000016b4d-9.dat upx behavioral2/memory/1232-16-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/1788-17-0x0000000000400000-0x0000000000435000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe CCTV.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe CCTV.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe CCTV.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe CCTV.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe CCTV.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe CCTV.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe CCTV.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe CCTV.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe CCTV.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe CCTV.exe File opened for modification C:\Program Files (x86)\Windows Defender\MpCmdRun.exe CCTV.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe CCTV.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe CCTV.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe CCTV.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\CCTV.exe 2026-10-22_014f6a7b83b74589ed353497e1563290_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\CCTV.exe 2026-10-22_014f6a7b83b74589ed353497e1563290_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\CCTV.exe CCTV.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3108 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_014f6a7b83b74589ed353497e1563290_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCTV.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1232 2026-10-22_014f6a7b83b74589ed353497e1563290_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe 1788 CCTV.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1232 wrote to memory of 3108 1232 2026-10-22_014f6a7b83b74589ed353497e1563290_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe 90 PID 1232 wrote to memory of 1788 1232 2026-10-22_014f6a7b83b74589ed353497e1563290_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_014f6a7b83b74589ed353497e1563290_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_014f6a7b83b74589ed353497e1563290_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\2026-10-22_014f6a7b83b74589ed353497e1563290_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hkill.bat2⤵
- Deletes itself
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3108
-
-
C:\Windows\CCTV.exeC:\Windows\CCTV.exe2⤵
- Executes dropped EXE
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1788
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-10-22_014f6a7b83b74589ed353497e1563290_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hkill.bat
- Path C:\Users\Admin\AppData\Local\Temp\2026-10-22_014f6a7b83b74589ed353497e1563290_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hkill.bat
- Size 324B
- SHA256 8c6640c9faa29a7b3fcf6a4d6e535c81c2a4f22a81a461a072a03796330f9e6b
- MD5 3b893950e83e2b4b94a64ce031137bcf
- SHA1 78955bd067faa623cb3abbc51caf74f00e97a09c
- SHA512 abe9d6279c4f38f4dae7f6ac4a347d1ff9bbc879fa1dbc2e4e595ff35d952cbe9812f080a9208fb546c1ab2273f57a541df248da4e928947a0406d1dee59e39d
- TLSH T162E086514877CFB944A4219707B4BCCAC06969EA934827056B20E9CC74BD84B30EA386
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\CCTV.exe
- Size 8.8MB
- SHA256 01729a3a4eb4fc1b8887a688a1c0fa518e10d18044a29b4e3126f38b3f9f540f
- MD5 014f6a7b83b74589ed353497e1563290
- SHA1 3f8373cfe5cb38285fd8632f884fe8f31441e81a
- SHA512 a840a25e5b76a40831c1db4e05d86a192545078d4808eff57fbbe0c2421c53e13959c76b28ffb237ca2b1131a3278900325bbf70201995cd1274935d2f2aa386
- SSDEEP 98304:bOAe/yVPKAWDgxC9Y5lpuG8lNaP+7nDdJJSYFwM3TsUrUpCjo:bOtQIG8yWLoqo
- TLSH T146967C1172F84175D0B382748A76DA8AE6367C105B31CACF12917A5E6F73BD1AE36332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\autorun.inf
- Size 26B
- SHA256 94f4f532c5d13217e9b0cf2706ea143cf51bfe83fbe62ba3c033469bbf83802f
- MD5 36812730603173b6ebe5cf22938e3e92
- SHA1 9b262a885e488c9e51b61a7a8d741225355b636d
- SHA512 6e2cf9a92ae462996b1ff6a6b202409178422afc0e5bb4794eb6ca4e8bda07f5fc8e5b143efcb7bf4cc08112c057ad3ae4a8d065cc7729757e22bc9c93da81fd
- MD5 SHA1 SHA512