Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 06:49
General
- Target 2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
- Size 8.3MB
- Sample261027-hlb71sch55
- SHA256 83ab3e97827f49467e6f6b7c6da80047ba66762f5f62e6be020713589348c35f
Malware Config
Extracted
-
cobaltstrike
-
0
-
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
- Detects Reflective DLL injection artifacts 21 IoCs
- UPX dump on OEP (original entry point) 64 IoCs
- XMRig Miner payload 64 IoCs
- Executes dropped EXE 21 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 21 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\tlVsMml.exeC:\Windows\System\tlVsMml.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ueffeBA.exeC:\Windows\System\ueffeBA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CDhGQso.exeC:\Windows\System\CDhGQso.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Vyqgubv.exeC:\Windows\System\Vyqgubv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hDcffcP.exeC:\Windows\System\hDcffcP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rGsemSE.exeC:\Windows\System\rGsemSE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GEkMyVr.exeC:\Windows\System\GEkMyVr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HSNyfnO.exeC:\Windows\System\HSNyfnO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ARSFFqu.exeC:\Windows\System\ARSFFqu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jpJuTnw.exeC:\Windows\System\jpJuTnw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\stRZLbs.exeC:\Windows\System\stRZLbs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YCPxVYK.exeC:\Windows\System\YCPxVYK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mIybHmv.exeC:\Windows\System\mIybHmv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZxDLFOV.exeC:\Windows\System\ZxDLFOV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gkcPjgB.exeC:\Windows\System\gkcPjgB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fEWIAyl.exeC:\Windows\System\fEWIAyl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dyuVRZg.exeC:\Windows\System\dyuVRZg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IbVQOys.exeC:\Windows\System\IbVQOys.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TgPiDFa.exeC:\Windows\System\TgPiDFa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YZCPmSB.exeC:\Windows\System\YZCPmSB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AwZGZEE.exeC:\Windows\System\AwZGZEE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
ARSFFqu.exe
AwZGZEE.exe
CDhGQso.exe
GEkMyVr.exe
HSNyfnO.exe
IbVQOys.exe
TgPiDFa.exe
Vyqgubv.exe
YCPxVYK.exe
YZCPmSB.exe
ZxDLFOV.exe
dyuVRZg.exe
fEWIAyl.exe
gkcPjgB.exe
hDcffcP.exe
jpJuTnw.exe
mIybHmv.exe
rGsemSE.exe
stRZLbs.exe
tlVsMml.exe
ueffeBA.exe
memory/404-157-0x00007FF79EBB0000-0x00007FF79EF02000-memory.dmp
memory/404-48-0x00007FF79EBB0000-0x00007FF79EF02000-memory.dmp
memory/404-116-0x00007FF79EBB0000-0x00007FF79EF02000-memory.dmp
memory/912-103-0x00007FF7DC900000-0x00007FF7DCC52000-memory.dmp
memory/912-164-0x00007FF7DC900000-0x00007FF7DCC52000-memory.dmp
memory/912-144-0x00007FF7DC900000-0x00007FF7DCC52000-memory.dmp
memory/1008-170-0x00007FF6FE000000-0x00007FF6FE352000-memory.dmp
memory/1008-117-0x00007FF6FE000000-0x00007FF6FE352000-memory.dmp
memory/1008-146-0x00007FF6FE000000-0x00007FF6FE352000-memory.dmp
memory/1436-143-0x00007FF6B57B0000-0x00007FF6B5B02000-memory.dmp
memory/1436-96-0x00007FF6B57B0000-0x00007FF6B5B02000-memory.dmp
memory/1436-165-0x00007FF6B57B0000-0x00007FF6B5B02000-memory.dmp
memory/1692-36-0x00007FF67C1B0000-0x00007FF67C502000-memory.dmp
memory/1692-102-0x00007FF67C1B0000-0x00007FF67C502000-memory.dmp
memory/1692-155-0x00007FF67C1B0000-0x00007FF67C502000-memory.dmp
memory/2284-110-0x00007FF6D73E0000-0x00007FF6D7732000-memory.dmp
memory/2284-145-0x00007FF6D73E0000-0x00007FF6D7732000-memory.dmp
memory/2284-166-0x00007FF6D73E0000-0x00007FF6D7732000-memory.dmp
memory/2556-109-0x00007FF6587C0000-0x00007FF658B12000-memory.dmp
memory/2556-42-0x00007FF6587C0000-0x00007FF658B12000-memory.dmp
memory/2556-158-0x00007FF6587C0000-0x00007FF658B12000-memory.dmp
memory/2592-123-0x00007FF7E7E20000-0x00007FF7E8172000-memory.dmp
memory/2592-156-0x00007FF7E7E20000-0x00007FF7E8172000-memory.dmp
memory/2592-54-0x00007FF7E7E20000-0x00007FF7E8172000-memory.dmp
memory/2676-147-0x00007FF72D780000-0x00007FF72DAD2000-memory.dmp
memory/2676-169-0x00007FF72D780000-0x00007FF72DAD2000-memory.dmp
memory/2676-124-0x00007FF72D780000-0x00007FF72DAD2000-memory.dmp
memory/2736-141-0x00007FF769470000-0x00007FF7697C2000-memory.dmp
memory/2736-82-0x00007FF769470000-0x00007FF7697C2000-memory.dmp
memory/2736-160-0x00007FF769470000-0x00007FF7697C2000-memory.dmp
memory/3020-168-0x00007FF701920000-0x00007FF701C72000-memory.dmp
memory/3020-131-0x00007FF701920000-0x00007FF701C72000-memory.dmp
memory/3020-148-0x00007FF701920000-0x00007FF701C72000-memory.dmp
memory/3232-154-0x00007FF638810000-0x00007FF638B62000-memory.dmp
memory/3232-95-0x00007FF638810000-0x00007FF638B62000-memory.dmp
memory/3232-30-0x00007FF638810000-0x00007FF638B62000-memory.dmp
memory/3544-81-0x00007FF71B7B0000-0x00007FF71BB02000-memory.dmp
memory/3544-152-0x00007FF71B7B0000-0x00007FF71BB02000-memory.dmp
memory/3544-19-0x00007FF71B7B0000-0x00007FF71BB02000-memory.dmp
memory/3756-140-0x00007FF6AB8C0000-0x00007FF6ABC12000-memory.dmp
memory/3756-75-0x00007FF6AB8C0000-0x00007FF6ABC12000-memory.dmp
memory/3756-163-0x00007FF6AB8C0000-0x00007FF6ABC12000-memory.dmp
memory/4128-162-0x00007FF79C190000-0x00007FF79C4E2000-memory.dmp
memory/4128-130-0x00007FF79C190000-0x00007FF79C4E2000-memory.dmp
memory/4128-61-0x00007FF79C190000-0x00007FF79C4E2000-memory.dmp
memory/4276-150-0x00007FF671040000-0x00007FF671392000-memory.dmp
memory/4276-67-0x00007FF671040000-0x00007FF671392000-memory.dmp
memory/4276-6-0x00007FF671040000-0x00007FF671392000-memory.dmp
memory/4964-1-0x000001AD7DF40000-0x000001AD7DF50000-memory.dmp
memory/4964-0-0x00007FF70F5C0000-0x00007FF70F912000-memory.dmp
memory/4964-60-0x00007FF70F5C0000-0x00007FF70F912000-memory.dmp
memory/5328-17-0x00007FF650090000-0x00007FF6503E2000-memory.dmp
memory/5328-151-0x00007FF650090000-0x00007FF6503E2000-memory.dmp
memory/5328-68-0x00007FF650090000-0x00007FF6503E2000-memory.dmp
memory/5600-138-0x00007FF68BF70000-0x00007FF68C2C2000-memory.dmp
memory/5600-167-0x00007FF68BF70000-0x00007FF68C2C2000-memory.dmp
memory/5600-149-0x00007FF68BF70000-0x00007FF68C2C2000-memory.dmp
memory/5648-88-0x00007FF72C530000-0x00007FF72C882000-memory.dmp
memory/5648-24-0x00007FF72C530000-0x00007FF72C882000-memory.dmp
memory/5648-153-0x00007FF72C530000-0x00007FF72C882000-memory.dmp
memory/5948-142-0x00007FF7E54B0000-0x00007FF7E5802000-memory.dmp
memory/5948-89-0x00007FF7E54B0000-0x00007FF7E5802000-memory.dmp
memory/5948-159-0x00007FF7E54B0000-0x00007FF7E5802000-memory.dmp
memory/5980-161-0x00007FF706F20000-0x00007FF707272000-memory.dmp
memory/5980-137-0x00007FF706F20000-0x00007FF707272000-memory.dmp
memory/5980-69-0x00007FF706F20000-0x00007FF707272000-memory.dmp