cobaltstrike | 6801f229a3464d24e7af76bc689bce169c4f34821fbd8366e21e3131b99b858d

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 5.9MB
Sample260820-wt6cqagq2x
SHA256 6801f229a3464d24e7af76bc689bce169c4f34821fbd8366e21e3131b99b858d
MD5 1956471fb80777bd50c2dd4eb6382981
SHA1 3bdde590776fa5920d4a25762c39ed0f12b625df
SHA512 c34f009c70398c0498169768193ea0af273d7d1196fe751cd03b8e2c8cb84af672df50ec4e7a532ebf7621cb090e9f73f896dec16b32deab26d6d8943ecc3089
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU4:Q+u56utgpPF8u/74
TLSH
T152565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x00080000000242bf-7.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242c5-28.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242c6-48.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242c7-60.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242d4-85.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242d6-113.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242d5-111.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242d3-106.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242d2-104.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242d1-102.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242cf-98.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242ce-92.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242cd-90.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242cc-80.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242d0-77.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242cb-76.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242ca-73.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242c8-65.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242c9-53.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242c4-50.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242c3-16.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral1/files/0x00080000000242bf-7.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242c5-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242c6-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242c7-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242d4-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242d6-113.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242d5-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242d3-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242d2-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242d1-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242cf-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242ce-92.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242cd-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242cc-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242d0-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242cb-76.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242ca-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242c8-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242c9-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242c4-50.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242c3-16.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral1/memory/1292-0-0x00007FF622040000-0x00007FF622394000-memory.dmp	UPX
behavioral1/files/0x00080000000242bf-7.dat	UPX
behavioral1/files/0x00070000000242c5-28.dat	UPX
behavioral1/files/0x00070000000242c6-48.dat	UPX
behavioral1/files/0x00070000000242c7-60.dat	UPX
behavioral1/files/0x00070000000242d4-85.dat	UPX
behavioral1/memory/1232-100-0x00007FF6B2C20000-0x00007FF6B2F74000-memory.dmp	UPX
behavioral1/files/0x00070000000242d6-113.dat	UPX
behavioral1/memory/2148-121-0x00007FF638AC0000-0x00007FF638E14000-memory.dmp	UPX
behavioral1/memory/5016-126-0x00007FF6111A0000-0x00007FF6114F4000-memory.dmp	UPX
behavioral1/memory/4432-127-0x00007FF6C60E0000-0x00007FF6C6434000-memory.dmp	UPX
behavioral1/memory/3580-125-0x00007FF72A0E0000-0x00007FF72A434000-memory.dmp	UPX
behavioral1/memory/1492-124-0x00007FF64ADE0000-0x00007FF64B134000-memory.dmp	UPX
behavioral1/memory/1220-123-0x00007FF6423E0000-0x00007FF642734000-memory.dmp	UPX
behavioral1/memory/1720-122-0x00007FF70A5A0000-0x00007FF70A8F4000-memory.dmp	UPX
behavioral1/memory/912-120-0x00007FF610AC0000-0x00007FF610E14000-memory.dmp	UPX
behavioral1/memory/1560-119-0x00007FF64A5C0000-0x00007FF64A914000-memory.dmp	UPX
behavioral1/memory/2972-118-0x00007FF786B50000-0x00007FF786EA4000-memory.dmp	UPX
behavioral1/memory/2916-117-0x00007FF682B20000-0x00007FF682E74000-memory.dmp	UPX
behavioral1/memory/4640-116-0x00007FF726F00000-0x00007FF727254000-memory.dmp	UPX
behavioral1/memory/432-115-0x00007FF6769D0000-0x00007FF676D24000-memory.dmp	UPX
behavioral1/files/0x00070000000242d5-111.dat	UPX
behavioral1/memory/2748-110-0x00007FF62FCA0000-0x00007FF62FFF4000-memory.dmp	UPX
behavioral1/files/0x00070000000242d3-106.dat	UPX
behavioral1/files/0x00070000000242d2-104.dat	UPX
behavioral1/files/0x00070000000242d1-102.dat	UPX
behavioral1/memory/4044-101-0x00007FF671000000-0x00007FF671354000-memory.dmp	UPX
behavioral1/files/0x00070000000242cf-98.dat	UPX
behavioral1/memory/728-95-0x00007FF6704F0000-0x00007FF670844000-memory.dmp	UPX
behavioral1/memory/4820-94-0x00007FF742C70000-0x00007FF742FC4000-memory.dmp	UPX
behavioral1/files/0x00070000000242ce-92.dat	UPX
behavioral1/files/0x00070000000242cd-90.dat	UPX
behavioral1/files/0x00070000000242cc-80.dat	UPX
behavioral1/files/0x00070000000242d0-77.dat	UPX
behavioral1/files/0x00070000000242cb-76.dat	UPX
behavioral1/files/0x00070000000242ca-73.dat	UPX
behavioral1/memory/5032-72-0x00007FF7072D0000-0x00007FF707624000-memory.dmp	UPX
behavioral1/files/0x00070000000242c8-65.dat	UPX
behavioral1/files/0x00070000000242c9-53.dat	UPX
behavioral1/files/0x00070000000242c4-50.dat	UPX
behavioral1/memory/5100-44-0x00007FF740360000-0x00007FF7406B4000-memory.dmp	UPX
behavioral1/memory/4540-24-0x00007FF759FA0000-0x00007FF75A2F4000-memory.dmp	UPX
behavioral1/files/0x00070000000242c3-16.dat	UPX
behavioral1/memory/1292-128-0x00007FF622040000-0x00007FF622394000-memory.dmp	UPX
behavioral1/memory/4540-129-0x00007FF759FA0000-0x00007FF75A2F4000-memory.dmp	UPX
behavioral1/memory/5100-130-0x00007FF740360000-0x00007FF7406B4000-memory.dmp	UPX
behavioral1/memory/5032-131-0x00007FF7072D0000-0x00007FF707624000-memory.dmp	UPX
behavioral1/memory/4540-132-0x00007FF759FA0000-0x00007FF75A2F4000-memory.dmp	UPX
behavioral1/memory/1220-142-0x00007FF6423E0000-0x00007FF642734000-memory.dmp	UPX
behavioral1/memory/2148-148-0x00007FF638AC0000-0x00007FF638E14000-memory.dmp	UPX
behavioral1/memory/4432-149-0x00007FF6C60E0000-0x00007FF6C6434000-memory.dmp	UPX
behavioral1/memory/912-147-0x00007FF610AC0000-0x00007FF610E14000-memory.dmp	UPX
behavioral1/memory/1560-146-0x00007FF64A5C0000-0x00007FF64A914000-memory.dmp	UPX
behavioral1/memory/2972-145-0x00007FF786B50000-0x00007FF786EA4000-memory.dmp	UPX
behavioral1/memory/2916-144-0x00007FF682B20000-0x00007FF682E74000-memory.dmp	UPX
behavioral1/memory/1492-143-0x00007FF64ADE0000-0x00007FF64B134000-memory.dmp	UPX
behavioral1/memory/4820-141-0x00007FF742C70000-0x00007FF742FC4000-memory.dmp	UPX
behavioral1/memory/1232-140-0x00007FF6B2C20000-0x00007FF6B2F74000-memory.dmp	UPX
behavioral1/memory/728-139-0x00007FF6704F0000-0x00007FF670844000-memory.dmp	UPX
behavioral1/memory/4044-138-0x00007FF671000000-0x00007FF671354000-memory.dmp	UPX
behavioral1/memory/2748-137-0x00007FF62FCA0000-0x00007FF62FFF4000-memory.dmp	UPX
behavioral1/memory/432-136-0x00007FF6769D0000-0x00007FF676D24000-memory.dmp	UPX
behavioral1/memory/5016-135-0x00007FF6111A0000-0x00007FF6114F4000-memory.dmp	UPX
behavioral1/memory/4640-134-0x00007FF726F00000-0x00007FF727254000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/1292-0-0x00007FF622040000-0x00007FF622394000-memory.dmp	xmrig
behavioral1/files/0x00080000000242bf-7.dat	xmrig
behavioral1/files/0x00070000000242c5-28.dat	xmrig
behavioral1/files/0x00070000000242c6-48.dat	xmrig
behavioral1/files/0x00070000000242c7-60.dat	xmrig
behavioral1/files/0x00070000000242d4-85.dat	xmrig
behavioral1/memory/1232-100-0x00007FF6B2C20000-0x00007FF6B2F74000-memory.dmp	xmrig
behavioral1/files/0x00070000000242d6-113.dat	xmrig
behavioral1/memory/2148-121-0x00007FF638AC0000-0x00007FF638E14000-memory.dmp	xmrig
behavioral1/memory/5016-126-0x00007FF6111A0000-0x00007FF6114F4000-memory.dmp	xmrig
behavioral1/memory/4432-127-0x00007FF6C60E0000-0x00007FF6C6434000-memory.dmp	xmrig
behavioral1/memory/3580-125-0x00007FF72A0E0000-0x00007FF72A434000-memory.dmp	xmrig
behavioral1/memory/1492-124-0x00007FF64ADE0000-0x00007FF64B134000-memory.dmp	xmrig
behavioral1/memory/1220-123-0x00007FF6423E0000-0x00007FF642734000-memory.dmp	xmrig
behavioral1/memory/1720-122-0x00007FF70A5A0000-0x00007FF70A8F4000-memory.dmp	xmrig
behavioral1/memory/912-120-0x00007FF610AC0000-0x00007FF610E14000-memory.dmp	xmrig
behavioral1/memory/1560-119-0x00007FF64A5C0000-0x00007FF64A914000-memory.dmp	xmrig
behavioral1/memory/2972-118-0x00007FF786B50000-0x00007FF786EA4000-memory.dmp	xmrig
behavioral1/memory/2916-117-0x00007FF682B20000-0x00007FF682E74000-memory.dmp	xmrig
behavioral1/memory/4640-116-0x00007FF726F00000-0x00007FF727254000-memory.dmp	xmrig
behavioral1/memory/432-115-0x00007FF6769D0000-0x00007FF676D24000-memory.dmp	xmrig
behavioral1/files/0x00070000000242d5-111.dat	xmrig
behavioral1/memory/2748-110-0x00007FF62FCA0000-0x00007FF62FFF4000-memory.dmp	xmrig
behavioral1/files/0x00070000000242d3-106.dat	xmrig
behavioral1/files/0x00070000000242d2-104.dat	xmrig
behavioral1/files/0x00070000000242d1-102.dat	xmrig
behavioral1/memory/4044-101-0x00007FF671000000-0x00007FF671354000-memory.dmp	xmrig
behavioral1/files/0x00070000000242cf-98.dat	xmrig
behavioral1/memory/728-95-0x00007FF6704F0000-0x00007FF670844000-memory.dmp	xmrig
behavioral1/memory/4820-94-0x00007FF742C70000-0x00007FF742FC4000-memory.dmp	xmrig
behavioral1/files/0x00070000000242ce-92.dat	xmrig
behavioral1/files/0x00070000000242cd-90.dat	xmrig
behavioral1/files/0x00070000000242cc-80.dat	xmrig
behavioral1/files/0x00070000000242d0-77.dat	xmrig
behavioral1/files/0x00070000000242cb-76.dat	xmrig
behavioral1/files/0x00070000000242ca-73.dat	xmrig
behavioral1/memory/5032-72-0x00007FF7072D0000-0x00007FF707624000-memory.dmp	xmrig
behavioral1/files/0x00070000000242c8-65.dat	xmrig
behavioral1/files/0x00070000000242c9-53.dat	xmrig
behavioral1/files/0x00070000000242c4-50.dat	xmrig
behavioral1/memory/5100-44-0x00007FF740360000-0x00007FF7406B4000-memory.dmp	xmrig
behavioral1/memory/4540-24-0x00007FF759FA0000-0x00007FF75A2F4000-memory.dmp	xmrig
behavioral1/files/0x00070000000242c3-16.dat	xmrig
behavioral1/memory/1292-128-0x00007FF622040000-0x00007FF622394000-memory.dmp	xmrig
behavioral1/memory/4540-129-0x00007FF759FA0000-0x00007FF75A2F4000-memory.dmp	xmrig
behavioral1/memory/5100-130-0x00007FF740360000-0x00007FF7406B4000-memory.dmp	xmrig
behavioral1/memory/5032-131-0x00007FF7072D0000-0x00007FF707624000-memory.dmp	xmrig
behavioral1/memory/4540-132-0x00007FF759FA0000-0x00007FF75A2F4000-memory.dmp	xmrig
behavioral1/memory/1220-142-0x00007FF6423E0000-0x00007FF642734000-memory.dmp	xmrig
behavioral1/memory/2148-148-0x00007FF638AC0000-0x00007FF638E14000-memory.dmp	xmrig
behavioral1/memory/4432-149-0x00007FF6C60E0000-0x00007FF6C6434000-memory.dmp	xmrig
behavioral1/memory/912-147-0x00007FF610AC0000-0x00007FF610E14000-memory.dmp	xmrig
behavioral1/memory/1560-146-0x00007FF64A5C0000-0x00007FF64A914000-memory.dmp	xmrig
behavioral1/memory/2972-145-0x00007FF786B50000-0x00007FF786EA4000-memory.dmp	xmrig
behavioral1/memory/2916-144-0x00007FF682B20000-0x00007FF682E74000-memory.dmp	xmrig
behavioral1/memory/1492-143-0x00007FF64ADE0000-0x00007FF64B134000-memory.dmp	xmrig
behavioral1/memory/4820-141-0x00007FF742C70000-0x00007FF742FC4000-memory.dmp	xmrig
behavioral1/memory/1232-140-0x00007FF6B2C20000-0x00007FF6B2F74000-memory.dmp	xmrig
behavioral1/memory/728-139-0x00007FF6704F0000-0x00007FF670844000-memory.dmp	xmrig
behavioral1/memory/4044-138-0x00007FF671000000-0x00007FF671354000-memory.dmp	xmrig
behavioral1/memory/2748-137-0x00007FF62FCA0000-0x00007FF62FFF4000-memory.dmp	xmrig
behavioral1/memory/432-136-0x00007FF6769D0000-0x00007FF676D24000-memory.dmp	xmrig
behavioral1/memory/5016-135-0x00007FF6111A0000-0x00007FF6114F4000-memory.dmp	xmrig
behavioral1/memory/4640-134-0x00007FF726F00000-0x00007FF727254000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4540	QmbISWc.exe
5100	wNgdURp.exe
1220	cEQvlGL.exe
5032	fZKVFbj.exe
1492	bhqvCOM.exe
4820	woJlCoH.exe
728	DKNOInW.exe
1232	fuWqJrf.exe
4044	VioZmeB.exe
2748	MuVkQDL.exe
432	hJGPfDr.exe
4640	zEjQxfr.exe
3580	IRDreJf.exe
2916	qvyOiAA.exe
5016	mThWVhA.exe
2972	fOouacj.exe
1560	XkACdXk.exe
912	KlLRLDP.exe
2148	XpAgxtX.exe
4432	eaiBMup.exe
1720	wNIFqhW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1292-0-0x00007FF622040000-0x00007FF622394000-memory.dmp	upx
behavioral1/files/0x00080000000242bf-7.dat	upx
behavioral1/files/0x00070000000242c5-28.dat	upx
behavioral1/files/0x00070000000242c6-48.dat	upx
behavioral1/files/0x00070000000242c7-60.dat	upx
behavioral1/files/0x00070000000242d4-85.dat	upx
behavioral1/memory/1232-100-0x00007FF6B2C20000-0x00007FF6B2F74000-memory.dmp	upx
behavioral1/files/0x00070000000242d6-113.dat	upx
behavioral1/memory/2148-121-0x00007FF638AC0000-0x00007FF638E14000-memory.dmp	upx
behavioral1/memory/5016-126-0x00007FF6111A0000-0x00007FF6114F4000-memory.dmp	upx
behavioral1/memory/4432-127-0x00007FF6C60E0000-0x00007FF6C6434000-memory.dmp	upx
behavioral1/memory/3580-125-0x00007FF72A0E0000-0x00007FF72A434000-memory.dmp	upx
behavioral1/memory/1492-124-0x00007FF64ADE0000-0x00007FF64B134000-memory.dmp	upx
behavioral1/memory/1220-123-0x00007FF6423E0000-0x00007FF642734000-memory.dmp	upx
behavioral1/memory/1720-122-0x00007FF70A5A0000-0x00007FF70A8F4000-memory.dmp	upx
behavioral1/memory/912-120-0x00007FF610AC0000-0x00007FF610E14000-memory.dmp	upx
behavioral1/memory/1560-119-0x00007FF64A5C0000-0x00007FF64A914000-memory.dmp	upx
behavioral1/memory/2972-118-0x00007FF786B50000-0x00007FF786EA4000-memory.dmp	upx
behavioral1/memory/2916-117-0x00007FF682B20000-0x00007FF682E74000-memory.dmp	upx
behavioral1/memory/4640-116-0x00007FF726F00000-0x00007FF727254000-memory.dmp	upx
behavioral1/memory/432-115-0x00007FF6769D0000-0x00007FF676D24000-memory.dmp	upx
behavioral1/files/0x00070000000242d5-111.dat	upx
behavioral1/memory/2748-110-0x00007FF62FCA0000-0x00007FF62FFF4000-memory.dmp	upx
behavioral1/files/0x00070000000242d3-106.dat	upx
behavioral1/files/0x00070000000242d2-104.dat	upx
behavioral1/files/0x00070000000242d1-102.dat	upx
behavioral1/memory/4044-101-0x00007FF671000000-0x00007FF671354000-memory.dmp	upx
behavioral1/files/0x00070000000242cf-98.dat	upx
behavioral1/memory/728-95-0x00007FF6704F0000-0x00007FF670844000-memory.dmp	upx
behavioral1/memory/4820-94-0x00007FF742C70000-0x00007FF742FC4000-memory.dmp	upx
behavioral1/files/0x00070000000242ce-92.dat	upx
behavioral1/files/0x00070000000242cd-90.dat	upx
behavioral1/files/0x00070000000242cc-80.dat	upx
behavioral1/files/0x00070000000242d0-77.dat	upx
behavioral1/files/0x00070000000242cb-76.dat	upx
behavioral1/files/0x00070000000242ca-73.dat	upx
behavioral1/memory/5032-72-0x00007FF7072D0000-0x00007FF707624000-memory.dmp	upx
behavioral1/files/0x00070000000242c8-65.dat	upx
behavioral1/files/0x00070000000242c9-53.dat	upx
behavioral1/files/0x00070000000242c4-50.dat	upx
behavioral1/memory/5100-44-0x00007FF740360000-0x00007FF7406B4000-memory.dmp	upx
behavioral1/memory/4540-24-0x00007FF759FA0000-0x00007FF75A2F4000-memory.dmp	upx
behavioral1/files/0x00070000000242c3-16.dat	upx
behavioral1/memory/1292-128-0x00007FF622040000-0x00007FF622394000-memory.dmp	upx
behavioral1/memory/4540-129-0x00007FF759FA0000-0x00007FF75A2F4000-memory.dmp	upx
behavioral1/memory/5100-130-0x00007FF740360000-0x00007FF7406B4000-memory.dmp	upx
behavioral1/memory/5032-131-0x00007FF7072D0000-0x00007FF707624000-memory.dmp	upx
behavioral1/memory/4540-132-0x00007FF759FA0000-0x00007FF75A2F4000-memory.dmp	upx
behavioral1/memory/1220-142-0x00007FF6423E0000-0x00007FF642734000-memory.dmp	upx
behavioral1/memory/2148-148-0x00007FF638AC0000-0x00007FF638E14000-memory.dmp	upx
behavioral1/memory/4432-149-0x00007FF6C60E0000-0x00007FF6C6434000-memory.dmp	upx
behavioral1/memory/912-147-0x00007FF610AC0000-0x00007FF610E14000-memory.dmp	upx
behavioral1/memory/1560-146-0x00007FF64A5C0000-0x00007FF64A914000-memory.dmp	upx
behavioral1/memory/2972-145-0x00007FF786B50000-0x00007FF786EA4000-memory.dmp	upx
behavioral1/memory/2916-144-0x00007FF682B20000-0x00007FF682E74000-memory.dmp	upx
behavioral1/memory/1492-143-0x00007FF64ADE0000-0x00007FF64B134000-memory.dmp	upx
behavioral1/memory/4820-141-0x00007FF742C70000-0x00007FF742FC4000-memory.dmp	upx
behavioral1/memory/1232-140-0x00007FF6B2C20000-0x00007FF6B2F74000-memory.dmp	upx
behavioral1/memory/728-139-0x00007FF6704F0000-0x00007FF670844000-memory.dmp	upx
behavioral1/memory/4044-138-0x00007FF671000000-0x00007FF671354000-memory.dmp	upx
behavioral1/memory/2748-137-0x00007FF62FCA0000-0x00007FF62FFF4000-memory.dmp	upx
behavioral1/memory/432-136-0x00007FF6769D0000-0x00007FF676D24000-memory.dmp	upx
behavioral1/memory/5016-135-0x00007FF6111A0000-0x00007FF6114F4000-memory.dmp	upx
behavioral1/memory/4640-134-0x00007FF726F00000-0x00007FF727254000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\QmbISWc.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\cEQvlGL.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\bhqvCOM.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\VioZmeB.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\eaiBMup.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\wNIFqhW.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fZKVFbj.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\zEjQxfr.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\IRDreJf.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\qvyOiAA.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\mThWVhA.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fOouacj.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\XkACdXk.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\woJlCoH.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fuWqJrf.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\KlLRLDP.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\XpAgxtX.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\wNgdURp.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\DKNOInW.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\MuVkQDL.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\hJGPfDr.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 4540	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	88
PID 1292 wrote to memory of 5100	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	89
PID 1292 wrote to memory of 1220	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 1292 wrote to memory of 5032	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 1292 wrote to memory of 1492	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 1292 wrote to memory of 4820	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 1292 wrote to memory of 728	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 1292 wrote to memory of 1232	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 1292 wrote to memory of 4044	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 1292 wrote to memory of 2748	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 1292 wrote to memory of 432	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 1292 wrote to memory of 4640	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 1292 wrote to memory of 3580	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 1292 wrote to memory of 2916	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 1292 wrote to memory of 5016	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 1292 wrote to memory of 2972	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 1292 wrote to memory of 1560	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 1292 wrote to memory of 912	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 1292 wrote to memory of 2148	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 1292 wrote to memory of 4432	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 1292 wrote to memory of 1720	1292	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\System\QmbISWc.exe
  C:\Windows\System\QmbISWc.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\wNgdURp.exe
  C:\Windows\System\wNgdURp.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\cEQvlGL.exe
  C:\Windows\System\cEQvlGL.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\fZKVFbj.exe
  C:\Windows\System\fZKVFbj.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\bhqvCOM.exe
  C:\Windows\System\bhqvCOM.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\woJlCoH.exe
  C:\Windows\System\woJlCoH.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\DKNOInW.exe
  C:\Windows\System\DKNOInW.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\fuWqJrf.exe
  C:\Windows\System\fuWqJrf.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\VioZmeB.exe
  C:\Windows\System\VioZmeB.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\MuVkQDL.exe
  C:\Windows\System\MuVkQDL.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\hJGPfDr.exe
  C:\Windows\System\hJGPfDr.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\zEjQxfr.exe
  C:\Windows\System\zEjQxfr.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\IRDreJf.exe
  C:\Windows\System\IRDreJf.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\qvyOiAA.exe
  C:\Windows\System\qvyOiAA.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\mThWVhA.exe
  C:\Windows\System\mThWVhA.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\fOouacj.exe
  C:\Windows\System\fOouacj.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\XkACdXk.exe
  C:\Windows\System\XkACdXk.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\KlLRLDP.exe
  C:\Windows\System\KlLRLDP.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\XpAgxtX.exe
  C:\Windows\System\XpAgxtX.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\eaiBMup.exe
  C:\Windows\System\eaiBMup.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\wNIFqhW.exe
  C:\Windows\System\wNIFqhW.exe
  2⤵
  - Executes dropped EXE
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DKNOInW.exe

Path C:\Windows\System\DKNOInW.exe
Size 5.9MB
SHA256 6350a4011036944391a4e2ebe3107453b9ff53a4d15b117bb707210c4889b31c
MD5 17fb798ebd40abf3f4737b2490537b1a
SHA1 2cd3970ba1b7128a0ce54cf32a0ebbd76837c857
SHA512 1a485fe4a65a1192301a461d2ce076d32d12a87c3bb60bb0adc5db3d1e18c4b64cc3873fc77c0bf5902ae325f859f4ed11f837431d2299868a704a26d9dfdbd8
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU+:Q+u56utgpPF8u/7+
TLSH
T19C565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRDreJf.exe

Path C:\Windows\System\IRDreJf.exe
Size 5.9MB
SHA256 bae9eee2bd65970d44f097399b47e5e5290af8ca6c8fa4cb55c1c9219b384a7f
MD5 c0e34bfaba69c9d26cbc705813e4939b
SHA1 8523b7ad9e997d2887b506a00d244d2f38ef2adc
SHA512 7a3fbfacb04fc74304c93f6f7e5c7f44a4d1dac1029c4a20777cf9b262f7df5ae9b1692b60b0ed91003e3424b996c2b8d7f9dbc8357d996acbf41c731be3d56d
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUu:Q+u56utgpPF8u/7u
TLSH
T116565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KlLRLDP.exe

Path C:\Windows\System\KlLRLDP.exe
Size 5.9MB
SHA256 b04e333730d666784a35079d2be05f7cca71336d1e034d29f5b39aed4de44303
MD5 16f49a4db604a67238db15f7c5b87da0
SHA1 84838f8e847fdd9d7b31e00f588e3143bafe9f4b
SHA512 b9f2d4fbd36bd0797c65e5b39d8ebad7c7b03b13a3bf68043f948a1b05599897d8482c1b9218c1fe20ff6b01813e8628e92e25cc6da1accba8d332a0f53c93b9
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUK:Q+u56utgpPF8u/7K
TLSH
T144565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MuVkQDL.exe

Path C:\Windows\System\MuVkQDL.exe
Size 5.9MB
SHA256 9b6f027e9cf28d5e39b13368327501e5fda14525df598da5835b6630bb877795
MD5 3629b987f5d29f3511d701be19749198
SHA1 faf82f121a8bfc5a243ffa71612c79402a566872
SHA512 8c1cd26fa294c4a7af0c91e36b57ca8144b540c2c9962965398e5cda06a891628f341ca9b93520849a1c661f4b09032ff1918d8784c3537c677ef0600d2655f8
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU5:Q+u56utgpPF8u/75
TLSH
T163565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QmbISWc.exe

Path C:\Windows\System\QmbISWc.exe
Size 5.9MB
SHA256 2104bd142cd4da35e5cd487750eb945e7092bd435959b7d64b6630a28f526fd0
MD5 ebc28d3235e32629d19755d76c180c5a
SHA1 c2b61b3936a9bf416d79e8dbc49591f7181799d4
SHA512 0c8cc2fcfc383e4872d6a94098ffec7da83fd1fbc8cbaf08b5243691c8a35040f7ca2189a6f51f36df9374c72cfc0a3984d20a659b76a45ee7931b2ebbafbcbc
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUb:Q+u56utgpPF8u/7b
TLSH
T191565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VioZmeB.exe

Path C:\Windows\System\VioZmeB.exe
Size 5.9MB
SHA256 83fb7af410313fc217ace6e8c76ca7bc76358c2abb74350f799b59066ac49151
MD5 9e0868cbbdc9348e4b57533d5c88f73b
SHA1 653c7e2fffa1632f47e3ad3ec1e2d3ad6dc420da
SHA512 9371fd9ee89e9deed3efde9029d964c4d13e3dd792c5f92ad45817cef229c826bafb1ba47214ff9e50a12a2aad38074901c7b0bf547fa14546a253c1eb81313f
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUu:Q+u56utgpPF8u/7u
TLSH
T1A0565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XkACdXk.exe

Path C:\Windows\System\XkACdXk.exe
Size 5.9MB
SHA256 7a7f443a33ace069f6dcab613d53df19efdad4e1bcb3271c492716eadfd6ba96
MD5 32ab490380cb33a9bbd81432928adb0c
SHA1 bb5712aeb4c5621a568926127157c5c9be8bee3a
SHA512 9dd0a4a81952f5d6e130a44a0567aa7ee92c8db20eb161c44515317e7f8c395e470281fa8856d60c7edb8d9cc34b81900cc539ed9326cf06fa3148c00d3a4cbd
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUu:Q+u56utgpPF8u/7u
TLSH
T1DB565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XpAgxtX.exe

Path C:\Windows\System\XpAgxtX.exe
Size 5.9MB
SHA256 e952cef294ea5f40690ae72de680d494dc5e7a41d1ab87c7bcefa9253496bcdd
MD5 550c1318a692159b0288762e2a24703a
SHA1 4240cd436e08a2f5c565fa7680cbb627e463fbde
SHA512 96cf54cf8e4b17efaf5ee514b794074ab4224efae2ea27b0bf7a6b6e4e33230e4f3138beffb9409fb50312fdddddd11b5004804d00ed1a189eb806b0ff1d2ccd
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUL:Q+u56utgpPF8u/7L
TLSH
T13D565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bhqvCOM.exe

Path C:\Windows\System\bhqvCOM.exe
Size 5.9MB
SHA256 a93b928acd4cd65fb171e545fb735ead92565cba0bd8db42e67f996a687c3bab
MD5 42583a895401c52677fad2f9597b41a7
SHA1 393ff991d0fff0a80bffaaa689d6ba756010f51e
SHA512 7521362916c24b2a0e17bd29f32cd84e6040bb0b876f6247a291bdb2b8792c87e1081b7650a1f100e72b6b5a6731ecea8c3272cfbc1629b89159cace134f0b89
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUv:Q+u56utgpPF8u/7v
TLSH
T15F565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cEQvlGL.exe

Path C:\Windows\System\cEQvlGL.exe
Size 5.9MB
SHA256 2d2ec7b67a336665aaddc2150b39f7009afbc5eecfeabcc12673806ca38ff653
MD5 5afa1f59cbc09e6155a022a7c9cbe165
SHA1 cfff7e6eae9a21cc583017f15cf558dc9d0fae74
SHA512 2ba7a65ef129e64955bbb24af8096247bc4026dc34edce0109dda9fb0a70405ec16a96529f073e727f48d12d88f1f0ddeb7e4efc3c144f040efb0ccc8d9de980
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU4:Q+u56utgpPF8u/74
TLSH
T1EA565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eaiBMup.exe

Path C:\Windows\System\eaiBMup.exe
Size 5.9MB
SHA256 3b0939bba732160a3965d607423620f34bcbb6f5fb4ea0e56beb638a4e100859
MD5 52ddde5fc4a625653731a132a4960c28
SHA1 bc1bdac85be3a6c8b61c8d345999088221c22fc5
SHA512 4427f77149b191f6a5fae18532720eca7a84681e0c1998d359fd1d8e008f563a8b835df1aa6215e605aec2647ef67f1ed740485186e4265d86d63d47cf06e240
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU8:Q+u56utgpPF8u/78
TLSH
T13C565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fOouacj.exe

Path C:\Windows\System\fOouacj.exe
Size 5.9MB
SHA256 94c11403cce929e021523bc2fd07d85a61b5d25da4899ab1b96e9f7836ae16ff
MD5 0645dd6d7b085499f0a53b77d6646d1b
SHA1 bf739fac257a69dd9cc36eb906f4bcaf34364e2e
SHA512 49e9ed84549b4c85a93f244c5c2c7c2f3b90c3956b7a6ae98ef48a8468632a4cd16bc3767b51043c848eb169036d0e5c629b508a9edddc07597e820db894fbd1
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUC:Q+u56utgpPF8u/7C
TLSH
T10E565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fZKVFbj.exe

Path C:\Windows\System\fZKVFbj.exe
Size 5.9MB
SHA256 7fc04cb4b21c1570e322657cd7065490696f6e6c80a8daf954e74e3d7429be76
MD5 8c42c628c73b6a755af42ae7374adeab
SHA1 adfff70aa8d3c84eeda12b6073f417839e2c1692
SHA512 015f84c615be6dbc844d2158f54bd68694b954f6e9fc36ae1d768a07bbb3fb609fde5b71ac6081e34b15c64b790e9cf1048ca0efcb3abb6d016d620292df6eed
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUg:Q+u56utgpPF8u/7g
TLSH
T12E565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fuWqJrf.exe

Path C:\Windows\System\fuWqJrf.exe
Size 5.9MB
SHA256 53e3c17fcaaa544eede90923c948d6079353352110f6b72755a2fe919d71ad1a
MD5 5df39529567a5f1243ff5365ae8860b0
SHA1 796d336da5b4d06a273dd6f56d4b7abd136ffd63
SHA512 98a3bd6421ff0f77fb5a8ed61dd7430eb0d787379cffe0af09bf4d3ded5e08db73aa44d8001006e42872f48fa8e72f2a05b6e9695bebc12a37f1e0b7d4a4cd60
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUH:Q+u56utgpPF8u/7H
TLSH
T1AC565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hJGPfDr.exe

Path C:\Windows\System\hJGPfDr.exe
Size 5.9MB
SHA256 2faf79cd980169b502879aad09a016c22ab13c7b718e649e2c3a5bf82da36694
MD5 ae8ff7401c736516be826ac33d184204
SHA1 d56148a9706d943d7f6d6c063cfeb58413601360
SHA512 0c48bcbc6ae53b5b708a497493d4aad0677f772f08129945a33b97b3eb95e26fecd202565b3e4b70d3e3e7a383ce4af43b07156fb97ef8ed5851f786dc893b18
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU0:Q+u56utgpPF8u/70
TLSH
T140565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mThWVhA.exe

Path C:\Windows\System\mThWVhA.exe
Size 5.9MB
SHA256 2703fda1b6af7a1891283982936dcecb469e590b3f96807ee02a842c5da04f93
MD5 cbbdf210da4222ad57a3d0ddeb0bf3e1
SHA1 316a6174dd6987d5a824bc1fd0eefe8be6e5e83a
SHA512 c5697e383b9ca445ef691befbffd9552a5c7e57487fa291faaf0aa62a27eff6049fb8904a3e0da7052ddd9918d06a8337dc7421de445028b7f7f137e0d20c57a
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUc:Q+u56utgpPF8u/7c
TLSH
T1A8565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qvyOiAA.exe

Path C:\Windows\System\qvyOiAA.exe
Size 5.9MB
SHA256 51fc2eb37a40ee5dbb67d55fb230fee075594950927a991bcd6b1cc60ac69e00
MD5 926bb84b50db54e86bc483fd2c43475b
SHA1 5350cc7f1ca08180a65b28df6951ec3f4ecb52f6
SHA512 0ae1bfe613e900b5ebe3a6612401172bb036aa11272580b03127fada7fcd9af816258aa895d9cb06050587d6377dbaef0fb58c1653b4419391541c6d93645e84
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUq:Q+u56utgpPF8u/7q
TLSH
T1B4565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wNIFqhW.exe

Path C:\Windows\System\wNIFqhW.exe
Size 5.9MB
SHA256 4c1236b93b34801a832577ba2cc161f32a05e719ab4d89225b030049c90b63fd
MD5 2be1b4a3238544a9a97b78b1c3b2a69a
SHA1 dde41a472d0a9a52874060c576a1bbe4d2f1308f
SHA512 6ce1092a03a1c51167cd3fd73658b8ef9ebdbdd827f7db36beb8b86d571e1b49a5f1b7b817fda44ca8100a75e762fb4a7127ad9adc225c0762629d09003779b3
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUD:Q+u56utgpPF8u/7D
TLSH
T187565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wNgdURp.exe

Path C:\Windows\System\wNgdURp.exe
Size 5.9MB
SHA256 7d04aeb761222407ac65a30a4f44a17cc93a77726bdc9e492128cb107832215d
MD5 8dcbc6f1c9d882b36f4bdf5510ae4cdd
SHA1 d9c475c8a8a0b6aa5c987efa3359e739eafa09e0
SHA512 4c3d8adad49d73be9a1ca5f7fe44f8e40ce56bebdf1c33674288ae9bd0ec37a73dd6849706b7bbb8f69ff67c2d578320b6b731170b7faa74ac08d8633eaee02c
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU7:Q+u56utgpPF8u/77
TLSH
T182565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

woJlCoH.exe

Path C:\Windows\System\woJlCoH.exe
Size 5.9MB
SHA256 3d05ce894570b27703b775d5fd5189cc329763f469c2df9f35107aefb27fe867
MD5 d2fe28f2a050c80d0468e203259c3875
SHA1 38ea99e5d9af9d76116eba6afd4eee909b9a7e31
SHA512 8b5887e3659b345747a6ca99f2dad5d589573d7b89f089570300048a717f01a4c02c0c79df8f179c7a5895b5d2e9f3f459b9fe8b470c13b04f0f7cea571b71a4
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUK:Q+u56utgpPF8u/7K
TLSH
T152565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zEjQxfr.exe

Path C:\Windows\System\zEjQxfr.exe
Size 5.9MB
SHA256 c61f60eb13dc61e8091de9a50ca102e3d42783c987a712eddf54c90406cbdbd0
MD5 8d111dc5fa9b12709444f4fe602f8010
SHA1 b8dc9c8a997d6f93a90d20384be5bed0fcec2b85
SHA512 773022713a902cc08d363c7c78caae103fefd82fae5287131b58bb3914b89d61f7e81922409a7ddcfb0231245b1320e32789386c5a836a958ddba82919f6b7f9
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUb:Q+u56utgpPF8u/7b
TLSH
T13B565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/432-136-0x00007FF6769D0000-0x00007FF676D24000-memory.dmp

Download

memory/432-115-0x00007FF6769D0000-0x00007FF676D24000-memory.dmp

Download

memory/728-95-0x00007FF6704F0000-0x00007FF670844000-memory.dmp

Download

memory/728-139-0x00007FF6704F0000-0x00007FF670844000-memory.dmp

Download

memory/912-120-0x00007FF610AC0000-0x00007FF610E14000-memory.dmp

Download

memory/912-147-0x00007FF610AC0000-0x00007FF610E14000-memory.dmp

Download

memory/1220-142-0x00007FF6423E0000-0x00007FF642734000-memory.dmp

Download

memory/1220-123-0x00007FF6423E0000-0x00007FF642734000-memory.dmp

Download

memory/1232-140-0x00007FF6B2C20000-0x00007FF6B2F74000-memory.dmp

Download

memory/1232-100-0x00007FF6B2C20000-0x00007FF6B2F74000-memory.dmp

Download

memory/1292-0-0x00007FF622040000-0x00007FF622394000-memory.dmp

Download

memory/1292-128-0x00007FF622040000-0x00007FF622394000-memory.dmp

Download

memory/1292-1-0x0000012DFDC30000-0x0000012DFDC40000-memory.dmp

Download

memory/1492-143-0x00007FF64ADE0000-0x00007FF64B134000-memory.dmp

Download

memory/1492-124-0x00007FF64ADE0000-0x00007FF64B134000-memory.dmp

Download

memory/1560-119-0x00007FF64A5C0000-0x00007FF64A914000-memory.dmp

Download

memory/1560-146-0x00007FF64A5C0000-0x00007FF64A914000-memory.dmp

Download

memory/1720-150-0x00007FF70A5A0000-0x00007FF70A8F4000-memory.dmp

Download

memory/1720-122-0x00007FF70A5A0000-0x00007FF70A8F4000-memory.dmp

Download

memory/2148-121-0x00007FF638AC0000-0x00007FF638E14000-memory.dmp

Download

memory/2148-148-0x00007FF638AC0000-0x00007FF638E14000-memory.dmp

Download

memory/2748-137-0x00007FF62FCA0000-0x00007FF62FFF4000-memory.dmp

Download

memory/2748-110-0x00007FF62FCA0000-0x00007FF62FFF4000-memory.dmp

Download

memory/2916-117-0x00007FF682B20000-0x00007FF682E74000-memory.dmp

Download

memory/2916-144-0x00007FF682B20000-0x00007FF682E74000-memory.dmp

Download

memory/2972-145-0x00007FF786B50000-0x00007FF786EA4000-memory.dmp

Download

memory/2972-118-0x00007FF786B50000-0x00007FF786EA4000-memory.dmp

Download

memory/3580-133-0x00007FF72A0E0000-0x00007FF72A434000-memory.dmp

Download

memory/3580-125-0x00007FF72A0E0000-0x00007FF72A434000-memory.dmp

Download

memory/4044-138-0x00007FF671000000-0x00007FF671354000-memory.dmp

Download

memory/4044-101-0x00007FF671000000-0x00007FF671354000-memory.dmp

Download

memory/4432-149-0x00007FF6C60E0000-0x00007FF6C6434000-memory.dmp

Download

memory/4432-127-0x00007FF6C60E0000-0x00007FF6C6434000-memory.dmp

Download

memory/4540-132-0x00007FF759FA0000-0x00007FF75A2F4000-memory.dmp

Download

memory/4540-24-0x00007FF759FA0000-0x00007FF75A2F4000-memory.dmp

Download

memory/4540-129-0x00007FF759FA0000-0x00007FF75A2F4000-memory.dmp

Download

memory/4640-116-0x00007FF726F00000-0x00007FF727254000-memory.dmp

Download

memory/4640-134-0x00007FF726F00000-0x00007FF727254000-memory.dmp

Download

memory/4820-94-0x00007FF742C70000-0x00007FF742FC4000-memory.dmp

Download

memory/4820-141-0x00007FF742C70000-0x00007FF742FC4000-memory.dmp

Download

memory/5016-126-0x00007FF6111A0000-0x00007FF6114F4000-memory.dmp

Download

memory/5016-135-0x00007FF6111A0000-0x00007FF6114F4000-memory.dmp

Download

memory/5032-72-0x00007FF7072D0000-0x00007FF707624000-memory.dmp

Download

memory/5032-131-0x00007FF7072D0000-0x00007FF707624000-memory.dmp

Download

memory/5100-130-0x00007FF740360000-0x00007FF7406B4000-memory.dmp

Download

memory/5100-44-0x00007FF740360000-0x00007FF7406B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads