cobaltstrike | 6801f229a3464d24e7af76bc689bce169c4f34821fbd8366e21e3131b99b858d

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 5.9MB
Sample260820-wt6cqagq2x
SHA256 6801f229a3464d24e7af76bc689bce169c4f34821fbd8366e21e3131b99b858d
MD5 1956471fb80777bd50c2dd4eb6382981
SHA1 3bdde590776fa5920d4a25762c39ed0f12b625df
SHA512 c34f009c70398c0498169768193ea0af273d7d1196fe751cd03b8e2c8cb84af672df50ec4e7a532ebf7621cb090e9f73f896dec16b32deab26d6d8943ecc3089
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU4:Q+u56utgpPF8u/74
TLSH
T152565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000f00000001b896-6.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5a6-11.dat	cobalt_reflective_dll
behavioral2/files/0x000e00000001c5a1-12.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5a7-22.dat	cobalt_reflective_dll
behavioral2/files/0x000e00000001c5a2-28.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5a8-34.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5a9-42.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5aa-46.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5ab-54.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5ac-59.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5ad-65.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5ae-72.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5af-80.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5b0-87.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5b1-93.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5b2-97.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5b3-103.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5b4-109.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5b5-116.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5b6-123.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5b7-131.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001b896-6.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5a6-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000e00000001c5a1-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5a7-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000e00000001c5a2-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5a8-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5a9-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5aa-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5ab-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5ac-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5ad-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5ae-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5af-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5b0-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5b1-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5b2-97.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5b3-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5b4-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5b5-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5b6-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5b7-131.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4108-0-0x00007FF74D220000-0x00007FF74D574000-memory.dmp	UPX
behavioral2/files/0x000f00000001b896-6.dat	UPX
behavioral2/memory/1280-7-0x00007FF75DD00000-0x00007FF75E054000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5a6-11.dat	UPX
behavioral2/files/0x000e00000001c5a1-12.dat	UPX
behavioral2/memory/4584-14-0x00007FF6B6230000-0x00007FF6B6584000-memory.dmp	UPX
behavioral2/memory/2280-19-0x00007FF7E45C0000-0x00007FF7E4914000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5a7-22.dat	UPX
behavioral2/memory/3388-26-0x00007FF759890000-0x00007FF759BE4000-memory.dmp	UPX
behavioral2/files/0x000e00000001c5a2-28.dat	UPX
behavioral2/memory/4928-32-0x00007FF64E1F0000-0x00007FF64E544000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5a8-34.dat	UPX
behavioral2/memory/1324-38-0x00007FF66F100000-0x00007FF66F454000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5a9-42.dat	UPX
behavioral2/memory/5116-44-0x00007FF770640000-0x00007FF770994000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5aa-46.dat	UPX
behavioral2/files/0x000d00000001c5ab-54.dat	UPX
behavioral2/memory/2384-55-0x00007FF760AD0000-0x00007FF760E24000-memory.dmp	UPX
behavioral2/memory/2860-50-0x00007FF7A6CD0000-0x00007FF7A7024000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5ac-59.dat	UPX
behavioral2/memory/2416-63-0x00007FF62C4C0000-0x00007FF62C814000-memory.dmp	UPX
behavioral2/memory/4108-62-0x00007FF74D220000-0x00007FF74D574000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5ad-65.dat	UPX
behavioral2/memory/5744-69-0x00007FF6C5A60000-0x00007FF6C5DB4000-memory.dmp	UPX
behavioral2/memory/1280-67-0x00007FF75DD00000-0x00007FF75E054000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5ae-72.dat	UPX
behavioral2/memory/4764-76-0x00007FF7FBFD0000-0x00007FF7FC324000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5af-80.dat	UPX
behavioral2/memory/4036-83-0x00007FF77B240000-0x00007FF77B594000-memory.dmp	UPX
behavioral2/memory/2280-82-0x00007FF7E45C0000-0x00007FF7E4914000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5b0-87.dat	UPX
behavioral2/memory/4100-89-0x00007FF77A200000-0x00007FF77A554000-memory.dmp	UPX
behavioral2/memory/3560-95-0x00007FF655A50000-0x00007FF655DA4000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5b1-93.dat	UPX
behavioral2/files/0x000d00000001c5b2-97.dat	UPX
behavioral2/memory/5088-101-0x00007FF6A4F70000-0x00007FF6A52C4000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5b3-103.dat	UPX
behavioral2/memory/4812-107-0x00007FF7278F0000-0x00007FF727C44000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5b4-109.dat	UPX
behavioral2/memory/2860-112-0x00007FF7A6CD0000-0x00007FF7A7024000-memory.dmp	UPX
behavioral2/memory/5044-114-0x00007FF795070000-0x00007FF7953C4000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5b5-116.dat	UPX
behavioral2/memory/2384-119-0x00007FF760AD0000-0x00007FF760E24000-memory.dmp	UPX
behavioral2/memory/4252-121-0x00007FF65B090000-0x00007FF65B3E4000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5b6-123.dat	UPX
behavioral2/memory/1220-127-0x00007FF7D8DC0000-0x00007FF7D9114000-memory.dmp	UPX
behavioral2/memory/5744-130-0x00007FF6C5A60000-0x00007FF6C5DB4000-memory.dmp	UPX
behavioral2/memory/1440-133-0x00007FF6AE5C0000-0x00007FF6AE914000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5b7-131.dat	UPX
behavioral2/memory/3560-134-0x00007FF655A50000-0x00007FF655DA4000-memory.dmp	UPX
behavioral2/memory/5088-135-0x00007FF6A4F70000-0x00007FF6A52C4000-memory.dmp	UPX
behavioral2/memory/4252-136-0x00007FF65B090000-0x00007FF65B3E4000-memory.dmp	UPX
behavioral2/memory/1440-137-0x00007FF6AE5C0000-0x00007FF6AE914000-memory.dmp	UPX
behavioral2/memory/1280-138-0x00007FF75DD00000-0x00007FF75E054000-memory.dmp	UPX
behavioral2/memory/4584-139-0x00007FF6B6230000-0x00007FF6B6584000-memory.dmp	UPX
behavioral2/memory/2280-140-0x00007FF7E45C0000-0x00007FF7E4914000-memory.dmp	UPX
behavioral2/memory/3388-141-0x00007FF759890000-0x00007FF759BE4000-memory.dmp	UPX
behavioral2/memory/4928-142-0x00007FF64E1F0000-0x00007FF64E544000-memory.dmp	UPX
behavioral2/memory/1324-143-0x00007FF66F100000-0x00007FF66F454000-memory.dmp	UPX
behavioral2/memory/5116-144-0x00007FF770640000-0x00007FF770994000-memory.dmp	UPX
behavioral2/memory/2860-145-0x00007FF7A6CD0000-0x00007FF7A7024000-memory.dmp	UPX
behavioral2/memory/2384-146-0x00007FF760AD0000-0x00007FF760E24000-memory.dmp	UPX
behavioral2/memory/2416-147-0x00007FF62C4C0000-0x00007FF62C814000-memory.dmp	UPX
behavioral2/memory/5744-148-0x00007FF6C5A60000-0x00007FF6C5DB4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4108-0-0x00007FF74D220000-0x00007FF74D574000-memory.dmp	xmrig
behavioral2/files/0x000f00000001b896-6.dat	xmrig
behavioral2/memory/1280-7-0x00007FF75DD00000-0x00007FF75E054000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5a6-11.dat	xmrig
behavioral2/files/0x000e00000001c5a1-12.dat	xmrig
behavioral2/memory/4584-14-0x00007FF6B6230000-0x00007FF6B6584000-memory.dmp	xmrig
behavioral2/memory/2280-19-0x00007FF7E45C0000-0x00007FF7E4914000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5a7-22.dat	xmrig
behavioral2/memory/3388-26-0x00007FF759890000-0x00007FF759BE4000-memory.dmp	xmrig
behavioral2/files/0x000e00000001c5a2-28.dat	xmrig
behavioral2/memory/4928-32-0x00007FF64E1F0000-0x00007FF64E544000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5a8-34.dat	xmrig
behavioral2/memory/1324-38-0x00007FF66F100000-0x00007FF66F454000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5a9-42.dat	xmrig
behavioral2/memory/5116-44-0x00007FF770640000-0x00007FF770994000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5aa-46.dat	xmrig
behavioral2/files/0x000d00000001c5ab-54.dat	xmrig
behavioral2/memory/2384-55-0x00007FF760AD0000-0x00007FF760E24000-memory.dmp	xmrig
behavioral2/memory/2860-50-0x00007FF7A6CD0000-0x00007FF7A7024000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5ac-59.dat	xmrig
behavioral2/memory/2416-63-0x00007FF62C4C0000-0x00007FF62C814000-memory.dmp	xmrig
behavioral2/memory/4108-62-0x00007FF74D220000-0x00007FF74D574000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5ad-65.dat	xmrig
behavioral2/memory/5744-69-0x00007FF6C5A60000-0x00007FF6C5DB4000-memory.dmp	xmrig
behavioral2/memory/1280-67-0x00007FF75DD00000-0x00007FF75E054000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5ae-72.dat	xmrig
behavioral2/memory/4764-76-0x00007FF7FBFD0000-0x00007FF7FC324000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5af-80.dat	xmrig
behavioral2/memory/4036-83-0x00007FF77B240000-0x00007FF77B594000-memory.dmp	xmrig
behavioral2/memory/2280-82-0x00007FF7E45C0000-0x00007FF7E4914000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5b0-87.dat	xmrig
behavioral2/memory/4100-89-0x00007FF77A200000-0x00007FF77A554000-memory.dmp	xmrig
behavioral2/memory/3560-95-0x00007FF655A50000-0x00007FF655DA4000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5b1-93.dat	xmrig
behavioral2/files/0x000d00000001c5b2-97.dat	xmrig
behavioral2/memory/5088-101-0x00007FF6A4F70000-0x00007FF6A52C4000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5b3-103.dat	xmrig
behavioral2/memory/4812-107-0x00007FF7278F0000-0x00007FF727C44000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5b4-109.dat	xmrig
behavioral2/memory/2860-112-0x00007FF7A6CD0000-0x00007FF7A7024000-memory.dmp	xmrig
behavioral2/memory/5044-114-0x00007FF795070000-0x00007FF7953C4000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5b5-116.dat	xmrig
behavioral2/memory/2384-119-0x00007FF760AD0000-0x00007FF760E24000-memory.dmp	xmrig
behavioral2/memory/4252-121-0x00007FF65B090000-0x00007FF65B3E4000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5b6-123.dat	xmrig
behavioral2/memory/1220-127-0x00007FF7D8DC0000-0x00007FF7D9114000-memory.dmp	xmrig
behavioral2/memory/5744-130-0x00007FF6C5A60000-0x00007FF6C5DB4000-memory.dmp	xmrig
behavioral2/memory/1440-133-0x00007FF6AE5C0000-0x00007FF6AE914000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5b7-131.dat	xmrig
behavioral2/memory/3560-134-0x00007FF655A50000-0x00007FF655DA4000-memory.dmp	xmrig
behavioral2/memory/5088-135-0x00007FF6A4F70000-0x00007FF6A52C4000-memory.dmp	xmrig
behavioral2/memory/4252-136-0x00007FF65B090000-0x00007FF65B3E4000-memory.dmp	xmrig
behavioral2/memory/1440-137-0x00007FF6AE5C0000-0x00007FF6AE914000-memory.dmp	xmrig
behavioral2/memory/1280-138-0x00007FF75DD00000-0x00007FF75E054000-memory.dmp	xmrig
behavioral2/memory/4584-139-0x00007FF6B6230000-0x00007FF6B6584000-memory.dmp	xmrig
behavioral2/memory/2280-140-0x00007FF7E45C0000-0x00007FF7E4914000-memory.dmp	xmrig
behavioral2/memory/3388-141-0x00007FF759890000-0x00007FF759BE4000-memory.dmp	xmrig
behavioral2/memory/4928-142-0x00007FF64E1F0000-0x00007FF64E544000-memory.dmp	xmrig
behavioral2/memory/1324-143-0x00007FF66F100000-0x00007FF66F454000-memory.dmp	xmrig
behavioral2/memory/5116-144-0x00007FF770640000-0x00007FF770994000-memory.dmp	xmrig
behavioral2/memory/2860-145-0x00007FF7A6CD0000-0x00007FF7A7024000-memory.dmp	xmrig
behavioral2/memory/2384-146-0x00007FF760AD0000-0x00007FF760E24000-memory.dmp	xmrig
behavioral2/memory/2416-147-0x00007FF62C4C0000-0x00007FF62C814000-memory.dmp	xmrig
behavioral2/memory/5744-148-0x00007FF6C5A60000-0x00007FF6C5DB4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1280	UXvnlwU.exe
4584	RwZdWBe.exe
2280	LvAaCQO.exe
3388	GZooaDU.exe
4928	rInqYwP.exe
1324	yyoZYWU.exe
5116	NvKyAVX.exe
2860	xBHmGBA.exe
2384	XLgoSwC.exe
2416	gVmtZHo.exe
5744	DVmgSym.exe
4764	reeGdNa.exe
4036	PZTDyPR.exe
4100	SIDtofO.exe
3560	lsSTQwk.exe
5088	olcyhMe.exe
4812	flNtzsX.exe
5044	IhiRUUV.exe
4252	QXAtoUo.exe
1220	tSPfAru.exe
1440	HGPcxsm.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4108-0-0x00007FF74D220000-0x00007FF74D574000-memory.dmp	upx
behavioral2/files/0x000f00000001b896-6.dat	upx
behavioral2/memory/1280-7-0x00007FF75DD00000-0x00007FF75E054000-memory.dmp	upx
behavioral2/files/0x000d00000001c5a6-11.dat	upx
behavioral2/files/0x000e00000001c5a1-12.dat	upx
behavioral2/memory/4584-14-0x00007FF6B6230000-0x00007FF6B6584000-memory.dmp	upx
behavioral2/memory/2280-19-0x00007FF7E45C0000-0x00007FF7E4914000-memory.dmp	upx
behavioral2/files/0x000d00000001c5a7-22.dat	upx
behavioral2/memory/3388-26-0x00007FF759890000-0x00007FF759BE4000-memory.dmp	upx
behavioral2/files/0x000e00000001c5a2-28.dat	upx
behavioral2/memory/4928-32-0x00007FF64E1F0000-0x00007FF64E544000-memory.dmp	upx
behavioral2/files/0x000d00000001c5a8-34.dat	upx
behavioral2/memory/1324-38-0x00007FF66F100000-0x00007FF66F454000-memory.dmp	upx
behavioral2/files/0x000d00000001c5a9-42.dat	upx
behavioral2/memory/5116-44-0x00007FF770640000-0x00007FF770994000-memory.dmp	upx
behavioral2/files/0x000d00000001c5aa-46.dat	upx
behavioral2/files/0x000d00000001c5ab-54.dat	upx
behavioral2/memory/2384-55-0x00007FF760AD0000-0x00007FF760E24000-memory.dmp	upx
behavioral2/memory/2860-50-0x00007FF7A6CD0000-0x00007FF7A7024000-memory.dmp	upx
behavioral2/files/0x000d00000001c5ac-59.dat	upx
behavioral2/memory/2416-63-0x00007FF62C4C0000-0x00007FF62C814000-memory.dmp	upx
behavioral2/memory/4108-62-0x00007FF74D220000-0x00007FF74D574000-memory.dmp	upx
behavioral2/files/0x000d00000001c5ad-65.dat	upx
behavioral2/memory/5744-69-0x00007FF6C5A60000-0x00007FF6C5DB4000-memory.dmp	upx
behavioral2/memory/1280-67-0x00007FF75DD00000-0x00007FF75E054000-memory.dmp	upx
behavioral2/files/0x000d00000001c5ae-72.dat	upx
behavioral2/memory/4764-76-0x00007FF7FBFD0000-0x00007FF7FC324000-memory.dmp	upx
behavioral2/files/0x000d00000001c5af-80.dat	upx
behavioral2/memory/4036-83-0x00007FF77B240000-0x00007FF77B594000-memory.dmp	upx
behavioral2/memory/2280-82-0x00007FF7E45C0000-0x00007FF7E4914000-memory.dmp	upx
behavioral2/files/0x000d00000001c5b0-87.dat	upx
behavioral2/memory/4100-89-0x00007FF77A200000-0x00007FF77A554000-memory.dmp	upx
behavioral2/memory/3560-95-0x00007FF655A50000-0x00007FF655DA4000-memory.dmp	upx
behavioral2/files/0x000d00000001c5b1-93.dat	upx
behavioral2/files/0x000d00000001c5b2-97.dat	upx
behavioral2/memory/5088-101-0x00007FF6A4F70000-0x00007FF6A52C4000-memory.dmp	upx
behavioral2/files/0x000d00000001c5b3-103.dat	upx
behavioral2/memory/4812-107-0x00007FF7278F0000-0x00007FF727C44000-memory.dmp	upx
behavioral2/files/0x000d00000001c5b4-109.dat	upx
behavioral2/memory/2860-112-0x00007FF7A6CD0000-0x00007FF7A7024000-memory.dmp	upx
behavioral2/memory/5044-114-0x00007FF795070000-0x00007FF7953C4000-memory.dmp	upx
behavioral2/files/0x000d00000001c5b5-116.dat	upx
behavioral2/memory/2384-119-0x00007FF760AD0000-0x00007FF760E24000-memory.dmp	upx
behavioral2/memory/4252-121-0x00007FF65B090000-0x00007FF65B3E4000-memory.dmp	upx
behavioral2/files/0x000d00000001c5b6-123.dat	upx
behavioral2/memory/1220-127-0x00007FF7D8DC0000-0x00007FF7D9114000-memory.dmp	upx
behavioral2/memory/5744-130-0x00007FF6C5A60000-0x00007FF6C5DB4000-memory.dmp	upx
behavioral2/memory/1440-133-0x00007FF6AE5C0000-0x00007FF6AE914000-memory.dmp	upx
behavioral2/files/0x000d00000001c5b7-131.dat	upx
behavioral2/memory/3560-134-0x00007FF655A50000-0x00007FF655DA4000-memory.dmp	upx
behavioral2/memory/5088-135-0x00007FF6A4F70000-0x00007FF6A52C4000-memory.dmp	upx
behavioral2/memory/4252-136-0x00007FF65B090000-0x00007FF65B3E4000-memory.dmp	upx
behavioral2/memory/1440-137-0x00007FF6AE5C0000-0x00007FF6AE914000-memory.dmp	upx
behavioral2/memory/1280-138-0x00007FF75DD00000-0x00007FF75E054000-memory.dmp	upx
behavioral2/memory/4584-139-0x00007FF6B6230000-0x00007FF6B6584000-memory.dmp	upx
behavioral2/memory/2280-140-0x00007FF7E45C0000-0x00007FF7E4914000-memory.dmp	upx
behavioral2/memory/3388-141-0x00007FF759890000-0x00007FF759BE4000-memory.dmp	upx
behavioral2/memory/4928-142-0x00007FF64E1F0000-0x00007FF64E544000-memory.dmp	upx
behavioral2/memory/1324-143-0x00007FF66F100000-0x00007FF66F454000-memory.dmp	upx
behavioral2/memory/5116-144-0x00007FF770640000-0x00007FF770994000-memory.dmp	upx
behavioral2/memory/2860-145-0x00007FF7A6CD0000-0x00007FF7A7024000-memory.dmp	upx
behavioral2/memory/2384-146-0x00007FF760AD0000-0x00007FF760E24000-memory.dmp	upx
behavioral2/memory/2416-147-0x00007FF62C4C0000-0x00007FF62C814000-memory.dmp	upx
behavioral2/memory/5744-148-0x00007FF6C5A60000-0x00007FF6C5DB4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\tSPfAru.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\HGPcxsm.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\UXvnlwU.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\RwZdWBe.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\LvAaCQO.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\XLgoSwC.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\QXAtoUo.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\rInqYwP.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\xBHmGBA.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\DVmgSym.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\reeGdNa.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\PZTDyPR.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\lsSTQwk.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\IhiRUUV.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\NvKyAVX.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\gVmtZHo.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\SIDtofO.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\GZooaDU.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\yyoZYWU.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\olcyhMe.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\flNtzsX.exe	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 1280	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	89
PID 4108 wrote to memory of 4584	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 4108 wrote to memory of 2280	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 4108 wrote to memory of 3388	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 4108 wrote to memory of 4928	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 4108 wrote to memory of 1324	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 4108 wrote to memory of 5116	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 4108 wrote to memory of 2860	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 4108 wrote to memory of 2384	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 4108 wrote to memory of 2416	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 4108 wrote to memory of 5744	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 4108 wrote to memory of 4764	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 4108 wrote to memory of 4036	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 4108 wrote to memory of 4100	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 4108 wrote to memory of 3560	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 4108 wrote to memory of 5088	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 4108 wrote to memory of 4812	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 4108 wrote to memory of 5044	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 4108 wrote to memory of 4252	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 4108 wrote to memory of 1220	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 4108 wrote to memory of 1440	4108	2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_1956471fb80777bd50c2dd4eb6382981_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\System\UXvnlwU.exe
  C:\Windows\System\UXvnlwU.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\RwZdWBe.exe
  C:\Windows\System\RwZdWBe.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\LvAaCQO.exe
  C:\Windows\System\LvAaCQO.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\GZooaDU.exe
  C:\Windows\System\GZooaDU.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\rInqYwP.exe
  C:\Windows\System\rInqYwP.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\yyoZYWU.exe
  C:\Windows\System\yyoZYWU.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\NvKyAVX.exe
  C:\Windows\System\NvKyAVX.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\xBHmGBA.exe
  C:\Windows\System\xBHmGBA.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\XLgoSwC.exe
  C:\Windows\System\XLgoSwC.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\gVmtZHo.exe
  C:\Windows\System\gVmtZHo.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\DVmgSym.exe
  C:\Windows\System\DVmgSym.exe
  2⤵
  - Executes dropped EXE
  PID:5744
- C:\Windows\System\reeGdNa.exe
  C:\Windows\System\reeGdNa.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\PZTDyPR.exe
  C:\Windows\System\PZTDyPR.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\SIDtofO.exe
  C:\Windows\System\SIDtofO.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\lsSTQwk.exe
  C:\Windows\System\lsSTQwk.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\olcyhMe.exe
  C:\Windows\System\olcyhMe.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\flNtzsX.exe
  C:\Windows\System\flNtzsX.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\IhiRUUV.exe
  C:\Windows\System\IhiRUUV.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\QXAtoUo.exe
  C:\Windows\System\QXAtoUo.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\tSPfAru.exe
  C:\Windows\System\tSPfAru.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\HGPcxsm.exe
  C:\Windows\System\HGPcxsm.exe
  2⤵
  - Executes dropped EXE
  PID:1440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DVmgSym.exe

Path C:\Windows\System\DVmgSym.exe
Size 5.9MB
SHA256 ed875fc8cf20820ad024637b18fe18bc09f1534c77cdcacc41d32202acf39f16
MD5 79854a62cc0347b40ef68e5d404cc0f1
SHA1 cd3a640ca5d5f3ae439548d1500845fe9a4e8f98
SHA512 090b8aab6f392589356db5b463f75d95e51f9e44978c273e822257c221b801fee41d62b630375aae8514a44d33608ae36e69814268194dc950ec42f39f0ff103
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU3:Q+u56utgpPF8u/73
TLSH
T179565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GZooaDU.exe

Path C:\Windows\System\GZooaDU.exe
Size 5.9MB
SHA256 d7a0b4e07e0886886eebdfad617a7c6b614feb7b224ce9ec792e928316efb4a4
MD5 932e0acfa7981c27f314e68249e1aae2
SHA1 3a43317d918daa0b89c7d0576f53ae519c39462d
SHA512 da7d49bd8ed96e0e8547ff2d8b926e6efa59da703d23384521eff3f5847844c19af73634674d5cc8c80249bdf4495c251fa2de8e1bf3bb8b456c098dd3e00671
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU5:Q+u56utgpPF8u/75
TLSH
T189565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HGPcxsm.exe

Path C:\Windows\System\HGPcxsm.exe
Size 5.9MB
SHA256 06de25608a6f86b8d2fa73df23a63f7873077bdbcfbe18776dd8b1053acc02be
MD5 0ed0ba07425f1c0c71986b37574d1679
SHA1 c153c661a8a7b06691e1d61177d9c2377a83a8df
SHA512 84d1bcda04c2af7f54e701eb179fe8b7460145ccb2503f350e3f58b096d9fb768e5f0f6ed9d66b434e40905819965c81a735f55ff458d41d51d0ebfe8961d090
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUa:Q+u56utgpPF8u/7a
TLSH
T138565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IhiRUUV.exe

Path C:\Windows\System\IhiRUUV.exe
Size 5.9MB
SHA256 dc81bba8989f69f7fd20dc3a6ba5813e9af6ebed9e537f2650d69ac5aea64686
MD5 08fd7947cf9d98787bd1db8e9c1cb014
SHA1 569226c5b89299944c05e743ffb941fb6e593f07
SHA512 859b53574215fdadbe574c35d0959d7a83ad42c5c9b196c0f55005c0ce67ceef183172615e540adc079486555312d69d9a34e265b66d55c7740bda2e3f9f9438
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUw:Q+u56utgpPF8u/7w
TLSH
T195565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LvAaCQO.exe

Path C:\Windows\System\LvAaCQO.exe
Size 5.9MB
SHA256 5098cd18e6ffd7ac33a73de9a31a9426b93a7dbad10a77f3cb07d76e61f97b82
MD5 9ed26e5b5f0c9afdbd26f7277835073c
SHA1 b46f984a33a4cff30596c8271cb2c9cf7c646ff1
SHA512 4493371791e7a457ec3b22ffa04fe0682d3f31d0173a23252bce71a3c4c474d63bc8c69b40ab1fbc996cff18e54990d873c9bb8e272334c36a01f8c366023e23
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUe:Q+u56utgpPF8u/7e
TLSH
T194565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NvKyAVX.exe

Path C:\Windows\System\NvKyAVX.exe
Size 5.9MB
SHA256 55c268d51383cc40160feeeb7646cec73b325b30a6254ce843d6683b030e18d8
MD5 2f198e80a9ffa9ab04c4576f7179018a
SHA1 f89f265093a7c866b53a86628fe5d43e21fe99d2
SHA512 197bc092f3892266346a3867661fc55fe747de11a7f3cd6ca0dade7aac5cf6ce2abf70d2244b80a1d7c0f19b57804752a9f80a2a71e3b3ed033d9cc0e23f26a2
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUI:Q+u56utgpPF8u/7I
TLSH
T17A565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PZTDyPR.exe

Path C:\Windows\System\PZTDyPR.exe
Size 5.9MB
SHA256 fed5e14470af9389f9c3689aa0dceca7a71fc1aa9dccc1f0945af527e6d6d2d1
MD5 f6333d2fc42201ad95fd0b74686e8939
SHA1 395d6fa25e7be444073b9a973503796f818d8146
SHA512 b3474f15ba91aefbb7b06dffdc15e5b276613a1dd881c1f413d6621afc4ea7e534b4546b02f9ff2512598bd9164b8dd6f43398c5ee2fc840f1bcdd143f97a113
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUj:Q+u56utgpPF8u/7j
TLSH
T128565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QXAtoUo.exe

Path C:\Windows\System\QXAtoUo.exe
Size 5.9MB
SHA256 15bdc67c535fd907934aec6d214a59166214c08969dc561cb7a6303ca5d74bb5
MD5 badb167aab55c6758108355aad2b6a68
SHA1 605a2db6532ba81a0bb9dc60b80acc893ba238b5
SHA512 a816091fb98614f3f8cb883c981146a8adee9f6f371f1d9ecf6a4756677735660ef18b67b4ae9b0070f7c9b79a62c5dc33e96b9bccc5cca75c9a7126ceb8285b
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUR:Q+u56utgpPF8u/7R
TLSH
T158565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RwZdWBe.exe

Path C:\Windows\System\RwZdWBe.exe
Size 5.9MB
SHA256 a24cca33f40f2204b2ad2f7e8a69c2d5a56660b4b7a3127f5fe212fa74712f7e
MD5 c9f53d115ca9a1316dd40ebed48fcf9e
SHA1 881d333557e73747685eed07375c9bab38da4135
SHA512 ff89e20f0def69e7a7d107ae5ef1cfed3a304e53e1d2044d0408f3533c3f21ca09e87ed739107f68a937ad16d46ac18c0aba8d100d341a11410cf27704712bec
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUH:Q+u56utgpPF8u/7H
TLSH
T129565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SIDtofO.exe

Path C:\Windows\System\SIDtofO.exe
Size 5.9MB
SHA256 927f71253253ab2fee929e43fc75218badc52824dee9c2c96e772e1203a70ff5
MD5 2ad6e865f5efb6a4e2b244b33db465c3
SHA1 85a7c54bba3af5f7aa2876ec48ada360faf735d2
SHA512 7ed5296a2fe3edd582a1bbe720ebb5a0107d94f07033e6136d9c5afc02e59b3dd493bae3b24c5fda4e412b5688cfdacb7447ab0973760d2a1998643df034cd06
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUC:Q+u56utgpPF8u/7C
TLSH
T1E9565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UXvnlwU.exe

Path C:\Windows\System\UXvnlwU.exe
Size 5.9MB
SHA256 2903943d9b54d709791992b8ba268901e04b0730459ec56dc4193fe4fdee6bdf
MD5 ed23d7e8a63a750b622a74204ea789f4
SHA1 6c7b9b696e1a72f25696e754f0f64b2c568da21d
SHA512 babcd025135f7f95ca1cad3e8144be636a8ffaa91d440847689e697dd32aea79ff1aef74513a046a660dd4b126238d9e8c5cd18a42a2bc3c93a53649d785cb2f
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU0:Q+u56utgpPF8u/70
TLSH
T120565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XLgoSwC.exe

Path C:\Windows\System\XLgoSwC.exe
Size 5.9MB
SHA256 535b0ee135528cfa59241d844df27d1d42acc73c5ea0f95da7bbbcd787dfc98d
MD5 4a833692e7e09db6e26d23841a908a7d
SHA1 ab6e9c1b1bd38b3e5a0d6239794d166fcdd693a9
SHA512 964c6b03a2d65222ddbc948235012fcd78e83a4cc4e8cab9eb18dabb41dc5b945c3c5806d948bd3641bc10f1ef4ac6ce5324d8a51fb0c0bb4accf2d8baad8ea8
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUS:Q+u56utgpPF8u/7S
TLSH
T166565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flNtzsX.exe

Path C:\Windows\System\flNtzsX.exe
Size 5.9MB
SHA256 a24e58a40357a0c507e1f5f26a125867d9a29edd9db9e45a03627ae034d4c205
MD5 5c08d51975ec7ca83a8b80c7885e6881
SHA1 e5acf354a26417a7adab88e23e22551f126210e7
SHA512 be1ca2adf86d4a1762a311c936739712f800b1a0dca586a1bfede1eb5a4861dd67e2e2adb879abd6fb61737b104677700adcf561b0e3d17a30bc41b3e590e3e3
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUS:Q+u56utgpPF8u/7S
TLSH
T1D5565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gVmtZHo.exe

Path C:\Windows\System\gVmtZHo.exe
Size 5.9MB
SHA256 dfc3de725be8018f730bd2973cd5bb50605da6872be0f1a6cf112a7b0c60d2ac
MD5 07a4956560bf1b03c6d3298d16f9dd51
SHA1 850d598f22f0e4478ede63e9b1f506e3c7b8e584
SHA512 f43e063e2f4efbb718e0bb70e41835b9b5d235233997c095b92e2a8d8bfabf7c0d1056c2c7a0517d15e7573517969924a3efefe730d49f1cba05007d74ff0511
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUJ:Q+u56utgpPF8u/7J
TLSH
T16C565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsSTQwk.exe

Path C:\Windows\System\lsSTQwk.exe
Size 5.9MB
SHA256 6a48ca3951e73eeada273208d99f6aa2e19e79e381b2ccecdeef627ee78da6a8
MD5 0c7cefcfad52e0284960e1763c3fef09
SHA1 b4fd39ceafb9ab0ad367d2d91f5493213abd8ee0
SHA512 e9879680c16957326a2d10fe52264f4ceb0c2bde4c86da4875e9d9d50939c8af04ff77c436cf129fa8c5a969f714f21ac4db3112caa3afc8312819865e91aa49
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUO:Q+u56utgpPF8u/7O
TLSH
T1C1565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olcyhMe.exe

Path C:\Windows\System\olcyhMe.exe
Size 5.9MB
SHA256 982d96283cc1b90507d75edafbeb6a757994fed4187ede92299b9752ad3cc8bc
MD5 9eaa83bd669da38191e4db65c60d9642
SHA1 601b642254af7bb42bbc46aea2575a0028b929fb
SHA512 41e8ece210fdaf34c0d7d25b184e889ac43506768f2c12dede144746ee7e508604717e090544b603d3fa8d8b7033ce53b9768939857af89c7682d962b1059b33
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUh:Q+u56utgpPF8u/7h
TLSH
T15E565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rInqYwP.exe

Path C:\Windows\System\rInqYwP.exe
Size 5.9MB
SHA256 5bb61cbfdde1f34b1b400e5d0ea9a6331900a67a0c8be28a7d4c99ad58e34d70
MD5 f888419ceb9dfda2d1ef2ac38c1814c1
SHA1 9fa9cdf08fb1ef5a0f63006a09e9d362534b76c2
SHA512 9cc10f2c16a9572600e4c706893e4d2cdbdcc5109388e0fc3fed74e0662b164fbbecb072ac22737acd78452683d82fa8c252d1085d6ed29c42bbfe5adfbfd925
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUP:Q+u56utgpPF8u/7P
TLSH
T16D565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reeGdNa.exe

Path C:\Windows\System\reeGdNa.exe
Size 5.9MB
SHA256 9d345dd4f18916af3ac0df95c70c51d6d81d847162e93f666ba901f480d3a4c0
MD5 20003facde9c2332fed0708118e4cbad
SHA1 9b37de96e2a57f7c36bc159f7e7d593b7097eb9d
SHA512 905fb47382dea44794a143fda5625d9454c7f521bff7a0822e03ec0b4de4300dd1af41ae1faa2704b8983f8323f51950ac93e9dc20b68d4cdbf049a3171f6189
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUa:Q+u56utgpPF8u/7a
TLSH
T1E0565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tSPfAru.exe

Path C:\Windows\System\tSPfAru.exe
Size 5.9MB
SHA256 729f608a2ad1295475f9205e8f890dc74c9249c0e7c08916b8626d2aad3e45ee
MD5 1c5d74c187e42bc0ae14a4c5bfaaf8e3
SHA1 198b903bc90c365edf1485810cb625ad478f5ee3
SHA512 39e0b3b00cd20380f0d91a0d713eabb39a03ec46b6b5462099754affe026141beb3eb6111fce973e8862897523a7bdd4656d12b55708267972c64cae64fb155f
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUP:Q+u56utgpPF8u/7P
TLSH
T128565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xBHmGBA.exe

Path C:\Windows\System\xBHmGBA.exe
Size 5.9MB
SHA256 3a297ef18fa25ee6c7cabffb89737085249cbbf70ac9b847a6e7b54a860d2729
MD5 85bf1aa42ca5d756b1af3016b7030659
SHA1 c187d3d3033f50c23f3e8f10a698686c7a1c84b3
SHA512 648526e4af34bdec3abd87b4b1d826f552e6afbca7015e49fddc83eb1017400bf5ba8e34d9b8192b84dca1de33814f6d4aec48bf02157d5ec64750a4a2f88a33
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUX:Q+u56utgpPF8u/7X
TLSH
T128565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yyoZYWU.exe

Path C:\Windows\System\yyoZYWU.exe
Size 5.9MB
SHA256 7148b8f9c36a1aec5d1b93f8e6e4e3ab2f8319c2030c6493c49f8e8acc15bf92
MD5 d70ab6462502e3f813add13f182b4524
SHA1 69a684603fe71ae32f9bc4fd6ee96480ee3cc93b
SHA512 d307554ff830e8a57ead0c45b4ca9f588cae757f22bb1fff528706a255eef30df29dd8afedaea199c582d01e99496a5257b09e41ad5c0ac31df78b0db3c90a8c
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUl:Q+u56utgpPF8u/7l
TLSH
T158565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1220-127-0x00007FF7D8DC0000-0x00007FF7D9114000-memory.dmp

Download

memory/1220-157-0x00007FF7D8DC0000-0x00007FF7D9114000-memory.dmp

Download

memory/1280-138-0x00007FF75DD00000-0x00007FF75E054000-memory.dmp

Download

memory/1280-7-0x00007FF75DD00000-0x00007FF75E054000-memory.dmp

Download

memory/1280-67-0x00007FF75DD00000-0x00007FF75E054000-memory.dmp

Download

memory/1324-143-0x00007FF66F100000-0x00007FF66F454000-memory.dmp

Download

memory/1324-38-0x00007FF66F100000-0x00007FF66F454000-memory.dmp

Download

memory/1440-137-0x00007FF6AE5C0000-0x00007FF6AE914000-memory.dmp

Download

memory/1440-158-0x00007FF6AE5C0000-0x00007FF6AE914000-memory.dmp

Download

memory/1440-133-0x00007FF6AE5C0000-0x00007FF6AE914000-memory.dmp

Download

memory/2280-82-0x00007FF7E45C0000-0x00007FF7E4914000-memory.dmp

Download

memory/2280-140-0x00007FF7E45C0000-0x00007FF7E4914000-memory.dmp

Download

memory/2280-19-0x00007FF7E45C0000-0x00007FF7E4914000-memory.dmp

Download

memory/2384-55-0x00007FF760AD0000-0x00007FF760E24000-memory.dmp

Download

memory/2384-146-0x00007FF760AD0000-0x00007FF760E24000-memory.dmp

Download

memory/2384-119-0x00007FF760AD0000-0x00007FF760E24000-memory.dmp

Download

memory/2416-147-0x00007FF62C4C0000-0x00007FF62C814000-memory.dmp

Download

memory/2416-63-0x00007FF62C4C0000-0x00007FF62C814000-memory.dmp

Download

memory/2860-112-0x00007FF7A6CD0000-0x00007FF7A7024000-memory.dmp

Download

memory/2860-50-0x00007FF7A6CD0000-0x00007FF7A7024000-memory.dmp

Download

memory/2860-145-0x00007FF7A6CD0000-0x00007FF7A7024000-memory.dmp

Download

memory/3388-141-0x00007FF759890000-0x00007FF759BE4000-memory.dmp

Download

memory/3388-26-0x00007FF759890000-0x00007FF759BE4000-memory.dmp

Download

memory/3560-152-0x00007FF655A50000-0x00007FF655DA4000-memory.dmp

Download

memory/3560-95-0x00007FF655A50000-0x00007FF655DA4000-memory.dmp

Download

memory/3560-134-0x00007FF655A50000-0x00007FF655DA4000-memory.dmp

Download

memory/4036-83-0x00007FF77B240000-0x00007FF77B594000-memory.dmp

Download

memory/4036-150-0x00007FF77B240000-0x00007FF77B594000-memory.dmp

Download

memory/4100-151-0x00007FF77A200000-0x00007FF77A554000-memory.dmp

Download

memory/4100-89-0x00007FF77A200000-0x00007FF77A554000-memory.dmp

Download

memory/4108-1-0x0000027862370000-0x0000027862380000-memory.dmp

Download

memory/4108-0-0x00007FF74D220000-0x00007FF74D574000-memory.dmp

Download

memory/4108-62-0x00007FF74D220000-0x00007FF74D574000-memory.dmp

Download

memory/4252-156-0x00007FF65B090000-0x00007FF65B3E4000-memory.dmp

Download

memory/4252-121-0x00007FF65B090000-0x00007FF65B3E4000-memory.dmp

Download

memory/4252-136-0x00007FF65B090000-0x00007FF65B3E4000-memory.dmp

Download

memory/4584-14-0x00007FF6B6230000-0x00007FF6B6584000-memory.dmp

Download

memory/4584-139-0x00007FF6B6230000-0x00007FF6B6584000-memory.dmp

Download

memory/4764-76-0x00007FF7FBFD0000-0x00007FF7FC324000-memory.dmp

Download

memory/4764-149-0x00007FF7FBFD0000-0x00007FF7FC324000-memory.dmp

Download

memory/4812-107-0x00007FF7278F0000-0x00007FF727C44000-memory.dmp

Download

memory/4812-154-0x00007FF7278F0000-0x00007FF727C44000-memory.dmp

Download

memory/4928-142-0x00007FF64E1F0000-0x00007FF64E544000-memory.dmp

Download

memory/4928-32-0x00007FF64E1F0000-0x00007FF64E544000-memory.dmp

Download

memory/5044-114-0x00007FF795070000-0x00007FF7953C4000-memory.dmp

Download

memory/5044-155-0x00007FF795070000-0x00007FF7953C4000-memory.dmp

Download

memory/5088-101-0x00007FF6A4F70000-0x00007FF6A52C4000-memory.dmp

Download

memory/5088-135-0x00007FF6A4F70000-0x00007FF6A52C4000-memory.dmp

Download

memory/5088-153-0x00007FF6A4F70000-0x00007FF6A52C4000-memory.dmp

Download

memory/5116-144-0x00007FF770640000-0x00007FF770994000-memory.dmp

Download

memory/5116-44-0x00007FF770640000-0x00007FF770994000-memory.dmp

Download

memory/5744-69-0x00007FF6C5A60000-0x00007FF6C5DB4000-memory.dmp

Download

memory/5744-148-0x00007FF6C5A60000-0x00007FF6C5DB4000-memory.dmp

Download

memory/5744-130-0x00007FF6C5A60000-0x00007FF6C5DB4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads