cobaltstrike | 999e11cdb580e27aeb8ee21c99487e0629801e074cfa9fa353a08160023a9092

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
Size 5.2MB
Sample260831-cs1lastdnc
SHA256 999e11cdb580e27aeb8ee21c99487e0629801e074cfa9fa353a08160023a9092
MD5 e2da398487a7f0bfb43cb2ff1e55849e
SHA1 4075cd32fe42fe23587c2b36c35b4522887ae724
SHA512 801e95117dd976643b48239ae56d95f3a8e11b74aeb03d0e0c2e7e8a2ceba63333daf8cb8e2e99ec504b8adf0b399d686863d03073c38249afad7c7ad6571c6f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBibf56utgpPFotBER/mQ32lUp
TLSH
T13F465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000a000000016cdf-5.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c51b-10.dat	cobalt_reflective_dll
behavioral2/files/0x000e00000001c516-11.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c51c-23.dat	cobalt_reflective_dll
behavioral2/files/0x000e00000001c517-28.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c51d-34.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c51e-40.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c51f-45.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c520-49.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c522-59.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c523-65.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c524-69.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c527-85.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c528-90.dat	cobalt_reflective_dll
behavioral2/files/0x0003000000008f2c-105.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c52c-109.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c52a-100.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c529-95.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c526-80.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c525-75.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c521-55.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000a000000016cdf-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c51b-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000e00000001c516-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c51c-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000e00000001c517-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c51d-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c51e-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c51f-45.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c520-49.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c522-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c523-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c524-69.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c527-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c528-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0003000000008f2c-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c52c-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c52a-100.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c529-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c526-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c525-75.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c521-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3656-0-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	UPX
behavioral2/files/0x000a000000016cdf-5.dat	UPX
behavioral2/memory/4080-8-0x00007FF676A90000-0x00007FF676DE1000-memory.dmp	UPX
behavioral2/files/0x000d00000001c51b-10.dat	UPX
behavioral2/files/0x000e00000001c516-11.dat	UPX
behavioral2/memory/5060-12-0x00007FF77DAC0000-0x00007FF77DE11000-memory.dmp	UPX
behavioral2/memory/2664-18-0x00007FF747840000-0x00007FF747B91000-memory.dmp	UPX
behavioral2/files/0x000d00000001c51c-23.dat	UPX
behavioral2/memory/2744-25-0x00007FF71F6D0000-0x00007FF71FA21000-memory.dmp	UPX
behavioral2/files/0x000e00000001c517-28.dat	UPX
behavioral2/files/0x000d00000001c51d-34.dat	UPX
behavioral2/files/0x000d00000001c51e-40.dat	UPX
behavioral2/files/0x000d00000001c51f-45.dat	UPX
behavioral2/files/0x000d00000001c520-49.dat	UPX
behavioral2/files/0x000d00000001c522-59.dat	UPX
behavioral2/files/0x000d00000001c523-65.dat	UPX
behavioral2/files/0x000d00000001c524-69.dat	UPX
behavioral2/files/0x000d00000001c527-85.dat	UPX
behavioral2/files/0x000d00000001c528-90.dat	UPX
behavioral2/files/0x0003000000008f2c-105.dat	UPX
behavioral2/files/0x000d00000001c52c-109.dat	UPX
behavioral2/files/0x000d00000001c52a-100.dat	UPX
behavioral2/files/0x000d00000001c529-95.dat	UPX
behavioral2/files/0x000d00000001c526-80.dat	UPX
behavioral2/files/0x000d00000001c525-75.dat	UPX
behavioral2/files/0x000d00000001c521-55.dat	UPX
behavioral2/memory/4340-111-0x00007FF7B2530000-0x00007FF7B2881000-memory.dmp	UPX
behavioral2/memory/2744-116-0x00007FF71F6D0000-0x00007FF71FA21000-memory.dmp	UPX
behavioral2/memory/4808-118-0x00007FF7BB190000-0x00007FF7BB4E1000-memory.dmp	UPX
behavioral2/memory/248-128-0x00007FF627350000-0x00007FF6276A1000-memory.dmp	UPX
behavioral2/memory/3532-134-0x00007FF790B80000-0x00007FF790ED1000-memory.dmp	UPX
behavioral2/memory/5572-133-0x00007FF7EF720000-0x00007FF7EFA71000-memory.dmp	UPX
behavioral2/memory/2996-132-0x00007FF639EE0000-0x00007FF63A231000-memory.dmp	UPX
behavioral2/memory/4948-131-0x00007FF7874D0000-0x00007FF787821000-memory.dmp	UPX
behavioral2/memory/3152-129-0x00007FF626380000-0x00007FF6266D1000-memory.dmp	UPX
behavioral2/memory/2036-130-0x00007FF70FA80000-0x00007FF70FDD1000-memory.dmp	UPX
behavioral2/memory/5424-127-0x00007FF7087F0000-0x00007FF708B41000-memory.dmp	UPX
behavioral2/memory/5940-126-0x00007FF72FD40000-0x00007FF730091000-memory.dmp	UPX
behavioral2/memory/4828-125-0x00007FF657C20000-0x00007FF657F71000-memory.dmp	UPX
behavioral2/memory/3756-123-0x00007FF6E75B0000-0x00007FF6E7901000-memory.dmp	UPX
behavioral2/memory/4608-122-0x00007FF6FE420000-0x00007FF6FE771000-memory.dmp	UPX
behavioral2/memory/5956-120-0x00007FF7F85D0000-0x00007FF7F8921000-memory.dmp	UPX
behavioral2/memory/4212-124-0x00007FF6821F0000-0x00007FF682541000-memory.dmp	UPX
behavioral2/memory/2856-121-0x00007FF742720000-0x00007FF742A71000-memory.dmp	UPX
behavioral2/memory/4340-117-0x00007FF7B2530000-0x00007FF7B2881000-memory.dmp	UPX
behavioral2/memory/5060-114-0x00007FF77DAC0000-0x00007FF77DE11000-memory.dmp	UPX
behavioral2/memory/3656-112-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	UPX
behavioral2/memory/2664-115-0x00007FF747840000-0x00007FF747B91000-memory.dmp	UPX
behavioral2/memory/4080-113-0x00007FF676A90000-0x00007FF676DE1000-memory.dmp	UPX
behavioral2/memory/3656-135-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	UPX
behavioral2/memory/3656-139-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	UPX
behavioral2/memory/3656-158-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	UPX
behavioral2/memory/3656-180-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	UPX
behavioral2/memory/4080-184-0x00007FF676A90000-0x00007FF676DE1000-memory.dmp	UPX
behavioral2/memory/5060-186-0x00007FF77DAC0000-0x00007FF77DE11000-memory.dmp	UPX
behavioral2/memory/2664-194-0x00007FF747840000-0x00007FF747B91000-memory.dmp	UPX
behavioral2/memory/2744-195-0x00007FF71F6D0000-0x00007FF71FA21000-memory.dmp	UPX
behavioral2/memory/4340-199-0x00007FF7B2530000-0x00007FF7B2881000-memory.dmp	UPX
behavioral2/memory/4808-198-0x00007FF7BB190000-0x00007FF7BB4E1000-memory.dmp	UPX
behavioral2/memory/4608-201-0x00007FF6FE420000-0x00007FF6FE771000-memory.dmp	UPX
behavioral2/memory/3532-214-0x00007FF790B80000-0x00007FF790ED1000-memory.dmp	UPX
behavioral2/memory/3756-221-0x00007FF6E75B0000-0x00007FF6E7901000-memory.dmp	UPX
behavioral2/memory/4212-223-0x00007FF6821F0000-0x00007FF682541000-memory.dmp	UPX
behavioral2/memory/4828-225-0x00007FF657C20000-0x00007FF657F71000-memory.dmp	UPX

XMRig Miner payload 58 IoCs

miner

resource	yara_rule
behavioral2/memory/4080-8-0x00007FF676A90000-0x00007FF676DE1000-memory.dmp	xmrig
behavioral2/memory/2744-116-0x00007FF71F6D0000-0x00007FF71FA21000-memory.dmp	xmrig
behavioral2/memory/4808-118-0x00007FF7BB190000-0x00007FF7BB4E1000-memory.dmp	xmrig
behavioral2/memory/248-128-0x00007FF627350000-0x00007FF6276A1000-memory.dmp	xmrig
behavioral2/memory/3532-134-0x00007FF790B80000-0x00007FF790ED1000-memory.dmp	xmrig
behavioral2/memory/5572-133-0x00007FF7EF720000-0x00007FF7EFA71000-memory.dmp	xmrig
behavioral2/memory/2996-132-0x00007FF639EE0000-0x00007FF63A231000-memory.dmp	xmrig
behavioral2/memory/4948-131-0x00007FF7874D0000-0x00007FF787821000-memory.dmp	xmrig
behavioral2/memory/3152-129-0x00007FF626380000-0x00007FF6266D1000-memory.dmp	xmrig
behavioral2/memory/2036-130-0x00007FF70FA80000-0x00007FF70FDD1000-memory.dmp	xmrig
behavioral2/memory/5424-127-0x00007FF7087F0000-0x00007FF708B41000-memory.dmp	xmrig
behavioral2/memory/5940-126-0x00007FF72FD40000-0x00007FF730091000-memory.dmp	xmrig
behavioral2/memory/4828-125-0x00007FF657C20000-0x00007FF657F71000-memory.dmp	xmrig
behavioral2/memory/3756-123-0x00007FF6E75B0000-0x00007FF6E7901000-memory.dmp	xmrig
behavioral2/memory/4608-122-0x00007FF6FE420000-0x00007FF6FE771000-memory.dmp	xmrig
behavioral2/memory/5956-120-0x00007FF7F85D0000-0x00007FF7F8921000-memory.dmp	xmrig
behavioral2/memory/4212-124-0x00007FF6821F0000-0x00007FF682541000-memory.dmp	xmrig
behavioral2/memory/2856-121-0x00007FF742720000-0x00007FF742A71000-memory.dmp	xmrig
behavioral2/memory/4340-117-0x00007FF7B2530000-0x00007FF7B2881000-memory.dmp	xmrig
behavioral2/memory/5060-114-0x00007FF77DAC0000-0x00007FF77DE11000-memory.dmp	xmrig
behavioral2/memory/3656-112-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	xmrig
behavioral2/memory/2664-115-0x00007FF747840000-0x00007FF747B91000-memory.dmp	xmrig
behavioral2/memory/4080-113-0x00007FF676A90000-0x00007FF676DE1000-memory.dmp	xmrig
behavioral2/memory/3656-135-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	xmrig
behavioral2/memory/3656-139-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	xmrig
behavioral2/memory/3656-158-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	xmrig
behavioral2/memory/3656-180-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	xmrig
behavioral2/memory/4080-184-0x00007FF676A90000-0x00007FF676DE1000-memory.dmp	xmrig
behavioral2/memory/5060-186-0x00007FF77DAC0000-0x00007FF77DE11000-memory.dmp	xmrig
behavioral2/memory/2664-194-0x00007FF747840000-0x00007FF747B91000-memory.dmp	xmrig
behavioral2/memory/2744-195-0x00007FF71F6D0000-0x00007FF71FA21000-memory.dmp	xmrig
behavioral2/memory/4340-199-0x00007FF7B2530000-0x00007FF7B2881000-memory.dmp	xmrig
behavioral2/memory/4808-198-0x00007FF7BB190000-0x00007FF7BB4E1000-memory.dmp	xmrig
behavioral2/memory/4608-201-0x00007FF6FE420000-0x00007FF6FE771000-memory.dmp	xmrig
behavioral2/memory/3532-214-0x00007FF790B80000-0x00007FF790ED1000-memory.dmp	xmrig
behavioral2/memory/3756-221-0x00007FF6E75B0000-0x00007FF6E7901000-memory.dmp	xmrig
behavioral2/memory/4212-223-0x00007FF6821F0000-0x00007FF682541000-memory.dmp	xmrig
behavioral2/memory/4828-225-0x00007FF657C20000-0x00007FF657F71000-memory.dmp	xmrig
behavioral2/memory/5956-219-0x00007FF7F85D0000-0x00007FF7F8921000-memory.dmp	xmrig
behavioral2/memory/5940-227-0x00007FF72FD40000-0x00007FF730091000-memory.dmp	xmrig
behavioral2/memory/2856-213-0x00007FF742720000-0x00007FF742A71000-memory.dmp	xmrig
behavioral2/memory/2036-232-0x00007FF70FA80000-0x00007FF70FDD1000-memory.dmp	xmrig
behavioral2/memory/3152-237-0x00007FF626380000-0x00007FF6266D1000-memory.dmp	xmrig
behavioral2/memory/248-238-0x00007FF627350000-0x00007FF6276A1000-memory.dmp	xmrig
behavioral2/memory/4948-241-0x00007FF7874D0000-0x00007FF787821000-memory.dmp	xmrig
behavioral2/memory/2996-240-0x00007FF639EE0000-0x00007FF63A231000-memory.dmp	xmrig
behavioral2/memory/5424-233-0x00007FF7087F0000-0x00007FF708B41000-memory.dmp	xmrig
behavioral2/memory/5572-230-0x00007FF7EF720000-0x00007FF7EFA71000-memory.dmp	xmrig
behavioral2/memory/3656-242-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	xmrig
behavioral2/memory/3656-243-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	xmrig
behavioral2/memory/3656-244-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	xmrig
behavioral2/memory/3656-245-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	xmrig
behavioral2/memory/3656-246-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	xmrig
behavioral2/memory/3656-247-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	xmrig
behavioral2/memory/3656-248-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	xmrig
behavioral2/memory/3656-249-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	xmrig
behavioral2/memory/3656-250-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	xmrig
behavioral2/memory/3656-251-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4080	dCgXHel.exe
5060	XbaVbDw.exe
2664	ruGcedU.exe
2744	KFsDCTK.exe
4340	IlWJJVJ.exe
4808	gXWJyAf.exe
3532	cLILKpw.exe
5956	PkwEwdh.exe
2856	pvJXoXI.exe
4608	uuUprez.exe
3756	LKUTrQv.exe
4212	VKtAhIp.exe
4828	INLJRmr.exe
5940	kjtOYsE.exe
5424	vxHuXlG.exe
248	SexXzdx.exe
3152	rCMmVzP.exe
2036	HDBFpBY.exe
4948	DhTCzaj.exe
2996	YCsbzJI.exe
5572	ZrqaPWk.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3656-0-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	upx
behavioral2/files/0x000a000000016cdf-5.dat	upx
behavioral2/memory/4080-8-0x00007FF676A90000-0x00007FF676DE1000-memory.dmp	upx
behavioral2/files/0x000d00000001c51b-10.dat	upx
behavioral2/files/0x000e00000001c516-11.dat	upx
behavioral2/memory/5060-12-0x00007FF77DAC0000-0x00007FF77DE11000-memory.dmp	upx
behavioral2/memory/2664-18-0x00007FF747840000-0x00007FF747B91000-memory.dmp	upx
behavioral2/files/0x000d00000001c51c-23.dat	upx
behavioral2/memory/2744-25-0x00007FF71F6D0000-0x00007FF71FA21000-memory.dmp	upx
behavioral2/files/0x000e00000001c517-28.dat	upx
behavioral2/files/0x000d00000001c51d-34.dat	upx
behavioral2/files/0x000d00000001c51e-40.dat	upx
behavioral2/files/0x000d00000001c51f-45.dat	upx
behavioral2/files/0x000d00000001c520-49.dat	upx
behavioral2/files/0x000d00000001c522-59.dat	upx
behavioral2/files/0x000d00000001c523-65.dat	upx
behavioral2/files/0x000d00000001c524-69.dat	upx
behavioral2/files/0x000d00000001c527-85.dat	upx
behavioral2/files/0x000d00000001c528-90.dat	upx
behavioral2/files/0x0003000000008f2c-105.dat	upx
behavioral2/files/0x000d00000001c52c-109.dat	upx
behavioral2/files/0x000d00000001c52a-100.dat	upx
behavioral2/files/0x000d00000001c529-95.dat	upx
behavioral2/files/0x000d00000001c526-80.dat	upx
behavioral2/files/0x000d00000001c525-75.dat	upx
behavioral2/files/0x000d00000001c521-55.dat	upx
behavioral2/memory/4340-111-0x00007FF7B2530000-0x00007FF7B2881000-memory.dmp	upx
behavioral2/memory/2744-116-0x00007FF71F6D0000-0x00007FF71FA21000-memory.dmp	upx
behavioral2/memory/4808-118-0x00007FF7BB190000-0x00007FF7BB4E1000-memory.dmp	upx
behavioral2/memory/248-128-0x00007FF627350000-0x00007FF6276A1000-memory.dmp	upx
behavioral2/memory/3532-134-0x00007FF790B80000-0x00007FF790ED1000-memory.dmp	upx
behavioral2/memory/5572-133-0x00007FF7EF720000-0x00007FF7EFA71000-memory.dmp	upx
behavioral2/memory/2996-132-0x00007FF639EE0000-0x00007FF63A231000-memory.dmp	upx
behavioral2/memory/4948-131-0x00007FF7874D0000-0x00007FF787821000-memory.dmp	upx
behavioral2/memory/3152-129-0x00007FF626380000-0x00007FF6266D1000-memory.dmp	upx
behavioral2/memory/2036-130-0x00007FF70FA80000-0x00007FF70FDD1000-memory.dmp	upx
behavioral2/memory/5424-127-0x00007FF7087F0000-0x00007FF708B41000-memory.dmp	upx
behavioral2/memory/5940-126-0x00007FF72FD40000-0x00007FF730091000-memory.dmp	upx
behavioral2/memory/4828-125-0x00007FF657C20000-0x00007FF657F71000-memory.dmp	upx
behavioral2/memory/3756-123-0x00007FF6E75B0000-0x00007FF6E7901000-memory.dmp	upx
behavioral2/memory/4608-122-0x00007FF6FE420000-0x00007FF6FE771000-memory.dmp	upx
behavioral2/memory/5956-120-0x00007FF7F85D0000-0x00007FF7F8921000-memory.dmp	upx
behavioral2/memory/4212-124-0x00007FF6821F0000-0x00007FF682541000-memory.dmp	upx
behavioral2/memory/2856-121-0x00007FF742720000-0x00007FF742A71000-memory.dmp	upx
behavioral2/memory/4340-117-0x00007FF7B2530000-0x00007FF7B2881000-memory.dmp	upx
behavioral2/memory/5060-114-0x00007FF77DAC0000-0x00007FF77DE11000-memory.dmp	upx
behavioral2/memory/3656-112-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	upx
behavioral2/memory/2664-115-0x00007FF747840000-0x00007FF747B91000-memory.dmp	upx
behavioral2/memory/4080-113-0x00007FF676A90000-0x00007FF676DE1000-memory.dmp	upx
behavioral2/memory/3656-135-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	upx
behavioral2/memory/3656-139-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	upx
behavioral2/memory/3656-158-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	upx
behavioral2/memory/3656-180-0x00007FF607FB0000-0x00007FF608301000-memory.dmp	upx
behavioral2/memory/4080-184-0x00007FF676A90000-0x00007FF676DE1000-memory.dmp	upx
behavioral2/memory/5060-186-0x00007FF77DAC0000-0x00007FF77DE11000-memory.dmp	upx
behavioral2/memory/2664-194-0x00007FF747840000-0x00007FF747B91000-memory.dmp	upx
behavioral2/memory/2744-195-0x00007FF71F6D0000-0x00007FF71FA21000-memory.dmp	upx
behavioral2/memory/4340-199-0x00007FF7B2530000-0x00007FF7B2881000-memory.dmp	upx
behavioral2/memory/4808-198-0x00007FF7BB190000-0x00007FF7BB4E1000-memory.dmp	upx
behavioral2/memory/4608-201-0x00007FF6FE420000-0x00007FF6FE771000-memory.dmp	upx
behavioral2/memory/3532-214-0x00007FF790B80000-0x00007FF790ED1000-memory.dmp	upx
behavioral2/memory/3756-221-0x00007FF6E75B0000-0x00007FF6E7901000-memory.dmp	upx
behavioral2/memory/4212-223-0x00007FF6821F0000-0x00007FF682541000-memory.dmp	upx
behavioral2/memory/4828-225-0x00007FF657C20000-0x00007FF657F71000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\KFsDCTK.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\gXWJyAf.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\pvJXoXI.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\LKUTrQv.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\kjtOYsE.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\SexXzdx.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\XbaVbDw.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\IlWJJVJ.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\PkwEwdh.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\VKtAhIp.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\HDBFpBY.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\dCgXHel.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\cLILKpw.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\uuUprez.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\vxHuXlG.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\DhTCzaj.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\ruGcedU.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\INLJRmr.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\rCMmVzP.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\YCsbzJI.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\ZrqaPWk.exe	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
Token: SeLockMemoryPrivilege	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 4080	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	90
PID 3656 wrote to memory of 5060	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	91
PID 3656 wrote to memory of 2664	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	92
PID 3656 wrote to memory of 2744	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	93
PID 3656 wrote to memory of 4340	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	94
PID 3656 wrote to memory of 4808	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	95
PID 3656 wrote to memory of 3532	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	96
PID 3656 wrote to memory of 5956	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	97
PID 3656 wrote to memory of 2856	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	98
PID 3656 wrote to memory of 4608	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	99
PID 3656 wrote to memory of 3756	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	100
PID 3656 wrote to memory of 4212	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	101
PID 3656 wrote to memory of 4828	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	102
PID 3656 wrote to memory of 5940	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	103
PID 3656 wrote to memory of 5424	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	104
PID 3656 wrote to memory of 248	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	105
PID 3656 wrote to memory of 3152	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	106
PID 3656 wrote to memory of 2036	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	107
PID 3656 wrote to memory of 4948	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	108
PID 3656 wrote to memory of 2996	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	109
PID 3656 wrote to memory of 5572	3656	2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_e2da398487a7f0bfb43cb2ff1e55849e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\System\dCgXHel.exe
  C:\Windows\System\dCgXHel.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\XbaVbDw.exe
  C:\Windows\System\XbaVbDw.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\ruGcedU.exe
  C:\Windows\System\ruGcedU.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\KFsDCTK.exe
  C:\Windows\System\KFsDCTK.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\IlWJJVJ.exe
  C:\Windows\System\IlWJJVJ.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\gXWJyAf.exe
  C:\Windows\System\gXWJyAf.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\cLILKpw.exe
  C:\Windows\System\cLILKpw.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\PkwEwdh.exe
  C:\Windows\System\PkwEwdh.exe
  2⤵
  - Executes dropped EXE
  PID:5956
- C:\Windows\System\pvJXoXI.exe
  C:\Windows\System\pvJXoXI.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\uuUprez.exe
  C:\Windows\System\uuUprez.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\LKUTrQv.exe
  C:\Windows\System\LKUTrQv.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\VKtAhIp.exe
  C:\Windows\System\VKtAhIp.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\INLJRmr.exe
  C:\Windows\System\INLJRmr.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\kjtOYsE.exe
  C:\Windows\System\kjtOYsE.exe
  2⤵
  - Executes dropped EXE
  PID:5940
- C:\Windows\System\vxHuXlG.exe
  C:\Windows\System\vxHuXlG.exe
  2⤵
  - Executes dropped EXE
  PID:5424
- C:\Windows\System\SexXzdx.exe
  C:\Windows\System\SexXzdx.exe
  2⤵
  - Executes dropped EXE
  PID:248
- C:\Windows\System\rCMmVzP.exe
  C:\Windows\System\rCMmVzP.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\HDBFpBY.exe
  C:\Windows\System\HDBFpBY.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\DhTCzaj.exe
  C:\Windows\System\DhTCzaj.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\YCsbzJI.exe
  C:\Windows\System\YCsbzJI.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\ZrqaPWk.exe
  C:\Windows\System\ZrqaPWk.exe
  2⤵
  - Executes dropped EXE
  PID:5572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DhTCzaj.exe

Path C:\Windows\System\DhTCzaj.exe
Size 5.2MB
SHA256 7d7ffc47e2d2f3c8d2a4de1f372ebdc1c6266553030772e9730a4442ee1a6c32
MD5 64a48efb435cf9e08d4962dca2fd6507
SHA1 e0a710ab8fbe5c2f13a69ba820b91c74dd3a3360
SHA512 9dd690d7bd502c38d6eba86a04a967e056d08bf37c1f0f95d9976983c9e15f19fe167843b81a9c152aeca8aa7fb7e5b120d2e3e1ed994cdc18ba1ad9125dc06e
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibf56utgpPFotBER/mQ32lU1
TLSH
T13E465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HDBFpBY.exe

Path C:\Windows\System\HDBFpBY.exe
Size 5.2MB
SHA256 8bd992eafc6777e402bbe0d7897a2fd0a625f08183c304c5fe3eaf8b44417d05
MD5 c4750541cd55306386baa9c0cb6ffbe0
SHA1 17cb2bf8605903a357abca42f95483b672a119fc
SHA512 b2783193ac7ae37d8b876d17e54fcaaf189fecdfee7f6f31d1519a6079a01ea5ca3cdcfc85b2b78b8179e275fef2167081984e575dc75475fa55cf0e9d5dcf74
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6la:RWWBibf56utgpPFotBER/mQ32lUe
TLSH
T1C0465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INLJRmr.exe

Path C:\Windows\System\INLJRmr.exe
Size 5.2MB
SHA256 ade29d0c2fbd43ae69b92d821274722060a2dc7cef7f8f642b47856e75f7912e
MD5 c8718720a23a10b29ab28505d776a7f3
SHA1 75a48abd1417db4d9a4e4c9eba392d8ec8ecf063
SHA512 276a0fa635242dd20affeb89eff9e28a5c20744daf8b9f679c2cf6f5f598bc1ca05dbecd7a6e9042e1acc642da0802b00df6741d04930067bae7bf2a2f55fbcb
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lUv
TLSH
T1B4465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IlWJJVJ.exe

Path C:\Windows\System\IlWJJVJ.exe
Size 5.2MB
SHA256 7d87ae3b7a8d39912a58cfeccb5920b33d23b9eefa76fe2fd7469c9d917452ae
MD5 ffe742eede39beeb7c9b5db72259b47e
SHA1 f86ff2eb3f5bc5d4209b87b063636ede6e5ba39e
SHA512 177cb36ecc8d50be9fc46446102f6c31f9391b659879eec3de4094c48a827e380e74226c8f55bde0c41d960e6632e0c82cc668ef57f1f2f5caff11db0831e186
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lj:RWWBibf56utgpPFotBER/mQ32lUf
TLSH
T1F8465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KFsDCTK.exe

Path C:\Windows\System\KFsDCTK.exe
Size 5.2MB
SHA256 b3d58df88323052852dd6b8d34d89d1b0b282f4f2a17d05a28cdbd0714b85f76
MD5 f670b9504b42b6ddbfeba7227bd17286
SHA1 ca9be3b75791b8c9c32f5001c16fb8695e5ec63e
SHA512 dcc1930e5f687472c89115e858638253a22dbdd1154d381dce0c3adddbca8ceba2454534b258647cab387170331ab2384c706720b307e6e690e8394481dc6875
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibf56utgpPFotBER/mQ32lUm
TLSH
T193465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LKUTrQv.exe

Path C:\Windows\System\LKUTrQv.exe
Size 5.2MB
SHA256 ee6a16199a019bc61c1e64abb023fca90d3dc5e27be1a71cf672198a77ac3f3c
MD5 cbb6fbb2ccb32d98e107ce26b2fa5ce7
SHA1 1d53c10e0ef6626e101e5e8144d2fd411b7a738d
SHA512 f69ba5837ed0749f9f316a08e610228a201e267ad847caabbd6d3ce3973504b2389fcd07e84d881e4363294835f5837a9c2865af6665939caadc14b58562bcd6
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lK:RWWBibf56utgpPFotBER/mQ32lUe
TLSH
T100465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PkwEwdh.exe

Path C:\Windows\System\PkwEwdh.exe
Size 5.2MB
SHA256 c79fa90c99effe2885c20f2778ff833a356c05f14316d860dff51f5a6c80cebc
MD5 fec2ab3b04ca743f3dc2b5f3b7f17627
SHA1 c61c02b5b3ff53f05c70af5ea89fdeb681f44280
SHA512 b4622a0aa705d9c723a5360585d012de3469512824ebc39910b2bc8912548b4f0a642d83d92200f3fe43f31f551929e19953fcf6d402bd465ba62fe58a83c8e6
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lc:RWWBibf56utgpPFotBER/mQ32lUg
TLSH
T1CA465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SexXzdx.exe

Path C:\Windows\System\SexXzdx.exe
Size 5.2MB
SHA256 8d56efccd38eeec757cef776441fa877399746ff391b9e85c39b0c1f611b479a
MD5 39621d75e68d680a821ea7bebba5670f
SHA1 56dd474d638300ab10a5554328ff15c019e920fd
SHA512 95a8ce90a308862bd94ee0ddf718fd613be106de5437ce243b95a62b150fa27cdee634553711b44992b3661520eae4f57089f53461a44b0d6fcdb773a6ebf4a0
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lr:RWWBibf56utgpPFotBER/mQ32lUn
TLSH
T1EB465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VKtAhIp.exe

Path C:\Windows\System\VKtAhIp.exe
Size 5.2MB
SHA256 be1b7b7aeeacb742880beb8911520d8c632cfec374bcce7b081b47d8e6dcbebe
MD5 436b06197cc999f8698258b428d13101
SHA1 e9d9aa824a25806af9497fb793ad29b81a2daa9c
SHA512 154309a7f28b536d8c7c9764a2e3d0eed35cc0514474a004ec6fb310a9e0bae5764834ecc7c694634c486ce68a18323ec8bad3c9569ab446cab3fbc8aa221d75
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibf56utgpPFotBER/mQ32lUj
TLSH
T1A8465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XbaVbDw.exe

Path C:\Windows\System\XbaVbDw.exe
Size 5.2MB
SHA256 57df9d0773e5844b6eaf107c9cc0be6906699e27d8a9fe6741366924db9f5ce0
MD5 a647cde85dea91a8ebb3fee257ebba85
SHA1 c38ee2fd5abdc230e043a55a42176cafda2e279a
SHA512 123ea01f8fdcd91045391f9779b6cc91a59b8dc8ff0dd1e9f0e2cef2742c5463a428250884086240a14b4a4a4ce9b8e2f08acb26ca56ae263af70f4e95e20e7e
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lM:RWWBibf56utgpPFotBER/mQ32lUo
TLSH
T10F465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YCsbzJI.exe

Path C:\Windows\System\YCsbzJI.exe
Size 5.2MB
SHA256 f5980a3b65a42fa5179b52f6e2a286a38e7f16e39fe18af6876bc24360cc95ad
MD5 d1ad32298907a48d59af48edb9f5a933
SHA1 5c4d430be5c2f2ff530a2a85dd328ccb4c6254dc
SHA512 b74c981ae25a31fb30d62f4d50ac853e3916815ed36b455bf3315b87a348a845218e32fc4c694b09e4d1d62902f5d48f905e89daf21449ebc2ace53a831004a3
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBibf56utgpPFotBER/mQ32lUF
TLSH
T1C1465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZrqaPWk.exe

Path C:\Windows\System\ZrqaPWk.exe
Size 5.2MB
SHA256 15b8d14d0ac99d79f9aefae069031e3bbaacdf4353708ae9804da4cbdbf7f08b
MD5 2fe7d9078fddeb11ee635c48df5ea31c
SHA1 65586d1850fb24e8f976b67cd0a3dea0177d6ad3
SHA512 9f24b7bbbc13bfb829e86aea2470cef06c1c544251a88c663f99bef7ec0ef951bfdc1a6102321726b3c31a506f50ba9ad639bdf16335d4740e46f687f68e4f19
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUY
TLSH
T1E6465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cLILKpw.exe

Path C:\Windows\System\cLILKpw.exe
Size 5.2MB
SHA256 5009f3fe49abb9da4276ade4db331d8acaebe1c49f276c85a4dad12ae6f0c419
MD5 7c6613d0fd419543fc9eb4a709c565e7
SHA1 6b0eea4f9e569094d9636ca26cbd114408fc13c1
SHA512 564b6086a2009aef73203acef67c7a138fefd08b9775c2c33d8b75fd352f28c631895213c6742525047a5b6765b45aadea3d462975b962baa2a0a744bc82639b
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lUB
TLSH
T13F465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dCgXHel.exe

Path C:\Windows\System\dCgXHel.exe
Size 5.2MB
SHA256 82032cff18e890c24ed08e0b8cb311dba913555163a2e2c086e20fcac6f10ab2
MD5 776b07cd7f3b333d13e87d31ab38cf03
SHA1 12494e6c64bcb91e5288b19c7b752938e1ec38e5
SHA512 6957b19fe793b8f7b41b979dbbb8d1523b77b1f16ec7b4c46ae859a80374ebd22721842313a08d8235a69ff41bdf25b41274bd1ca472793d2c14c1160438b953
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBibf56utgpPFotBER/mQ32lU6
TLSH
T156465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gXWJyAf.exe

Path C:\Windows\System\gXWJyAf.exe
Size 5.2MB
SHA256 e0691c0c8d2c0be01f58ba4bf39acffb49597ee777e6b60e1051a461a6cfc4d5
MD5 45ee390dfd85c7fe97b45d87bd8dcbff
SHA1 35aefe64ee0a0281c829adf917866b62137d61c2
SHA512 502386157f6495f3a3a15f8d6a2ebccac9298a61e190388899214eda4ee480270cb6e855535543120d0013882dc4e29c57d780a26f721dd0002cd615945d0167
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l5:RWWBibf56utgpPFotBER/mQ32lU9
TLSH
T13A465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kjtOYsE.exe

Path C:\Windows\System\kjtOYsE.exe
Size 5.2MB
SHA256 4dfd0e0ad6610e1c8488e6bd0ff047d8d87afdbdf7108abf196d3bfa37028b2f
MD5 dc9f29e064ca2684e2e547faeb593a30
SHA1 1ce55143d6c1bca5dffc48398d958e30da99d0da
SHA512 44d702c0a2568604e86bb590a8f3c0d461bc1331a92570727b11f72ec407de31ff08d49b1e3395d65d755f0ace8f533ceefc704f3ddc18a9584a07a5c33e1ab6
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lB:RWWBibf56utgpPFotBER/mQ32lU1
TLSH
T192465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pvJXoXI.exe

Path C:\Windows\System\pvJXoXI.exe
Size 5.2MB
SHA256 84614c84915641310627ee50afc75999c9f25494c53df0f7659b7b750b209068
MD5 4db343ffb78eb7f8162a26498be253d1
SHA1 c34b85c7fa5bbcf3915c18e3c3609eba57a84e3d
SHA512 cdc4b71c4c6cd42d35fd3193d2c17924568d06c241fdc12031c170e71a7a105763b04555c6198ac12bf51907cb97669c4df5b21990a4ad2125fd30f0a1d97f18
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibf56utgpPFotBER/mQ32lUW
TLSH
T1C6465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rCMmVzP.exe

Path C:\Windows\System\rCMmVzP.exe
Size 5.2MB
SHA256 6e505dbd132e14ae9a74072bb6fa7c3bf94bdd5b9d2d7d80670d60bfae0617a8
MD5 9cccf761967bd061a12fe7e9154800f4
SHA1 c6ff20a05615997489a8e875a5cfa83b54b4cc36
SHA512 3d8d7b0765f7705e8b5d771f9e055f89a314015511041ebdeb874bd53e0dfb8cf4dd5c04485e10071811679df5c48002c6d1ed08e4fd2c22894ad356a14794d7
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibf56utgpPFotBER/mQ32lUd
TLSH
T106465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ruGcedU.exe

Path C:\Windows\System\ruGcedU.exe
Size 5.2MB
SHA256 670915354f16a3e20e40d0d8954818b85e7bb9e8dcd034d4c7886c7f59f85bbc
MD5 03128accb2cf4ec48c107609a64b9e7c
SHA1 78e4e3df036f39cde830574c6e091aae06fa954a
SHA512 d8ba60bb5160d13e41e7e1029ea7699b3adb78d7b13a3c2963c2297759670c68db54146f81b63d5987ec0c0b1db6dc61049c4478566d4d271ea73703f7a74fc5
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibf56utgpPFotBER/mQ32lUi
TLSH
T150465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uuUprez.exe

Path C:\Windows\System\uuUprez.exe
Size 5.2MB
SHA256 da345dc0401a946ac1cb2a82afd92c67cf8c9026f045dd7b50d76b5f5c731945
MD5 5dbce585c079e841a8d7717b757968e4
SHA1 36c31068b383036ee3dc444c996379416943d88d
SHA512 7877d674c3cdcfded89fc690b7064d9efa42b52aad1b1f92510b01223f44a6bce3a4eb439067b8ff2f13dfbecfcf5ff6fea3eaa9c6eb9b8b3f817891e6e3dd4f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUg
TLSH
T1C4465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vxHuXlG.exe

Path C:\Windows\System\vxHuXlG.exe
Size 5.2MB
SHA256 46b2142d92271c9ea6d8bd91639338f43d598f2b498bffb33638fa962501905b
MD5 f87204bc6f9cae1ae3e161ac2b1b09f5
SHA1 117f0ace21c911e92c5fee5f4346165ed9eb9e99
SHA512 47f60ae30a22c8ad66738e33eef155ad77aa9e0a5d57684d03e3dfcf8841569f7937f73ce16af50679dbfe73eeaf56e38aa271964a795d15e2fa2610f8d12cba
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l9:RWWBibf56utgpPFotBER/mQ32lUx
TLSH
T11B465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-128-0x00007FF627350000-0x00007FF6276A1000-memory.dmp

Download

memory/248-238-0x00007FF627350000-0x00007FF6276A1000-memory.dmp

Download

memory/2036-130-0x00007FF70FA80000-0x00007FF70FDD1000-memory.dmp

Download

memory/2036-232-0x00007FF70FA80000-0x00007FF70FDD1000-memory.dmp

Download

memory/2664-18-0x00007FF747840000-0x00007FF747B91000-memory.dmp

Download

memory/2664-115-0x00007FF747840000-0x00007FF747B91000-memory.dmp

Download

memory/2664-194-0x00007FF747840000-0x00007FF747B91000-memory.dmp

Download

memory/2744-195-0x00007FF71F6D0000-0x00007FF71FA21000-memory.dmp

Download

memory/2744-116-0x00007FF71F6D0000-0x00007FF71FA21000-memory.dmp

Download

memory/2744-25-0x00007FF71F6D0000-0x00007FF71FA21000-memory.dmp

Download

memory/2856-121-0x00007FF742720000-0x00007FF742A71000-memory.dmp

Download

memory/2856-213-0x00007FF742720000-0x00007FF742A71000-memory.dmp

Download

memory/2996-240-0x00007FF639EE0000-0x00007FF63A231000-memory.dmp

Download

memory/2996-132-0x00007FF639EE0000-0x00007FF63A231000-memory.dmp

Download

memory/3152-129-0x00007FF626380000-0x00007FF6266D1000-memory.dmp

Download

memory/3152-237-0x00007FF626380000-0x00007FF6266D1000-memory.dmp

Download

memory/3532-134-0x00007FF790B80000-0x00007FF790ED1000-memory.dmp

Download

memory/3532-214-0x00007FF790B80000-0x00007FF790ED1000-memory.dmp

Download

memory/3656-244-0x00007FF607FB0000-0x00007FF608301000-memory.dmp

Download

memory/3656-135-0x00007FF607FB0000-0x00007FF608301000-memory.dmp

Download

memory/3656-243-0x00007FF607FB0000-0x00007FF608301000-memory.dmp

Download

memory/3656-242-0x00007FF607FB0000-0x00007FF608301000-memory.dmp

Download

memory/3656-248-0x00007FF607FB0000-0x00007FF608301000-memory.dmp

Download

memory/3656-245-0x00007FF607FB0000-0x00007FF608301000-memory.dmp

Download

memory/3656-249-0x00007FF607FB0000-0x00007FF608301000-memory.dmp

Download

memory/3656-246-0x00007FF607FB0000-0x00007FF608301000-memory.dmp

Download

memory/3656-112-0x00007FF607FB0000-0x00007FF608301000-memory.dmp

Download

memory/3656-250-0x00007FF607FB0000-0x00007FF608301000-memory.dmp

Download

memory/3656-0-0x00007FF607FB0000-0x00007FF608301000-memory.dmp

Download

memory/3656-247-0x00007FF607FB0000-0x00007FF608301000-memory.dmp

Download

memory/3656-139-0x00007FF607FB0000-0x00007FF608301000-memory.dmp

Download

memory/3656-158-0x00007FF607FB0000-0x00007FF608301000-memory.dmp

Download

memory/3656-180-0x00007FF607FB0000-0x00007FF608301000-memory.dmp

Download

memory/3656-1-0x000001F2519C0000-0x000001F2519D0000-memory.dmp

Download

memory/3656-251-0x00007FF607FB0000-0x00007FF608301000-memory.dmp

Download

memory/3756-123-0x00007FF6E75B0000-0x00007FF6E7901000-memory.dmp

Download

memory/3756-221-0x00007FF6E75B0000-0x00007FF6E7901000-memory.dmp

Download

memory/4080-8-0x00007FF676A90000-0x00007FF676DE1000-memory.dmp

Download

memory/4080-184-0x00007FF676A90000-0x00007FF676DE1000-memory.dmp

Download

memory/4080-113-0x00007FF676A90000-0x00007FF676DE1000-memory.dmp

Download

memory/4212-223-0x00007FF6821F0000-0x00007FF682541000-memory.dmp

Download

memory/4212-124-0x00007FF6821F0000-0x00007FF682541000-memory.dmp

Download

memory/4340-199-0x00007FF7B2530000-0x00007FF7B2881000-memory.dmp

Download

memory/4340-111-0x00007FF7B2530000-0x00007FF7B2881000-memory.dmp

Download

memory/4340-117-0x00007FF7B2530000-0x00007FF7B2881000-memory.dmp

Download

memory/4608-201-0x00007FF6FE420000-0x00007FF6FE771000-memory.dmp

Download

memory/4608-122-0x00007FF6FE420000-0x00007FF6FE771000-memory.dmp

Download

memory/4808-118-0x00007FF7BB190000-0x00007FF7BB4E1000-memory.dmp

Download

memory/4808-198-0x00007FF7BB190000-0x00007FF7BB4E1000-memory.dmp

Download

memory/4828-125-0x00007FF657C20000-0x00007FF657F71000-memory.dmp

Download

memory/4828-225-0x00007FF657C20000-0x00007FF657F71000-memory.dmp

Download

memory/4948-241-0x00007FF7874D0000-0x00007FF787821000-memory.dmp

Download

memory/4948-131-0x00007FF7874D0000-0x00007FF787821000-memory.dmp

Download

memory/5060-186-0x00007FF77DAC0000-0x00007FF77DE11000-memory.dmp

Download

memory/5060-114-0x00007FF77DAC0000-0x00007FF77DE11000-memory.dmp

Download

memory/5060-12-0x00007FF77DAC0000-0x00007FF77DE11000-memory.dmp

Download

memory/5424-127-0x00007FF7087F0000-0x00007FF708B41000-memory.dmp

Download

memory/5424-233-0x00007FF7087F0000-0x00007FF708B41000-memory.dmp

Download

memory/5572-230-0x00007FF7EF720000-0x00007FF7EFA71000-memory.dmp

Download

memory/5572-133-0x00007FF7EF720000-0x00007FF7EFA71000-memory.dmp

Download

memory/5940-126-0x00007FF72FD40000-0x00007FF730091000-memory.dmp

Download

memory/5940-227-0x00007FF72FD40000-0x00007FF730091000-memory.dmp

Download

memory/5956-120-0x00007FF7F85D0000-0x00007FF7F8921000-memory.dmp

Download

memory/5956-219-0x00007FF7F85D0000-0x00007FF7F8921000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads