cobaltstrike | edfa95e7d5b20d7ec5af9ce8fa55ea8e49fdd4fcd01752692f1e11037cff7128

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 5.9MB
Sample260903-171rlsgl21
SHA256 edfa95e7d5b20d7ec5af9ce8fa55ea8e49fdd4fcd01752692f1e11037cff7128
MD5 cf30e18e23d3b67e818891c392be84ec
SHA1 62ee10f36235cf72454155324e86955c8260dac4
SHA512 e7b62be9efa9b21baa99cd169a3547188282d8da07b3e77c8b68c30debfb07432a97cd5223f909e3f6c0b86efe15d4adffd1ae484c9f4fe14ddaf41b20854929
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
TLSH
T132565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x00070000000242fd-7.dat	cobalt_reflective_dll
behavioral1/files/0x000900000002425e-4.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024300-32.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024306-59.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002430d-84.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002430f-89.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024303-88.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024302-87.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002430e-86.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002430c-83.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002430b-82.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002430a-81.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024309-80.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024304-77.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024308-72.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242ff-71.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024301-62.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024307-60.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024305-58.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242fe-55.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000242fc-29.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral1/files/0x00070000000242fd-7.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000900000002425e-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024300-32.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024306-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002430d-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002430f-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024303-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024302-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002430e-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002430c-83.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002430b-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002430a-81.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024309-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024304-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024308-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242ff-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024301-62.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024307-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024305-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242fe-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000242fc-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral1/memory/2936-0-0x00007FF6ECC10000-0x00007FF6ECF64000-memory.dmp	UPX
behavioral1/files/0x00070000000242fd-7.dat	UPX
behavioral1/files/0x000900000002425e-4.dat	UPX
behavioral1/memory/4316-10-0x00007FF64E200000-0x00007FF64E554000-memory.dmp	UPX
behavioral1/files/0x0007000000024300-32.dat	UPX
behavioral1/files/0x0007000000024306-59.dat	UPX
behavioral1/files/0x000700000002430d-84.dat	UPX
behavioral1/memory/2060-90-0x00007FF6B4810000-0x00007FF6B4B64000-memory.dmp	UPX
behavioral1/memory/4948-94-0x00007FF781960000-0x00007FF781CB4000-memory.dmp	UPX
behavioral1/memory/1696-99-0x00007FF7C2F60000-0x00007FF7C32B4000-memory.dmp	UPX
behavioral1/memory/4416-104-0x00007FF71ACD0000-0x00007FF71B024000-memory.dmp	UPX
behavioral1/memory/2852-105-0x00007FF6BA3E0000-0x00007FF6BA734000-memory.dmp	UPX
behavioral1/memory/1916-103-0x00007FF630160000-0x00007FF6304B4000-memory.dmp	UPX
behavioral1/memory/3504-102-0x00007FF6DEDE0000-0x00007FF6DF134000-memory.dmp	UPX
behavioral1/memory/2996-101-0x00007FF629050000-0x00007FF6293A4000-memory.dmp	UPX
behavioral1/memory/1120-100-0x00007FF7C4400000-0x00007FF7C4754000-memory.dmp	UPX
behavioral1/memory/4136-98-0x00007FF698A40000-0x00007FF698D94000-memory.dmp	UPX
behavioral1/memory/4720-97-0x00007FF62B7A0000-0x00007FF62BAF4000-memory.dmp	UPX
behavioral1/memory/4492-96-0x00007FF78AE60000-0x00007FF78B1B4000-memory.dmp	UPX
behavioral1/memory/3976-95-0x00007FF706F30000-0x00007FF707284000-memory.dmp	UPX
behavioral1/memory/1168-93-0x00007FF6F0E40000-0x00007FF6F1194000-memory.dmp	UPX
behavioral1/memory/4272-92-0x00007FF6E4590000-0x00007FF6E48E4000-memory.dmp	UPX
behavioral1/memory/2364-91-0x00007FF6F4380000-0x00007FF6F46D4000-memory.dmp	UPX
behavioral1/files/0x000700000002430f-89.dat	UPX
behavioral1/files/0x0007000000024303-88.dat	UPX
behavioral1/files/0x0007000000024302-87.dat	UPX
behavioral1/files/0x000700000002430e-86.dat	UPX
behavioral1/memory/4512-85-0x00007FF61B4F0000-0x00007FF61B844000-memory.dmp	UPX
behavioral1/files/0x000700000002430c-83.dat	UPX
behavioral1/files/0x000700000002430b-82.dat	UPX
behavioral1/files/0x000700000002430a-81.dat	UPX
behavioral1/files/0x0007000000024309-80.dat	UPX
behavioral1/files/0x0007000000024304-77.dat	UPX
behavioral1/files/0x0007000000024308-72.dat	UPX
behavioral1/files/0x00070000000242ff-71.dat	UPX
behavioral1/memory/2184-68-0x00007FF67E450000-0x00007FF67E7A4000-memory.dmp	UPX
behavioral1/files/0x0007000000024301-62.dat	UPX
behavioral1/memory/2200-61-0x00007FF7689C0000-0x00007FF768D14000-memory.dmp	UPX
behavioral1/files/0x0007000000024307-60.dat	UPX
behavioral1/files/0x0007000000024305-58.dat	UPX
behavioral1/files/0x00070000000242fe-55.dat	UPX
behavioral1/memory/1880-38-0x00007FF61B0E0000-0x00007FF61B434000-memory.dmp	UPX
behavioral1/files/0x00070000000242fc-29.dat	UPX
behavioral1/memory/2936-128-0x00007FF6ECC10000-0x00007FF6ECF64000-memory.dmp	UPX
behavioral1/memory/4316-129-0x00007FF64E200000-0x00007FF64E554000-memory.dmp	UPX
behavioral1/memory/1880-130-0x00007FF61B0E0000-0x00007FF61B434000-memory.dmp	UPX
behavioral1/memory/2060-132-0x00007FF6B4810000-0x00007FF6B4B64000-memory.dmp	UPX
behavioral1/memory/2200-131-0x00007FF7689C0000-0x00007FF768D14000-memory.dmp	UPX
behavioral1/memory/2364-133-0x00007FF6F4380000-0x00007FF6F46D4000-memory.dmp	UPX
behavioral1/memory/1168-134-0x00007FF6F0E40000-0x00007FF6F1194000-memory.dmp	UPX
behavioral1/memory/3976-136-0x00007FF706F30000-0x00007FF707284000-memory.dmp	UPX
behavioral1/memory/4136-139-0x00007FF698A40000-0x00007FF698D94000-memory.dmp	UPX
behavioral1/memory/2996-142-0x00007FF629050000-0x00007FF6293A4000-memory.dmp	UPX
behavioral1/memory/1120-141-0x00007FF7C4400000-0x00007FF7C4754000-memory.dmp	UPX
behavioral1/memory/1696-140-0x00007FF7C2F60000-0x00007FF7C32B4000-memory.dmp	UPX
behavioral1/memory/4720-138-0x00007FF62B7A0000-0x00007FF62BAF4000-memory.dmp	UPX
behavioral1/memory/4492-137-0x00007FF78AE60000-0x00007FF78B1B4000-memory.dmp	UPX
behavioral1/memory/4948-135-0x00007FF781960000-0x00007FF781CB4000-memory.dmp	UPX
behavioral1/memory/2852-143-0x00007FF6BA3E0000-0x00007FF6BA734000-memory.dmp	UPX
behavioral1/memory/4316-144-0x00007FF64E200000-0x00007FF64E554000-memory.dmp	UPX
behavioral1/memory/1880-145-0x00007FF61B0E0000-0x00007FF61B434000-memory.dmp	UPX
behavioral1/memory/2200-151-0x00007FF7689C0000-0x00007FF768D14000-memory.dmp	UPX
behavioral1/memory/4272-152-0x00007FF6E4590000-0x00007FF6E48E4000-memory.dmp	UPX
behavioral1/memory/2184-150-0x00007FF67E450000-0x00007FF67E7A4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2936-0-0x00007FF6ECC10000-0x00007FF6ECF64000-memory.dmp	xmrig
behavioral1/files/0x00070000000242fd-7.dat	xmrig
behavioral1/files/0x000900000002425e-4.dat	xmrig
behavioral1/memory/4316-10-0x00007FF64E200000-0x00007FF64E554000-memory.dmp	xmrig
behavioral1/files/0x0007000000024300-32.dat	xmrig
behavioral1/files/0x0007000000024306-59.dat	xmrig
behavioral1/files/0x000700000002430d-84.dat	xmrig
behavioral1/memory/2060-90-0x00007FF6B4810000-0x00007FF6B4B64000-memory.dmp	xmrig
behavioral1/memory/4948-94-0x00007FF781960000-0x00007FF781CB4000-memory.dmp	xmrig
behavioral1/memory/1696-99-0x00007FF7C2F60000-0x00007FF7C32B4000-memory.dmp	xmrig
behavioral1/memory/4416-104-0x00007FF71ACD0000-0x00007FF71B024000-memory.dmp	xmrig
behavioral1/memory/2852-105-0x00007FF6BA3E0000-0x00007FF6BA734000-memory.dmp	xmrig
behavioral1/memory/1916-103-0x00007FF630160000-0x00007FF6304B4000-memory.dmp	xmrig
behavioral1/memory/3504-102-0x00007FF6DEDE0000-0x00007FF6DF134000-memory.dmp	xmrig
behavioral1/memory/2996-101-0x00007FF629050000-0x00007FF6293A4000-memory.dmp	xmrig
behavioral1/memory/1120-100-0x00007FF7C4400000-0x00007FF7C4754000-memory.dmp	xmrig
behavioral1/memory/4136-98-0x00007FF698A40000-0x00007FF698D94000-memory.dmp	xmrig
behavioral1/memory/4720-97-0x00007FF62B7A0000-0x00007FF62BAF4000-memory.dmp	xmrig
behavioral1/memory/4492-96-0x00007FF78AE60000-0x00007FF78B1B4000-memory.dmp	xmrig
behavioral1/memory/3976-95-0x00007FF706F30000-0x00007FF707284000-memory.dmp	xmrig
behavioral1/memory/1168-93-0x00007FF6F0E40000-0x00007FF6F1194000-memory.dmp	xmrig
behavioral1/memory/4272-92-0x00007FF6E4590000-0x00007FF6E48E4000-memory.dmp	xmrig
behavioral1/memory/2364-91-0x00007FF6F4380000-0x00007FF6F46D4000-memory.dmp	xmrig
behavioral1/files/0x000700000002430f-89.dat	xmrig
behavioral1/files/0x0007000000024303-88.dat	xmrig
behavioral1/files/0x0007000000024302-87.dat	xmrig
behavioral1/files/0x000700000002430e-86.dat	xmrig
behavioral1/memory/4512-85-0x00007FF61B4F0000-0x00007FF61B844000-memory.dmp	xmrig
behavioral1/files/0x000700000002430c-83.dat	xmrig
behavioral1/files/0x000700000002430b-82.dat	xmrig
behavioral1/files/0x000700000002430a-81.dat	xmrig
behavioral1/files/0x0007000000024309-80.dat	xmrig
behavioral1/files/0x0007000000024304-77.dat	xmrig
behavioral1/files/0x0007000000024308-72.dat	xmrig
behavioral1/files/0x00070000000242ff-71.dat	xmrig
behavioral1/memory/2184-68-0x00007FF67E450000-0x00007FF67E7A4000-memory.dmp	xmrig
behavioral1/files/0x0007000000024301-62.dat	xmrig
behavioral1/memory/2200-61-0x00007FF7689C0000-0x00007FF768D14000-memory.dmp	xmrig
behavioral1/files/0x0007000000024307-60.dat	xmrig
behavioral1/files/0x0007000000024305-58.dat	xmrig
behavioral1/files/0x00070000000242fe-55.dat	xmrig
behavioral1/memory/1880-38-0x00007FF61B0E0000-0x00007FF61B434000-memory.dmp	xmrig
behavioral1/files/0x00070000000242fc-29.dat	xmrig
behavioral1/memory/2936-128-0x00007FF6ECC10000-0x00007FF6ECF64000-memory.dmp	xmrig
behavioral1/memory/4316-129-0x00007FF64E200000-0x00007FF64E554000-memory.dmp	xmrig
behavioral1/memory/1880-130-0x00007FF61B0E0000-0x00007FF61B434000-memory.dmp	xmrig
behavioral1/memory/2060-132-0x00007FF6B4810000-0x00007FF6B4B64000-memory.dmp	xmrig
behavioral1/memory/2200-131-0x00007FF7689C0000-0x00007FF768D14000-memory.dmp	xmrig
behavioral1/memory/2364-133-0x00007FF6F4380000-0x00007FF6F46D4000-memory.dmp	xmrig
behavioral1/memory/1168-134-0x00007FF6F0E40000-0x00007FF6F1194000-memory.dmp	xmrig
behavioral1/memory/3976-136-0x00007FF706F30000-0x00007FF707284000-memory.dmp	xmrig
behavioral1/memory/4136-139-0x00007FF698A40000-0x00007FF698D94000-memory.dmp	xmrig
behavioral1/memory/2996-142-0x00007FF629050000-0x00007FF6293A4000-memory.dmp	xmrig
behavioral1/memory/1120-141-0x00007FF7C4400000-0x00007FF7C4754000-memory.dmp	xmrig
behavioral1/memory/1696-140-0x00007FF7C2F60000-0x00007FF7C32B4000-memory.dmp	xmrig
behavioral1/memory/4720-138-0x00007FF62B7A0000-0x00007FF62BAF4000-memory.dmp	xmrig
behavioral1/memory/4492-137-0x00007FF78AE60000-0x00007FF78B1B4000-memory.dmp	xmrig
behavioral1/memory/4948-135-0x00007FF781960000-0x00007FF781CB4000-memory.dmp	xmrig
behavioral1/memory/2852-143-0x00007FF6BA3E0000-0x00007FF6BA734000-memory.dmp	xmrig
behavioral1/memory/4316-144-0x00007FF64E200000-0x00007FF64E554000-memory.dmp	xmrig
behavioral1/memory/1880-145-0x00007FF61B0E0000-0x00007FF61B434000-memory.dmp	xmrig
behavioral1/memory/2200-151-0x00007FF7689C0000-0x00007FF768D14000-memory.dmp	xmrig
behavioral1/memory/4272-152-0x00007FF6E4590000-0x00007FF6E48E4000-memory.dmp	xmrig
behavioral1/memory/2184-150-0x00007FF67E450000-0x00007FF67E7A4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4316	rkPPQgQ.exe
1880	Ckuqiir.exe
2200	smBaQiU.exe
2184	rUNNILV.exe
3504	csHfdPQ.exe
4512	CjiFORn.exe
1916	KUwCDYr.exe
2060	CHJKrVQ.exe
2364	DaXVVbF.exe
4272	qHtwukV.exe
1168	NtLIYPj.exe
4948	gSkqLXY.exe
3976	wPmDKqz.exe
4416	boIfSAv.exe
4492	OVRQqnh.exe
4720	OnZfbBi.exe
4136	sSWPsgS.exe
1696	PpvojWQ.exe
1120	muWwwDw.exe
2852	UJBpXvI.exe
2996	GSgNQZe.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2936-0-0x00007FF6ECC10000-0x00007FF6ECF64000-memory.dmp	upx
behavioral1/files/0x00070000000242fd-7.dat	upx
behavioral1/files/0x000900000002425e-4.dat	upx
behavioral1/memory/4316-10-0x00007FF64E200000-0x00007FF64E554000-memory.dmp	upx
behavioral1/files/0x0007000000024300-32.dat	upx
behavioral1/files/0x0007000000024306-59.dat	upx
behavioral1/files/0x000700000002430d-84.dat	upx
behavioral1/memory/2060-90-0x00007FF6B4810000-0x00007FF6B4B64000-memory.dmp	upx
behavioral1/memory/4948-94-0x00007FF781960000-0x00007FF781CB4000-memory.dmp	upx
behavioral1/memory/1696-99-0x00007FF7C2F60000-0x00007FF7C32B4000-memory.dmp	upx
behavioral1/memory/4416-104-0x00007FF71ACD0000-0x00007FF71B024000-memory.dmp	upx
behavioral1/memory/2852-105-0x00007FF6BA3E0000-0x00007FF6BA734000-memory.dmp	upx
behavioral1/memory/1916-103-0x00007FF630160000-0x00007FF6304B4000-memory.dmp	upx
behavioral1/memory/3504-102-0x00007FF6DEDE0000-0x00007FF6DF134000-memory.dmp	upx
behavioral1/memory/2996-101-0x00007FF629050000-0x00007FF6293A4000-memory.dmp	upx
behavioral1/memory/1120-100-0x00007FF7C4400000-0x00007FF7C4754000-memory.dmp	upx
behavioral1/memory/4136-98-0x00007FF698A40000-0x00007FF698D94000-memory.dmp	upx
behavioral1/memory/4720-97-0x00007FF62B7A0000-0x00007FF62BAF4000-memory.dmp	upx
behavioral1/memory/4492-96-0x00007FF78AE60000-0x00007FF78B1B4000-memory.dmp	upx
behavioral1/memory/3976-95-0x00007FF706F30000-0x00007FF707284000-memory.dmp	upx
behavioral1/memory/1168-93-0x00007FF6F0E40000-0x00007FF6F1194000-memory.dmp	upx
behavioral1/memory/4272-92-0x00007FF6E4590000-0x00007FF6E48E4000-memory.dmp	upx
behavioral1/memory/2364-91-0x00007FF6F4380000-0x00007FF6F46D4000-memory.dmp	upx
behavioral1/files/0x000700000002430f-89.dat	upx
behavioral1/files/0x0007000000024303-88.dat	upx
behavioral1/files/0x0007000000024302-87.dat	upx
behavioral1/files/0x000700000002430e-86.dat	upx
behavioral1/memory/4512-85-0x00007FF61B4F0000-0x00007FF61B844000-memory.dmp	upx
behavioral1/files/0x000700000002430c-83.dat	upx
behavioral1/files/0x000700000002430b-82.dat	upx
behavioral1/files/0x000700000002430a-81.dat	upx
behavioral1/files/0x0007000000024309-80.dat	upx
behavioral1/files/0x0007000000024304-77.dat	upx
behavioral1/files/0x0007000000024308-72.dat	upx
behavioral1/files/0x00070000000242ff-71.dat	upx
behavioral1/memory/2184-68-0x00007FF67E450000-0x00007FF67E7A4000-memory.dmp	upx
behavioral1/files/0x0007000000024301-62.dat	upx
behavioral1/memory/2200-61-0x00007FF7689C0000-0x00007FF768D14000-memory.dmp	upx
behavioral1/files/0x0007000000024307-60.dat	upx
behavioral1/files/0x0007000000024305-58.dat	upx
behavioral1/files/0x00070000000242fe-55.dat	upx
behavioral1/memory/1880-38-0x00007FF61B0E0000-0x00007FF61B434000-memory.dmp	upx
behavioral1/files/0x00070000000242fc-29.dat	upx
behavioral1/memory/2936-128-0x00007FF6ECC10000-0x00007FF6ECF64000-memory.dmp	upx
behavioral1/memory/4316-129-0x00007FF64E200000-0x00007FF64E554000-memory.dmp	upx
behavioral1/memory/1880-130-0x00007FF61B0E0000-0x00007FF61B434000-memory.dmp	upx
behavioral1/memory/2060-132-0x00007FF6B4810000-0x00007FF6B4B64000-memory.dmp	upx
behavioral1/memory/2200-131-0x00007FF7689C0000-0x00007FF768D14000-memory.dmp	upx
behavioral1/memory/2364-133-0x00007FF6F4380000-0x00007FF6F46D4000-memory.dmp	upx
behavioral1/memory/1168-134-0x00007FF6F0E40000-0x00007FF6F1194000-memory.dmp	upx
behavioral1/memory/3976-136-0x00007FF706F30000-0x00007FF707284000-memory.dmp	upx
behavioral1/memory/4136-139-0x00007FF698A40000-0x00007FF698D94000-memory.dmp	upx
behavioral1/memory/2996-142-0x00007FF629050000-0x00007FF6293A4000-memory.dmp	upx
behavioral1/memory/1120-141-0x00007FF7C4400000-0x00007FF7C4754000-memory.dmp	upx
behavioral1/memory/1696-140-0x00007FF7C2F60000-0x00007FF7C32B4000-memory.dmp	upx
behavioral1/memory/4720-138-0x00007FF62B7A0000-0x00007FF62BAF4000-memory.dmp	upx
behavioral1/memory/4492-137-0x00007FF78AE60000-0x00007FF78B1B4000-memory.dmp	upx
behavioral1/memory/4948-135-0x00007FF781960000-0x00007FF781CB4000-memory.dmp	upx
behavioral1/memory/2852-143-0x00007FF6BA3E0000-0x00007FF6BA734000-memory.dmp	upx
behavioral1/memory/4316-144-0x00007FF64E200000-0x00007FF64E554000-memory.dmp	upx
behavioral1/memory/1880-145-0x00007FF61B0E0000-0x00007FF61B434000-memory.dmp	upx
behavioral1/memory/2200-151-0x00007FF7689C0000-0x00007FF768D14000-memory.dmp	upx
behavioral1/memory/4272-152-0x00007FF6E4590000-0x00007FF6E48E4000-memory.dmp	upx
behavioral1/memory/2184-150-0x00007FF67E450000-0x00007FF67E7A4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\KUwCDYr.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\boIfSAv.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\UJBpXvI.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\Ckuqiir.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\DaXVVbF.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\qHtwukV.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\gSkqLXY.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\GSgNQZe.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\CHJKrVQ.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\NtLIYPj.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\OVRQqnh.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\PpvojWQ.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\muWwwDw.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\csHfdPQ.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\CjiFORn.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\wPmDKqz.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\OnZfbBi.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\sSWPsgS.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\rkPPQgQ.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\smBaQiU.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\rUNNILV.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 4316	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	87
PID 2936 wrote to memory of 1880	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	88
PID 2936 wrote to memory of 2200	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	89
PID 2936 wrote to memory of 2184	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 2936 wrote to memory of 3504	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 2936 wrote to memory of 4512	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 2936 wrote to memory of 1916	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 2936 wrote to memory of 2060	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 2936 wrote to memory of 2364	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 2936 wrote to memory of 4272	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 2936 wrote to memory of 1168	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 2936 wrote to memory of 4948	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 2936 wrote to memory of 3976	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 2936 wrote to memory of 4416	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 2936 wrote to memory of 4492	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 2936 wrote to memory of 4720	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 2936 wrote to memory of 4136	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 2936 wrote to memory of 1696	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 2936 wrote to memory of 1120	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 2936 wrote to memory of 2852	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 2936 wrote to memory of 2996	2936	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\System\rkPPQgQ.exe
  C:\Windows\System\rkPPQgQ.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\Ckuqiir.exe
  C:\Windows\System\Ckuqiir.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\smBaQiU.exe
  C:\Windows\System\smBaQiU.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\rUNNILV.exe
  C:\Windows\System\rUNNILV.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\csHfdPQ.exe
  C:\Windows\System\csHfdPQ.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\CjiFORn.exe
  C:\Windows\System\CjiFORn.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\KUwCDYr.exe
  C:\Windows\System\KUwCDYr.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\CHJKrVQ.exe
  C:\Windows\System\CHJKrVQ.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\DaXVVbF.exe
  C:\Windows\System\DaXVVbF.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\qHtwukV.exe
  C:\Windows\System\qHtwukV.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\NtLIYPj.exe
  C:\Windows\System\NtLIYPj.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\gSkqLXY.exe
  C:\Windows\System\gSkqLXY.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\wPmDKqz.exe
  C:\Windows\System\wPmDKqz.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\boIfSAv.exe
  C:\Windows\System\boIfSAv.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\OVRQqnh.exe
  C:\Windows\System\OVRQqnh.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\OnZfbBi.exe
  C:\Windows\System\OnZfbBi.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\sSWPsgS.exe
  C:\Windows\System\sSWPsgS.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\PpvojWQ.exe
  C:\Windows\System\PpvojWQ.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\muWwwDw.exe
  C:\Windows\System\muWwwDw.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\UJBpXvI.exe
  C:\Windows\System\UJBpXvI.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\GSgNQZe.exe
  C:\Windows\System\GSgNQZe.exe
  2⤵
  - Executes dropped EXE
  PID:2996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CHJKrVQ.exe

Path C:\Windows\System\CHJKrVQ.exe
Size 5.9MB
SHA256 a189f18dbfe39b93ba45693339c8ece5f015b95b43b5b2e4949a50b0d5065718
MD5 d16f90961dd03681a5dc00c3222b9726
SHA1 4e38b295fdc21ef1dfcfd9775f8950fbc14bcc23
SHA512 180849bc6f6f45bd04b243e890c36fae18fe31150140c693afe9c929c8002dfc8894ccc3345469347b3590233a3a543baf55e8a1f6b2fd9d30b1056b15113c2b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
TLSH
T1C3565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CjiFORn.exe

Path C:\Windows\System\CjiFORn.exe
Size 5.9MB
SHA256 1f6f0c9b8d29b5dbe0821ee2415aad33d263c01ad53f5e03e6f4ffdecffa7ddb
MD5 83b7b95ab3d6818b85f6cadbb8d906e9
SHA1 b29bb71fc31642275f3de0e5cbb8f424b2d9d413
SHA512 33129b578f2e9aeba9db458c76703a135e87ca54c1316d43e1797a6ce8d054d08c124a1adf414f8bffd0f4c2da447051657e2f8484cf56171a329f933f5c5b4b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
TLSH
T155565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ckuqiir.exe

Path C:\Windows\System\Ckuqiir.exe
Size 5.9MB
SHA256 3d01957da49f7f234093ac393c2f0fb928abb454745249a5029b81eecc7bb8f9
MD5 3d5d6195b9625a7fb143c98966453174
SHA1 3ac5ab47e6a6598fa9fbdf096262ed81c3158111
SHA512 985d92ee97d3cd35924731f31e131fd292ae228b1415aed37ab7aff1109cc4d918372c25b2cbbb22a73b92c0c7161a54fd387cd86ad555214bc87b05a946d0d6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
TLSH
T172565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DaXVVbF.exe

Path C:\Windows\System\DaXVVbF.exe
Size 5.9MB
SHA256 3ec2d509349af08c48872416ee8dc2ff36dbac6056ed45e2389f06acd66e0210
MD5 54a27fc9309450cb59d7368d553a2b73
SHA1 521c1bb6df637e8239a2aa4f9e8a42974ec4bdcc
SHA512 d3a60b896021eb992412f1b683236dfacde074cc7f31d0cb4931f472d1dfd561b9fa75d5b7a3351fb97301530268d4261381a780d339ba3b474a1dae0d2c2b5a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
TLSH
T155565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GSgNQZe.exe

Path C:\Windows\System\GSgNQZe.exe
Size 5.9MB
SHA256 8e5c7d2bde703a8b2e5f4ee022cb1b66522f6006e8260ff86dc23992a5c2a7c3
MD5 8d936fabc2c5ffeb1a67c80e707a3d2f
SHA1 39689fe2b2f5700d2d41ca2815175a655b0f4077
SHA512 3714e0939e8c54f890e2ec7f6ad58a09e2218f1cbfecf683cfd5c06da6bd9ea2eed512fd01105d9204a660f45267989d168170df7c8f16fcd0759c9c42fc96f9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
TLSH
T19E565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KUwCDYr.exe

Path C:\Windows\System\KUwCDYr.exe
Size 5.9MB
SHA256 8cea4953a6da05bd98fdabd55980822ff1eb3c91115cd04fbc63bff419e85acf
MD5 15009990951300d0d131f2d9794cd016
SHA1 e4b1c49b0d03832776db055e41487b840c7bafd8
SHA512 1ba046d1da5d422d075221a1bfa03702db15903e38d0998d0a6cd8b94481f61d67be96f77d9eaab57fcd987632e40082b00b3ca465240082a71d5e4f63756def
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
TLSH
T153565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NtLIYPj.exe

Path C:\Windows\System\NtLIYPj.exe
Size 5.9MB
SHA256 2a67bf2da0ffab4500b7c45316c1d61355f3736e69bbf390520547434961c2e8
MD5 5fa1a06903e9d0b791edefd57ef7c822
SHA1 92c761bf90e4628409995c88115c079fab9420d0
SHA512 61130326dd73ca70b007479965d27764cfe282c426fb867b4fe3dd03d5d378eafe2d95fa23c702e568f19675c2d1db993113a30d94dd513f737cfaa5eea513e9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
TLSH
T14D565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OVRQqnh.exe

Path C:\Windows\System\OVRQqnh.exe
Size 5.9MB
SHA256 5227057515a54eb950955038d503e78fc86ae5d477b33f01c2aea5d3abd87f67
MD5 f13a9899423f683cb691e3ee84122df7
SHA1 05152beae2de1b326c630f15a6a4fb1ba38d8419
SHA512 fdeb3db7612e4d5eb1f7cae3026c7563cea581d28f0f1a372a0118c031dc7bf9a4c0e0dcb85c08bff294a77af41e975a0944a0c422ee1a1a5d8a0a639b2d95a9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
TLSH
T140565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OnZfbBi.exe

Path C:\Windows\System\OnZfbBi.exe
Size 5.9MB
SHA256 2831c44498d0a12aab8c0e5c426f81d4039f515540a50339acb1b31410c16078
MD5 7d8967f4c2492b6c3aedd17c10434247
SHA1 d361f8a6cfbcb34ae100046329d78dcdeee6bb8a
SHA512 aa44150a6669a3dfe6c100a3da2d6112924ed5fd72f0c8cf9cbd9330bac9b3dc97732532fefba70762c730c3013890ae9cfde7c7bbad08d0f0a58290cbd864b0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
TLSH
T1D9565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PpvojWQ.exe

Path C:\Windows\System\PpvojWQ.exe
Size 5.9MB
SHA256 1e23bff61011f1a37da57d31b76fc8770d64eaaa02b1834b88efe3c207566ba1
MD5 0990dd3cb131864f928bba8df2516892
SHA1 828f46ba08a6178ca5a3b1bfccd852a3fa62a139
SHA512 ce2d268ebe945fb2d94b6c78eeb450df6dce16abe52eeef4e4503114983bfe70a68a2c484cce90d91806c0669757ad2159b231b35e7dc7e1b0331048002eb304
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
TLSH
T14D565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UJBpXvI.exe

Path C:\Windows\System\UJBpXvI.exe
Size 5.9MB
SHA256 ccc6dfee0ee52c9faa9e94e71ee577e428e27a122dda9b8a01efa02366ee7027
MD5 a0ff4640b2ea0b6dd2263719c665202c
SHA1 c71ec67e2d3ad751bc711e0fc7ecfe82ff99c67e
SHA512 eb966099c8110e7de692718e24533e8f8340726c4857018ce670e63fb9d2b0ecc8bad1ebed69984452c4c1b1cae30695668a6ad4a506ec1c59c511cda1f7d89a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:Q+856utgpPF8u/7g
TLSH
T127565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boIfSAv.exe

Path C:\Windows\System\boIfSAv.exe
Size 5.9MB
SHA256 337b9f42435bf9fb69abc9415c9d16d825914b419618c79afb24ec739c6ecfe2
MD5 b5915bad179a22fd0483cacec592712b
SHA1 0f7b40b0628993f9ce95d81eefe5e945302d5105
SHA512 e58bd3dfb42f3e8a663a02d75934626f3653bf2056b01901cd86cc8ebf0baaddbfae035ff48117fce217ca58e771c93bda0ffb3511ca5fdf17ebdef1351816f6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
TLSH
T166565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csHfdPQ.exe

Path C:\Windows\System\csHfdPQ.exe
Size 5.9MB
SHA256 43465eca042520015a27eb917b904bf59ac0c689cac593374dcd4ed2df511b20
MD5 4b3f0184d5ce7f095720c2ad8a8d7acb
SHA1 d4d665ea0fc6f9119a47ba941685fb355ad67de5
SHA512 8fdc294d22663c000b32dc0bdc5e50bb6553ae5be649e675c4c735b6477d5ef619387375d28dc6bee625cc5a6984cc70c50e267da6d3b05d5c06c4ccc0277e1a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
TLSH
T151565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gSkqLXY.exe

Path C:\Windows\System\gSkqLXY.exe
Size 5.9MB
SHA256 3cab6a8218ce42da3dd1e42557f54dd39b5fd0b43f71bfa21104819f96a1e468
MD5 8b706d0b072a1c2f07bfcc7f1668d8df
SHA1 394deb5a0fdc73458f71a8ef236d9ecb23d656fe
SHA512 5a4f8b7e1374da9016f786753e502ba84e27b774d554aaebb7b49bd85079691d03b1f38b8988a905deaa4dd725204ff599b87d1f5a89c1750164c5f56c60d08d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:Q+856utgpPF8u/7d
TLSH
T1A3565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

muWwwDw.exe

Path C:\Windows\System\muWwwDw.exe
Size 5.9MB
SHA256 39319c31cd764816dbd466b3782efc930cc4a1c9b103001dbe8f1824dbc93ef3
MD5 d55fdd94b25c19ed270fc2eb9439efe8
SHA1 e21df392a792744270b9b63e120352246c08cc17
SHA512 5b4a7fe6e529db16128a000a64672408e721da987f0eb4bb4ce5ba529c9d1513f907065976a68081edf8841913f93c45b8d12055910e0b6264baff9e5910403c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
TLSH
T156565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qHtwukV.exe

Path C:\Windows\System\qHtwukV.exe
Size 5.9MB
SHA256 d664ddd24953a462efc316271709c7b08761665f488879b7256148b7771832e5
MD5 a76987d2e943bdd87932e404dcd140e5
SHA1 5c3be0a59b9ec3ceeff2ab98453112ff74969b35
SHA512 3efd054fc9ab3ae6d989debb8e5fe0bc2a4eecff1fc60a377978df27ace63beea814985c5b0b8ff4d1c202d709bf401e672875dbe597a9c57f5c03fdddfb4267
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
TLSH
T101565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rUNNILV.exe

Path C:\Windows\System\rUNNILV.exe
Size 5.9MB
SHA256 733d0cb8398e0fd34734a84b6c45db39d2c5d9fb75dde279d3cf6fe6487a09bf
MD5 573c621a2203ff41ac97d8ef7c0c61fb
SHA1 e2d5845d6bf2aa99785cafac1163c661531a158e
SHA512 6e974ad0d8483e7b3c2b387e2157f5481a3f45de9ad1f2bbfc87838217cc156e05b526486c3712b3eb2e3553566d043bb6a55565e7cb2ce563f76d205531cbce
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
TLSH
T182565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rkPPQgQ.exe

Path C:\Windows\System\rkPPQgQ.exe
Size 5.9MB
SHA256 379dc7cd00552fbd33f0518932bb5e1421488364242bccec2632a3e4a312c417
MD5 28bff0c196f3a1d4714430037604dc80
SHA1 2c5387d33e98ae2096774b658c10366382e0a94e
SHA512 6a0ac72f5745eb1ac73b4ad061d9df80b7aa9a1ae60d6269b33fe1a1c192dbd96944ad03291b9ec165ad47cb8b5fd71dd83022990d89f104a8e2adfc43814c75
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
TLSH
T1F8565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sSWPsgS.exe

Path C:\Windows\System\sSWPsgS.exe
Size 5.9MB
SHA256 b4a957a4d02331231ce4b1e44def1f54ba50b7554f06c3185ffc9edd2933ba90
MD5 28c0deb561bffcb8282b316405db04b4
SHA1 6a53785c130d63d8268b3ad228f60f21a07d99b4
SHA512 b8fcc62e09b3c6b28bfd2ce989968cd28ae9b050ecc0e8d56ee7a67ffddc564562d9834dde792faef87f02c61a06b81b97fc872470c3f6f4ef1e327a27fb90d2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
TLSH
T17A565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smBaQiU.exe

Path C:\Windows\System\smBaQiU.exe
Size 5.9MB
SHA256 ac380be5ca38733d0f30f98e6ffd43fe7aa4f00629ff9756fa6600d02b73140e
MD5 cb7528674d3d32474cc9e92b7ed93a73
SHA1 cd6e56ba57fe42048881d1d0edde79f986657453
SHA512 5e024a9acda6ef878e3372ac94c356963126f1ffb88fc5f2d8e42b5ec988f5e0d93a81bc94aa5b07eabe95d6399e7bebfe3cf8070a8b4cccbd421dc18214a2e3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
TLSH
T13F565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wPmDKqz.exe

Path C:\Windows\System\wPmDKqz.exe
Size 5.9MB
SHA256 9e0efc11d0e0e1f052eea8886a19b6eba7fcd526b725ce773e37d6c754e8931c
MD5 e37cfed2d43c096f4ed04f5a5c37acb0
SHA1 373d6e19b502a4c756dbe4658188c60f8aa78978
SHA512 cbf62ce3026741d98f495699144693736c4ac2a0045a5a1c5ac9589d1f61c8aa660f2b27c8e10f0805b51e7e0689f035bf75b401bad97caf1253bd6ba082d3b6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
TLSH
T100565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1120-100-0x00007FF7C4400000-0x00007FF7C4754000-memory.dmp

Download

memory/1120-141-0x00007FF7C4400000-0x00007FF7C4754000-memory.dmp

Download

memory/1120-159-0x00007FF7C4400000-0x00007FF7C4754000-memory.dmp

Download

memory/1168-134-0x00007FF6F0E40000-0x00007FF6F1194000-memory.dmp

Download

memory/1168-163-0x00007FF6F0E40000-0x00007FF6F1194000-memory.dmp

Download

memory/1168-93-0x00007FF6F0E40000-0x00007FF6F1194000-memory.dmp

Download

memory/1696-155-0x00007FF7C2F60000-0x00007FF7C32B4000-memory.dmp

Download

memory/1696-99-0x00007FF7C2F60000-0x00007FF7C32B4000-memory.dmp

Download

memory/1696-140-0x00007FF7C2F60000-0x00007FF7C32B4000-memory.dmp

Download

memory/1880-145-0x00007FF61B0E0000-0x00007FF61B434000-memory.dmp

Download

memory/1880-130-0x00007FF61B0E0000-0x00007FF61B434000-memory.dmp

Download

memory/1880-38-0x00007FF61B0E0000-0x00007FF61B434000-memory.dmp

Download

memory/1916-103-0x00007FF630160000-0x00007FF6304B4000-memory.dmp

Download

memory/1916-148-0x00007FF630160000-0x00007FF6304B4000-memory.dmp

Download

memory/2060-90-0x00007FF6B4810000-0x00007FF6B4B64000-memory.dmp

Download

memory/2060-157-0x00007FF6B4810000-0x00007FF6B4B64000-memory.dmp

Download

memory/2060-132-0x00007FF6B4810000-0x00007FF6B4B64000-memory.dmp

Download

memory/2184-68-0x00007FF67E450000-0x00007FF67E7A4000-memory.dmp

Download

memory/2184-150-0x00007FF67E450000-0x00007FF67E7A4000-memory.dmp

Download

memory/2200-151-0x00007FF7689C0000-0x00007FF768D14000-memory.dmp

Download

memory/2200-61-0x00007FF7689C0000-0x00007FF768D14000-memory.dmp

Download

memory/2200-131-0x00007FF7689C0000-0x00007FF768D14000-memory.dmp

Download

memory/2364-153-0x00007FF6F4380000-0x00007FF6F46D4000-memory.dmp

Download

memory/2364-91-0x00007FF6F4380000-0x00007FF6F46D4000-memory.dmp

Download

memory/2364-133-0x00007FF6F4380000-0x00007FF6F46D4000-memory.dmp

Download

memory/2852-143-0x00007FF6BA3E0000-0x00007FF6BA734000-memory.dmp

Download

memory/2852-105-0x00007FF6BA3E0000-0x00007FF6BA734000-memory.dmp

Download

memory/2852-158-0x00007FF6BA3E0000-0x00007FF6BA734000-memory.dmp

Download

memory/2936-128-0x00007FF6ECC10000-0x00007FF6ECF64000-memory.dmp

Download

memory/2936-0-0x00007FF6ECC10000-0x00007FF6ECF64000-memory.dmp

Download

memory/2936-1-0x0000020E99870000-0x0000020E99880000-memory.dmp

Download

memory/2996-142-0x00007FF629050000-0x00007FF6293A4000-memory.dmp

Download

memory/2996-101-0x00007FF629050000-0x00007FF6293A4000-memory.dmp

Download

memory/2996-161-0x00007FF629050000-0x00007FF6293A4000-memory.dmp

Download

memory/3504-102-0x00007FF6DEDE0000-0x00007FF6DF134000-memory.dmp

Download

memory/3504-147-0x00007FF6DEDE0000-0x00007FF6DF134000-memory.dmp

Download

memory/3976-95-0x00007FF706F30000-0x00007FF707284000-memory.dmp

Download

memory/3976-136-0x00007FF706F30000-0x00007FF707284000-memory.dmp

Download

memory/3976-156-0x00007FF706F30000-0x00007FF707284000-memory.dmp

Download

memory/4136-98-0x00007FF698A40000-0x00007FF698D94000-memory.dmp

Download

memory/4136-154-0x00007FF698A40000-0x00007FF698D94000-memory.dmp

Download

memory/4136-139-0x00007FF698A40000-0x00007FF698D94000-memory.dmp

Download

memory/4272-152-0x00007FF6E4590000-0x00007FF6E48E4000-memory.dmp

Download

memory/4272-92-0x00007FF6E4590000-0x00007FF6E48E4000-memory.dmp

Download

memory/4316-129-0x00007FF64E200000-0x00007FF64E554000-memory.dmp

Download

memory/4316-144-0x00007FF64E200000-0x00007FF64E554000-memory.dmp

Download

memory/4316-10-0x00007FF64E200000-0x00007FF64E554000-memory.dmp

Download

memory/4416-104-0x00007FF71ACD0000-0x00007FF71B024000-memory.dmp

Download

memory/4416-146-0x00007FF71ACD0000-0x00007FF71B024000-memory.dmp

Download

memory/4492-137-0x00007FF78AE60000-0x00007FF78B1B4000-memory.dmp

Download

memory/4492-96-0x00007FF78AE60000-0x00007FF78B1B4000-memory.dmp

Download

memory/4492-164-0x00007FF78AE60000-0x00007FF78B1B4000-memory.dmp

Download

memory/4512-149-0x00007FF61B4F0000-0x00007FF61B844000-memory.dmp

Download

memory/4512-85-0x00007FF61B4F0000-0x00007FF61B844000-memory.dmp

Download

memory/4720-97-0x00007FF62B7A0000-0x00007FF62BAF4000-memory.dmp

Download

memory/4720-162-0x00007FF62B7A0000-0x00007FF62BAF4000-memory.dmp

Download

memory/4720-138-0x00007FF62B7A0000-0x00007FF62BAF4000-memory.dmp

Download

memory/4948-94-0x00007FF781960000-0x00007FF781CB4000-memory.dmp

Download

memory/4948-135-0x00007FF781960000-0x00007FF781CB4000-memory.dmp

Download

memory/4948-160-0x00007FF781960000-0x00007FF781CB4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads