cobaltstrike | edfa95e7d5b20d7ec5af9ce8fa55ea8e49fdd4fcd01752692f1e11037cff7128

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 5.9MB
Sample260903-171rlsgl21
SHA256 edfa95e7d5b20d7ec5af9ce8fa55ea8e49fdd4fcd01752692f1e11037cff7128
MD5 cf30e18e23d3b67e818891c392be84ec
SHA1 62ee10f36235cf72454155324e86955c8260dac4
SHA512 e7b62be9efa9b21baa99cd169a3547188282d8da07b3e77c8b68c30debfb07432a97cd5223f909e3f6c0b86efe15d4adffd1ae484c9f4fe14ddaf41b20854929
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
TLSH
T132565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x002100000001c41b-5.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c570-11.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c56f-13.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c572-23.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c56c-29.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c573-35.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c574-41.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c575-45.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c576-50.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c577-56.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c579-61.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c57a-66.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c57b-70.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c57c-74.dat	cobalt_reflective_dll
behavioral2/files/0x0004000000000414-81.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c57e-85.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c57f-90.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c580-95.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c581-101.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c584-106.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c585-110.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x002100000001c41b-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c570-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c56f-13.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c572-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c56c-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c573-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c574-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c575-45.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c576-50.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c577-56.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c579-61.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c57a-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c57b-70.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c57c-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0004000000000414-81.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c57e-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c57f-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c580-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c581-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c584-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c585-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/5700-0-0x00007FF7BA4A0000-0x00007FF7BA7F4000-memory.dmp	UPX
behavioral2/files/0x002100000001c41b-5.dat	UPX
behavioral2/memory/5976-8-0x00007FF61D270000-0x00007FF61D5C4000-memory.dmp	UPX
behavioral2/files/0x000c00000001c570-11.dat	UPX
behavioral2/files/0x000c00000001c56f-13.dat	UPX
behavioral2/memory/4472-12-0x00007FF7643E0000-0x00007FF764734000-memory.dmp	UPX
behavioral2/memory/2644-18-0x00007FF645B40000-0x00007FF645E94000-memory.dmp	UPX
behavioral2/files/0x000c00000001c572-23.dat	UPX
behavioral2/memory/3864-26-0x00007FF7367D0000-0x00007FF736B24000-memory.dmp	UPX
behavioral2/files/0x000d00000001c56c-29.dat	UPX
behavioral2/memory/3036-30-0x00007FF6F2910000-0x00007FF6F2C64000-memory.dmp	UPX
behavioral2/files/0x000c00000001c573-35.dat	UPX
behavioral2/files/0x000c00000001c574-41.dat	UPX
behavioral2/files/0x000c00000001c575-45.dat	UPX
behavioral2/files/0x000c00000001c576-50.dat	UPX
behavioral2/files/0x000c00000001c577-56.dat	UPX
behavioral2/files/0x000c00000001c579-61.dat	UPX
behavioral2/files/0x000c00000001c57a-66.dat	UPX
behavioral2/files/0x000c00000001c57b-70.dat	UPX
behavioral2/files/0x000c00000001c57c-74.dat	UPX
behavioral2/files/0x0004000000000414-81.dat	UPX
behavioral2/files/0x000c00000001c57e-85.dat	UPX
behavioral2/files/0x000c00000001c57f-90.dat	UPX
behavioral2/files/0x000c00000001c580-95.dat	UPX
behavioral2/files/0x000c00000001c581-101.dat	UPX
behavioral2/files/0x000c00000001c584-106.dat	UPX
behavioral2/files/0x000c00000001c585-110.dat	UPX
behavioral2/memory/6048-112-0x00007FF713790000-0x00007FF713AE4000-memory.dmp	UPX
behavioral2/memory/3544-114-0x00007FF6A8660000-0x00007FF6A89B4000-memory.dmp	UPX
behavioral2/memory/4940-115-0x00007FF762950000-0x00007FF762CA4000-memory.dmp	UPX
behavioral2/memory/4648-113-0x00007FF70C020000-0x00007FF70C374000-memory.dmp	UPX
behavioral2/memory/4092-117-0x00007FF6620E0000-0x00007FF662434000-memory.dmp	UPX
behavioral2/memory/5848-119-0x00007FF7B0EB0000-0x00007FF7B1204000-memory.dmp	UPX
behavioral2/memory/3752-118-0x00007FF70E510000-0x00007FF70E864000-memory.dmp	UPX
behavioral2/memory/5196-116-0x00007FF658BF0000-0x00007FF658F44000-memory.dmp	UPX
behavioral2/memory/6080-120-0x00007FF6D97E0000-0x00007FF6D9B34000-memory.dmp	UPX
behavioral2/memory/4756-122-0x00007FF715250000-0x00007FF7155A4000-memory.dmp	UPX
behavioral2/memory/4204-123-0x00007FF668B40000-0x00007FF668E94000-memory.dmp	UPX
behavioral2/memory/2444-125-0x00007FF7BC420000-0x00007FF7BC774000-memory.dmp	UPX
behavioral2/memory/2820-127-0x00007FF7700A0000-0x00007FF7703F4000-memory.dmp	UPX
behavioral2/memory/1092-126-0x00007FF60A0B0000-0x00007FF60A404000-memory.dmp	UPX
behavioral2/memory/3424-124-0x00007FF64EA50000-0x00007FF64EDA4000-memory.dmp	UPX
behavioral2/memory/4952-121-0x00007FF6B7960000-0x00007FF6B7CB4000-memory.dmp	UPX
behavioral2/memory/5700-128-0x00007FF7BA4A0000-0x00007FF7BA7F4000-memory.dmp	UPX
behavioral2/memory/4472-129-0x00007FF7643E0000-0x00007FF764734000-memory.dmp	UPX
behavioral2/memory/2644-130-0x00007FF645B40000-0x00007FF645E94000-memory.dmp	UPX
behavioral2/memory/3864-131-0x00007FF7367D0000-0x00007FF736B24000-memory.dmp	UPX
behavioral2/memory/3036-132-0x00007FF6F2910000-0x00007FF6F2C64000-memory.dmp	UPX
behavioral2/memory/6048-133-0x00007FF713790000-0x00007FF713AE4000-memory.dmp	UPX
behavioral2/memory/5976-134-0x00007FF61D270000-0x00007FF61D5C4000-memory.dmp	UPX
behavioral2/memory/4472-135-0x00007FF7643E0000-0x00007FF764734000-memory.dmp	UPX
behavioral2/memory/2644-136-0x00007FF645B40000-0x00007FF645E94000-memory.dmp	UPX
behavioral2/memory/3864-137-0x00007FF7367D0000-0x00007FF736B24000-memory.dmp	UPX
behavioral2/memory/3036-138-0x00007FF6F2910000-0x00007FF6F2C64000-memory.dmp	UPX
behavioral2/memory/6048-139-0x00007FF713790000-0x00007FF713AE4000-memory.dmp	UPX
behavioral2/memory/2820-140-0x00007FF7700A0000-0x00007FF7703F4000-memory.dmp	UPX
behavioral2/memory/4648-141-0x00007FF70C020000-0x00007FF70C374000-memory.dmp	UPX
behavioral2/memory/3544-142-0x00007FF6A8660000-0x00007FF6A89B4000-memory.dmp	UPX
behavioral2/memory/4940-143-0x00007FF762950000-0x00007FF762CA4000-memory.dmp	UPX
behavioral2/memory/4092-145-0x00007FF6620E0000-0x00007FF662434000-memory.dmp	UPX
behavioral2/memory/5196-144-0x00007FF658BF0000-0x00007FF658F44000-memory.dmp	UPX
behavioral2/memory/5848-146-0x00007FF7B0EB0000-0x00007FF7B1204000-memory.dmp	UPX
behavioral2/memory/6080-147-0x00007FF6D97E0000-0x00007FF6D9B34000-memory.dmp	UPX
behavioral2/memory/3752-148-0x00007FF70E510000-0x00007FF70E864000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/5700-0-0x00007FF7BA4A0000-0x00007FF7BA7F4000-memory.dmp	xmrig
behavioral2/files/0x002100000001c41b-5.dat	xmrig
behavioral2/memory/5976-8-0x00007FF61D270000-0x00007FF61D5C4000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c570-11.dat	xmrig
behavioral2/files/0x000c00000001c56f-13.dat	xmrig
behavioral2/memory/4472-12-0x00007FF7643E0000-0x00007FF764734000-memory.dmp	xmrig
behavioral2/memory/2644-18-0x00007FF645B40000-0x00007FF645E94000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c572-23.dat	xmrig
behavioral2/memory/3864-26-0x00007FF7367D0000-0x00007FF736B24000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c56c-29.dat	xmrig
behavioral2/memory/3036-30-0x00007FF6F2910000-0x00007FF6F2C64000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c573-35.dat	xmrig
behavioral2/files/0x000c00000001c574-41.dat	xmrig
behavioral2/files/0x000c00000001c575-45.dat	xmrig
behavioral2/files/0x000c00000001c576-50.dat	xmrig
behavioral2/files/0x000c00000001c577-56.dat	xmrig
behavioral2/files/0x000c00000001c579-61.dat	xmrig
behavioral2/files/0x000c00000001c57a-66.dat	xmrig
behavioral2/files/0x000c00000001c57b-70.dat	xmrig
behavioral2/files/0x000c00000001c57c-74.dat	xmrig
behavioral2/files/0x0004000000000414-81.dat	xmrig
behavioral2/files/0x000c00000001c57e-85.dat	xmrig
behavioral2/files/0x000c00000001c57f-90.dat	xmrig
behavioral2/files/0x000c00000001c580-95.dat	xmrig
behavioral2/files/0x000c00000001c581-101.dat	xmrig
behavioral2/files/0x000c00000001c584-106.dat	xmrig
behavioral2/files/0x000c00000001c585-110.dat	xmrig
behavioral2/memory/6048-112-0x00007FF713790000-0x00007FF713AE4000-memory.dmp	xmrig
behavioral2/memory/3544-114-0x00007FF6A8660000-0x00007FF6A89B4000-memory.dmp	xmrig
behavioral2/memory/4940-115-0x00007FF762950000-0x00007FF762CA4000-memory.dmp	xmrig
behavioral2/memory/4648-113-0x00007FF70C020000-0x00007FF70C374000-memory.dmp	xmrig
behavioral2/memory/4092-117-0x00007FF6620E0000-0x00007FF662434000-memory.dmp	xmrig
behavioral2/memory/5848-119-0x00007FF7B0EB0000-0x00007FF7B1204000-memory.dmp	xmrig
behavioral2/memory/3752-118-0x00007FF70E510000-0x00007FF70E864000-memory.dmp	xmrig
behavioral2/memory/5196-116-0x00007FF658BF0000-0x00007FF658F44000-memory.dmp	xmrig
behavioral2/memory/6080-120-0x00007FF6D97E0000-0x00007FF6D9B34000-memory.dmp	xmrig
behavioral2/memory/4756-122-0x00007FF715250000-0x00007FF7155A4000-memory.dmp	xmrig
behavioral2/memory/4204-123-0x00007FF668B40000-0x00007FF668E94000-memory.dmp	xmrig
behavioral2/memory/2444-125-0x00007FF7BC420000-0x00007FF7BC774000-memory.dmp	xmrig
behavioral2/memory/2820-127-0x00007FF7700A0000-0x00007FF7703F4000-memory.dmp	xmrig
behavioral2/memory/1092-126-0x00007FF60A0B0000-0x00007FF60A404000-memory.dmp	xmrig
behavioral2/memory/3424-124-0x00007FF64EA50000-0x00007FF64EDA4000-memory.dmp	xmrig
behavioral2/memory/4952-121-0x00007FF6B7960000-0x00007FF6B7CB4000-memory.dmp	xmrig
behavioral2/memory/5700-128-0x00007FF7BA4A0000-0x00007FF7BA7F4000-memory.dmp	xmrig
behavioral2/memory/4472-129-0x00007FF7643E0000-0x00007FF764734000-memory.dmp	xmrig
behavioral2/memory/2644-130-0x00007FF645B40000-0x00007FF645E94000-memory.dmp	xmrig
behavioral2/memory/3864-131-0x00007FF7367D0000-0x00007FF736B24000-memory.dmp	xmrig
behavioral2/memory/3036-132-0x00007FF6F2910000-0x00007FF6F2C64000-memory.dmp	xmrig
behavioral2/memory/6048-133-0x00007FF713790000-0x00007FF713AE4000-memory.dmp	xmrig
behavioral2/memory/5976-134-0x00007FF61D270000-0x00007FF61D5C4000-memory.dmp	xmrig
behavioral2/memory/4472-135-0x00007FF7643E0000-0x00007FF764734000-memory.dmp	xmrig
behavioral2/memory/2644-136-0x00007FF645B40000-0x00007FF645E94000-memory.dmp	xmrig
behavioral2/memory/3864-137-0x00007FF7367D0000-0x00007FF736B24000-memory.dmp	xmrig
behavioral2/memory/3036-138-0x00007FF6F2910000-0x00007FF6F2C64000-memory.dmp	xmrig
behavioral2/memory/6048-139-0x00007FF713790000-0x00007FF713AE4000-memory.dmp	xmrig
behavioral2/memory/2820-140-0x00007FF7700A0000-0x00007FF7703F4000-memory.dmp	xmrig
behavioral2/memory/4648-141-0x00007FF70C020000-0x00007FF70C374000-memory.dmp	xmrig
behavioral2/memory/3544-142-0x00007FF6A8660000-0x00007FF6A89B4000-memory.dmp	xmrig
behavioral2/memory/4940-143-0x00007FF762950000-0x00007FF762CA4000-memory.dmp	xmrig
behavioral2/memory/4092-145-0x00007FF6620E0000-0x00007FF662434000-memory.dmp	xmrig
behavioral2/memory/5196-144-0x00007FF658BF0000-0x00007FF658F44000-memory.dmp	xmrig
behavioral2/memory/5848-146-0x00007FF7B0EB0000-0x00007FF7B1204000-memory.dmp	xmrig
behavioral2/memory/6080-147-0x00007FF6D97E0000-0x00007FF6D9B34000-memory.dmp	xmrig
behavioral2/memory/3752-148-0x00007FF70E510000-0x00007FF70E864000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
5976	BhnNUIt.exe
4472	EkaypbS.exe
2644	lOvPIWe.exe
3864	acGATqm.exe
3036	hdyPpwI.exe
6048	QbVUMGX.exe
2820	oTgzflL.exe
4648	FlRGirk.exe
3544	BXGWOlD.exe
4940	prldVwE.exe
5196	jkDWmsU.exe
4092	glXFLNg.exe
3752	HormaGR.exe
5848	IMgTkqv.exe
6080	LFPBkXc.exe
4952	pWqzFva.exe
4756	qcvgNsI.exe
4204	GmbwIlp.exe
3424	BjOicPD.exe
2444	OWzbNlX.exe
1092	gzvWfyk.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5700-0-0x00007FF7BA4A0000-0x00007FF7BA7F4000-memory.dmp	upx
behavioral2/files/0x002100000001c41b-5.dat	upx
behavioral2/memory/5976-8-0x00007FF61D270000-0x00007FF61D5C4000-memory.dmp	upx
behavioral2/files/0x000c00000001c570-11.dat	upx
behavioral2/files/0x000c00000001c56f-13.dat	upx
behavioral2/memory/4472-12-0x00007FF7643E0000-0x00007FF764734000-memory.dmp	upx
behavioral2/memory/2644-18-0x00007FF645B40000-0x00007FF645E94000-memory.dmp	upx
behavioral2/files/0x000c00000001c572-23.dat	upx
behavioral2/memory/3864-26-0x00007FF7367D0000-0x00007FF736B24000-memory.dmp	upx
behavioral2/files/0x000d00000001c56c-29.dat	upx
behavioral2/memory/3036-30-0x00007FF6F2910000-0x00007FF6F2C64000-memory.dmp	upx
behavioral2/files/0x000c00000001c573-35.dat	upx
behavioral2/files/0x000c00000001c574-41.dat	upx
behavioral2/files/0x000c00000001c575-45.dat	upx
behavioral2/files/0x000c00000001c576-50.dat	upx
behavioral2/files/0x000c00000001c577-56.dat	upx
behavioral2/files/0x000c00000001c579-61.dat	upx
behavioral2/files/0x000c00000001c57a-66.dat	upx
behavioral2/files/0x000c00000001c57b-70.dat	upx
behavioral2/files/0x000c00000001c57c-74.dat	upx
behavioral2/files/0x0004000000000414-81.dat	upx
behavioral2/files/0x000c00000001c57e-85.dat	upx
behavioral2/files/0x000c00000001c57f-90.dat	upx
behavioral2/files/0x000c00000001c580-95.dat	upx
behavioral2/files/0x000c00000001c581-101.dat	upx
behavioral2/files/0x000c00000001c584-106.dat	upx
behavioral2/files/0x000c00000001c585-110.dat	upx
behavioral2/memory/6048-112-0x00007FF713790000-0x00007FF713AE4000-memory.dmp	upx
behavioral2/memory/3544-114-0x00007FF6A8660000-0x00007FF6A89B4000-memory.dmp	upx
behavioral2/memory/4940-115-0x00007FF762950000-0x00007FF762CA4000-memory.dmp	upx
behavioral2/memory/4648-113-0x00007FF70C020000-0x00007FF70C374000-memory.dmp	upx
behavioral2/memory/4092-117-0x00007FF6620E0000-0x00007FF662434000-memory.dmp	upx
behavioral2/memory/5848-119-0x00007FF7B0EB0000-0x00007FF7B1204000-memory.dmp	upx
behavioral2/memory/3752-118-0x00007FF70E510000-0x00007FF70E864000-memory.dmp	upx
behavioral2/memory/5196-116-0x00007FF658BF0000-0x00007FF658F44000-memory.dmp	upx
behavioral2/memory/6080-120-0x00007FF6D97E0000-0x00007FF6D9B34000-memory.dmp	upx
behavioral2/memory/4756-122-0x00007FF715250000-0x00007FF7155A4000-memory.dmp	upx
behavioral2/memory/4204-123-0x00007FF668B40000-0x00007FF668E94000-memory.dmp	upx
behavioral2/memory/2444-125-0x00007FF7BC420000-0x00007FF7BC774000-memory.dmp	upx
behavioral2/memory/2820-127-0x00007FF7700A0000-0x00007FF7703F4000-memory.dmp	upx
behavioral2/memory/1092-126-0x00007FF60A0B0000-0x00007FF60A404000-memory.dmp	upx
behavioral2/memory/3424-124-0x00007FF64EA50000-0x00007FF64EDA4000-memory.dmp	upx
behavioral2/memory/4952-121-0x00007FF6B7960000-0x00007FF6B7CB4000-memory.dmp	upx
behavioral2/memory/5700-128-0x00007FF7BA4A0000-0x00007FF7BA7F4000-memory.dmp	upx
behavioral2/memory/4472-129-0x00007FF7643E0000-0x00007FF764734000-memory.dmp	upx
behavioral2/memory/2644-130-0x00007FF645B40000-0x00007FF645E94000-memory.dmp	upx
behavioral2/memory/3864-131-0x00007FF7367D0000-0x00007FF736B24000-memory.dmp	upx
behavioral2/memory/3036-132-0x00007FF6F2910000-0x00007FF6F2C64000-memory.dmp	upx
behavioral2/memory/6048-133-0x00007FF713790000-0x00007FF713AE4000-memory.dmp	upx
behavioral2/memory/5976-134-0x00007FF61D270000-0x00007FF61D5C4000-memory.dmp	upx
behavioral2/memory/4472-135-0x00007FF7643E0000-0x00007FF764734000-memory.dmp	upx
behavioral2/memory/2644-136-0x00007FF645B40000-0x00007FF645E94000-memory.dmp	upx
behavioral2/memory/3864-137-0x00007FF7367D0000-0x00007FF736B24000-memory.dmp	upx
behavioral2/memory/3036-138-0x00007FF6F2910000-0x00007FF6F2C64000-memory.dmp	upx
behavioral2/memory/6048-139-0x00007FF713790000-0x00007FF713AE4000-memory.dmp	upx
behavioral2/memory/2820-140-0x00007FF7700A0000-0x00007FF7703F4000-memory.dmp	upx
behavioral2/memory/4648-141-0x00007FF70C020000-0x00007FF70C374000-memory.dmp	upx
behavioral2/memory/3544-142-0x00007FF6A8660000-0x00007FF6A89B4000-memory.dmp	upx
behavioral2/memory/4940-143-0x00007FF762950000-0x00007FF762CA4000-memory.dmp	upx
behavioral2/memory/4092-145-0x00007FF6620E0000-0x00007FF662434000-memory.dmp	upx
behavioral2/memory/5196-144-0x00007FF658BF0000-0x00007FF658F44000-memory.dmp	upx
behavioral2/memory/5848-146-0x00007FF7B0EB0000-0x00007FF7B1204000-memory.dmp	upx
behavioral2/memory/6080-147-0x00007FF6D97E0000-0x00007FF6D9B34000-memory.dmp	upx
behavioral2/memory/3752-148-0x00007FF70E510000-0x00007FF70E864000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\QbVUMGX.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\FlRGirk.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\HormaGR.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\BjOicPD.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\gzvWfyk.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\lOvPIWe.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\acGATqm.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\oTgzflL.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\prldVwE.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\pWqzFva.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\GmbwIlp.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\OWzbNlX.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\jkDWmsU.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\IMgTkqv.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\qcvgNsI.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\BhnNUIt.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\EkaypbS.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\hdyPpwI.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\BXGWOlD.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\glXFLNg.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\LFPBkXc.exe	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5700 wrote to memory of 5976	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 5700 wrote to memory of 4472	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 5700 wrote to memory of 2644	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 5700 wrote to memory of 3864	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 5700 wrote to memory of 3036	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 5700 wrote to memory of 6048	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 5700 wrote to memory of 2820	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 5700 wrote to memory of 4648	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 5700 wrote to memory of 3544	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 5700 wrote to memory of 4940	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 5700 wrote to memory of 5196	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 5700 wrote to memory of 4092	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 5700 wrote to memory of 3752	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 5700 wrote to memory of 5848	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 5700 wrote to memory of 6080	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 5700 wrote to memory of 4952	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 5700 wrote to memory of 4756	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 5700 wrote to memory of 4204	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 5700 wrote to memory of 3424	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 5700 wrote to memory of 2444	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109
PID 5700 wrote to memory of 1092	5700	2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_cf30e18e23d3b67e818891c392be84ec_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5700
- C:\Windows\System\BhnNUIt.exe
  C:\Windows\System\BhnNUIt.exe
  2⤵
  - Executes dropped EXE
  PID:5976
- C:\Windows\System\EkaypbS.exe
  C:\Windows\System\EkaypbS.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\lOvPIWe.exe
  C:\Windows\System\lOvPIWe.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\acGATqm.exe
  C:\Windows\System\acGATqm.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\hdyPpwI.exe
  C:\Windows\System\hdyPpwI.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\QbVUMGX.exe
  C:\Windows\System\QbVUMGX.exe
  2⤵
  - Executes dropped EXE
  PID:6048
- C:\Windows\System\oTgzflL.exe
  C:\Windows\System\oTgzflL.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\FlRGirk.exe
  C:\Windows\System\FlRGirk.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\BXGWOlD.exe
  C:\Windows\System\BXGWOlD.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\prldVwE.exe
  C:\Windows\System\prldVwE.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\jkDWmsU.exe
  C:\Windows\System\jkDWmsU.exe
  2⤵
  - Executes dropped EXE
  PID:5196
- C:\Windows\System\glXFLNg.exe
  C:\Windows\System\glXFLNg.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\HormaGR.exe
  C:\Windows\System\HormaGR.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\IMgTkqv.exe
  C:\Windows\System\IMgTkqv.exe
  2⤵
  - Executes dropped EXE
  PID:5848
- C:\Windows\System\LFPBkXc.exe
  C:\Windows\System\LFPBkXc.exe
  2⤵
  - Executes dropped EXE
  PID:6080
- C:\Windows\System\pWqzFva.exe
  C:\Windows\System\pWqzFva.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\qcvgNsI.exe
  C:\Windows\System\qcvgNsI.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\GmbwIlp.exe
  C:\Windows\System\GmbwIlp.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\BjOicPD.exe
  C:\Windows\System\BjOicPD.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\OWzbNlX.exe
  C:\Windows\System\OWzbNlX.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\gzvWfyk.exe
  C:\Windows\System\gzvWfyk.exe
  2⤵
  - Executes dropped EXE
  PID:1092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BXGWOlD.exe

Path C:\Windows\System\BXGWOlD.exe
Size 5.9MB
SHA256 1fc52aeee51de6efc9af36bcf51ca9dbfa1e97adc05b0c3dd4e68a9c1a44b4dd
MD5 826feeaa0b77a81515f89444283299cc
SHA1 bd85a63801a94fdaa45eac6b5174c7d73c06d1ad
SHA512 cf81a63fac83a4649a6abaeb6dd1862529b288eead4b2e6736feb8403389f068e1cf8ca78d669d2a2d84bfae124d0779f34cd3438f93fe2d894fc3e53ae530e4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
TLSH
T1A2565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BhnNUIt.exe

Path C:\Windows\System\BhnNUIt.exe
Size 5.9MB
SHA256 6553ba70136f3300617f67a293967c03e7ea54fbcd9ddd554f4099f10cf1d10b
MD5 ec14b8d5368864dde89ae779fc6206d4
SHA1 0a6bb74113ae9757f2b4bb81f1c8a18b1bf25c0e
SHA512 26f75abc55ccfa8dc61166f9fd630b555ca7be97744f1ca44c03d0f2b53a9fb4d918b7886c2915a1bfe9e610c4975c561f4b60e64bd09c1ebc4b47a2bb379e10
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
TLSH
T1FC565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BjOicPD.exe

Path C:\Windows\System\BjOicPD.exe
Size 5.9MB
SHA256 9782641f9317c94df3963ee1b9d59e31ea170a1591952ebf936bf1d1bf9870a5
MD5 8c031e27e5e029b9c90693781a2f2b74
SHA1 68155413cc275091672aab4c554338995a03a5d1
SHA512 a6eaa18918da5c6896d4f856e2af45b1bd6e1d20735a0c63987f8ffe221bdeeaff92adf0fee4da5225b2edad243ad7508fb1098c3964d3535cd8a02c15a24e95
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:Q+856utgpPF8u/7k
TLSH
T1B0565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EkaypbS.exe

Path C:\Windows\System\EkaypbS.exe
Size 5.9MB
SHA256 27cb78f94e9c4f82f95b82bea6ae87c6ea935c1b64507a1dae6408abd09ad5ac
MD5 ae12910c505627f170996263d33e0a69
SHA1 bd139aedb63d1c932ddb15250b8f47f8ddbe9d15
SHA512 4f154bede8bb44386c4c4893b0b57da2f3c15acd84e44c41695723f392f7f9abd66c41c02040b3bb2d5006f9307a79d943d6112d576d90e981e3ecfc792cf80a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
TLSH
T1CF565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FlRGirk.exe

Path C:\Windows\System\FlRGirk.exe
Size 5.9MB
SHA256 4d936926352588038107d9f549583385c2c653dd50a02e0b7abb378f3989a669
MD5 c535b0965f10a48ed3d8ae23ae121c27
SHA1 0e71ab6302c6e0931fc22012a34c8ff73df8e018
SHA512 2cbdf89fb56ce0bc4c14234a752c83fa1bd1d90929c7cfaaf6fd6ae1777b6f321fa8e94c81f95bcbdcee7b1315a620e36a4365d9da3952bf71effa6ff9bee477
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
TLSH
T122565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GmbwIlp.exe

Path C:\Windows\System\GmbwIlp.exe
Size 5.9MB
SHA256 44f00a131928fbf1ec5278cced483e67efae2a2e58d263101133f74dd0c4637f
MD5 f583d885a9e4fbe9f88b411e5bbad761
SHA1 d21706abfbfddb44e8db5e9cbdd761cfc3800302
SHA512 86fdc3c3dac271f8266d2e3c0b7d371aaac4da18840931acb7be99c73e6665b796fec2887d94159c8e38b4e033403542adc51789407b36b3f223dc201a4b8621
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
TLSH
T1A1565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HormaGR.exe

Path C:\Windows\System\HormaGR.exe
Size 5.9MB
SHA256 e8bd81d87b29dd385643de8dd176242c37daf123ea4f708b81387853ac4564b3
MD5 c2d93df7599055e78eada3bcbd911d16
SHA1 9f6eba398c004300827839eaceade5f250032d1c
SHA512 7e73cd79ec8f5ceaa90621a9bd81d0701c9a31fb2c7f936e9589a90ac694ffd9cae94b03497ce4950a6a30159ccda25c0fc8b615d0dfeaee2533af299f6aed0c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
TLSH
T108565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IMgTkqv.exe

Path C:\Windows\System\IMgTkqv.exe
Size 5.9MB
SHA256 3e1ad26550ecd6228045f052236af21a8151581168c98be109b3d227f1fa6830
MD5 eaf02599e8b09d1e477bce70a1db2a66
SHA1 47e483122354d73f9978046fd2927895906c77ff
SHA512 6030c5d80961b34e4d8ce5fe86b728d6a76991d83a348500609530b2ec39a44333c912a643dd4ce0144bb47847bb8f1dc41ebe23aa1561a728e576f19c7dcb6b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
TLSH
T145565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LFPBkXc.exe

Path C:\Windows\System\LFPBkXc.exe
Size 5.9MB
SHA256 5e2ec1f9b1e69f579e559120cc64b6aae16cee0143f2b6f3edf0712e4ab824a4
MD5 d8b96510e5aeb8d8f47cc17c2d77f6d4
SHA1 1fcf1c7bdf072c1cc299f3ed8a1227847882684d
SHA512 efd70c529008ebe4fadf43ab6dc23bd3b04d7419c4c632206996758a9efa9ac96f838d098e5082255a5a3e6157d96a783f7750f8651f5bffc81a240aed43a1dc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
TLSH
T1CF565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OWzbNlX.exe

Path C:\Windows\System\OWzbNlX.exe
Size 5.9MB
SHA256 c82382ae0d9de1dc58c8429a87d9da0fa763fac90438104a0bbfb5dcc469e35a
MD5 4417158953ac6eb46ab22df66dc56c93
SHA1 d77f71ce0d6bbd5ed9981cf1ca6f8e69964d39b4
SHA512 fef586ecedbaeb8dfabe7c0ae28d9d51bae0bb7f771334b8e86e7410788ed418259a599bcf407afd49dd73b2e87cb7428002f5b0f7c6bdfe30e8f0539e015687
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
TLSH
T10A565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QbVUMGX.exe

Path C:\Windows\System\QbVUMGX.exe
Size 5.9MB
SHA256 0290f35fd8c3bbce0b526e7bd56cd59f2d3fa272d8f43cdf4298d4139e3d4ad2
MD5 10d436e5f758634b8df809a45fe75df4
SHA1 594bfc6a59707c9597974697093253b2e187afb0
SHA512 5ec1c8a7f59cd40a460ff967c62a66518c843774e3389f5431196e54a057fbfda875e95f722c7c02ae9eed32853f3967ad01ce90553dda4cbed93b13c237cf1b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
TLSH
T1B5565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acGATqm.exe

Path C:\Windows\System\acGATqm.exe
Size 5.9MB
SHA256 b9a686108fb40aad4fabd2b88e7a8e8bd5fec16fcbdb3eada4bc834fd06b484e
MD5 046dba708e3a9d71e974ef9d19a4eb9b
SHA1 225cf2522ca0fd1da9ccfaa7d404a700541b6c6e
SHA512 ae584da408201331ad2181615221c15fcd9dc77ca3e96552583c3a4a5d015379f7a7207095f125246d132849d422e9eb69806c91e20895fafd80aa6671e76765
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
TLSH
T11A565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

glXFLNg.exe

Path C:\Windows\System\glXFLNg.exe
Size 5.9MB
SHA256 e243a328eeea33e8e31b75526d560daf8860e01cabfad65b59b5cfb5aa5aea8f
MD5 a764ca7c55018427158275bb428d71df
SHA1 864f9f7fd4a78791c67c6b5fc8d6f6f2db742200
SHA512 1e3ccae1428642e07d8a42ccdac38f58c9684c30f8a2220c429f7b4f2cb07e552927317d2d5662facebeee7642b7e14030be9aa1d00950d3c28c35e81279b18a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:Q+856utgpPF8u/7g
TLSH
T16A565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gzvWfyk.exe

Path C:\Windows\System\gzvWfyk.exe
Size 5.9MB
SHA256 dae755a632611d5ded918c7e6df54c5d7ac06afb84e7fdd9684d82914d721f89
MD5 30c8dbbc1812e26e47f3d161212223b4
SHA1 0da989eae34ea410a6d51ab8aeeaf62c4d98392e
SHA512 dd332b1f81c537350921d482ae30cd28bafff88495b912c05ca26422ba6ece7bbb2b778a3e34654c36b292f2fc566e9cc024f5f5e60066a6c36587085de9ebac
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
TLSH
T153565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hdyPpwI.exe

Path C:\Windows\System\hdyPpwI.exe
Size 5.9MB
SHA256 df71130c8dc6d63666e45e6ad68139b1543e60e3764417d5598323326ead4335
MD5 f3f01f860f6d7cc24ec224f0f9bfdb05
SHA1 746a4e58bd85c69e44da43e923fb55574980f24e
SHA512 d93d58c250141940924d766e9bdbe195e7ba7f577d49fc87e83f76aee72d2922fd9e68b5de6d056974cb0b958e3b945de6819b9866b06046ba4f0c859649c62c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
TLSH
T1F7565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jkDWmsU.exe

Path C:\Windows\System\jkDWmsU.exe
Size 5.9MB
SHA256 9ddcdb975e1defe738b391928618f96d66f4405c22898e148f975ab6e5afac30
MD5 09b21ffd137bec6f5855a7a4f8ea5fb9
SHA1 9f90bfb5b0f7224d77eb9d0a149ae1c4d163a9c5
SHA512 f1c13b6c1c5f7d28add8819e645d24fb58e41320ac159ee4d2a5c5b4adeb2b8e7d7a059a45fe2cff90c12848420a2e6f482369974e47c6ce2a48e0ada978b470
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
TLSH
T17C565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lOvPIWe.exe

Path C:\Windows\System\lOvPIWe.exe
Size 5.9MB
SHA256 4f16a508504bdd9182c516de399f8f1f459a732c08d2229c949f7bc04ca3a4ba
MD5 e5b1904de6e106cff18fb5947b419489
SHA1 790bfdfda1d326d8c5dd16be4ea30c1ae02c0066
SHA512 c76d19daa3619fb9b0cc6e0a9a0644e8a7f4104eecc47e4b4764a41f70ca0f113827e47f2869a3ee7ed251957ce27926382f25aeb9dcaebdda5c30cb2495357e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
TLSH
T101565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oTgzflL.exe

Path C:\Windows\System\oTgzflL.exe
Size 5.9MB
SHA256 00dee68a37c08f751cfadac07b4592a53cc123aa9a20d7b55d353c05823792f8
MD5 0dfe198d558ff5528241a419143b31e4
SHA1 ad0eae3c325e8da5b396444d4e64f0433d5e1dbd
SHA512 c7d94ff2c8688e8079aad39951c80dde8a5b0eb4ae72e9f21d5d0392a67b39cd90b0f69c9b70af40c5b28b25f1f524b00341da77722a2a742503893f23e7050a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
TLSH
T1B6565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pWqzFva.exe

Path C:\Windows\System\pWqzFva.exe
Size 5.9MB
SHA256 014561228e6c0ed0f54e0ef9bf16b32505ae47de3c6bc1e3abe230dd26f9373d
MD5 03e955c45f1f05d2c77a93cf9ed4d0f0
SHA1 f1937204e896e46c1d76c73742630149b55e7aa5
SHA512 87e0d1425b0e884ada5479f785fe5fbd0413c5bfd7f3e27a59aeb55a2f331d989b1aa3fc00a23c653f469fa31f17b60c4d5c785c8fc18f627fa4e3a4e248e99e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
TLSH
T125565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prldVwE.exe

Path C:\Windows\System\prldVwE.exe
Size 5.9MB
SHA256 58c4ebdff395af56610a4fea911914a461afa0f9f905117116dbd56143e91090
MD5 03fa1d1c81e67aeb4148b92b144ac61b
SHA1 1fce8f5d4a691a0b7f433e0712d394bb32580d15
SHA512 fa76c8781aa73516d714d4d914e9b26169dfaf95aba1240280eea715f1eb7401761c761ea8d427528c5e15286bef03079279b0ba74717f2814461dc2313986ec
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
TLSH
T1AB565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qcvgNsI.exe

Path C:\Windows\System\qcvgNsI.exe
Size 5.9MB
SHA256 df5f959c30a97fd1ca6f14471388f18700730f2078b93fc9f6171069a7d35d7f
MD5 e0fa97039ba69685c4099a0648fc2e9c
SHA1 6e685238bfd6d57d05012cdf7d1debd6b531aff8
SHA512 4ee6b3f344325db50a4b2f3c3bef305b5a5f1edadb3c5d3741feb1073d5d090a7e28751ec5723ca02ea26c2c89b87794847725973bb990cf1cbfcad7e1b414ab
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
TLSH
T1BE565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1092-153-0x00007FF60A0B0000-0x00007FF60A404000-memory.dmp

Download

memory/1092-126-0x00007FF60A0B0000-0x00007FF60A404000-memory.dmp

Download

memory/2444-154-0x00007FF7BC420000-0x00007FF7BC774000-memory.dmp

Download

memory/2444-125-0x00007FF7BC420000-0x00007FF7BC774000-memory.dmp

Download

memory/2644-136-0x00007FF645B40000-0x00007FF645E94000-memory.dmp

Download

memory/2644-18-0x00007FF645B40000-0x00007FF645E94000-memory.dmp

Download

memory/2644-130-0x00007FF645B40000-0x00007FF645E94000-memory.dmp

Download

memory/2820-140-0x00007FF7700A0000-0x00007FF7703F4000-memory.dmp

Download

memory/2820-127-0x00007FF7700A0000-0x00007FF7703F4000-memory.dmp

Download

memory/3036-30-0x00007FF6F2910000-0x00007FF6F2C64000-memory.dmp

Download

memory/3036-132-0x00007FF6F2910000-0x00007FF6F2C64000-memory.dmp

Download

memory/3036-138-0x00007FF6F2910000-0x00007FF6F2C64000-memory.dmp

Download

memory/3424-124-0x00007FF64EA50000-0x00007FF64EDA4000-memory.dmp

Download

memory/3424-152-0x00007FF64EA50000-0x00007FF64EDA4000-memory.dmp

Download

memory/3544-114-0x00007FF6A8660000-0x00007FF6A89B4000-memory.dmp

Download

memory/3544-142-0x00007FF6A8660000-0x00007FF6A89B4000-memory.dmp

Download

memory/3752-118-0x00007FF70E510000-0x00007FF70E864000-memory.dmp

Download

memory/3752-148-0x00007FF70E510000-0x00007FF70E864000-memory.dmp

Download

memory/3864-137-0x00007FF7367D0000-0x00007FF736B24000-memory.dmp

Download

memory/3864-26-0x00007FF7367D0000-0x00007FF736B24000-memory.dmp

Download

memory/3864-131-0x00007FF7367D0000-0x00007FF736B24000-memory.dmp

Download

memory/4092-145-0x00007FF6620E0000-0x00007FF662434000-memory.dmp

Download

memory/4092-117-0x00007FF6620E0000-0x00007FF662434000-memory.dmp

Download

memory/4204-123-0x00007FF668B40000-0x00007FF668E94000-memory.dmp

Download

memory/4204-150-0x00007FF668B40000-0x00007FF668E94000-memory.dmp

Download

memory/4472-135-0x00007FF7643E0000-0x00007FF764734000-memory.dmp

Download

memory/4472-12-0x00007FF7643E0000-0x00007FF764734000-memory.dmp

Download

memory/4472-129-0x00007FF7643E0000-0x00007FF764734000-memory.dmp

Download

memory/4648-113-0x00007FF70C020000-0x00007FF70C374000-memory.dmp

Download

memory/4648-141-0x00007FF70C020000-0x00007FF70C374000-memory.dmp

Download

memory/4756-122-0x00007FF715250000-0x00007FF7155A4000-memory.dmp

Download

memory/4756-151-0x00007FF715250000-0x00007FF7155A4000-memory.dmp

Download

memory/4940-143-0x00007FF762950000-0x00007FF762CA4000-memory.dmp

Download

memory/4940-115-0x00007FF762950000-0x00007FF762CA4000-memory.dmp

Download

memory/4952-121-0x00007FF6B7960000-0x00007FF6B7CB4000-memory.dmp

Download

memory/4952-149-0x00007FF6B7960000-0x00007FF6B7CB4000-memory.dmp

Download

memory/5196-116-0x00007FF658BF0000-0x00007FF658F44000-memory.dmp

Download

memory/5196-144-0x00007FF658BF0000-0x00007FF658F44000-memory.dmp

Download

memory/5700-1-0x0000019605D10000-0x0000019605D20000-memory.dmp

Download

memory/5700-128-0x00007FF7BA4A0000-0x00007FF7BA7F4000-memory.dmp

Download

memory/5700-0-0x00007FF7BA4A0000-0x00007FF7BA7F4000-memory.dmp

Download

memory/5848-146-0x00007FF7B0EB0000-0x00007FF7B1204000-memory.dmp

Download

memory/5848-119-0x00007FF7B0EB0000-0x00007FF7B1204000-memory.dmp

Download

memory/5976-134-0x00007FF61D270000-0x00007FF61D5C4000-memory.dmp

Download

memory/5976-8-0x00007FF61D270000-0x00007FF61D5C4000-memory.dmp

Download

memory/6048-112-0x00007FF713790000-0x00007FF713AE4000-memory.dmp

Download

memory/6048-133-0x00007FF713790000-0x00007FF713AE4000-memory.dmp

Download

memory/6048-139-0x00007FF713790000-0x00007FF713AE4000-memory.dmp

Download

memory/6080-147-0x00007FF6D97E0000-0x00007FF6D9B34000-memory.dmp

Download

memory/6080-120-0x00007FF6D97E0000-0x00007FF6D9B34000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads