cobaltstrike | 306240190e85aa8f4f76d90fed05cd6ba521d99b98a4880c0bfd92219737c932

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 5.9MB
Sample260903-ll2dpatfjf
SHA256 306240190e85aa8f4f76d90fed05cd6ba521d99b98a4880c0bfd92219737c932
MD5 768741b16b2e8a7e97be53350cab0bc2
SHA1 3cbce92e2a33b52c2788322cee38113831057d8f
SHA512 492050ca68c76db280c6e83c7a8c79a587fef47a68b9292c9887abae0a10e326b294836e0ba9d1675410222d4a7e31aa33e0ea9114c6a540d974aa2d8f83a31e
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUW:Q+p56utgpPF8u/7W
TLSH
T1A4565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0005000000016b3f-5.dat	cobalt_reflective_dll
behavioral2/files/0x0005000000016cbe-10.dat	cobalt_reflective_dll
behavioral2/files/0x000500000001b815-12.dat	cobalt_reflective_dll
behavioral2/files/0x000500000001b871-23.dat	cobalt_reflective_dll
behavioral2/files/0x00090000000167e7-28.dat	cobalt_reflective_dll
behavioral2/files/0x000900000001bc1b-35.dat	cobalt_reflective_dll
behavioral2/files/0x001400000001c4c2-41.dat	cobalt_reflective_dll
behavioral2/files/0x001200000001c549-47.dat	cobalt_reflective_dll
behavioral2/files/0x000e00000001c54a-53.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c54c-69.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c54d-76.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c550-96.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c552-110.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c553-117.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c554-124.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c556-137.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c555-130.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c551-102.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c54f-88.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c54e-82.dat	cobalt_reflective_dll
behavioral2/files/0x000e00000001c54b-62.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b3f-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0005000000016cbe-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000500000001b815-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000500000001b871-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00090000000167e7-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000900000001bc1b-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x001400000001c4c2-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x001200000001c549-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000e00000001c54a-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c54c-69.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c54d-76.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c550-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c552-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c553-117.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c554-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c556-137.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c555-130.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c551-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c54f-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c54e-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000e00000001c54b-62.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1512-0-0x00007FF7F3D20000-0x00007FF7F4074000-memory.dmp	UPX
behavioral2/files/0x0005000000016b3f-5.dat	UPX
behavioral2/memory/4880-8-0x00007FF6CE760000-0x00007FF6CEAB4000-memory.dmp	UPX
behavioral2/files/0x0005000000016cbe-10.dat	UPX
behavioral2/files/0x000500000001b815-12.dat	UPX
behavioral2/memory/5716-14-0x00007FF6D9100000-0x00007FF6D9454000-memory.dmp	UPX
behavioral2/memory/5172-18-0x00007FF7C40C0000-0x00007FF7C4414000-memory.dmp	UPX
behavioral2/files/0x000500000001b871-23.dat	UPX
behavioral2/memory/4540-24-0x00007FF69FCA0000-0x00007FF69FFF4000-memory.dmp	UPX
behavioral2/files/0x00090000000167e7-28.dat	UPX
behavioral2/memory/4220-30-0x00007FF7191F0000-0x00007FF719544000-memory.dmp	UPX
behavioral2/files/0x000900000001bc1b-35.dat	UPX
behavioral2/memory/5628-37-0x00007FF739FA0000-0x00007FF73A2F4000-memory.dmp	UPX
behavioral2/files/0x001400000001c4c2-41.dat	UPX
behavioral2/files/0x001200000001c549-47.dat	UPX
behavioral2/files/0x000e00000001c54a-53.dat	UPX
behavioral2/memory/4880-61-0x00007FF6CE760000-0x00007FF6CEAB4000-memory.dmp	UPX
behavioral2/memory/4176-64-0x00007FF65D260000-0x00007FF65D5B4000-memory.dmp	UPX
behavioral2/files/0x000d00000001c54c-69.dat	UPX
behavioral2/files/0x000d00000001c54d-76.dat	UPX
behavioral2/memory/4540-87-0x00007FF69FCA0000-0x00007FF69FFF4000-memory.dmp	UPX
behavioral2/memory/1932-90-0x00007FF62DD80000-0x00007FF62E0D4000-memory.dmp	UPX
behavioral2/files/0x000d00000001c550-96.dat	UPX
behavioral2/memory/2912-104-0x00007FF76D310000-0x00007FF76D664000-memory.dmp	UPX
behavioral2/files/0x000d00000001c552-110.dat	UPX
behavioral2/files/0x000d00000001c553-117.dat	UPX
behavioral2/files/0x000d00000001c554-124.dat	UPX
behavioral2/memory/4628-132-0x00007FF7BC1C0000-0x00007FF7BC514000-memory.dmp	UPX
behavioral2/files/0x000d00000001c556-137.dat	UPX
behavioral2/memory/5288-136-0x00007FF671B00000-0x00007FF671E54000-memory.dmp	UPX
behavioral2/memory/112-135-0x00007FF6D2740000-0x00007FF6D2A94000-memory.dmp	UPX
behavioral2/files/0x000d00000001c555-130.dat	UPX
behavioral2/memory/4176-129-0x00007FF65D260000-0x00007FF65D5B4000-memory.dmp	UPX
behavioral2/memory/2376-123-0x00007FF660B10000-0x00007FF660E64000-memory.dmp	UPX
behavioral2/memory/2472-122-0x00007FF610D30000-0x00007FF611084000-memory.dmp	UPX
behavioral2/memory/2580-116-0x00007FF73EBA0000-0x00007FF73EEF4000-memory.dmp	UPX
behavioral2/memory/3916-115-0x00007FF639D20000-0x00007FF63A074000-memory.dmp	UPX
behavioral2/memory/4652-109-0x00007FF7D5860000-0x00007FF7D5BB4000-memory.dmp	UPX
behavioral2/memory/5944-108-0x00007FF7D0A20000-0x00007FF7D0D74000-memory.dmp	UPX
behavioral2/files/0x000d00000001c551-102.dat	UPX
behavioral2/memory/5628-101-0x00007FF739FA0000-0x00007FF73A2F4000-memory.dmp	UPX
behavioral2/memory/1672-95-0x00007FF6392A0000-0x00007FF6395F4000-memory.dmp	UPX
behavioral2/memory/4220-94-0x00007FF7191F0000-0x00007FF719544000-memory.dmp	UPX
behavioral2/files/0x000d00000001c54f-88.dat	UPX
behavioral2/files/0x000d00000001c54e-82.dat	UPX
behavioral2/memory/2140-81-0x00007FF669020000-0x00007FF669374000-memory.dmp	UPX
behavioral2/memory/460-75-0x00007FF71B590000-0x00007FF71B8E4000-memory.dmp	UPX
behavioral2/memory/5172-74-0x00007FF7C40C0000-0x00007FF7C4414000-memory.dmp	UPX
behavioral2/memory/112-68-0x00007FF6D2740000-0x00007FF6D2A94000-memory.dmp	UPX
behavioral2/files/0x000e00000001c54b-62.dat	UPX
behavioral2/memory/2472-55-0x00007FF610D30000-0x00007FF611084000-memory.dmp	UPX
behavioral2/memory/1512-54-0x00007FF7F3D20000-0x00007FF7F4074000-memory.dmp	UPX
behavioral2/memory/3916-48-0x00007FF639D20000-0x00007FF63A074000-memory.dmp	UPX
behavioral2/memory/5944-42-0x00007FF7D0A20000-0x00007FF7D0D74000-memory.dmp	UPX
behavioral2/memory/460-139-0x00007FF71B590000-0x00007FF71B8E4000-memory.dmp	UPX
behavioral2/memory/2140-140-0x00007FF669020000-0x00007FF669374000-memory.dmp	UPX
behavioral2/memory/1932-141-0x00007FF62DD80000-0x00007FF62E0D4000-memory.dmp	UPX
behavioral2/memory/1672-142-0x00007FF6392A0000-0x00007FF6395F4000-memory.dmp	UPX
behavioral2/memory/2912-143-0x00007FF76D310000-0x00007FF76D664000-memory.dmp	UPX
behavioral2/memory/4652-144-0x00007FF7D5860000-0x00007FF7D5BB4000-memory.dmp	UPX
behavioral2/memory/2580-145-0x00007FF73EBA0000-0x00007FF73EEF4000-memory.dmp	UPX
behavioral2/memory/2376-146-0x00007FF660B10000-0x00007FF660E64000-memory.dmp	UPX
behavioral2/memory/4628-147-0x00007FF7BC1C0000-0x00007FF7BC514000-memory.dmp	UPX
behavioral2/memory/5288-148-0x00007FF671B00000-0x00007FF671E54000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1512-0-0x00007FF7F3D20000-0x00007FF7F4074000-memory.dmp	xmrig
behavioral2/files/0x0005000000016b3f-5.dat	xmrig
behavioral2/memory/4880-8-0x00007FF6CE760000-0x00007FF6CEAB4000-memory.dmp	xmrig
behavioral2/files/0x0005000000016cbe-10.dat	xmrig
behavioral2/files/0x000500000001b815-12.dat	xmrig
behavioral2/memory/5716-14-0x00007FF6D9100000-0x00007FF6D9454000-memory.dmp	xmrig
behavioral2/memory/5172-18-0x00007FF7C40C0000-0x00007FF7C4414000-memory.dmp	xmrig
behavioral2/files/0x000500000001b871-23.dat	xmrig
behavioral2/memory/4540-24-0x00007FF69FCA0000-0x00007FF69FFF4000-memory.dmp	xmrig
behavioral2/files/0x00090000000167e7-28.dat	xmrig
behavioral2/memory/4220-30-0x00007FF7191F0000-0x00007FF719544000-memory.dmp	xmrig
behavioral2/files/0x000900000001bc1b-35.dat	xmrig
behavioral2/memory/5628-37-0x00007FF739FA0000-0x00007FF73A2F4000-memory.dmp	xmrig
behavioral2/files/0x001400000001c4c2-41.dat	xmrig
behavioral2/files/0x001200000001c549-47.dat	xmrig
behavioral2/files/0x000e00000001c54a-53.dat	xmrig
behavioral2/memory/4880-61-0x00007FF6CE760000-0x00007FF6CEAB4000-memory.dmp	xmrig
behavioral2/memory/4176-64-0x00007FF65D260000-0x00007FF65D5B4000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c54c-69.dat	xmrig
behavioral2/files/0x000d00000001c54d-76.dat	xmrig
behavioral2/memory/4540-87-0x00007FF69FCA0000-0x00007FF69FFF4000-memory.dmp	xmrig
behavioral2/memory/1932-90-0x00007FF62DD80000-0x00007FF62E0D4000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c550-96.dat	xmrig
behavioral2/memory/2912-104-0x00007FF76D310000-0x00007FF76D664000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c552-110.dat	xmrig
behavioral2/files/0x000d00000001c553-117.dat	xmrig
behavioral2/files/0x000d00000001c554-124.dat	xmrig
behavioral2/memory/4628-132-0x00007FF7BC1C0000-0x00007FF7BC514000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c556-137.dat	xmrig
behavioral2/memory/5288-136-0x00007FF671B00000-0x00007FF671E54000-memory.dmp	xmrig
behavioral2/memory/112-135-0x00007FF6D2740000-0x00007FF6D2A94000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c555-130.dat	xmrig
behavioral2/memory/4176-129-0x00007FF65D260000-0x00007FF65D5B4000-memory.dmp	xmrig
behavioral2/memory/2376-123-0x00007FF660B10000-0x00007FF660E64000-memory.dmp	xmrig
behavioral2/memory/2472-122-0x00007FF610D30000-0x00007FF611084000-memory.dmp	xmrig
behavioral2/memory/2580-116-0x00007FF73EBA0000-0x00007FF73EEF4000-memory.dmp	xmrig
behavioral2/memory/3916-115-0x00007FF639D20000-0x00007FF63A074000-memory.dmp	xmrig
behavioral2/memory/4652-109-0x00007FF7D5860000-0x00007FF7D5BB4000-memory.dmp	xmrig
behavioral2/memory/5944-108-0x00007FF7D0A20000-0x00007FF7D0D74000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c551-102.dat	xmrig
behavioral2/memory/5628-101-0x00007FF739FA0000-0x00007FF73A2F4000-memory.dmp	xmrig
behavioral2/memory/1672-95-0x00007FF6392A0000-0x00007FF6395F4000-memory.dmp	xmrig
behavioral2/memory/4220-94-0x00007FF7191F0000-0x00007FF719544000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c54f-88.dat	xmrig
behavioral2/files/0x000d00000001c54e-82.dat	xmrig
behavioral2/memory/2140-81-0x00007FF669020000-0x00007FF669374000-memory.dmp	xmrig
behavioral2/memory/460-75-0x00007FF71B590000-0x00007FF71B8E4000-memory.dmp	xmrig
behavioral2/memory/5172-74-0x00007FF7C40C0000-0x00007FF7C4414000-memory.dmp	xmrig
behavioral2/memory/112-68-0x00007FF6D2740000-0x00007FF6D2A94000-memory.dmp	xmrig
behavioral2/files/0x000e00000001c54b-62.dat	xmrig
behavioral2/memory/2472-55-0x00007FF610D30000-0x00007FF611084000-memory.dmp	xmrig
behavioral2/memory/1512-54-0x00007FF7F3D20000-0x00007FF7F4074000-memory.dmp	xmrig
behavioral2/memory/3916-48-0x00007FF639D20000-0x00007FF63A074000-memory.dmp	xmrig
behavioral2/memory/5944-42-0x00007FF7D0A20000-0x00007FF7D0D74000-memory.dmp	xmrig
behavioral2/memory/460-139-0x00007FF71B590000-0x00007FF71B8E4000-memory.dmp	xmrig
behavioral2/memory/2140-140-0x00007FF669020000-0x00007FF669374000-memory.dmp	xmrig
behavioral2/memory/1932-141-0x00007FF62DD80000-0x00007FF62E0D4000-memory.dmp	xmrig
behavioral2/memory/1672-142-0x00007FF6392A0000-0x00007FF6395F4000-memory.dmp	xmrig
behavioral2/memory/2912-143-0x00007FF76D310000-0x00007FF76D664000-memory.dmp	xmrig
behavioral2/memory/4652-144-0x00007FF7D5860000-0x00007FF7D5BB4000-memory.dmp	xmrig
behavioral2/memory/2580-145-0x00007FF73EBA0000-0x00007FF73EEF4000-memory.dmp	xmrig
behavioral2/memory/2376-146-0x00007FF660B10000-0x00007FF660E64000-memory.dmp	xmrig
behavioral2/memory/4628-147-0x00007FF7BC1C0000-0x00007FF7BC514000-memory.dmp	xmrig
behavioral2/memory/5288-148-0x00007FF671B00000-0x00007FF671E54000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4880	PJGnuMq.exe
5716	FiYQZad.exe
5172	zZaPzos.exe
4540	FrxjlUI.exe
4220	FAsGOlw.exe
5628	VJxOeGH.exe
5944	YDoUoGV.exe
3916	iyqeHbV.exe
2472	MMZGXRR.exe
4176	rigyKYj.exe
112	EiNZUzR.exe
460	URGIulU.exe
2140	IozXxBQ.exe
1932	bLkjDDB.exe
1672	GaQBWeE.exe
2912	YChlTgu.exe
4652	VmOOvcw.exe
2580	qJbWAqh.exe
2376	ggHcxCG.exe
4628	AifbeZu.exe
5288	knYPwEi.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1512-0-0x00007FF7F3D20000-0x00007FF7F4074000-memory.dmp	upx
behavioral2/files/0x0005000000016b3f-5.dat	upx
behavioral2/memory/4880-8-0x00007FF6CE760000-0x00007FF6CEAB4000-memory.dmp	upx
behavioral2/files/0x0005000000016cbe-10.dat	upx
behavioral2/files/0x000500000001b815-12.dat	upx
behavioral2/memory/5716-14-0x00007FF6D9100000-0x00007FF6D9454000-memory.dmp	upx
behavioral2/memory/5172-18-0x00007FF7C40C0000-0x00007FF7C4414000-memory.dmp	upx
behavioral2/files/0x000500000001b871-23.dat	upx
behavioral2/memory/4540-24-0x00007FF69FCA0000-0x00007FF69FFF4000-memory.dmp	upx
behavioral2/files/0x00090000000167e7-28.dat	upx
behavioral2/memory/4220-30-0x00007FF7191F0000-0x00007FF719544000-memory.dmp	upx
behavioral2/files/0x000900000001bc1b-35.dat	upx
behavioral2/memory/5628-37-0x00007FF739FA0000-0x00007FF73A2F4000-memory.dmp	upx
behavioral2/files/0x001400000001c4c2-41.dat	upx
behavioral2/files/0x001200000001c549-47.dat	upx
behavioral2/files/0x000e00000001c54a-53.dat	upx
behavioral2/memory/4880-61-0x00007FF6CE760000-0x00007FF6CEAB4000-memory.dmp	upx
behavioral2/memory/4176-64-0x00007FF65D260000-0x00007FF65D5B4000-memory.dmp	upx
behavioral2/files/0x000d00000001c54c-69.dat	upx
behavioral2/files/0x000d00000001c54d-76.dat	upx
behavioral2/memory/4540-87-0x00007FF69FCA0000-0x00007FF69FFF4000-memory.dmp	upx
behavioral2/memory/1932-90-0x00007FF62DD80000-0x00007FF62E0D4000-memory.dmp	upx
behavioral2/files/0x000d00000001c550-96.dat	upx
behavioral2/memory/2912-104-0x00007FF76D310000-0x00007FF76D664000-memory.dmp	upx
behavioral2/files/0x000d00000001c552-110.dat	upx
behavioral2/files/0x000d00000001c553-117.dat	upx
behavioral2/files/0x000d00000001c554-124.dat	upx
behavioral2/memory/4628-132-0x00007FF7BC1C0000-0x00007FF7BC514000-memory.dmp	upx
behavioral2/files/0x000d00000001c556-137.dat	upx
behavioral2/memory/5288-136-0x00007FF671B00000-0x00007FF671E54000-memory.dmp	upx
behavioral2/memory/112-135-0x00007FF6D2740000-0x00007FF6D2A94000-memory.dmp	upx
behavioral2/files/0x000d00000001c555-130.dat	upx
behavioral2/memory/4176-129-0x00007FF65D260000-0x00007FF65D5B4000-memory.dmp	upx
behavioral2/memory/2376-123-0x00007FF660B10000-0x00007FF660E64000-memory.dmp	upx
behavioral2/memory/2472-122-0x00007FF610D30000-0x00007FF611084000-memory.dmp	upx
behavioral2/memory/2580-116-0x00007FF73EBA0000-0x00007FF73EEF4000-memory.dmp	upx
behavioral2/memory/3916-115-0x00007FF639D20000-0x00007FF63A074000-memory.dmp	upx
behavioral2/memory/4652-109-0x00007FF7D5860000-0x00007FF7D5BB4000-memory.dmp	upx
behavioral2/memory/5944-108-0x00007FF7D0A20000-0x00007FF7D0D74000-memory.dmp	upx
behavioral2/files/0x000d00000001c551-102.dat	upx
behavioral2/memory/5628-101-0x00007FF739FA0000-0x00007FF73A2F4000-memory.dmp	upx
behavioral2/memory/1672-95-0x00007FF6392A0000-0x00007FF6395F4000-memory.dmp	upx
behavioral2/memory/4220-94-0x00007FF7191F0000-0x00007FF719544000-memory.dmp	upx
behavioral2/files/0x000d00000001c54f-88.dat	upx
behavioral2/files/0x000d00000001c54e-82.dat	upx
behavioral2/memory/2140-81-0x00007FF669020000-0x00007FF669374000-memory.dmp	upx
behavioral2/memory/460-75-0x00007FF71B590000-0x00007FF71B8E4000-memory.dmp	upx
behavioral2/memory/5172-74-0x00007FF7C40C0000-0x00007FF7C4414000-memory.dmp	upx
behavioral2/memory/112-68-0x00007FF6D2740000-0x00007FF6D2A94000-memory.dmp	upx
behavioral2/files/0x000e00000001c54b-62.dat	upx
behavioral2/memory/2472-55-0x00007FF610D30000-0x00007FF611084000-memory.dmp	upx
behavioral2/memory/1512-54-0x00007FF7F3D20000-0x00007FF7F4074000-memory.dmp	upx
behavioral2/memory/3916-48-0x00007FF639D20000-0x00007FF63A074000-memory.dmp	upx
behavioral2/memory/5944-42-0x00007FF7D0A20000-0x00007FF7D0D74000-memory.dmp	upx
behavioral2/memory/460-139-0x00007FF71B590000-0x00007FF71B8E4000-memory.dmp	upx
behavioral2/memory/2140-140-0x00007FF669020000-0x00007FF669374000-memory.dmp	upx
behavioral2/memory/1932-141-0x00007FF62DD80000-0x00007FF62E0D4000-memory.dmp	upx
behavioral2/memory/1672-142-0x00007FF6392A0000-0x00007FF6395F4000-memory.dmp	upx
behavioral2/memory/2912-143-0x00007FF76D310000-0x00007FF76D664000-memory.dmp	upx
behavioral2/memory/4652-144-0x00007FF7D5860000-0x00007FF7D5BB4000-memory.dmp	upx
behavioral2/memory/2580-145-0x00007FF73EBA0000-0x00007FF73EEF4000-memory.dmp	upx
behavioral2/memory/2376-146-0x00007FF660B10000-0x00007FF660E64000-memory.dmp	upx
behavioral2/memory/4628-147-0x00007FF7BC1C0000-0x00007FF7BC514000-memory.dmp	upx
behavioral2/memory/5288-148-0x00007FF671B00000-0x00007FF671E54000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\FrxjlUI.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\VJxOeGH.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\YDoUoGV.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\iyqeHbV.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\qJbWAqh.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\FiYQZad.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\rigyKYj.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\GaQBWeE.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ggHcxCG.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\bLkjDDB.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\PJGnuMq.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\zZaPzos.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\MMZGXRR.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\EiNZUzR.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\FAsGOlw.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\URGIulU.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\IozXxBQ.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\YChlTgu.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\VmOOvcw.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\AifbeZu.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\knYPwEi.exe	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 4880	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 1512 wrote to memory of 5716	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 1512 wrote to memory of 5172	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 1512 wrote to memory of 4540	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 1512 wrote to memory of 4220	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 1512 wrote to memory of 5628	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 1512 wrote to memory of 5944	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 1512 wrote to memory of 3916	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 1512 wrote to memory of 2472	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 1512 wrote to memory of 4176	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 1512 wrote to memory of 112	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 1512 wrote to memory of 460	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 1512 wrote to memory of 2140	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 1512 wrote to memory of 1932	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 1512 wrote to memory of 1672	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 1512 wrote to memory of 2912	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 1512 wrote to memory of 4652	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 1512 wrote to memory of 2580	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 1512 wrote to memory of 2376	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109
PID 1512 wrote to memory of 4628	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	110
PID 1512 wrote to memory of 5288	1512	2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_768741b16b2e8a7e97be53350cab0bc2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\System\PJGnuMq.exe
  C:\Windows\System\PJGnuMq.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\FiYQZad.exe
  C:\Windows\System\FiYQZad.exe
  2⤵
  - Executes dropped EXE
  PID:5716
- C:\Windows\System\zZaPzos.exe
  C:\Windows\System\zZaPzos.exe
  2⤵
  - Executes dropped EXE
  PID:5172
- C:\Windows\System\FrxjlUI.exe
  C:\Windows\System\FrxjlUI.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\FAsGOlw.exe
  C:\Windows\System\FAsGOlw.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\VJxOeGH.exe
  C:\Windows\System\VJxOeGH.exe
  2⤵
  - Executes dropped EXE
  PID:5628
- C:\Windows\System\YDoUoGV.exe
  C:\Windows\System\YDoUoGV.exe
  2⤵
  - Executes dropped EXE
  PID:5944
- C:\Windows\System\iyqeHbV.exe
  C:\Windows\System\iyqeHbV.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\MMZGXRR.exe
  C:\Windows\System\MMZGXRR.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\rigyKYj.exe
  C:\Windows\System\rigyKYj.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\EiNZUzR.exe
  C:\Windows\System\EiNZUzR.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\URGIulU.exe
  C:\Windows\System\URGIulU.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\IozXxBQ.exe
  C:\Windows\System\IozXxBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\bLkjDDB.exe
  C:\Windows\System\bLkjDDB.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\GaQBWeE.exe
  C:\Windows\System\GaQBWeE.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\YChlTgu.exe
  C:\Windows\System\YChlTgu.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\VmOOvcw.exe
  C:\Windows\System\VmOOvcw.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\qJbWAqh.exe
  C:\Windows\System\qJbWAqh.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\ggHcxCG.exe
  C:\Windows\System\ggHcxCG.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\AifbeZu.exe
  C:\Windows\System\AifbeZu.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\knYPwEi.exe
  C:\Windows\System\knYPwEi.exe
  2⤵
  - Executes dropped EXE
  PID:5288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AifbeZu.exe

Path C:\Windows\System\AifbeZu.exe
Size 5.9MB
SHA256 3ea5527ca09ca7c2e22ec9b200cd475afa08707b9213209a55d0471a0a4936bf
MD5 4852fcdcddad6317c838da36dc20e630
SHA1 d4a7d7f2515bbadd63e2a893d73d1b0f3bf9787e
SHA512 ce9437b6c74474b17acd15b64a40b2722dd41225ddd1740979d0667513e7cb692ea5b5bca84b7312ef588829fea6e1eec57bf671b0efad8467e3e495dff8b5a4
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUx:Q+p56utgpPF8u/7x
TLSH
T113565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EiNZUzR.exe

Path C:\Windows\System\EiNZUzR.exe
Size 5.9MB
SHA256 e152c0d4666b3c4e92d5a852c8e53028d5eb05391e782d18abbc2e70844e44ad
MD5 a38254acf55cfcbfb4ad72e40e6f46ee
SHA1 905df97e6419bcaacf837bfad95618fbd7f448e1
SHA512 14333070f6b71fd9f5d58449853eb002962d7488ad4a5a081ebde03b25689268d56873b382762c918329e77cc33b29ce40a92a8b58ce21d80f7138f1e3216c0b
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lU0:Q+p56utgpPF8u/70
TLSH
T18C565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FAsGOlw.exe

Path C:\Windows\System\FAsGOlw.exe
Size 5.9MB
SHA256 f509ce458da0b42872e0715d54f0b7d40cd398ce05fcbcdae0432bc354c66a11
MD5 f70e0e0c0c73998324f896806db97903
SHA1 46f6fff0246e87ed296addfe19c9c9b5e768de54
SHA512 95c7dcd363d0527d382ecec416caa833d82e37e66014e2d0ecd2f7f6a4b91744b947132f1b1d5cb918aca82b7925f75e479d49288e19e8f40bfd4707f61c65ee
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUO:Q+p56utgpPF8u/7O
TLSH
T198565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FiYQZad.exe

Path C:\Windows\System\FiYQZad.exe
Size 5.9MB
SHA256 26b4f628733fb45e2d54d277d3a7c5f7d9ed1572e7588aa5b2078991853cb51e
MD5 deaf7e5d73f6b19e1f5b12d73ec4e87c
SHA1 97b6154cd26677c2a5d89f7ba2f59022c8a32e46
SHA512 0cef0b7f83a4587c04df273ef0b2436db8cfda799c1f418dbacd7353ab5a5689142cbd4adb2794c066c35827d740a6b0fd47897f476f36281728af456332fade
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUy:Q+p56utgpPF8u/7y
TLSH
T127565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FrxjlUI.exe

Path C:\Windows\System\FrxjlUI.exe
Size 5.9MB
SHA256 044d969123ad65d7289934f4a7639170975582ea36daf47cdc483566dd5d76e2
MD5 1573d94ef2ef5b432fe3545de2d07cb4
SHA1 7d440d3a3ff6d11ccc73066f7c8e94a545576459
SHA512 490ddd8d7fc003bbf885616032d1ad034eff9a809c86acfe2ff8078ef25c108a925b56f3f769ee8f520f16e36ea00fe02b9a81432200e6df2b9f71a3594ce95b
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lU4:Q+p56utgpPF8u/74
TLSH
T154565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GaQBWeE.exe

Path C:\Windows\System\GaQBWeE.exe
Size 5.9MB
SHA256 cab563ad4a7e39424bf69ee25db6699a0e0bb219b413d2e9dbf32361113541cc
MD5 0a295d2584b9cac5129b13a362f44e7e
SHA1 73c5c530bcec8fd5187cfd5b33e900549ed46c3b
SHA512 1115cb1d1194cca00cd80fd6a145ca6b3fb2106f173ac38b20e92748769b19b1ae927b1c2ebc9f3a056d798f87e2231e57ce1b61dc6d62b00eaa5f1d5033db2e
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUp:Q+p56utgpPF8u/7p
TLSH
T1C9565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IozXxBQ.exe

Path C:\Windows\System\IozXxBQ.exe
Size 5.9MB
SHA256 827fc6e389f042ef4387a6eaa4b1015c233ba7cdf8bf811ba9860666312b05b5
MD5 9699fbafb02abb4ce63ee9defdd6710c
SHA1 beff092cd4dcb3eefb9173bda570546afe01cd8f
SHA512 e86e06c189f35863a7c3dd6ceaababeaa9f0af2dcde55a36e4ccc4f532bfa87701d7bcd73955efe61ce084e4b34b22e0c20ea390322cb2b7bc505a0c85ff2746
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUw:Q+p56utgpPF8u/7w
TLSH
T1CD565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MMZGXRR.exe

Path C:\Windows\System\MMZGXRR.exe
Size 5.9MB
SHA256 95a4bbce9b9020bdc63c7a64f99fc70da4e2eb20bea569ced19ecd03712996db
MD5 6bc925eadabfdcecfe3a0249abbaea61
SHA1 1c086586b576f26c1b6c9eebcdb3c13b2a2d9b2a
SHA512 978cf3d404c7e21d215e72de9a4b6fd0828aac90bdcc57cfdcef2868bddb5e8eff9630161446edb9747bba8e9a8e3dd4535815c26c28d91b4c578c800e10910c
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUI:Q+p56utgpPF8u/7I
TLSH
T168565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PJGnuMq.exe

Path C:\Windows\System\PJGnuMq.exe
Size 5.9MB
SHA256 d730bd6473ded40ed5ecf98aa9e36b6a57fec9fee6635249134a8cd0e33fd27b
MD5 398beafe046d8981f89c523c214ce7ee
SHA1 721873cb1d3b0dd0f9dc3839c80e69603f28b8e0
SHA512 1d4e489bae96178afdad98e5ff22dd5e87a4611e79c340f44625de6c9d0ec3a12a5abeb0e9d0ba363b8e41dac4e5f084fdf129e4d861c73b0c313d7ff2560b7d
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUC:Q+p56utgpPF8u/7C
TLSH
T1C3565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

URGIulU.exe

Path C:\Windows\System\URGIulU.exe
Size 5.9MB
SHA256 e97d5a05036f8c7d31c613df1a4e4b30807ea4203c55a052c9d3adda6a0e42c5
MD5 a50cfec1065c3768e752c89e43f38a71
SHA1 44eceaa7d2e89d97ec765fe5cde23aa7b04d576f
SHA512 5a36df3b01b6b6fc0dfb8d32d4c501661634ed075a5d9e4130b8165b317ef137ef076ae20c3376ef9042f51e7bd7b40469fa1a3409d58343ee404d5d97437132
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUO:Q+p56utgpPF8u/7O
TLSH
T1A3565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VJxOeGH.exe

Path C:\Windows\System\VJxOeGH.exe
Size 5.9MB
SHA256 9ecd341137b3e838abb1c6b3f8d4cb4a8a9e43dbbee014017bbd6e2991a07067
MD5 e7ee97d5415824034e9153d4180f70ad
SHA1 211db7de835dcbde263164f748a2f6cd0cdbe581
SHA512 a04eb72dd6161d3f9a4e9e80333e56474ae94840222ff0a4ebb4f5166e63509f208a5c148b370105576594c53600a92349701d1bce9a71a55da2fd0e7bf12377
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUY:Q+p56utgpPF8u/7Y
TLSH
T1B5565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VmOOvcw.exe

Path C:\Windows\System\VmOOvcw.exe
Size 5.9MB
SHA256 de915a1dcf3f97e6e77ec302fe46a62cb30126cf318dd35879e8064fc5d20055
MD5 319d6a98b125220581df84b66a32d59b
SHA1 a3844f7a826ffd47b21d5dcf3acce66f1028d89d
SHA512 14d34253d65e8d8190ae3adc4245fb0c0f1f7046593f2d64f74684b98990d48525418e2007375c7d24ae56fbf805edd8e1c523903b04b35558e55acbc562c68d
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUa:Q+p56utgpPF8u/7a
TLSH
T162565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YChlTgu.exe

Path C:\Windows\System\YChlTgu.exe
Size 5.9MB
SHA256 858092f7f8c3df73d7cbb3f3ec474ff85b2ee344171c67a8a2dad86e344a34cb
MD5 1725175cb6506df2f67ca2900f5ede33
SHA1 010ca863f09c226c8568ae9d6c7e478eadd88efd
SHA512 c63db7b94f849d81ec302b1db246b480316517d336d3ac96dbd47206b59c4b5c5bf765fcfb95a50b3d343d086c1e3c7743db993d90be5fac48a49bc00d2b509b
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUW:Q+p56utgpPF8u/7W
TLSH
T13E565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YDoUoGV.exe

Path C:\Windows\System\YDoUoGV.exe
Size 5.9MB
SHA256 b0b2207e8ac6f12434963585f705a65b9bae008dd30c23452748dae477429f35
MD5 d41f739844914779ed8a8ec6998c280b
SHA1 f1eeebc5d8682ab094965abae447f0481b83de69
SHA512 c2b8c0af05596c732f2095c65756bd7548e43fd74c0b5d20fc02d403e6983ef670983005d6aa8425ef391b3acdfa3ad23df601ad726d23b9b739edc540efb2e2
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUp:Q+p56utgpPF8u/7p
TLSH
T1F6565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bLkjDDB.exe

Path C:\Windows\System\bLkjDDB.exe
Size 5.9MB
SHA256 28f419f4beb56c052030b39aa6123557c7dcd2502f6b8e37c3c18e7ca5afc99a
MD5 231fa4ff16501cb4c06f4463f79f34d6
SHA1 83d35e71b1c057256d00f7555796a85abf891700
SHA512 71164d0e6c08c46a6906a55d6c2e684c90d6bf5b2e8c81ffb794575ad0a0a6895b0be80599f37d10f6c2ba1ddf1f860b9ff261eafa3a48ebdf21962d1e85ea41
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUa:Q+p56utgpPF8u/7a
TLSH
T1FA565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ggHcxCG.exe

Path C:\Windows\System\ggHcxCG.exe
Size 5.9MB
SHA256 f667f9126fe1e2bff61b5050b2849b7640ed34182330e9df8ffd5d890c09c08f
MD5 5666fae99952fa40fe3febea5b9e563c
SHA1 4cad85e60eb3252840fb11c45857fe2d60cf3425
SHA512 33c441fa0046ce347d344db52f70d54bb91744c587567b87a0ea46e2cdb976dfce8aa39edc9b8c85377fdcd05005b9ab64b5bef6aae1eb0b9875c0aafb3ea81e
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUO:Q+p56utgpPF8u/7O
TLSH
T11B565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iyqeHbV.exe

Path C:\Windows\System\iyqeHbV.exe
Size 5.9MB
SHA256 249674cba9ed06b10d0ccba7bd0dff0b249d1add016365445fb56f80081e5760
MD5 d21b02de85d7248c9667fce4658358d3
SHA1 80c5965cac01c26e3430ad1e10c944cee1f6cb8c
SHA512 19bc72deedf016d403004f95a49c78c0f94866eb39438e1b0e80580f9ada896e00ff3cf8a9d80ca480bfb7b1fb696fea93a26dcb5ee13139f7fabe2b94dafa1a
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUx:Q+p56utgpPF8u/7x
TLSH
T108565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

knYPwEi.exe

Path C:\Windows\System\knYPwEi.exe
Size 5.9MB
SHA256 dca0f4b37386ccf14f3191e80048637ce8d079fbd8e14d37f3971176f1fcbc48
MD5 8ce05c74380b908db7fbc575c0432e9e
SHA1 e89375b6ad7844ec10a9e974ba1726f494c37fdd
SHA512 d3219c73793194b1879b259e08976dfbf26002652a04d7a7576c5eb927918cdeb449226a42f6cdbb959248fec05439830ac272700583a7a1f1018eb59e7d2815
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUv:Q+p56utgpPF8u/7v
TLSH
T1FB565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qJbWAqh.exe

Path C:\Windows\System\qJbWAqh.exe
Size 5.9MB
SHA256 08a0c5d2537d2f74e15686c3a1a992f9dffdea2bca28e52eaa669229e2358ae4
MD5 0a4a6dfe9ab0edf1e9cc5eb330539d5b
SHA1 228051d12d33e1635315d2621996ca479a92cc3f
SHA512 49b165c09c184e1888a3a093682d51e9e5b3d140c91f179aaa76905f71a5e42cb1b2435e3ccff12ab3f164f50d3ed65fd1205be3ab6e51c8c52bee756e27e323
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lU7:Q+p56utgpPF8u/77
TLSH
T18A565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rigyKYj.exe

Path C:\Windows\System\rigyKYj.exe
Size 5.9MB
SHA256 c1ef434bb09a94efb7961f0a82e77cda2386a9bedd620581390a23f5be51a5bf
MD5 b19bab908396e1107d3e972566281744
SHA1 8410f3b4fb562aa7eb67292afbc0ffde67b39dc6
SHA512 bd9b946d6902982e5fb2bb6e4e20bc9561960f623180fed0220d2cddb638155d2942e377a02b51ef7adc41f56b07180d5e2cf827d5d0b3e982a196470165f8c8
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUi:Q+p56utgpPF8u/7i
TLSH
T140565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zZaPzos.exe

Path C:\Windows\System\zZaPzos.exe
Size 5.9MB
SHA256 1488dd5c18ee790a3e47d8d0ae67db54a753c5ea88e6428771a00235afbe96cc
MD5 5c232ba70d805522f67dfb4f694dc682
SHA1 da3679d991f9bccb3929a0eea1464b555ef7939d
SHA512 c9b0222802afd1113122ed811e3a210a8680b1b4e70df69c2737e038d6ad32ae0b289371bcefbb86eff11641eea45d5cf4c5854029488880297fa2eb9786c8b1
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUb:Q+p56utgpPF8u/7b
TLSH
T128565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/112-159-0x00007FF6D2740000-0x00007FF6D2A94000-memory.dmp

Download

memory/112-68-0x00007FF6D2740000-0x00007FF6D2A94000-memory.dmp

Download

memory/112-135-0x00007FF6D2740000-0x00007FF6D2A94000-memory.dmp

Download

memory/460-160-0x00007FF71B590000-0x00007FF71B8E4000-memory.dmp

Download

memory/460-75-0x00007FF71B590000-0x00007FF71B8E4000-memory.dmp

Download

memory/460-139-0x00007FF71B590000-0x00007FF71B8E4000-memory.dmp

Download

memory/1512-0-0x00007FF7F3D20000-0x00007FF7F4074000-memory.dmp

Download

memory/1512-1-0x000001BA125C0000-0x000001BA125D0000-memory.dmp

Download

memory/1512-54-0x00007FF7F3D20000-0x00007FF7F4074000-memory.dmp

Download

memory/1672-95-0x00007FF6392A0000-0x00007FF6395F4000-memory.dmp

Download

memory/1672-142-0x00007FF6392A0000-0x00007FF6395F4000-memory.dmp

Download

memory/1672-163-0x00007FF6392A0000-0x00007FF6395F4000-memory.dmp

Download

memory/1932-141-0x00007FF62DD80000-0x00007FF62E0D4000-memory.dmp

Download

memory/1932-162-0x00007FF62DD80000-0x00007FF62E0D4000-memory.dmp

Download

memory/1932-90-0x00007FF62DD80000-0x00007FF62E0D4000-memory.dmp

Download

memory/2140-140-0x00007FF669020000-0x00007FF669374000-memory.dmp

Download

memory/2140-81-0x00007FF669020000-0x00007FF669374000-memory.dmp

Download

memory/2140-161-0x00007FF669020000-0x00007FF669374000-memory.dmp

Download

memory/2376-123-0x00007FF660B10000-0x00007FF660E64000-memory.dmp

Download

memory/2376-146-0x00007FF660B10000-0x00007FF660E64000-memory.dmp

Download

memory/2376-166-0x00007FF660B10000-0x00007FF660E64000-memory.dmp

Download

memory/2472-122-0x00007FF610D30000-0x00007FF611084000-memory.dmp

Download

memory/2472-55-0x00007FF610D30000-0x00007FF611084000-memory.dmp

Download

memory/2472-157-0x00007FF610D30000-0x00007FF611084000-memory.dmp

Download

memory/2580-116-0x00007FF73EBA0000-0x00007FF73EEF4000-memory.dmp

Download

memory/2580-145-0x00007FF73EBA0000-0x00007FF73EEF4000-memory.dmp

Download

memory/2580-167-0x00007FF73EBA0000-0x00007FF73EEF4000-memory.dmp

Download

memory/2912-143-0x00007FF76D310000-0x00007FF76D664000-memory.dmp

Download

memory/2912-164-0x00007FF76D310000-0x00007FF76D664000-memory.dmp

Download

memory/2912-104-0x00007FF76D310000-0x00007FF76D664000-memory.dmp

Download

memory/3916-156-0x00007FF639D20000-0x00007FF63A074000-memory.dmp

Download

memory/3916-115-0x00007FF639D20000-0x00007FF63A074000-memory.dmp

Download

memory/3916-48-0x00007FF639D20000-0x00007FF63A074000-memory.dmp

Download

memory/4176-64-0x00007FF65D260000-0x00007FF65D5B4000-memory.dmp

Download

memory/4176-129-0x00007FF65D260000-0x00007FF65D5B4000-memory.dmp

Download

memory/4176-158-0x00007FF65D260000-0x00007FF65D5B4000-memory.dmp

Download

memory/4220-94-0x00007FF7191F0000-0x00007FF719544000-memory.dmp

Download

memory/4220-30-0x00007FF7191F0000-0x00007FF719544000-memory.dmp

Download

memory/4220-153-0x00007FF7191F0000-0x00007FF719544000-memory.dmp

Download

memory/4540-152-0x00007FF69FCA0000-0x00007FF69FFF4000-memory.dmp

Download

memory/4540-24-0x00007FF69FCA0000-0x00007FF69FFF4000-memory.dmp

Download

memory/4540-87-0x00007FF69FCA0000-0x00007FF69FFF4000-memory.dmp

Download

memory/4628-168-0x00007FF7BC1C0000-0x00007FF7BC514000-memory.dmp

Download

memory/4628-147-0x00007FF7BC1C0000-0x00007FF7BC514000-memory.dmp

Download

memory/4628-132-0x00007FF7BC1C0000-0x00007FF7BC514000-memory.dmp

Download

memory/4652-109-0x00007FF7D5860000-0x00007FF7D5BB4000-memory.dmp

Download

memory/4652-165-0x00007FF7D5860000-0x00007FF7D5BB4000-memory.dmp

Download

memory/4652-144-0x00007FF7D5860000-0x00007FF7D5BB4000-memory.dmp

Download

memory/4880-61-0x00007FF6CE760000-0x00007FF6CEAB4000-memory.dmp

Download

memory/4880-149-0x00007FF6CE760000-0x00007FF6CEAB4000-memory.dmp

Download

memory/4880-8-0x00007FF6CE760000-0x00007FF6CEAB4000-memory.dmp

Download

memory/5172-151-0x00007FF7C40C0000-0x00007FF7C4414000-memory.dmp

Download

memory/5172-74-0x00007FF7C40C0000-0x00007FF7C4414000-memory.dmp

Download

memory/5172-18-0x00007FF7C40C0000-0x00007FF7C4414000-memory.dmp

Download

memory/5288-136-0x00007FF671B00000-0x00007FF671E54000-memory.dmp

Download

memory/5288-148-0x00007FF671B00000-0x00007FF671E54000-memory.dmp

Download

memory/5288-169-0x00007FF671B00000-0x00007FF671E54000-memory.dmp

Download

memory/5628-37-0x00007FF739FA0000-0x00007FF73A2F4000-memory.dmp

Download

memory/5628-101-0x00007FF739FA0000-0x00007FF73A2F4000-memory.dmp

Download

memory/5628-154-0x00007FF739FA0000-0x00007FF73A2F4000-memory.dmp

Download

memory/5716-150-0x00007FF6D9100000-0x00007FF6D9454000-memory.dmp

Download

memory/5716-14-0x00007FF6D9100000-0x00007FF6D9454000-memory.dmp

Download

memory/5944-155-0x00007FF7D0A20000-0x00007FF7D0D74000-memory.dmp

Download

memory/5944-108-0x00007FF7D0A20000-0x00007FF7D0D74000-memory.dmp

Download

memory/5944-42-0x00007FF7D0A20000-0x00007FF7D0D74000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads