cobaltstrike | 58aa271e8116a435e9720e728977d1b0aa87a086527e947d5e94e4a3d331ea89

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
Size 5.2MB
Sample260909-va138ayblc
SHA256 58aa271e8116a435e9720e728977d1b0aa87a086527e947d5e94e4a3d331ea89
MD5 81e73ec20b30b1b61581d36247414bbc
SHA1 694eac29bd1cc165c1af288658ef9aa24a919aad
SHA512 c3faf4a8f26f69a62a90eaff617d4bd7ce5955dda6b1d9928b84a62b550b2710af3f8383cae2ef3f1d78fca38b07600fd9f2026df60569698b4f5fea3cd2d5d0
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lN:RWWBibf56utgpPFotBER/mQ32lUp
TLSH
T145465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000600000001b714-5.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c405-10.dat	cobalt_reflective_dll
behavioral2/files/0x001000000001c3f1-11.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c406-23.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c408-27.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c409-34.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c40a-38.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c40b-44.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c40c-49.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c40d-54.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c422-59.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c423-64.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c424-69.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c429-93.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c42d-108.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c42b-104.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c42a-99.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c428-89.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c427-84.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c426-79.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c425-74.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000600000001b714-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c405-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x001000000001c3f1-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c406-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c408-27.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c409-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c40a-38.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c40b-44.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c40c-49.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c40d-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c422-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c423-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c424-69.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c429-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c42d-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c42b-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c42a-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c428-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c427-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c426-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c425-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4324-0-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	UPX
behavioral2/files/0x000600000001b714-5.dat	UPX
behavioral2/memory/4232-7-0x00007FF66FF90000-0x00007FF6702E1000-memory.dmp	UPX
behavioral2/files/0x000d00000001c405-10.dat	UPX
behavioral2/files/0x001000000001c3f1-11.dat	UPX
behavioral2/memory/3324-14-0x00007FF765980000-0x00007FF765CD1000-memory.dmp	UPX
behavioral2/files/0x000d00000001c406-23.dat	UPX
behavioral2/files/0x000d00000001c408-27.dat	UPX
behavioral2/files/0x000d00000001c409-34.dat	UPX
behavioral2/files/0x000d00000001c40a-38.dat	UPX
behavioral2/files/0x000d00000001c40b-44.dat	UPX
behavioral2/files/0x000d00000001c40c-49.dat	UPX
behavioral2/files/0x000d00000001c40d-54.dat	UPX
behavioral2/files/0x000d00000001c422-59.dat	UPX
behavioral2/files/0x000d00000001c423-64.dat	UPX
behavioral2/files/0x000d00000001c424-69.dat	UPX
behavioral2/files/0x000d00000001c429-93.dat	UPX
behavioral2/files/0x000d00000001c42d-108.dat	UPX
behavioral2/files/0x000d00000001c42b-104.dat	UPX
behavioral2/files/0x000d00000001c42a-99.dat	UPX
behavioral2/files/0x000d00000001c428-89.dat	UPX
behavioral2/files/0x000d00000001c427-84.dat	UPX
behavioral2/files/0x000d00000001c426-79.dat	UPX
behavioral2/files/0x000d00000001c425-74.dat	UPX
behavioral2/memory/5376-18-0x00007FF7763E0000-0x00007FF776731000-memory.dmp	UPX
behavioral2/memory/3324-113-0x00007FF765980000-0x00007FF765CD1000-memory.dmp	UPX
behavioral2/memory/4232-112-0x00007FF66FF90000-0x00007FF6702E1000-memory.dmp	UPX
behavioral2/memory/2724-124-0x00007FF7C7540000-0x00007FF7C7891000-memory.dmp	UPX
behavioral2/memory/2856-133-0x00007FF77C600000-0x00007FF77C951000-memory.dmp	UPX
behavioral2/memory/6064-132-0x00007FF689810000-0x00007FF689B61000-memory.dmp	UPX
behavioral2/memory/3300-131-0x00007FF79EA80000-0x00007FF79EDD1000-memory.dmp	UPX
behavioral2/memory/476-130-0x00007FF726CB0000-0x00007FF727001000-memory.dmp	UPX
behavioral2/memory/408-129-0x00007FF635B20000-0x00007FF635E71000-memory.dmp	UPX
behavioral2/memory/2616-128-0x00007FF7DE550000-0x00007FF7DE8A1000-memory.dmp	UPX
behavioral2/memory/8-127-0x00007FF6B66C0000-0x00007FF6B6A11000-memory.dmp	UPX
behavioral2/memory/3096-126-0x00007FF7B89B0000-0x00007FF7B8D01000-memory.dmp	UPX
behavioral2/memory/1360-125-0x00007FF799F30000-0x00007FF79A281000-memory.dmp	UPX
behavioral2/memory/5468-123-0x00007FF6257E0000-0x00007FF625B31000-memory.dmp	UPX
behavioral2/memory/5976-122-0x00007FF64D900000-0x00007FF64DC51000-memory.dmp	UPX
behavioral2/memory/4676-119-0x00007FF760500000-0x00007FF760851000-memory.dmp	UPX
behavioral2/memory/2504-118-0x00007FF7DE1C0000-0x00007FF7DE511000-memory.dmp	UPX
behavioral2/memory/4536-115-0x00007FF6EB090000-0x00007FF6EB3E1000-memory.dmp	UPX
behavioral2/memory/2972-120-0x00007FF72B8F0000-0x00007FF72BC41000-memory.dmp	UPX
behavioral2/memory/5100-121-0x00007FF6E4640000-0x00007FF6E4991000-memory.dmp	UPX
behavioral2/memory/5232-116-0x00007FF791040000-0x00007FF791391000-memory.dmp	UPX
behavioral2/memory/4324-111-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	UPX
behavioral2/memory/5376-114-0x00007FF7763E0000-0x00007FF776731000-memory.dmp	UPX
behavioral2/memory/4536-110-0x00007FF6EB090000-0x00007FF6EB3E1000-memory.dmp	UPX
behavioral2/memory/4324-134-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	UPX
behavioral2/memory/4324-156-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	UPX
behavioral2/memory/4324-157-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	UPX
behavioral2/memory/4324-179-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	UPX
behavioral2/memory/4232-185-0x00007FF66FF90000-0x00007FF6702E1000-memory.dmp	UPX
behavioral2/memory/3324-187-0x00007FF765980000-0x00007FF765CD1000-memory.dmp	UPX
behavioral2/memory/5376-189-0x00007FF7763E0000-0x00007FF776731000-memory.dmp	UPX
behavioral2/memory/5232-190-0x00007FF791040000-0x00007FF791391000-memory.dmp	UPX
behavioral2/memory/4536-191-0x00007FF6EB090000-0x00007FF6EB3E1000-memory.dmp	UPX
behavioral2/memory/2856-206-0x00007FF77C600000-0x00007FF77C951000-memory.dmp	UPX
behavioral2/memory/2504-210-0x00007FF7DE1C0000-0x00007FF7DE511000-memory.dmp	UPX
behavioral2/memory/4676-209-0x00007FF760500000-0x00007FF760851000-memory.dmp	UPX
behavioral2/memory/2616-225-0x00007FF7DE550000-0x00007FF7DE8A1000-memory.dmp	UPX
behavioral2/memory/2972-229-0x00007FF72B8F0000-0x00007FF72BC41000-memory.dmp	UPX
behavioral2/memory/408-234-0x00007FF635B20000-0x00007FF635E71000-memory.dmp	UPX
behavioral2/memory/476-236-0x00007FF726CB0000-0x00007FF727001000-memory.dmp	UPX

XMRig Miner payload 57 IoCs

miner

resource	yara_rule
behavioral2/memory/3324-113-0x00007FF765980000-0x00007FF765CD1000-memory.dmp	xmrig
behavioral2/memory/4232-112-0x00007FF66FF90000-0x00007FF6702E1000-memory.dmp	xmrig
behavioral2/memory/2724-124-0x00007FF7C7540000-0x00007FF7C7891000-memory.dmp	xmrig
behavioral2/memory/2856-133-0x00007FF77C600000-0x00007FF77C951000-memory.dmp	xmrig
behavioral2/memory/6064-132-0x00007FF689810000-0x00007FF689B61000-memory.dmp	xmrig
behavioral2/memory/3300-131-0x00007FF79EA80000-0x00007FF79EDD1000-memory.dmp	xmrig
behavioral2/memory/476-130-0x00007FF726CB0000-0x00007FF727001000-memory.dmp	xmrig
behavioral2/memory/408-129-0x00007FF635B20000-0x00007FF635E71000-memory.dmp	xmrig
behavioral2/memory/2616-128-0x00007FF7DE550000-0x00007FF7DE8A1000-memory.dmp	xmrig
behavioral2/memory/8-127-0x00007FF6B66C0000-0x00007FF6B6A11000-memory.dmp	xmrig
behavioral2/memory/3096-126-0x00007FF7B89B0000-0x00007FF7B8D01000-memory.dmp	xmrig
behavioral2/memory/1360-125-0x00007FF799F30000-0x00007FF79A281000-memory.dmp	xmrig
behavioral2/memory/5468-123-0x00007FF6257E0000-0x00007FF625B31000-memory.dmp	xmrig
behavioral2/memory/5976-122-0x00007FF64D900000-0x00007FF64DC51000-memory.dmp	xmrig
behavioral2/memory/4676-119-0x00007FF760500000-0x00007FF760851000-memory.dmp	xmrig
behavioral2/memory/2504-118-0x00007FF7DE1C0000-0x00007FF7DE511000-memory.dmp	xmrig
behavioral2/memory/4536-115-0x00007FF6EB090000-0x00007FF6EB3E1000-memory.dmp	xmrig
behavioral2/memory/2972-120-0x00007FF72B8F0000-0x00007FF72BC41000-memory.dmp	xmrig
behavioral2/memory/5100-121-0x00007FF6E4640000-0x00007FF6E4991000-memory.dmp	xmrig
behavioral2/memory/5232-116-0x00007FF791040000-0x00007FF791391000-memory.dmp	xmrig
behavioral2/memory/4324-111-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	xmrig
behavioral2/memory/5376-114-0x00007FF7763E0000-0x00007FF776731000-memory.dmp	xmrig
behavioral2/memory/4324-134-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	xmrig
behavioral2/memory/4324-156-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	xmrig
behavioral2/memory/4324-157-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	xmrig
behavioral2/memory/4324-179-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	xmrig
behavioral2/memory/4232-185-0x00007FF66FF90000-0x00007FF6702E1000-memory.dmp	xmrig
behavioral2/memory/3324-187-0x00007FF765980000-0x00007FF765CD1000-memory.dmp	xmrig
behavioral2/memory/5376-189-0x00007FF7763E0000-0x00007FF776731000-memory.dmp	xmrig
behavioral2/memory/5232-190-0x00007FF791040000-0x00007FF791391000-memory.dmp	xmrig
behavioral2/memory/4536-191-0x00007FF6EB090000-0x00007FF6EB3E1000-memory.dmp	xmrig
behavioral2/memory/2856-206-0x00007FF77C600000-0x00007FF77C951000-memory.dmp	xmrig
behavioral2/memory/2504-210-0x00007FF7DE1C0000-0x00007FF7DE511000-memory.dmp	xmrig
behavioral2/memory/4676-209-0x00007FF760500000-0x00007FF760851000-memory.dmp	xmrig
behavioral2/memory/2616-225-0x00007FF7DE550000-0x00007FF7DE8A1000-memory.dmp	xmrig
behavioral2/memory/2972-229-0x00007FF72B8F0000-0x00007FF72BC41000-memory.dmp	xmrig
behavioral2/memory/408-234-0x00007FF635B20000-0x00007FF635E71000-memory.dmp	xmrig
behavioral2/memory/476-236-0x00007FF726CB0000-0x00007FF727001000-memory.dmp	xmrig
behavioral2/memory/3300-238-0x00007FF79EA80000-0x00007FF79EDD1000-memory.dmp	xmrig
behavioral2/memory/1360-233-0x00007FF799F30000-0x00007FF79A281000-memory.dmp	xmrig
behavioral2/memory/8-230-0x00007FF6B66C0000-0x00007FF6B6A11000-memory.dmp	xmrig
behavioral2/memory/5100-227-0x00007FF6E4640000-0x00007FF6E4991000-memory.dmp	xmrig
behavioral2/memory/2724-218-0x00007FF7C7540000-0x00007FF7C7891000-memory.dmp	xmrig
behavioral2/memory/3096-212-0x00007FF7B89B0000-0x00007FF7B8D01000-memory.dmp	xmrig
behavioral2/memory/5976-216-0x00007FF64D900000-0x00007FF64DC51000-memory.dmp	xmrig
behavioral2/memory/5468-214-0x00007FF6257E0000-0x00007FF625B31000-memory.dmp	xmrig
behavioral2/memory/6064-240-0x00007FF689810000-0x00007FF689B61000-memory.dmp	xmrig
behavioral2/memory/4324-241-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	xmrig
behavioral2/memory/4324-242-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	xmrig
behavioral2/memory/4324-243-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	xmrig
behavioral2/memory/4324-244-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	xmrig
behavioral2/memory/4324-245-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	xmrig
behavioral2/memory/4324-246-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	xmrig
behavioral2/memory/4324-247-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	xmrig
behavioral2/memory/4324-248-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	xmrig
behavioral2/memory/4324-249-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	xmrig
behavioral2/memory/4324-250-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4232	yljwdUj.exe
3324	orlUSLH.exe
5376	tcfycHC.exe
4536	DOCPnON.exe
5232	MHxlDKV.exe
2856	rdWQseO.exe
2504	UHHeQRO.exe
4676	aiFBOrr.exe
2972	cikcsCp.exe
5100	sgVvzcM.exe
5976	cssAOZW.exe
5468	uHgWfwR.exe
2724	ERyOsXO.exe
1360	OJsQMJU.exe
3096	CAdXzOQ.exe
8	ohONGYa.exe
2616	nxjaUdx.exe
408	NNDJmZJ.exe
476	WKAkEHN.exe
3300	rTwvxRi.exe
6064	dmtTVJO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4324-0-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	upx
behavioral2/files/0x000600000001b714-5.dat	upx
behavioral2/memory/4232-7-0x00007FF66FF90000-0x00007FF6702E1000-memory.dmp	upx
behavioral2/files/0x000d00000001c405-10.dat	upx
behavioral2/files/0x001000000001c3f1-11.dat	upx
behavioral2/memory/3324-14-0x00007FF765980000-0x00007FF765CD1000-memory.dmp	upx
behavioral2/files/0x000d00000001c406-23.dat	upx
behavioral2/files/0x000d00000001c408-27.dat	upx
behavioral2/files/0x000d00000001c409-34.dat	upx
behavioral2/files/0x000d00000001c40a-38.dat	upx
behavioral2/files/0x000d00000001c40b-44.dat	upx
behavioral2/files/0x000d00000001c40c-49.dat	upx
behavioral2/files/0x000d00000001c40d-54.dat	upx
behavioral2/files/0x000d00000001c422-59.dat	upx
behavioral2/files/0x000d00000001c423-64.dat	upx
behavioral2/files/0x000d00000001c424-69.dat	upx
behavioral2/files/0x000d00000001c429-93.dat	upx
behavioral2/files/0x000d00000001c42d-108.dat	upx
behavioral2/files/0x000d00000001c42b-104.dat	upx
behavioral2/files/0x000d00000001c42a-99.dat	upx
behavioral2/files/0x000d00000001c428-89.dat	upx
behavioral2/files/0x000d00000001c427-84.dat	upx
behavioral2/files/0x000d00000001c426-79.dat	upx
behavioral2/files/0x000d00000001c425-74.dat	upx
behavioral2/memory/5376-18-0x00007FF7763E0000-0x00007FF776731000-memory.dmp	upx
behavioral2/memory/3324-113-0x00007FF765980000-0x00007FF765CD1000-memory.dmp	upx
behavioral2/memory/4232-112-0x00007FF66FF90000-0x00007FF6702E1000-memory.dmp	upx
behavioral2/memory/2724-124-0x00007FF7C7540000-0x00007FF7C7891000-memory.dmp	upx
behavioral2/memory/2856-133-0x00007FF77C600000-0x00007FF77C951000-memory.dmp	upx
behavioral2/memory/6064-132-0x00007FF689810000-0x00007FF689B61000-memory.dmp	upx
behavioral2/memory/3300-131-0x00007FF79EA80000-0x00007FF79EDD1000-memory.dmp	upx
behavioral2/memory/476-130-0x00007FF726CB0000-0x00007FF727001000-memory.dmp	upx
behavioral2/memory/408-129-0x00007FF635B20000-0x00007FF635E71000-memory.dmp	upx
behavioral2/memory/2616-128-0x00007FF7DE550000-0x00007FF7DE8A1000-memory.dmp	upx
behavioral2/memory/8-127-0x00007FF6B66C0000-0x00007FF6B6A11000-memory.dmp	upx
behavioral2/memory/3096-126-0x00007FF7B89B0000-0x00007FF7B8D01000-memory.dmp	upx
behavioral2/memory/1360-125-0x00007FF799F30000-0x00007FF79A281000-memory.dmp	upx
behavioral2/memory/5468-123-0x00007FF6257E0000-0x00007FF625B31000-memory.dmp	upx
behavioral2/memory/5976-122-0x00007FF64D900000-0x00007FF64DC51000-memory.dmp	upx
behavioral2/memory/4676-119-0x00007FF760500000-0x00007FF760851000-memory.dmp	upx
behavioral2/memory/2504-118-0x00007FF7DE1C0000-0x00007FF7DE511000-memory.dmp	upx
behavioral2/memory/4536-115-0x00007FF6EB090000-0x00007FF6EB3E1000-memory.dmp	upx
behavioral2/memory/2972-120-0x00007FF72B8F0000-0x00007FF72BC41000-memory.dmp	upx
behavioral2/memory/5100-121-0x00007FF6E4640000-0x00007FF6E4991000-memory.dmp	upx
behavioral2/memory/5232-116-0x00007FF791040000-0x00007FF791391000-memory.dmp	upx
behavioral2/memory/4324-111-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	upx
behavioral2/memory/5376-114-0x00007FF7763E0000-0x00007FF776731000-memory.dmp	upx
behavioral2/memory/4536-110-0x00007FF6EB090000-0x00007FF6EB3E1000-memory.dmp	upx
behavioral2/memory/4324-134-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	upx
behavioral2/memory/4324-156-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	upx
behavioral2/memory/4324-157-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	upx
behavioral2/memory/4324-179-0x00007FF770CF0000-0x00007FF771041000-memory.dmp	upx
behavioral2/memory/4232-185-0x00007FF66FF90000-0x00007FF6702E1000-memory.dmp	upx
behavioral2/memory/3324-187-0x00007FF765980000-0x00007FF765CD1000-memory.dmp	upx
behavioral2/memory/5376-189-0x00007FF7763E0000-0x00007FF776731000-memory.dmp	upx
behavioral2/memory/5232-190-0x00007FF791040000-0x00007FF791391000-memory.dmp	upx
behavioral2/memory/4536-191-0x00007FF6EB090000-0x00007FF6EB3E1000-memory.dmp	upx
behavioral2/memory/2856-206-0x00007FF77C600000-0x00007FF77C951000-memory.dmp	upx
behavioral2/memory/2504-210-0x00007FF7DE1C0000-0x00007FF7DE511000-memory.dmp	upx
behavioral2/memory/4676-209-0x00007FF760500000-0x00007FF760851000-memory.dmp	upx
behavioral2/memory/2616-225-0x00007FF7DE550000-0x00007FF7DE8A1000-memory.dmp	upx
behavioral2/memory/2972-229-0x00007FF72B8F0000-0x00007FF72BC41000-memory.dmp	upx
behavioral2/memory/408-234-0x00007FF635B20000-0x00007FF635E71000-memory.dmp	upx
behavioral2/memory/476-236-0x00007FF726CB0000-0x00007FF727001000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\DOCPnON.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\UHHeQRO.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\aiFBOrr.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\rTwvxRi.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\tcfycHC.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\cikcsCp.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\uHgWfwR.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\ohONGYa.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\dmtTVJO.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\sgVvzcM.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\NNDJmZJ.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\MHxlDKV.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\rdWQseO.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\cssAOZW.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\ERyOsXO.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\OJsQMJU.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\CAdXzOQ.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\nxjaUdx.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\WKAkEHN.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\yljwdUj.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\orlUSLH.exe	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
Token: SeLockMemoryPrivilege	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4232	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	89
PID 4324 wrote to memory of 3324	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	90
PID 4324 wrote to memory of 5376	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	91
PID 4324 wrote to memory of 4536	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	93
PID 4324 wrote to memory of 5232	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	94
PID 4324 wrote to memory of 2856	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	95
PID 4324 wrote to memory of 2504	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	96
PID 4324 wrote to memory of 4676	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	97
PID 4324 wrote to memory of 2972	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	98
PID 4324 wrote to memory of 5100	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	99
PID 4324 wrote to memory of 5976	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	100
PID 4324 wrote to memory of 5468	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	101
PID 4324 wrote to memory of 2724	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	102
PID 4324 wrote to memory of 1360	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	103
PID 4324 wrote to memory of 3096	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	104
PID 4324 wrote to memory of 8	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	105
PID 4324 wrote to memory of 2616	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	106
PID 4324 wrote to memory of 408	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	107
PID 4324 wrote to memory of 476	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	108
PID 4324 wrote to memory of 3300	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	109
PID 4324 wrote to memory of 6064	4324	2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_81e73ec20b30b1b61581d36247414bbc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\System\yljwdUj.exe
  C:\Windows\System\yljwdUj.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\orlUSLH.exe
  C:\Windows\System\orlUSLH.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\tcfycHC.exe
  C:\Windows\System\tcfycHC.exe
  2⤵
  - Executes dropped EXE
  PID:5376
- C:\Windows\System\DOCPnON.exe
  C:\Windows\System\DOCPnON.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\MHxlDKV.exe
  C:\Windows\System\MHxlDKV.exe
  2⤵
  - Executes dropped EXE
  PID:5232
- C:\Windows\System\rdWQseO.exe
  C:\Windows\System\rdWQseO.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\UHHeQRO.exe
  C:\Windows\System\UHHeQRO.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\aiFBOrr.exe
  C:\Windows\System\aiFBOrr.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\cikcsCp.exe
  C:\Windows\System\cikcsCp.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\sgVvzcM.exe
  C:\Windows\System\sgVvzcM.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\cssAOZW.exe
  C:\Windows\System\cssAOZW.exe
  2⤵
  - Executes dropped EXE
  PID:5976
- C:\Windows\System\uHgWfwR.exe
  C:\Windows\System\uHgWfwR.exe
  2⤵
  - Executes dropped EXE
  PID:5468
- C:\Windows\System\ERyOsXO.exe
  C:\Windows\System\ERyOsXO.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\OJsQMJU.exe
  C:\Windows\System\OJsQMJU.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\CAdXzOQ.exe
  C:\Windows\System\CAdXzOQ.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\ohONGYa.exe
  C:\Windows\System\ohONGYa.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\nxjaUdx.exe
  C:\Windows\System\nxjaUdx.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\NNDJmZJ.exe
  C:\Windows\System\NNDJmZJ.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\WKAkEHN.exe
  C:\Windows\System\WKAkEHN.exe
  2⤵
  - Executes dropped EXE
  PID:476
- C:\Windows\System\rTwvxRi.exe
  C:\Windows\System\rTwvxRi.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\dmtTVJO.exe
  C:\Windows\System\dmtTVJO.exe
  2⤵
  - Executes dropped EXE
  PID:6064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CAdXzOQ.exe

Path C:\Windows\System\CAdXzOQ.exe
Size 5.2MB
SHA256 cba66c7d825fde475cd2777fd4321df9ce8ad0da9f20c509360657d0ba58af8f
MD5 040d1d100e415485728785ad522389b9
SHA1 57e7055fb1af7cff0889c85b0f4fff38fb62c6c3
SHA512 ab33ca15d8bb4af165f7741e724df3b0e8b5741fcf92035a7ad7485a14b1864e7e0af91f5f022b775a2406f3dc96dc88c919159fc5e632c70fe94dc4481a745b
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibf56utgpPFotBER/mQ32lUh
TLSH
T11A465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DOCPnON.exe

Path C:\Windows\System\DOCPnON.exe
Size 5.2MB
SHA256 a3c629373198488a5d2e2ab322d2899a970003895345e7bca5c04b49f0acf3bf
MD5 5c625304d2c5184933e00d6a2ccb321a
SHA1 f996757dd237ecf7b4ad0e330b9a4e8225bb76e3
SHA512 12c9b7159c289448d39d03efda2f74a2bb21480533d5dc2e94548bca7b018dd8aa5cfaa311f90bd094969d440a7b15240c7ff4036c4f0978c1fd374a56dea6e9
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6le:RWWBibf56utgpPFotBER/mQ32lUq
TLSH
T1CB465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ERyOsXO.exe

Path C:\Windows\System\ERyOsXO.exe
Size 5.2MB
SHA256 8a2b9f4c1c0d7631d902648a1cfbe3d92ebce682989993b546c1def6daebb5a2
MD5 1cd2266de4db91ca8ab882a4a0bd0380
SHA1 49068231e7e2bcd5a90f8192158462927d18baf6
SHA512 470b47d448b3e34cee54d890cbd2da6b91f7f5ba8e4faf293dac32b396697adfa071244bb3352d202cc38dd8f9f1056bb60f1117c8410d817bdcef5a1633cda9
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibf56utgpPFotBER/mQ32lUu
TLSH
T102465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MHxlDKV.exe

Path C:\Windows\System\MHxlDKV.exe
Size 5.2MB
SHA256 2ae245d3a3b308d843dda02f446a01c8f417424a3aac3db46002da55555a6bc4
MD5 14a8a8593a01c3657614ebe0d60729cc
SHA1 354fe193251c8c8a45abdcd7ab18d2b978fad912
SHA512 85840347daedce086012aa60eba19bbbea7803bc8986feafa9e31fc499b0f28b2ec8c0a82c0899020e0d860e18bda12b2cb2f6d5b2ba0f32102d9b340c4ff5b2
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibf56utgpPFotBER/mQ32lUm
TLSH
T1CB465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NNDJmZJ.exe

Path C:\Windows\System\NNDJmZJ.exe
Size 5.2MB
SHA256 a4585627b894be88835acbe4b7ec76df3ddc53deee606755392205f15359e18d
MD5 3445d1a4f48443be488ed5c46d077f52
SHA1 a1d2c887d6c1c360bb7ece9fa529eb14a4d603ab
SHA512 fa74f2f4182ce120ef330cb20ff294cf439a3a325106866d1e7d73217f24433c298cb61b092dbd4097c75361ad3a6ae55e298154207092967def6e71290b790d
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l3:RWWBibf56utgpPFotBER/mQ32lUD
TLSH
T1AF465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OJsQMJU.exe

Path C:\Windows\System\OJsQMJU.exe
Size 5.2MB
SHA256 57b6b265e6ac73fefddf890fbfb5c24e5b2a63352d2fc43a9a38277cea26caa1
MD5 8f4d2c71c18385afad29159c58ef99f7
SHA1 8e70ef63a4f20da21bc1b43c785578d8688ad0a5
SHA512 ee5eaa52024f4f2524680ae017e188aecaa2517fae3b10b89c38f4b7ef810530821e9bd77b14c3a957032751a60e0633eccf950f88cfe2ce91685e00b6c96db9
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUr
TLSH
T12D465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UHHeQRO.exe

Path C:\Windows\System\UHHeQRO.exe
Size 5.2MB
SHA256 6d11fb39e5e4e2173eedba124f1c61f0eb3d52899ba36abc6d945a7982f15965
MD5 1d895ce0281c012d19574baf04c65c9c
SHA1 8cd8ed90dd8ff59a7d0b6b4b4b95632fec8f1728
SHA512 484fb6f5bf17902bd4bbb3f1f17da7f2b2327fb14169f3f84c08c426a0f51e9b831a7d9efaee2e5390d8a36be228645480e054dd7d21f0f67180d52610f8af1e
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l6:RWWBibf56utgpPFotBER/mQ32lU2
TLSH
T1E4465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WKAkEHN.exe

Path C:\Windows\System\WKAkEHN.exe
Size 5.2MB
SHA256 d5ca304ebc5281465ea89f9fd79f2bcd3d53fdcf24d9d626a3e0a565752aca33
MD5 c1ab92dab51ee36cc0fbb87e03e57b7b
SHA1 309f1b68ea24cae461aae44c7da420592db536af
SHA512 091954642414146bf6e793e1b3b1ca920145ca3dbbd811a09b6ab0404ff3dca156f441a96573ed108e44feddfe52a1353c0ec28b2fd4be42ed8544298342f34c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibf56utgpPFotBER/mQ32lUl
TLSH
T1C2465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aiFBOrr.exe

Path C:\Windows\System\aiFBOrr.exe
Size 5.2MB
SHA256 cbb9b3ff6876c43e3e525fad40fadcefebed9ce02c0639ef2184f7035458309b
MD5 501368a179e43ffb8a574ea2d659c3bb
SHA1 1650b462caa366cc22a818a76a9d2e910c8112fe
SHA512 7774ef67ec7f212c11c4a559d1975bb657f07fc4a5381539949801707c8f679ef67064d54181ff4f81fea137621958c056a4729bdf41f32cce6532a4322459fa
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lb:RWWBibf56utgpPFotBER/mQ32lUv
TLSH
T160465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cikcsCp.exe

Path C:\Windows\System\cikcsCp.exe
Size 5.2MB
SHA256 43fda0ca1f23549c7ab7d430a129605a4dbd9fba8635fd2e2729f7b4cf8f989b
MD5 43b4469563d99ffebfbfe3c3e32fc4da
SHA1 5b50370beccc1d06a0342902044dfc61c355ef24
SHA512 ee9aeacb6d746e0bcfc6e951663ca323a5d3dbf639061adb5901826471899f29917ef177f230dec467ad332b138158bf77750679a41c04672112a71601206dc3
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lY:RWWBibf56utgpPFotBER/mQ32lUU
TLSH
T110465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cssAOZW.exe

Path C:\Windows\System\cssAOZW.exe
Size 5.2MB
SHA256 9cb48e173a1350bba2d86682ef7843ee999029737be7daff28ea4b36342e6d95
MD5 e4f72dc3cbdb8dd43157c60cd7f92b7c
SHA1 989837deaae864d5a18f32ca3292cac0fb2ac866
SHA512 7853a2a44f011f3c81c53018cc07f3eabe5918bb6ef87b3a298fbb6bd0e3b83f2b671fac9fbb3924a07ea38f21f941c96ccd0c849cf7d16c79ef01b4a4cf26ef
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBibf56utgpPFotBER/mQ32lUF
TLSH
T15B465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dmtTVJO.exe

Path C:\Windows\System\dmtTVJO.exe
Size 5.2MB
SHA256 f6d82cbc7d6154ed9ad8e45d45a09c65c41fa0484cb8f001f7b7d81b0e9168d5
MD5 643b35ba704a92afa3618f0cba78b289
SHA1 25fdce28bf971f9c1c559659bacae364e2fe3184
SHA512 723573f418fb5148d0b214822bef24257ef3cf54f4f4590f015903f930da789a51a300fb958107034fd1e75f10b05f9eb79a6ef30ff31f73c74550e7a15923b8
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lo:RWWBibf56utgpPFotBER/mQ32lUM
TLSH
T1C8465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nxjaUdx.exe

Path C:\Windows\System\nxjaUdx.exe
Size 5.2MB
SHA256 7f4fb5fc035dde2cf529159720569d079ef3e75ce145adf545f720a020dd3d1f
MD5 07d05b07856f7dc89ed08bf0dcccdb09
SHA1 a315f73ec51d419ba70b49fc196ac5dc12220ccb
SHA512 6ae731af42c5f5bd6ee1dc19fed0172f702f9fd775e80b2a09a5c00db1b64c4d9b1dd2db59fd503e4435172da26230506c5caa4cc6041a69dc2b54b954e712f8
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lN:RWWBibf56utgpPFotBER/mQ32lUB
TLSH
T1AC465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ohONGYa.exe

Path C:\Windows\System\ohONGYa.exe
Size 5.2MB
SHA256 e8cc577c81d4d6962fcba838d243134fb5031c7344153cbf6a3f2c0ee945166e
MD5 e90b9e955098af7cc113f0458a191284
SHA1 6df2b181d1232781f6ce6d3343c5861caafb229e
SHA512 fc39cf0a07eaf58d0670fba641526cb69f8e586ffa3701103708136b0ac29d559c209451a2be4cfb9883c589b491a49ef86c28097cd83fbd3ebdaafade64f2e3
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lv:RWWBibf56utgpPFotBER/mQ32lU7
TLSH
T1F9465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orlUSLH.exe

Path C:\Windows\System\orlUSLH.exe
Size 5.2MB
SHA256 40f621f80cb614a64a709368a3498c95c962bddb85ae29e48e4d9d6aa36b5679
MD5 770002c112cd7a5ffaf06a87282be9f5
SHA1 9a8431ba0fe99da3f412b4352d72601dd88bce39
SHA512 55390f8ada8459ca22395e9ea4112ed6b9ea1244db4f00ec180a23e9ee56c3a727b61b7508f2412fbc3335d1334e4b053a2522ae45d5ddffb0f6c31ee3e6b463
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lx:RWWBibf56utgpPFotBER/mQ32lUt
TLSH
T121465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rTwvxRi.exe

Path C:\Windows\System\rTwvxRi.exe
Size 5.2MB
SHA256 cd1aebe6014176376ed191e931a5daa66cbbcf829e70e088c0df7058d88bcf2a
MD5 b1f21df29e738b57db44340139b9e670
SHA1 da4699ff66ab2fcc5048d2b90d5c0f5a34faf253
SHA512 6456617b4d32a8563d9c9705b455b41b9a8de7acb6e60edb457144e1c89a961fbd12de6675f0d7f63c1e45a8440ce9355c2a66b534e679f1fe14726f31ffb9bf
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lT:RWWBibf56utgpPFotBER/mQ32lUf
TLSH
T102465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rdWQseO.exe

Path C:\Windows\System\rdWQseO.exe
Size 5.2MB
SHA256 5b34cec81506da7050c364c2307dd44c0e77295309ead70402e76fc205bf37a2
MD5 3952d7499d8fab8696ff60c046aa2829
SHA1 8a9eafc6c5c1aab9cdb7d72b5af9c533e8a47bd0
SHA512 abe3317d5231f110b3df62e9b26eb7f1a99146434f48572cff71b37e6b982b27f137cc4bc480362b3924fd3b0a1c09aab1d2b25a7ed7520980ab0d8f725130a0
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l5:RWWBibf56utgpPFotBER/mQ32lUt
TLSH
T184465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sgVvzcM.exe

Path C:\Windows\System\sgVvzcM.exe
Size 5.2MB
SHA256 63836ac251b59e352bef76c728eca2c69892fc295106944a58b5f584915d3c34
MD5 2ab0b598ca9bd9229955015ece7ac04c
SHA1 736a92aef8c8552bf469155ca942a2917680ea8f
SHA512 d6833eef12d2c4f70bcaff395124fa6dde7bd1853f541d69620cfb5b0afe9d8345e9624da82a2d42885722347062ccf30a8df3e66b44c88f7017b196e83cbf6f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUj
TLSH
T15F465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tcfycHC.exe

Path C:\Windows\System\tcfycHC.exe
Size 5.2MB
SHA256 60f60d2ca80c1c321d62ffd00e8c412b5a54a11c6c12828c5a69d92efde7efd4
MD5 ab5f5bdbb6f44af8fe9740e4b4a73b02
SHA1 65e64af5bf68ed2aa2249e61a572621b56fa774c
SHA512 43ad4b0fa8d91290ab9d562301dd9e7c0cb8dbb0def90878fa7b28b14668d63d212061b2a5635d9eb05b1a29dea26d462d788a64271507353c513ca35ce3d357
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibf56utgpPFotBER/mQ32lUi
TLSH
T13A465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uHgWfwR.exe

Path C:\Windows\System\uHgWfwR.exe
Size 5.2MB
SHA256 d5b3e743d34c70c8ed5e757dfd321c8315d0f84c994bb29b2aedcd4ab71aa1d0
MD5 288af38ac1e783efaf897d756d0e6cb0
SHA1 5a7f3ae4bc6999442a7308f751ae2801a5aba552
SHA512 d7a569ce9a0a0372341f4c7a439b8939fb1721169637a7165c6f5da9da89d410187e7199a59e943aa8fa81dc4290d8ab8431813f3f498d9043b8b3d1c17db84d
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibf56utgpPFotBER/mQ32lU0
TLSH
T1D0465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yljwdUj.exe

Path C:\Windows\System\yljwdUj.exe
Size 5.2MB
SHA256 10d3cd1ce411666ccd1450550a640254055ed009865f1725e6e02c1b907dfe1c
MD5 ed7ad238a0ef33acc37e3a80965dadca
SHA1 fbd881f9ddd4e337005bffbbb0058d1649360005
SHA512 d2fde0a6bc745d871b5c6aa3da2209bb022743193977d8a9ba219078f4b6876cb189aa874c38a26bcf0237c1a80f87a48715cebd5d2a551f790c4cfd8319b25f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibf56utgpPFotBER/mQ32lUy
TLSH
T1CD465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-127-0x00007FF6B66C0000-0x00007FF6B6A11000-memory.dmp

Download

memory/8-230-0x00007FF6B66C0000-0x00007FF6B6A11000-memory.dmp

Download

memory/408-234-0x00007FF635B20000-0x00007FF635E71000-memory.dmp

Download

memory/408-129-0x00007FF635B20000-0x00007FF635E71000-memory.dmp

Download

memory/476-236-0x00007FF726CB0000-0x00007FF727001000-memory.dmp

Download

memory/476-130-0x00007FF726CB0000-0x00007FF727001000-memory.dmp

Download

memory/1360-125-0x00007FF799F30000-0x00007FF79A281000-memory.dmp

Download

memory/1360-233-0x00007FF799F30000-0x00007FF79A281000-memory.dmp

Download

memory/2504-118-0x00007FF7DE1C0000-0x00007FF7DE511000-memory.dmp

Download

memory/2504-210-0x00007FF7DE1C0000-0x00007FF7DE511000-memory.dmp

Download

memory/2616-225-0x00007FF7DE550000-0x00007FF7DE8A1000-memory.dmp

Download

memory/2616-128-0x00007FF7DE550000-0x00007FF7DE8A1000-memory.dmp

Download

memory/2724-124-0x00007FF7C7540000-0x00007FF7C7891000-memory.dmp

Download

memory/2724-218-0x00007FF7C7540000-0x00007FF7C7891000-memory.dmp

Download

memory/2856-133-0x00007FF77C600000-0x00007FF77C951000-memory.dmp

Download

memory/2856-206-0x00007FF77C600000-0x00007FF77C951000-memory.dmp

Download

memory/2972-120-0x00007FF72B8F0000-0x00007FF72BC41000-memory.dmp

Download

memory/2972-229-0x00007FF72B8F0000-0x00007FF72BC41000-memory.dmp

Download

memory/3096-126-0x00007FF7B89B0000-0x00007FF7B8D01000-memory.dmp

Download

memory/3096-212-0x00007FF7B89B0000-0x00007FF7B8D01000-memory.dmp

Download

memory/3300-238-0x00007FF79EA80000-0x00007FF79EDD1000-memory.dmp

Download

memory/3300-131-0x00007FF79EA80000-0x00007FF79EDD1000-memory.dmp

Download

memory/3324-113-0x00007FF765980000-0x00007FF765CD1000-memory.dmp

Download

memory/3324-14-0x00007FF765980000-0x00007FF765CD1000-memory.dmp

Download

memory/3324-187-0x00007FF765980000-0x00007FF765CD1000-memory.dmp

Download

memory/4232-7-0x00007FF66FF90000-0x00007FF6702E1000-memory.dmp

Download

memory/4232-185-0x00007FF66FF90000-0x00007FF6702E1000-memory.dmp

Download

memory/4232-112-0x00007FF66FF90000-0x00007FF6702E1000-memory.dmp

Download

memory/4324-1-0x000001979DEB0000-0x000001979DEC0000-memory.dmp

Download

memory/4324-244-0x00007FF770CF0000-0x00007FF771041000-memory.dmp

Download

memory/4324-157-0x00007FF770CF0000-0x00007FF771041000-memory.dmp

Download

memory/4324-179-0x00007FF770CF0000-0x00007FF771041000-memory.dmp

Download

memory/4324-134-0x00007FF770CF0000-0x00007FF771041000-memory.dmp

Download

memory/4324-242-0x00007FF770CF0000-0x00007FF771041000-memory.dmp

Download

memory/4324-250-0x00007FF770CF0000-0x00007FF771041000-memory.dmp

Download

memory/4324-241-0x00007FF770CF0000-0x00007FF771041000-memory.dmp

Download

memory/4324-248-0x00007FF770CF0000-0x00007FF771041000-memory.dmp

Download

memory/4324-156-0x00007FF770CF0000-0x00007FF771041000-memory.dmp

Download

memory/4324-111-0x00007FF770CF0000-0x00007FF771041000-memory.dmp

Download

memory/4324-245-0x00007FF770CF0000-0x00007FF771041000-memory.dmp

Download

memory/4324-243-0x00007FF770CF0000-0x00007FF771041000-memory.dmp

Download

memory/4324-247-0x00007FF770CF0000-0x00007FF771041000-memory.dmp

Download

memory/4324-249-0x00007FF770CF0000-0x00007FF771041000-memory.dmp

Download

memory/4324-0-0x00007FF770CF0000-0x00007FF771041000-memory.dmp

Download

memory/4324-246-0x00007FF770CF0000-0x00007FF771041000-memory.dmp

Download

memory/4536-115-0x00007FF6EB090000-0x00007FF6EB3E1000-memory.dmp

Download

memory/4536-191-0x00007FF6EB090000-0x00007FF6EB3E1000-memory.dmp

Download

memory/4536-110-0x00007FF6EB090000-0x00007FF6EB3E1000-memory.dmp

Download

memory/4676-209-0x00007FF760500000-0x00007FF760851000-memory.dmp

Download

memory/4676-119-0x00007FF760500000-0x00007FF760851000-memory.dmp

Download

memory/5100-227-0x00007FF6E4640000-0x00007FF6E4991000-memory.dmp

Download

memory/5100-121-0x00007FF6E4640000-0x00007FF6E4991000-memory.dmp

Download

memory/5232-116-0x00007FF791040000-0x00007FF791391000-memory.dmp

Download

memory/5232-190-0x00007FF791040000-0x00007FF791391000-memory.dmp

Download

memory/5376-114-0x00007FF7763E0000-0x00007FF776731000-memory.dmp

Download

memory/5376-18-0x00007FF7763E0000-0x00007FF776731000-memory.dmp

Download

memory/5376-189-0x00007FF7763E0000-0x00007FF776731000-memory.dmp

Download

memory/5468-214-0x00007FF6257E0000-0x00007FF625B31000-memory.dmp

Download

memory/5468-123-0x00007FF6257E0000-0x00007FF625B31000-memory.dmp

Download

memory/5976-216-0x00007FF64D900000-0x00007FF64DC51000-memory.dmp

Download

memory/5976-122-0x00007FF64D900000-0x00007FF64DC51000-memory.dmp

Download

memory/6064-240-0x00007FF689810000-0x00007FF689B61000-memory.dmp

Download

memory/6064-132-0x00007FF689810000-0x00007FF689B61000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads