cobaltstrike | 7861ec2249ef0e1f8f6c7024d351178aa6e43e5a97d4fae9cddf881ab8080124

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
Size 5.2MB
Sample260910-a25khashng
SHA256 7861ec2249ef0e1f8f6c7024d351178aa6e43e5a97d4fae9cddf881ab8080124
MD5 0947628caae10148e753ee62fd37394a
SHA1 346c9a0cd88a2d08740b58d402991a5554523248
SHA512 e89323535027b203f08a9b9c62277a189da99a5fe9d94a941002839076e0675058bf9874a6da7ef5bb5761b40658bb3c4de0a242c37151d5270ecf0fa35755fc
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lQ:RWWBibf56utgpPFotBER/mQ32lUM
TLSH
T16E465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x0007000000024679-44.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024681-73.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024687-93.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024682-109.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024680-105.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024686-103.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002467b-98.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002467c-96.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002467a-94.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024678-91.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024685-88.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024684-87.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024683-85.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002467f-84.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002467d-77.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024675-74.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002467e-62.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024677-37.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024676-29.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024674-14.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000024670-8.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024679-44.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024681-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024687-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024682-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024680-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024686-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002467b-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002467c-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002467a-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024678-91.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024685-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024684-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024683-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002467f-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002467d-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024675-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002467e-62.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024677-37.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024676-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024674-14.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0008000000024670-8.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral1/memory/4488-0-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	UPX
behavioral1/files/0x0007000000024679-44.dat	UPX
behavioral1/files/0x0007000000024681-73.dat	UPX
behavioral1/files/0x0007000000024687-93.dat	UPX
behavioral1/files/0x0007000000024682-109.dat	UPX
behavioral1/memory/2032-118-0x00007FF74ADA0000-0x00007FF74B0F1000-memory.dmp	UPX
behavioral1/memory/4296-126-0x00007FF742260000-0x00007FF7425B1000-memory.dmp	UPX
behavioral1/memory/5604-125-0x00007FF7A9390000-0x00007FF7A96E1000-memory.dmp	UPX
behavioral1/memory/1564-124-0x00007FF616390000-0x00007FF6166E1000-memory.dmp	UPX
behavioral1/memory/4532-123-0x00007FF63AFD0000-0x00007FF63B321000-memory.dmp	UPX
behavioral1/memory/3532-122-0x00007FF75CBA0000-0x00007FF75CEF1000-memory.dmp	UPX
behavioral1/memory/5960-121-0x00007FF7DFE20000-0x00007FF7E0171000-memory.dmp	UPX
behavioral1/memory/1892-120-0x00007FF607010000-0x00007FF607361000-memory.dmp	UPX
behavioral1/memory/5052-119-0x00007FF68EA60000-0x00007FF68EDB1000-memory.dmp	UPX
behavioral1/memory/3820-117-0x00007FF7BEC40000-0x00007FF7BEF91000-memory.dmp	UPX
behavioral1/memory/688-116-0x00007FF645890000-0x00007FF645BE1000-memory.dmp	UPX
behavioral1/memory/2252-115-0x00007FF6D10F0000-0x00007FF6D1441000-memory.dmp	UPX
behavioral1/memory/840-114-0x00007FF7F9980000-0x00007FF7F9CD1000-memory.dmp	UPX
behavioral1/memory/3140-113-0x00007FF6D8400000-0x00007FF6D8751000-memory.dmp	UPX
behavioral1/memory/2404-106-0x00007FF7A3270000-0x00007FF7A35C1000-memory.dmp	UPX
behavioral1/files/0x0007000000024680-105.dat	UPX
behavioral1/files/0x0007000000024686-103.dat	UPX
behavioral1/memory/4836-101-0x00007FF7BA350000-0x00007FF7BA6A1000-memory.dmp	UPX
behavioral1/files/0x000700000002467b-98.dat	UPX
behavioral1/files/0x000700000002467c-96.dat	UPX
behavioral1/files/0x000700000002467a-94.dat	UPX
behavioral1/files/0x0007000000024678-91.dat	UPX
behavioral1/files/0x0007000000024685-88.dat	UPX
behavioral1/files/0x0007000000024684-87.dat	UPX
behavioral1/files/0x0007000000024683-85.dat	UPX
behavioral1/files/0x000700000002467f-84.dat	UPX
behavioral1/memory/4236-80-0x00007FF7531B0000-0x00007FF753501000-memory.dmp	UPX
behavioral1/files/0x000700000002467d-77.dat	UPX
behavioral1/files/0x0007000000024675-74.dat	UPX
behavioral1/files/0x000700000002467e-62.dat	UPX
behavioral1/memory/3792-79-0x00007FF740EF0000-0x00007FF741241000-memory.dmp	UPX
behavioral1/memory/972-58-0x00007FF671620000-0x00007FF671971000-memory.dmp	UPX
behavioral1/memory/5672-56-0x00007FF7287A0000-0x00007FF728AF1000-memory.dmp	UPX
behavioral1/files/0x0007000000024677-37.dat	UPX
behavioral1/files/0x0007000000024676-29.dat	UPX
behavioral1/memory/4508-24-0x00007FF73A830000-0x00007FF73AB81000-memory.dmp	UPX
behavioral1/files/0x0007000000024674-14.dat	UPX
behavioral1/files/0x0008000000024670-8.dat	UPX
behavioral1/memory/3820-143-0x00007FF7BEC40000-0x00007FF7BEF91000-memory.dmp	UPX
behavioral1/memory/3792-134-0x00007FF740EF0000-0x00007FF741241000-memory.dmp	UPX
behavioral1/memory/5672-131-0x00007FF7287A0000-0x00007FF728AF1000-memory.dmp	UPX
behavioral1/memory/4508-129-0x00007FF73A830000-0x00007FF73AB81000-memory.dmp	UPX
behavioral1/memory/4488-128-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	UPX
behavioral1/memory/4488-172-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	UPX
behavioral1/memory/4488-194-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	UPX
behavioral1/memory/4488-195-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	UPX
behavioral1/memory/4508-217-0x00007FF73A830000-0x00007FF73AB81000-memory.dmp	UPX
behavioral1/memory/4532-218-0x00007FF63AFD0000-0x00007FF63B321000-memory.dmp	UPX
behavioral1/memory/1564-220-0x00007FF616390000-0x00007FF6166E1000-memory.dmp	UPX
behavioral1/memory/5604-228-0x00007FF7A9390000-0x00007FF7A96E1000-memory.dmp	UPX
behavioral1/memory/5672-227-0x00007FF7287A0000-0x00007FF728AF1000-memory.dmp	UPX
behavioral1/memory/972-225-0x00007FF671620000-0x00007FF671971000-memory.dmp	UPX
behavioral1/memory/4236-222-0x00007FF7531B0000-0x00007FF753501000-memory.dmp	UPX
behavioral1/memory/4296-235-0x00007FF742260000-0x00007FF7425B1000-memory.dmp	UPX
behavioral1/memory/5960-237-0x00007FF7DFE20000-0x00007FF7E0171000-memory.dmp	UPX
behavioral1/memory/3792-254-0x00007FF740EF0000-0x00007FF741241000-memory.dmp	UPX
behavioral1/memory/2252-252-0x00007FF6D10F0000-0x00007FF6D1441000-memory.dmp	UPX
behavioral1/memory/5052-251-0x00007FF68EA60000-0x00007FF68EDB1000-memory.dmp	UPX
behavioral1/memory/1892-249-0x00007FF607010000-0x00007FF607361000-memory.dmp	UPX

XMRig Miner payload 58 IoCs

miner

resource	yara_rule
behavioral1/memory/2032-118-0x00007FF74ADA0000-0x00007FF74B0F1000-memory.dmp	xmrig
behavioral1/memory/4296-126-0x00007FF742260000-0x00007FF7425B1000-memory.dmp	xmrig
behavioral1/memory/5604-125-0x00007FF7A9390000-0x00007FF7A96E1000-memory.dmp	xmrig
behavioral1/memory/1564-124-0x00007FF616390000-0x00007FF6166E1000-memory.dmp	xmrig
behavioral1/memory/4532-123-0x00007FF63AFD0000-0x00007FF63B321000-memory.dmp	xmrig
behavioral1/memory/3532-122-0x00007FF75CBA0000-0x00007FF75CEF1000-memory.dmp	xmrig
behavioral1/memory/5960-121-0x00007FF7DFE20000-0x00007FF7E0171000-memory.dmp	xmrig
behavioral1/memory/1892-120-0x00007FF607010000-0x00007FF607361000-memory.dmp	xmrig
behavioral1/memory/5052-119-0x00007FF68EA60000-0x00007FF68EDB1000-memory.dmp	xmrig
behavioral1/memory/3820-117-0x00007FF7BEC40000-0x00007FF7BEF91000-memory.dmp	xmrig
behavioral1/memory/688-116-0x00007FF645890000-0x00007FF645BE1000-memory.dmp	xmrig
behavioral1/memory/2252-115-0x00007FF6D10F0000-0x00007FF6D1441000-memory.dmp	xmrig
behavioral1/memory/840-114-0x00007FF7F9980000-0x00007FF7F9CD1000-memory.dmp	xmrig
behavioral1/memory/3140-113-0x00007FF6D8400000-0x00007FF6D8751000-memory.dmp	xmrig
behavioral1/memory/2404-106-0x00007FF7A3270000-0x00007FF7A35C1000-memory.dmp	xmrig
behavioral1/memory/4836-101-0x00007FF7BA350000-0x00007FF7BA6A1000-memory.dmp	xmrig
behavioral1/memory/4236-80-0x00007FF7531B0000-0x00007FF753501000-memory.dmp	xmrig
behavioral1/memory/972-58-0x00007FF671620000-0x00007FF671971000-memory.dmp	xmrig
behavioral1/memory/4508-24-0x00007FF73A830000-0x00007FF73AB81000-memory.dmp	xmrig
behavioral1/memory/3820-143-0x00007FF7BEC40000-0x00007FF7BEF91000-memory.dmp	xmrig
behavioral1/memory/3792-134-0x00007FF740EF0000-0x00007FF741241000-memory.dmp	xmrig
behavioral1/memory/5672-131-0x00007FF7287A0000-0x00007FF728AF1000-memory.dmp	xmrig
behavioral1/memory/4508-129-0x00007FF73A830000-0x00007FF73AB81000-memory.dmp	xmrig
behavioral1/memory/4488-128-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	xmrig
behavioral1/memory/4488-172-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	xmrig
behavioral1/memory/4488-194-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	xmrig
behavioral1/memory/4488-195-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	xmrig
behavioral1/memory/4508-217-0x00007FF73A830000-0x00007FF73AB81000-memory.dmp	xmrig
behavioral1/memory/4532-218-0x00007FF63AFD0000-0x00007FF63B321000-memory.dmp	xmrig
behavioral1/memory/1564-220-0x00007FF616390000-0x00007FF6166E1000-memory.dmp	xmrig
behavioral1/memory/5604-228-0x00007FF7A9390000-0x00007FF7A96E1000-memory.dmp	xmrig
behavioral1/memory/5672-227-0x00007FF7287A0000-0x00007FF728AF1000-memory.dmp	xmrig
behavioral1/memory/972-225-0x00007FF671620000-0x00007FF671971000-memory.dmp	xmrig
behavioral1/memory/4236-222-0x00007FF7531B0000-0x00007FF753501000-memory.dmp	xmrig
behavioral1/memory/4296-235-0x00007FF742260000-0x00007FF7425B1000-memory.dmp	xmrig
behavioral1/memory/5960-237-0x00007FF7DFE20000-0x00007FF7E0171000-memory.dmp	xmrig
behavioral1/memory/3792-254-0x00007FF740EF0000-0x00007FF741241000-memory.dmp	xmrig
behavioral1/memory/2252-252-0x00007FF6D10F0000-0x00007FF6D1441000-memory.dmp	xmrig
behavioral1/memory/5052-251-0x00007FF68EA60000-0x00007FF68EDB1000-memory.dmp	xmrig
behavioral1/memory/1892-249-0x00007FF607010000-0x00007FF607361000-memory.dmp	xmrig
behavioral1/memory/2032-247-0x00007FF74ADA0000-0x00007FF74B0F1000-memory.dmp	xmrig
behavioral1/memory/3532-245-0x00007FF75CBA0000-0x00007FF75CEF1000-memory.dmp	xmrig
behavioral1/memory/2404-239-0x00007FF7A3270000-0x00007FF7A35C1000-memory.dmp	xmrig
behavioral1/memory/688-233-0x00007FF645890000-0x00007FF645BE1000-memory.dmp	xmrig
behavioral1/memory/840-231-0x00007FF7F9980000-0x00007FF7F9CD1000-memory.dmp	xmrig
behavioral1/memory/4836-243-0x00007FF7BA350000-0x00007FF7BA6A1000-memory.dmp	xmrig
behavioral1/memory/3140-241-0x00007FF6D8400000-0x00007FF6D8751000-memory.dmp	xmrig
behavioral1/memory/4488-255-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	xmrig
behavioral1/memory/4488-257-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	xmrig
behavioral1/memory/3820-260-0x00007FF7BEC40000-0x00007FF7BEF91000-memory.dmp	xmrig
behavioral1/memory/4488-261-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	xmrig
behavioral1/memory/4488-262-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	xmrig
behavioral1/memory/4488-263-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	xmrig
behavioral1/memory/4488-264-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	xmrig
behavioral1/memory/4488-265-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	xmrig
behavioral1/memory/4488-266-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	xmrig
behavioral1/memory/4488-267-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	xmrig
behavioral1/memory/4488-268-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4508	JUPRpsy.exe
4532	OIDIcht.exe
5672	CSSHEnK.exe
1564	CPsnakt.exe
972	fCSVAZU.exe
3792	FABcqrX.exe
4236	DVxJxWq.exe
4836	PXwuMZc.exe
2404	gdfgmDo.exe
3140	evomhfY.exe
840	RFgEJfo.exe
5604	LgWBdFk.exe
2252	tdcEWJf.exe
688	BiBCEyX.exe
3820	LhHVPuP.exe
2032	kUZiopU.exe
4296	FnLTfHG.exe
5052	HBGxqJV.exe
1892	SnoEhAb.exe
5960	pKWgEbm.exe
3532	TQMjjlo.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4488-0-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	upx
behavioral1/files/0x0007000000024679-44.dat	upx
behavioral1/files/0x0007000000024681-73.dat	upx
behavioral1/files/0x0007000000024687-93.dat	upx
behavioral1/files/0x0007000000024682-109.dat	upx
behavioral1/memory/2032-118-0x00007FF74ADA0000-0x00007FF74B0F1000-memory.dmp	upx
behavioral1/memory/4296-126-0x00007FF742260000-0x00007FF7425B1000-memory.dmp	upx
behavioral1/memory/5604-125-0x00007FF7A9390000-0x00007FF7A96E1000-memory.dmp	upx
behavioral1/memory/1564-124-0x00007FF616390000-0x00007FF6166E1000-memory.dmp	upx
behavioral1/memory/4532-123-0x00007FF63AFD0000-0x00007FF63B321000-memory.dmp	upx
behavioral1/memory/3532-122-0x00007FF75CBA0000-0x00007FF75CEF1000-memory.dmp	upx
behavioral1/memory/5960-121-0x00007FF7DFE20000-0x00007FF7E0171000-memory.dmp	upx
behavioral1/memory/1892-120-0x00007FF607010000-0x00007FF607361000-memory.dmp	upx
behavioral1/memory/5052-119-0x00007FF68EA60000-0x00007FF68EDB1000-memory.dmp	upx
behavioral1/memory/3820-117-0x00007FF7BEC40000-0x00007FF7BEF91000-memory.dmp	upx
behavioral1/memory/688-116-0x00007FF645890000-0x00007FF645BE1000-memory.dmp	upx
behavioral1/memory/2252-115-0x00007FF6D10F0000-0x00007FF6D1441000-memory.dmp	upx
behavioral1/memory/840-114-0x00007FF7F9980000-0x00007FF7F9CD1000-memory.dmp	upx
behavioral1/memory/3140-113-0x00007FF6D8400000-0x00007FF6D8751000-memory.dmp	upx
behavioral1/memory/2404-106-0x00007FF7A3270000-0x00007FF7A35C1000-memory.dmp	upx
behavioral1/files/0x0007000000024680-105.dat	upx
behavioral1/files/0x0007000000024686-103.dat	upx
behavioral1/memory/4836-101-0x00007FF7BA350000-0x00007FF7BA6A1000-memory.dmp	upx
behavioral1/files/0x000700000002467b-98.dat	upx
behavioral1/files/0x000700000002467c-96.dat	upx
behavioral1/files/0x000700000002467a-94.dat	upx
behavioral1/files/0x0007000000024678-91.dat	upx
behavioral1/files/0x0007000000024685-88.dat	upx
behavioral1/files/0x0007000000024684-87.dat	upx
behavioral1/files/0x0007000000024683-85.dat	upx
behavioral1/files/0x000700000002467f-84.dat	upx
behavioral1/memory/4236-80-0x00007FF7531B0000-0x00007FF753501000-memory.dmp	upx
behavioral1/files/0x000700000002467d-77.dat	upx
behavioral1/files/0x0007000000024675-74.dat	upx
behavioral1/files/0x000700000002467e-62.dat	upx
behavioral1/memory/3792-79-0x00007FF740EF0000-0x00007FF741241000-memory.dmp	upx
behavioral1/memory/972-58-0x00007FF671620000-0x00007FF671971000-memory.dmp	upx
behavioral1/memory/5672-56-0x00007FF7287A0000-0x00007FF728AF1000-memory.dmp	upx
behavioral1/files/0x0007000000024677-37.dat	upx
behavioral1/files/0x0007000000024676-29.dat	upx
behavioral1/memory/4508-24-0x00007FF73A830000-0x00007FF73AB81000-memory.dmp	upx
behavioral1/files/0x0007000000024674-14.dat	upx
behavioral1/files/0x0008000000024670-8.dat	upx
behavioral1/memory/3820-143-0x00007FF7BEC40000-0x00007FF7BEF91000-memory.dmp	upx
behavioral1/memory/3792-134-0x00007FF740EF0000-0x00007FF741241000-memory.dmp	upx
behavioral1/memory/5672-131-0x00007FF7287A0000-0x00007FF728AF1000-memory.dmp	upx
behavioral1/memory/4508-129-0x00007FF73A830000-0x00007FF73AB81000-memory.dmp	upx
behavioral1/memory/4488-128-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	upx
behavioral1/memory/4488-172-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	upx
behavioral1/memory/4488-194-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	upx
behavioral1/memory/4488-195-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp	upx
behavioral1/memory/4508-217-0x00007FF73A830000-0x00007FF73AB81000-memory.dmp	upx
behavioral1/memory/4532-218-0x00007FF63AFD0000-0x00007FF63B321000-memory.dmp	upx
behavioral1/memory/1564-220-0x00007FF616390000-0x00007FF6166E1000-memory.dmp	upx
behavioral1/memory/5604-228-0x00007FF7A9390000-0x00007FF7A96E1000-memory.dmp	upx
behavioral1/memory/5672-227-0x00007FF7287A0000-0x00007FF728AF1000-memory.dmp	upx
behavioral1/memory/972-225-0x00007FF671620000-0x00007FF671971000-memory.dmp	upx
behavioral1/memory/4236-222-0x00007FF7531B0000-0x00007FF753501000-memory.dmp	upx
behavioral1/memory/4296-235-0x00007FF742260000-0x00007FF7425B1000-memory.dmp	upx
behavioral1/memory/5960-237-0x00007FF7DFE20000-0x00007FF7E0171000-memory.dmp	upx
behavioral1/memory/3792-254-0x00007FF740EF0000-0x00007FF741241000-memory.dmp	upx
behavioral1/memory/2252-252-0x00007FF6D10F0000-0x00007FF6D1441000-memory.dmp	upx
behavioral1/memory/5052-251-0x00007FF68EA60000-0x00007FF68EDB1000-memory.dmp	upx
behavioral1/memory/1892-249-0x00007FF607010000-0x00007FF607361000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\TQMjjlo.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\CSSHEnK.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\fCSVAZU.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\PXwuMZc.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\LhHVPuP.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\FnLTfHG.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\JUPRpsy.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\gdfgmDo.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\evomhfY.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\LgWBdFk.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\kUZiopU.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\HBGxqJV.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\SnoEhAb.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\pKWgEbm.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\OIDIcht.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\CPsnakt.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\tdcEWJf.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\BiBCEyX.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\FABcqrX.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\DVxJxWq.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\RFgEJfo.exe	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
Token: SeLockMemoryPrivilege	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 4508	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	85
PID 4488 wrote to memory of 4532	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	86
PID 4488 wrote to memory of 5672	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	87
PID 4488 wrote to memory of 1564	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	88
PID 4488 wrote to memory of 972	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	89
PID 4488 wrote to memory of 3792	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	90
PID 4488 wrote to memory of 4236	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	91
PID 4488 wrote to memory of 4836	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	92
PID 4488 wrote to memory of 2404	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	93
PID 4488 wrote to memory of 3140	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	94
PID 4488 wrote to memory of 840	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	95
PID 4488 wrote to memory of 5604	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	96
PID 4488 wrote to memory of 2252	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	97
PID 4488 wrote to memory of 688	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	98
PID 4488 wrote to memory of 3820	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	99
PID 4488 wrote to memory of 2032	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	100
PID 4488 wrote to memory of 4296	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	101
PID 4488 wrote to memory of 5052	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	102
PID 4488 wrote to memory of 1892	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	103
PID 4488 wrote to memory of 5960	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	104
PID 4488 wrote to memory of 3532	4488	2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_0947628caae10148e753ee62fd37394a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\System\JUPRpsy.exe
  C:\Windows\System\JUPRpsy.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\OIDIcht.exe
  C:\Windows\System\OIDIcht.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\CSSHEnK.exe
  C:\Windows\System\CSSHEnK.exe
  2⤵
  - Executes dropped EXE
  PID:5672
- C:\Windows\System\CPsnakt.exe
  C:\Windows\System\CPsnakt.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\fCSVAZU.exe
  C:\Windows\System\fCSVAZU.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\FABcqrX.exe
  C:\Windows\System\FABcqrX.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\DVxJxWq.exe
  C:\Windows\System\DVxJxWq.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\PXwuMZc.exe
  C:\Windows\System\PXwuMZc.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\gdfgmDo.exe
  C:\Windows\System\gdfgmDo.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\evomhfY.exe
  C:\Windows\System\evomhfY.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\RFgEJfo.exe
  C:\Windows\System\RFgEJfo.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\LgWBdFk.exe
  C:\Windows\System\LgWBdFk.exe
  2⤵
  - Executes dropped EXE
  PID:5604
- C:\Windows\System\tdcEWJf.exe
  C:\Windows\System\tdcEWJf.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\BiBCEyX.exe
  C:\Windows\System\BiBCEyX.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\LhHVPuP.exe
  C:\Windows\System\LhHVPuP.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\kUZiopU.exe
  C:\Windows\System\kUZiopU.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\FnLTfHG.exe
  C:\Windows\System\FnLTfHG.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\HBGxqJV.exe
  C:\Windows\System\HBGxqJV.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\SnoEhAb.exe
  C:\Windows\System\SnoEhAb.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\pKWgEbm.exe
  C:\Windows\System\pKWgEbm.exe
  2⤵
  - Executes dropped EXE
  PID:5960
- C:\Windows\System\TQMjjlo.exe
  C:\Windows\System\TQMjjlo.exe
  2⤵
  - Executes dropped EXE
  PID:3532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BiBCEyX.exe

Path C:\Windows\System\BiBCEyX.exe
Size 5.2MB
SHA256 c8c1c91ea3ee2ddb7711089ea32eff1b5569dfb029e520188acf29e5c6c60e89
MD5 c3e9606faa6dc3a1d3c7d6c783b2d42e
SHA1 255ea65511b9b9ede35203fa4b98c7c62f0ede2f
SHA512 60a07acba6a46d847e872d7928613806db5af140c400be81871a96349e4aea2a4ae5c36ebf464564e28f2c5cee2d847b1efc76b87eca98ed98ef20138d55d55c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l4:RWWBibf56utgpPFotBER/mQ32lUU
TLSH
T144465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CPsnakt.exe

Path C:\Windows\System\CPsnakt.exe
Size 5.2MB
SHA256 63483bba9c2c28ca561e145bd1116e6adc885a14832919a836f137d357fa6327
MD5 4da8eb19f1a9156c610c56d45c315736
SHA1 b8a0dd4e2db75819f4525a0b74f2ef5d2cd9f419
SHA512 44cc688c497b6ee5db95c840e6d058331f16faf73b46877100f6f7cf731f5ed5bed7aab9bc0946986db5ecbac8a93c79ea3ad05124b38b30d98faebaf81e81a2
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibf56utgpPFotBER/mQ32lUa
TLSH
T1E9465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSSHEnK.exe

Path C:\Windows\System\CSSHEnK.exe
Size 5.2MB
SHA256 3f90a9b967a10b01509612f0dfc465e6d04026a4c3ddb28064eacdcd3537384e
MD5 ffc7539c845e629fe90f9e96f87d2930
SHA1 c8add2b656141cff2e5358f489b7f4b4527bc838
SHA512 adf784664efea28f60bda1940d93b11837156419e3b1c42e456d0d320cb0f70d3856c93a8ba3bd333452775d4a32067d4c145493e21c0d1e7fc80201bc10afce
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lb:RWWBibf56utgpPFotBER/mQ32lUf
TLSH
T1F2465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DVxJxWq.exe

Path C:\Windows\System\DVxJxWq.exe
Size 5.2MB
SHA256 7c49ba616c2c714b5171953404c63f95edbf6e5e08e5750c173cc2292b836604
MD5 8aa7d656661020c11f51fdf9c3e5948a
SHA1 a94cc53aa84d53f6648120efc9fb767a3edf4c04
SHA512 4185432f8c32d4596f3abaaadf75f40a3ebba3dae07f15327bea0452d93fe103583f87946f3c70ccb7c5ea7c3d089b83a01e896c8e5a9f730672a020f60fb99e
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lUV
TLSH
T1A3465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FABcqrX.exe

Path C:\Windows\System\FABcqrX.exe
Size 5.2MB
SHA256 3ac849835ffdf1f9124a8fa28a61f8731265406ce0ccbbe4903e83f68431e0c4
MD5 8f0e24d21a1c0d9e8756a9e04e047ef3
SHA1 ee9957deab06c34b232d2083da24bef45c3cef01
SHA512 47508ea587e26b8e736f37500582f242f047470395413d2027449752a849d405a2cdb261daa1ad8783eb2533e524fbe61debbcced6ed180821c070b37e9222f0
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lt:RWWBibf56utgpPFotBER/mQ32lUJ
TLSH
T1FB465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FnLTfHG.exe

Path C:\Windows\System\FnLTfHG.exe
Size 5.2MB
SHA256 2e71a2cf29174e9b836edccf96dd34a4c17e6f5dd34d3aed9b2bac06cd4dcfbb
MD5 8a1bb3d1b91d6932bf7e2cf4ddb2b745
SHA1 aae142fd0ec139e4c71e2527330fff25bf800576
SHA512 9373bf8c9c478cfa7a1d53ed8e51c5d66bc136b63651b5db70fad688ee94684b17aa0bfa18945e775dae5ded42d4725ca8de99dec1f38b06a46f9d9faf899912
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lE:RWWBibf56utgpPFotBER/mQ32lUg
TLSH
T1CF465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HBGxqJV.exe

Path C:\Windows\System\HBGxqJV.exe
Size 5.2MB
SHA256 7711b9e23d36ba9e5a0f3b83add812be2dd2634d3e5b6257ec960ab6302ec4a2
MD5 8fb25d084b849d6cf495ba9ef2749b08
SHA1 5dc05fb240486a12cc503908ee2bac82615eaa53
SHA512 0eca2fbb5f0a96e94acf802bbde919e396fe79c6f98446303417beca12823edc54bc0bf27d120c276d82d83785e32abb470a73d68a4c5c639cd406a366d314fd
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibf56utgpPFotBER/mQ32lUG
TLSH
T104465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JUPRpsy.exe

Path C:\Windows\System\JUPRpsy.exe
Size 5.2MB
SHA256 53c63b94e0fecc032b7f058d23e5c7cd6aee0187c1755e3a62e157b485d71995
MD5 d768d1224e48a02a5fa1fb4085d874e6
SHA1 0ff5ff8e8ae2cb6106f3f4b4cc664bf6e10b81e1
SHA512 dedafa06bb42b14962996dd7aa1ca19905913a4a0aef5e5d0d91959e837f6188a38095f3f8dc99571328d3ed2204958aafcbd45d3740335afdd19f3df4df37f9
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lv:RWWBibf56utgpPFotBER/mQ32lUr
TLSH
T1EC465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LgWBdFk.exe

Path C:\Windows\System\LgWBdFk.exe
Size 5.2MB
SHA256 386dc40e1e50bcc16898046af1ee6b76829ddadf689a8aa2e5bfc2055fee8898
MD5 eb4e274168eb1c933de312b846ca8170
SHA1 d894057db27de7c83c3bf9573a60ff7de9625fb2
SHA512 39534d8a3d56af31dc74a4ff3c6964ee18b00f50a272ce64482906f5f250fa055a67093d8710562d937c27991bd95b09694c719a29a8b75f54f27cd8d2e6de7c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibf56utgpPFotBER/mQ32lUq
TLSH
T1E1465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LhHVPuP.exe

Path C:\Windows\System\LhHVPuP.exe
Size 5.2MB
SHA256 c381c88fe970cbb6b63c01896fb46a5f83ba863212b9847e9194ee4dd9e76c5f
MD5 e8a1cec6b9eb18b9e88a77b066dc6645
SHA1 2d2df4fb1785c29169634c8c5119481663dac4ff
SHA512 c77ad1529fb6403ae6ee40387f3b8ec6ef77d1b828d322085c3be5ed9a7ff12fee85777b53057b1d1b8d19184f39745029de2e72c6c8542e3dbdccf4998b4e2f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lx:RWWBibf56utgpPFotBER/mQ32lU9
TLSH
T15F465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OIDIcht.exe

Path C:\Windows\System\OIDIcht.exe
Size 5.2MB
SHA256 c87e7c1654eebe09b39044e1b42297d1f3734e1780ad9b47441edace130e67c2
MD5 678efcc01ee4318deb04dfabb9b79ada
SHA1 504511bc2b95985183aa5dd6e6c9ff0cda21eb61
SHA512 bd157e354cef18132cd0b960a573fa3e68bbd80f0c0ac55cc12bc89bcfc7846803a8adad62a5a4c4f1378038fb3a23535a29a403a39cba45ee0856323ceb49fc
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ly:RWWBibf56utgpPFotBER/mQ32lUG
TLSH
T170465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PXwuMZc.exe

Path C:\Windows\System\PXwuMZc.exe
Size 5.2MB
SHA256 9bfdb7156802efadeab2c1a55503c50125ddcc4a9f5bdc367f1bd54bd2248500
MD5 07066ca953453c07f3991f9c3eb3e964
SHA1 fc50e225b4ee1373669ebc87bbb18cdb7a33f37c
SHA512 5832bd73d918ca330f667b779493325e975db2df47c0c026496c9fb2db50573b332fd4105a2a7c0db34265e0fdb1df6828835df6b340d145e08f49eae678dad3
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lQ:RWWBibf56utgpPFotBER/mQ32lUE
TLSH
T1DD465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RFgEJfo.exe

Path C:\Windows\System\RFgEJfo.exe
Size 5.2MB
SHA256 a0aabc242652c3be8779067b080f6214a1f1b56aecf7caee431c83ef59e6dfd9
MD5 d3770ea54239e5a5997c70488db2cdea
SHA1 5e992cb48a5da8dbacab23efb7f8dd847a167198
SHA512 da72a4ec3106914d3a1d20095b49ae4c911b67c74d8d2400deccb914f741133482b0aa8726ac5451cdf2d4cd0887ce4d01af9a75f2e610dfff9ec706aa36a334
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lt:RWWBibf56utgpPFotBER/mQ32lUB
TLSH
T120465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SnoEhAb.exe

Path C:\Windows\System\SnoEhAb.exe
Size 5.2MB
SHA256 2098e1d4e8b15376d11b085c0b0c024cd57dbdb747af0321387d148b325bb000
MD5 3f995f1779238a0a8008e1937b437504
SHA1 a4a96294982619cfb6f477e81e2ac52c1239451f
SHA512 6a17a094cfbe27f56ee413d99390a90614c7eb2a8bfe875d34894755e993e6e40522e637dfdfdeb0d6539305d339fdddd5d5b331cda6e98f653d8e6ad6a8da3a
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibf56utgpPFotBER/mQ32lUO
TLSH
T125465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TQMjjlo.exe

Path C:\Windows\System\TQMjjlo.exe
Size 5.2MB
SHA256 239e134270673b92ca0cdb2538f948723a518bb47915461b3f22c51d441ae710
MD5 8043d818f78724ae714c95fc908ae97e
SHA1 9eaa35edf73670bfaca7f110b1720d1380ae9237
SHA512 1e3893df1e162cf44ca0c1aa5ee762d02ecbf591710fbbda3ff09c85492905ee72f73ae09435f48bb2764972879947bf1a79cc123af79ca401e2b19425999077
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lUR
TLSH
T135465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evomhfY.exe

Path C:\Windows\System\evomhfY.exe
Size 5.2MB
SHA256 88cbe250ec414516cb5bd9777b8ee75edac55eb171789bd8fbed68f9c6aad24f
MD5 dfe972d33564b393480353fde0bf5449
SHA1 c865448ce50734b71a58905a96dc8636e2906ade
SHA512 8a8cd4f8f984761300c1addd278943779e38f5cccf142c96f9ef5f1ebd980ca8d01329735d393682b39366172f4b70d52f33efd88ffc2363b3fc01645392b55a
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lf:RWWBibf56utgpPFotBER/mQ32lUb
TLSH
T159465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fCSVAZU.exe

Path C:\Windows\System\fCSVAZU.exe
Size 5.2MB
SHA256 3ed642d66d1985c7268baf378c770ec51bc1da737c40704207d41de2f5a38b0e
MD5 5c836c38e365fe892e973a3c76055aef
SHA1 3fc7b22f020d32e5353f80df0dc6a833ecddeda2
SHA512 0bdbd674216e96631bda386dd034ca36f7ebd964c63638d35add02054190abd60f71faad6c32f156686538b6ad84fa4ac3623aebfda842ded6e64501ce7fc3c6
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lU:RWWBibf56utgpPFotBER/mQ32lUI
TLSH
T10E465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdfgmDo.exe

Path C:\Windows\System\gdfgmDo.exe
Size 5.2MB
SHA256 1c75507c91ef3ca42c5ee3a8439291e0b2ef77fe124ef4596c85bdb12ae84604
MD5 4cd6571ebd52ce2afed98be61f8fd0ca
SHA1 c590cee18ef88f1b5195fdc1072f3b99d36d3baa
SHA512 4ba70431715db23b4b6a2e2a0ff9db834af0529adef607f0ead886b0a6b0c86461da0f1fe45714c99d2a5f9d59375487dd40bfeefb87ab39db806fdab3c2b61c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lN:RWWBibf56utgpPFotBER/mQ32lUJ
TLSH
T1E8465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kUZiopU.exe

Path C:\Windows\System\kUZiopU.exe
Size 5.2MB
SHA256 37956af4c9b654644f4c373242a69f160bc02fa6d61b0d1fd1d71d10fc3ea746
MD5 48d5d0a36998fd0ab7f6ee27b90f7f39
SHA1 1ebff08edb856ef2b9ca6793ac5b15f2597bd79c
SHA512 090ad145b9d64feeb84c5cc28a0806e1fe19d36ef43e1e8d3b435a07ab6d1d0c728e04126940c483c69bc66773b69486055d02f25557b13c3e9c0105c806ca88
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l8:RWWBibf56utgpPFotBER/mQ32lUI
TLSH
T1DC465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pKWgEbm.exe

Path C:\Windows\System\pKWgEbm.exe
Size 5.2MB
SHA256 1e928647f8eb92615a9fb7b70dfeb2af017a6845ce38f816cefef95d0062ca2f
MD5 f20828aca72213e32bd1da1d7e3a094d
SHA1 2e9ecedd576d916e26e0e0903859e190465ac3e2
SHA512 a060884d79036d9a4b0555ddb85c149ad86655ca608f7d16ab0f9f1c267dce1f0ff104e23184ad37c79f7c084055d97cf4c75874669ac042adf30e78eab5959b
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l5:RWWBibf56utgpPFotBER/mQ32lU9
TLSH
T1E7465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tdcEWJf.exe

Path C:\Windows\System\tdcEWJf.exe
Size 5.2MB
SHA256 0abe9881fc6609fad00a1d751dc494a19e054a22de400447a19ffb1ba8f94093
MD5 85dd215f6d3868145c8dc45cf3a8b422
SHA1 3487de5b650337514067d486aaba6c17a27245f7
SHA512 ee8a952c8948e5efc3c3881035da084c3101adb83baeb1928c562b1c472d4f1a3fa3facfa4c6b9bf0292f50074e3647071190d4a0788b89db0a79e0cece7b3a5
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBibf56utgpPFotBER/mQ32lUa
TLSH
T1E1465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/688-116-0x00007FF645890000-0x00007FF645BE1000-memory.dmp

Download

memory/688-233-0x00007FF645890000-0x00007FF645BE1000-memory.dmp

Download

memory/840-231-0x00007FF7F9980000-0x00007FF7F9CD1000-memory.dmp

Download

memory/840-114-0x00007FF7F9980000-0x00007FF7F9CD1000-memory.dmp

Download

memory/972-225-0x00007FF671620000-0x00007FF671971000-memory.dmp

Download

memory/972-58-0x00007FF671620000-0x00007FF671971000-memory.dmp

Download

memory/1564-124-0x00007FF616390000-0x00007FF6166E1000-memory.dmp

Download

memory/1564-220-0x00007FF616390000-0x00007FF6166E1000-memory.dmp

Download

memory/1892-120-0x00007FF607010000-0x00007FF607361000-memory.dmp

Download

memory/1892-249-0x00007FF607010000-0x00007FF607361000-memory.dmp

Download

memory/2032-247-0x00007FF74ADA0000-0x00007FF74B0F1000-memory.dmp

Download

memory/2032-118-0x00007FF74ADA0000-0x00007FF74B0F1000-memory.dmp

Download

memory/2252-252-0x00007FF6D10F0000-0x00007FF6D1441000-memory.dmp

Download

memory/2252-115-0x00007FF6D10F0000-0x00007FF6D1441000-memory.dmp

Download

memory/2404-106-0x00007FF7A3270000-0x00007FF7A35C1000-memory.dmp

Download

memory/2404-239-0x00007FF7A3270000-0x00007FF7A35C1000-memory.dmp

Download

memory/3140-113-0x00007FF6D8400000-0x00007FF6D8751000-memory.dmp

Download

memory/3140-241-0x00007FF6D8400000-0x00007FF6D8751000-memory.dmp

Download

memory/3532-122-0x00007FF75CBA0000-0x00007FF75CEF1000-memory.dmp

Download

memory/3532-245-0x00007FF75CBA0000-0x00007FF75CEF1000-memory.dmp

Download

memory/3792-134-0x00007FF740EF0000-0x00007FF741241000-memory.dmp

Download

memory/3792-79-0x00007FF740EF0000-0x00007FF741241000-memory.dmp

Download

memory/3792-254-0x00007FF740EF0000-0x00007FF741241000-memory.dmp

Download

memory/3820-143-0x00007FF7BEC40000-0x00007FF7BEF91000-memory.dmp

Download

memory/3820-260-0x00007FF7BEC40000-0x00007FF7BEF91000-memory.dmp

Download

memory/3820-117-0x00007FF7BEC40000-0x00007FF7BEF91000-memory.dmp

Download

memory/4236-80-0x00007FF7531B0000-0x00007FF753501000-memory.dmp

Download

memory/4236-222-0x00007FF7531B0000-0x00007FF753501000-memory.dmp

Download

memory/4296-126-0x00007FF742260000-0x00007FF7425B1000-memory.dmp

Download

memory/4296-235-0x00007FF742260000-0x00007FF7425B1000-memory.dmp

Download

memory/4488-1-0x00000169AA150000-0x00000169AA160000-memory.dmp

Download

memory/4488-257-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp

Download

memory/4488-268-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp

Download

memory/4488-267-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp

Download

memory/4488-266-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp

Download

memory/4488-265-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp

Download

memory/4488-264-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp

Download

memory/4488-195-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp

Download

memory/4488-194-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp

Download

memory/4488-263-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp

Download

memory/4488-172-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp

Download

memory/4488-128-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp

Download

memory/4488-262-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp

Download

memory/4488-261-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp

Download

memory/4488-255-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp

Download

memory/4488-0-0x00007FF6A3C80000-0x00007FF6A3FD1000-memory.dmp

Download

memory/4508-217-0x00007FF73A830000-0x00007FF73AB81000-memory.dmp

Download

memory/4508-24-0x00007FF73A830000-0x00007FF73AB81000-memory.dmp

Download

memory/4508-129-0x00007FF73A830000-0x00007FF73AB81000-memory.dmp

Download

memory/4532-218-0x00007FF63AFD0000-0x00007FF63B321000-memory.dmp

Download

memory/4532-123-0x00007FF63AFD0000-0x00007FF63B321000-memory.dmp

Download

memory/4836-101-0x00007FF7BA350000-0x00007FF7BA6A1000-memory.dmp

Download

memory/4836-243-0x00007FF7BA350000-0x00007FF7BA6A1000-memory.dmp

Download

memory/5052-251-0x00007FF68EA60000-0x00007FF68EDB1000-memory.dmp

Download

memory/5052-119-0x00007FF68EA60000-0x00007FF68EDB1000-memory.dmp

Download

memory/5604-125-0x00007FF7A9390000-0x00007FF7A96E1000-memory.dmp

Download

memory/5604-228-0x00007FF7A9390000-0x00007FF7A96E1000-memory.dmp

Download

memory/5672-56-0x00007FF7287A0000-0x00007FF728AF1000-memory.dmp

Download

memory/5672-131-0x00007FF7287A0000-0x00007FF728AF1000-memory.dmp

Download

memory/5672-227-0x00007FF7287A0000-0x00007FF728AF1000-memory.dmp

Download

memory/5960-237-0x00007FF7DFE20000-0x00007FF7E0171000-memory.dmp

Download

memory/5960-121-0x00007FF7DFE20000-0x00007FF7E0171000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads