cobaltstrike | 0189143f7ae24172d72b0a6010309883a4293a8b7005c5d6beca88adf95b0e93

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample260910-a7n5psshrb
SHA256 0189143f7ae24172d72b0a6010309883a4293a8b7005c5d6beca88adf95b0e93
MD5 05ab70d25dc2d0a1bb3f758ab4e9d250
SHA1 d7a250e829b9f1b63404c9dc2d1533a8991c13e8
SHA512 f531d718428cf136c687f7bb212df46f091cf520d0c7d1ee1fefeb43451f8be2b46cc261e506fc018366e0dd3e686441c39fefff4bddee5acd396b2dcbd85f55
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUi:v+A56utgpPF8u/7i
TLSH
T11B965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00110000000118ee-4.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000001c63b-10.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c638-13.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000001c63c-23.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000001c63d-29.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000001c63e-33.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000001c640-43.dat	cobalt_reflective_dll
behavioral2/files/0x0003000000008f19-47.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000001c642-54.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000001c643-62.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000001c644-70.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000001c645-76.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000001c646-83.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000001c647-89.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000001c648-96.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000001c649-103.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000001c64a-108.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000001c64b-116.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000001c64d-131.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000001c64e-137.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000001c64c-124.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x00110000000118ee-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000001c63b-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c638-13.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000001c63c-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000001c63d-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000001c63e-33.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000001c640-43.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0003000000008f19-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000001c642-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000001c643-62.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000001c644-70.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000001c645-76.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000001c646-83.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000001c647-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000001c648-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000001c649-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000001c64a-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000001c64b-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000001c64d-131.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000001c64e-137.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000001c64c-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4724-0-0x00007FF785D20000-0x00007FF786072000-memory.dmp	UPX
behavioral2/files/0x00110000000118ee-4.dat	UPX
behavioral2/memory/1300-8-0x00007FF6699A0000-0x00007FF669CF2000-memory.dmp	UPX
behavioral2/files/0x000b00000001c63b-10.dat	UPX
behavioral2/memory/1588-12-0x00007FF79DF20000-0x00007FF79E272000-memory.dmp	UPX
behavioral2/files/0x000c00000001c638-13.dat	UPX
behavioral2/memory/5356-19-0x00007FF686D00000-0x00007FF687052000-memory.dmp	UPX
behavioral2/files/0x000b00000001c63c-23.dat	UPX
behavioral2/files/0x000b00000001c63d-29.dat	UPX
behavioral2/memory/6948-30-0x00007FF6E7590000-0x00007FF6E78E2000-memory.dmp	UPX
behavioral2/memory/556-32-0x00007FF6F4AE0000-0x00007FF6F4E32000-memory.dmp	UPX
behavioral2/files/0x000b00000001c63e-33.dat	UPX
behavioral2/memory/6784-36-0x00007FF7E4D70000-0x00007FF7E50C2000-memory.dmp	UPX
behavioral2/memory/5236-42-0x00007FF617AE0000-0x00007FF617E32000-memory.dmp	UPX
behavioral2/files/0x000b00000001c640-43.dat	UPX
behavioral2/files/0x0003000000008f19-47.dat	UPX
behavioral2/memory/7128-49-0x00007FF61E710000-0x00007FF61EA62000-memory.dmp	UPX
behavioral2/memory/4724-48-0x00007FF785D20000-0x00007FF786072000-memory.dmp	UPX
behavioral2/files/0x000b00000001c642-54.dat	UPX
behavioral2/memory/7048-56-0x00007FF683B40000-0x00007FF683E92000-memory.dmp	UPX
behavioral2/memory/1588-55-0x00007FF79DF20000-0x00007FF79E272000-memory.dmp	UPX
behavioral2/memory/5356-61-0x00007FF686D00000-0x00007FF687052000-memory.dmp	UPX
behavioral2/files/0x000b00000001c643-62.dat	UPX
behavioral2/memory/4600-66-0x00007FF6D7610000-0x00007FF6D7962000-memory.dmp	UPX
behavioral2/memory/6948-64-0x00007FF6E7590000-0x00007FF6E78E2000-memory.dmp	UPX
behavioral2/memory/556-67-0x00007FF6F4AE0000-0x00007FF6F4E32000-memory.dmp	UPX
behavioral2/files/0x000b00000001c644-70.dat	UPX
behavioral2/memory/7036-72-0x00007FF72D280000-0x00007FF72D5D2000-memory.dmp	UPX
behavioral2/files/0x000b00000001c645-76.dat	UPX
behavioral2/memory/2520-79-0x00007FF6AC7B0000-0x00007FF6ACB02000-memory.dmp	UPX
behavioral2/memory/6784-78-0x00007FF7E4D70000-0x00007FF7E50C2000-memory.dmp	UPX
behavioral2/files/0x000b00000001c646-83.dat	UPX
behavioral2/files/0x000b00000001c647-89.dat	UPX
behavioral2/files/0x000b00000001c648-96.dat	UPX
behavioral2/files/0x000b00000001c649-103.dat	UPX
behavioral2/files/0x000b00000001c64a-108.dat	UPX
behavioral2/files/0x000b00000001c64b-116.dat	UPX
behavioral2/memory/4600-123-0x00007FF6D7610000-0x00007FF6D7962000-memory.dmp	UPX
behavioral2/files/0x000b00000001c64d-131.dat	UPX
behavioral2/files/0x000b00000001c64e-137.dat	UPX
behavioral2/memory/3888-136-0x00007FF6E38A0000-0x00007FF6E3BF2000-memory.dmp	UPX
behavioral2/memory/7036-135-0x00007FF72D280000-0x00007FF72D5D2000-memory.dmp	UPX
behavioral2/memory/2232-130-0x00007FF614610000-0x00007FF614962000-memory.dmp	UPX
behavioral2/memory/6852-126-0x00007FF6ED1A0000-0x00007FF6ED4F2000-memory.dmp	UPX
behavioral2/files/0x000b00000001c64c-124.dat	UPX
behavioral2/memory/4268-117-0x00007FF7C8CD0000-0x00007FF7C9022000-memory.dmp	UPX
behavioral2/memory/6780-111-0x00007FF6C62A0000-0x00007FF6C65F2000-memory.dmp	UPX
behavioral2/memory/7048-110-0x00007FF683B40000-0x00007FF683E92000-memory.dmp	UPX
behavioral2/memory/7072-104-0x00007FF7FDCC0000-0x00007FF7FE012000-memory.dmp	UPX
behavioral2/memory/4392-98-0x00007FF609140000-0x00007FF609492000-memory.dmp	UPX
behavioral2/memory/7128-97-0x00007FF61E710000-0x00007FF61EA62000-memory.dmp	UPX
behavioral2/memory/6520-91-0x00007FF712A50000-0x00007FF712DA2000-memory.dmp	UPX
behavioral2/memory/1508-87-0x00007FF77BDD0000-0x00007FF77C122000-memory.dmp	UPX
behavioral2/memory/5236-84-0x00007FF617AE0000-0x00007FF617E32000-memory.dmp	UPX
behavioral2/memory/2520-139-0x00007FF6AC7B0000-0x00007FF6ACB02000-memory.dmp	UPX
behavioral2/memory/1508-140-0x00007FF77BDD0000-0x00007FF77C122000-memory.dmp	UPX
behavioral2/memory/6520-141-0x00007FF712A50000-0x00007FF712DA2000-memory.dmp	UPX
behavioral2/memory/4392-142-0x00007FF609140000-0x00007FF609492000-memory.dmp	UPX
behavioral2/memory/7072-143-0x00007FF7FDCC0000-0x00007FF7FE012000-memory.dmp	UPX
behavioral2/memory/6780-144-0x00007FF6C62A0000-0x00007FF6C65F2000-memory.dmp	UPX
behavioral2/memory/4268-145-0x00007FF7C8CD0000-0x00007FF7C9022000-memory.dmp	UPX
behavioral2/memory/6852-146-0x00007FF6ED1A0000-0x00007FF6ED4F2000-memory.dmp	UPX
behavioral2/memory/2232-147-0x00007FF614610000-0x00007FF614962000-memory.dmp	UPX
behavioral2/memory/3888-148-0x00007FF6E38A0000-0x00007FF6E3BF2000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4724-0-0x00007FF785D20000-0x00007FF786072000-memory.dmp	xmrig
behavioral2/files/0x00110000000118ee-4.dat	xmrig
behavioral2/memory/1300-8-0x00007FF6699A0000-0x00007FF669CF2000-memory.dmp	xmrig
behavioral2/files/0x000b00000001c63b-10.dat	xmrig
behavioral2/memory/1588-12-0x00007FF79DF20000-0x00007FF79E272000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c638-13.dat	xmrig
behavioral2/memory/5356-19-0x00007FF686D00000-0x00007FF687052000-memory.dmp	xmrig
behavioral2/files/0x000b00000001c63c-23.dat	xmrig
behavioral2/files/0x000b00000001c63d-29.dat	xmrig
behavioral2/memory/6948-30-0x00007FF6E7590000-0x00007FF6E78E2000-memory.dmp	xmrig
behavioral2/memory/556-32-0x00007FF6F4AE0000-0x00007FF6F4E32000-memory.dmp	xmrig
behavioral2/files/0x000b00000001c63e-33.dat	xmrig
behavioral2/memory/6784-36-0x00007FF7E4D70000-0x00007FF7E50C2000-memory.dmp	xmrig
behavioral2/memory/5236-42-0x00007FF617AE0000-0x00007FF617E32000-memory.dmp	xmrig
behavioral2/files/0x000b00000001c640-43.dat	xmrig
behavioral2/files/0x0003000000008f19-47.dat	xmrig
behavioral2/memory/7128-49-0x00007FF61E710000-0x00007FF61EA62000-memory.dmp	xmrig
behavioral2/memory/4724-48-0x00007FF785D20000-0x00007FF786072000-memory.dmp	xmrig
behavioral2/files/0x000b00000001c642-54.dat	xmrig
behavioral2/memory/7048-56-0x00007FF683B40000-0x00007FF683E92000-memory.dmp	xmrig
behavioral2/memory/1588-55-0x00007FF79DF20000-0x00007FF79E272000-memory.dmp	xmrig
behavioral2/memory/5356-61-0x00007FF686D00000-0x00007FF687052000-memory.dmp	xmrig
behavioral2/files/0x000b00000001c643-62.dat	xmrig
behavioral2/memory/4600-66-0x00007FF6D7610000-0x00007FF6D7962000-memory.dmp	xmrig
behavioral2/memory/6948-64-0x00007FF6E7590000-0x00007FF6E78E2000-memory.dmp	xmrig
behavioral2/memory/556-67-0x00007FF6F4AE0000-0x00007FF6F4E32000-memory.dmp	xmrig
behavioral2/files/0x000b00000001c644-70.dat	xmrig
behavioral2/memory/7036-72-0x00007FF72D280000-0x00007FF72D5D2000-memory.dmp	xmrig
behavioral2/files/0x000b00000001c645-76.dat	xmrig
behavioral2/memory/2520-79-0x00007FF6AC7B0000-0x00007FF6ACB02000-memory.dmp	xmrig
behavioral2/memory/6784-78-0x00007FF7E4D70000-0x00007FF7E50C2000-memory.dmp	xmrig
behavioral2/files/0x000b00000001c646-83.dat	xmrig
behavioral2/files/0x000b00000001c647-89.dat	xmrig
behavioral2/files/0x000b00000001c648-96.dat	xmrig
behavioral2/files/0x000b00000001c649-103.dat	xmrig
behavioral2/files/0x000b00000001c64a-108.dat	xmrig
behavioral2/files/0x000b00000001c64b-116.dat	xmrig
behavioral2/memory/4600-123-0x00007FF6D7610000-0x00007FF6D7962000-memory.dmp	xmrig
behavioral2/files/0x000b00000001c64d-131.dat	xmrig
behavioral2/files/0x000b00000001c64e-137.dat	xmrig
behavioral2/memory/3888-136-0x00007FF6E38A0000-0x00007FF6E3BF2000-memory.dmp	xmrig
behavioral2/memory/7036-135-0x00007FF72D280000-0x00007FF72D5D2000-memory.dmp	xmrig
behavioral2/memory/2232-130-0x00007FF614610000-0x00007FF614962000-memory.dmp	xmrig
behavioral2/memory/6852-126-0x00007FF6ED1A0000-0x00007FF6ED4F2000-memory.dmp	xmrig
behavioral2/files/0x000b00000001c64c-124.dat	xmrig
behavioral2/memory/4268-117-0x00007FF7C8CD0000-0x00007FF7C9022000-memory.dmp	xmrig
behavioral2/memory/6780-111-0x00007FF6C62A0000-0x00007FF6C65F2000-memory.dmp	xmrig
behavioral2/memory/7048-110-0x00007FF683B40000-0x00007FF683E92000-memory.dmp	xmrig
behavioral2/memory/7072-104-0x00007FF7FDCC0000-0x00007FF7FE012000-memory.dmp	xmrig
behavioral2/memory/4392-98-0x00007FF609140000-0x00007FF609492000-memory.dmp	xmrig
behavioral2/memory/7128-97-0x00007FF61E710000-0x00007FF61EA62000-memory.dmp	xmrig
behavioral2/memory/6520-91-0x00007FF712A50000-0x00007FF712DA2000-memory.dmp	xmrig
behavioral2/memory/1508-87-0x00007FF77BDD0000-0x00007FF77C122000-memory.dmp	xmrig
behavioral2/memory/5236-84-0x00007FF617AE0000-0x00007FF617E32000-memory.dmp	xmrig
behavioral2/memory/2520-139-0x00007FF6AC7B0000-0x00007FF6ACB02000-memory.dmp	xmrig
behavioral2/memory/1508-140-0x00007FF77BDD0000-0x00007FF77C122000-memory.dmp	xmrig
behavioral2/memory/6520-141-0x00007FF712A50000-0x00007FF712DA2000-memory.dmp	xmrig
behavioral2/memory/4392-142-0x00007FF609140000-0x00007FF609492000-memory.dmp	xmrig
behavioral2/memory/7072-143-0x00007FF7FDCC0000-0x00007FF7FE012000-memory.dmp	xmrig
behavioral2/memory/6780-144-0x00007FF6C62A0000-0x00007FF6C65F2000-memory.dmp	xmrig
behavioral2/memory/4268-145-0x00007FF7C8CD0000-0x00007FF7C9022000-memory.dmp	xmrig
behavioral2/memory/6852-146-0x00007FF6ED1A0000-0x00007FF6ED4F2000-memory.dmp	xmrig
behavioral2/memory/2232-147-0x00007FF614610000-0x00007FF614962000-memory.dmp	xmrig
behavioral2/memory/3888-148-0x00007FF6E38A0000-0x00007FF6E3BF2000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1300	NeZQiHa.exe
1588	ekBEXtp.exe
5356	WENrMHn.exe
6948	YANUCLZ.exe
556	rxAFqeE.exe
6784	iMqsDUI.exe
5236	BklDntg.exe
7128	KGcposQ.exe
7048	JycNTSR.exe
4600	uFqYstj.exe
7036	LXPngpk.exe
2520	tyGtOWz.exe
1508	nUmvRqU.exe
6520	fqJzyUb.exe
4392	XQnaTxs.exe
7072	oENRrDD.exe
6780	UmDtoJv.exe
4268	ppTiuuy.exe
6852	XRBkrHH.exe
2232	yonztPR.exe
3888	ylsSomi.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4724-0-0x00007FF785D20000-0x00007FF786072000-memory.dmp	upx
behavioral2/files/0x00110000000118ee-4.dat	upx
behavioral2/memory/1300-8-0x00007FF6699A0000-0x00007FF669CF2000-memory.dmp	upx
behavioral2/files/0x000b00000001c63b-10.dat	upx
behavioral2/memory/1588-12-0x00007FF79DF20000-0x00007FF79E272000-memory.dmp	upx
behavioral2/files/0x000c00000001c638-13.dat	upx
behavioral2/memory/5356-19-0x00007FF686D00000-0x00007FF687052000-memory.dmp	upx
behavioral2/files/0x000b00000001c63c-23.dat	upx
behavioral2/files/0x000b00000001c63d-29.dat	upx
behavioral2/memory/6948-30-0x00007FF6E7590000-0x00007FF6E78E2000-memory.dmp	upx
behavioral2/memory/556-32-0x00007FF6F4AE0000-0x00007FF6F4E32000-memory.dmp	upx
behavioral2/files/0x000b00000001c63e-33.dat	upx
behavioral2/memory/6784-36-0x00007FF7E4D70000-0x00007FF7E50C2000-memory.dmp	upx
behavioral2/memory/5236-42-0x00007FF617AE0000-0x00007FF617E32000-memory.dmp	upx
behavioral2/files/0x000b00000001c640-43.dat	upx
behavioral2/files/0x0003000000008f19-47.dat	upx
behavioral2/memory/7128-49-0x00007FF61E710000-0x00007FF61EA62000-memory.dmp	upx
behavioral2/memory/4724-48-0x00007FF785D20000-0x00007FF786072000-memory.dmp	upx
behavioral2/files/0x000b00000001c642-54.dat	upx
behavioral2/memory/7048-56-0x00007FF683B40000-0x00007FF683E92000-memory.dmp	upx
behavioral2/memory/1588-55-0x00007FF79DF20000-0x00007FF79E272000-memory.dmp	upx
behavioral2/memory/5356-61-0x00007FF686D00000-0x00007FF687052000-memory.dmp	upx
behavioral2/files/0x000b00000001c643-62.dat	upx
behavioral2/memory/4600-66-0x00007FF6D7610000-0x00007FF6D7962000-memory.dmp	upx
behavioral2/memory/6948-64-0x00007FF6E7590000-0x00007FF6E78E2000-memory.dmp	upx
behavioral2/memory/556-67-0x00007FF6F4AE0000-0x00007FF6F4E32000-memory.dmp	upx
behavioral2/files/0x000b00000001c644-70.dat	upx
behavioral2/memory/7036-72-0x00007FF72D280000-0x00007FF72D5D2000-memory.dmp	upx
behavioral2/files/0x000b00000001c645-76.dat	upx
behavioral2/memory/2520-79-0x00007FF6AC7B0000-0x00007FF6ACB02000-memory.dmp	upx
behavioral2/memory/6784-78-0x00007FF7E4D70000-0x00007FF7E50C2000-memory.dmp	upx
behavioral2/files/0x000b00000001c646-83.dat	upx
behavioral2/files/0x000b00000001c647-89.dat	upx
behavioral2/files/0x000b00000001c648-96.dat	upx
behavioral2/files/0x000b00000001c649-103.dat	upx
behavioral2/files/0x000b00000001c64a-108.dat	upx
behavioral2/files/0x000b00000001c64b-116.dat	upx
behavioral2/memory/4600-123-0x00007FF6D7610000-0x00007FF6D7962000-memory.dmp	upx
behavioral2/files/0x000b00000001c64d-131.dat	upx
behavioral2/files/0x000b00000001c64e-137.dat	upx
behavioral2/memory/3888-136-0x00007FF6E38A0000-0x00007FF6E3BF2000-memory.dmp	upx
behavioral2/memory/7036-135-0x00007FF72D280000-0x00007FF72D5D2000-memory.dmp	upx
behavioral2/memory/2232-130-0x00007FF614610000-0x00007FF614962000-memory.dmp	upx
behavioral2/memory/6852-126-0x00007FF6ED1A0000-0x00007FF6ED4F2000-memory.dmp	upx
behavioral2/files/0x000b00000001c64c-124.dat	upx
behavioral2/memory/4268-117-0x00007FF7C8CD0000-0x00007FF7C9022000-memory.dmp	upx
behavioral2/memory/6780-111-0x00007FF6C62A0000-0x00007FF6C65F2000-memory.dmp	upx
behavioral2/memory/7048-110-0x00007FF683B40000-0x00007FF683E92000-memory.dmp	upx
behavioral2/memory/7072-104-0x00007FF7FDCC0000-0x00007FF7FE012000-memory.dmp	upx
behavioral2/memory/4392-98-0x00007FF609140000-0x00007FF609492000-memory.dmp	upx
behavioral2/memory/7128-97-0x00007FF61E710000-0x00007FF61EA62000-memory.dmp	upx
behavioral2/memory/6520-91-0x00007FF712A50000-0x00007FF712DA2000-memory.dmp	upx
behavioral2/memory/1508-87-0x00007FF77BDD0000-0x00007FF77C122000-memory.dmp	upx
behavioral2/memory/5236-84-0x00007FF617AE0000-0x00007FF617E32000-memory.dmp	upx
behavioral2/memory/2520-139-0x00007FF6AC7B0000-0x00007FF6ACB02000-memory.dmp	upx
behavioral2/memory/1508-140-0x00007FF77BDD0000-0x00007FF77C122000-memory.dmp	upx
behavioral2/memory/6520-141-0x00007FF712A50000-0x00007FF712DA2000-memory.dmp	upx
behavioral2/memory/4392-142-0x00007FF609140000-0x00007FF609492000-memory.dmp	upx
behavioral2/memory/7072-143-0x00007FF7FDCC0000-0x00007FF7FE012000-memory.dmp	upx
behavioral2/memory/6780-144-0x00007FF6C62A0000-0x00007FF6C65F2000-memory.dmp	upx
behavioral2/memory/4268-145-0x00007FF7C8CD0000-0x00007FF7C9022000-memory.dmp	upx
behavioral2/memory/6852-146-0x00007FF6ED1A0000-0x00007FF6ED4F2000-memory.dmp	upx
behavioral2/memory/2232-147-0x00007FF614610000-0x00007FF614962000-memory.dmp	upx
behavioral2/memory/3888-148-0x00007FF6E38A0000-0x00007FF6E3BF2000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\JycNTSR.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\nUmvRqU.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\UmDtoJv.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\yonztPR.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ylsSomi.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\LXPngpk.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\tyGtOWz.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ppTiuuy.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\XRBkrHH.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\NeZQiHa.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ekBEXtp.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\YANUCLZ.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\rxAFqeE.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\uFqYstj.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fqJzyUb.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\XQnaTxs.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\oENRrDD.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\WENrMHn.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\iMqsDUI.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\BklDntg.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\KGcposQ.exe	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 1300	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 4724 wrote to memory of 1588	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 4724 wrote to memory of 5356	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 4724 wrote to memory of 6948	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 4724 wrote to memory of 556	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 4724 wrote to memory of 6784	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 4724 wrote to memory of 5236	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 4724 wrote to memory of 7128	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 4724 wrote to memory of 7048	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 4724 wrote to memory of 4600	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 4724 wrote to memory of 7036	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 4724 wrote to memory of 2520	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 4724 wrote to memory of 1508	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 4724 wrote to memory of 6520	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 4724 wrote to memory of 4392	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 4724 wrote to memory of 7072	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 4724 wrote to memory of 6780	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 4724 wrote to memory of 4268	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 4724 wrote to memory of 6852	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 4724 wrote to memory of 2232	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109
PID 4724 wrote to memory of 3888	4724	2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_05ab70d25dc2d0a1bb3f758ab4e9d250_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\System\NeZQiHa.exe
  C:\Windows\System\NeZQiHa.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\ekBEXtp.exe
  C:\Windows\System\ekBEXtp.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\WENrMHn.exe
  C:\Windows\System\WENrMHn.exe
  2⤵
  - Executes dropped EXE
  PID:5356
- C:\Windows\System\YANUCLZ.exe
  C:\Windows\System\YANUCLZ.exe
  2⤵
  - Executes dropped EXE
  PID:6948
- C:\Windows\System\rxAFqeE.exe
  C:\Windows\System\rxAFqeE.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\iMqsDUI.exe
  C:\Windows\System\iMqsDUI.exe
  2⤵
  - Executes dropped EXE
  PID:6784
- C:\Windows\System\BklDntg.exe
  C:\Windows\System\BklDntg.exe
  2⤵
  - Executes dropped EXE
  PID:5236
- C:\Windows\System\KGcposQ.exe
  C:\Windows\System\KGcposQ.exe
  2⤵
  - Executes dropped EXE
  PID:7128
- C:\Windows\System\JycNTSR.exe
  C:\Windows\System\JycNTSR.exe
  2⤵
  - Executes dropped EXE
  PID:7048
- C:\Windows\System\uFqYstj.exe
  C:\Windows\System\uFqYstj.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\LXPngpk.exe
  C:\Windows\System\LXPngpk.exe
  2⤵
  - Executes dropped EXE
  PID:7036
- C:\Windows\System\tyGtOWz.exe
  C:\Windows\System\tyGtOWz.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\nUmvRqU.exe
  C:\Windows\System\nUmvRqU.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\fqJzyUb.exe
  C:\Windows\System\fqJzyUb.exe
  2⤵
  - Executes dropped EXE
  PID:6520
- C:\Windows\System\XQnaTxs.exe
  C:\Windows\System\XQnaTxs.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\oENRrDD.exe
  C:\Windows\System\oENRrDD.exe
  2⤵
  - Executes dropped EXE
  PID:7072
- C:\Windows\System\UmDtoJv.exe
  C:\Windows\System\UmDtoJv.exe
  2⤵
  - Executes dropped EXE
  PID:6780
- C:\Windows\System\ppTiuuy.exe
  C:\Windows\System\ppTiuuy.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\XRBkrHH.exe
  C:\Windows\System\XRBkrHH.exe
  2⤵
  - Executes dropped EXE
  PID:6852
- C:\Windows\System\yonztPR.exe
  C:\Windows\System\yonztPR.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\ylsSomi.exe
  C:\Windows\System\ylsSomi.exe
  2⤵
  - Executes dropped EXE
  PID:3888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BklDntg.exe

Path C:\Windows\System\BklDntg.exe
Size 8.3MB
SHA256 844cc829d24d5a51bfa2dc3f6f8579298920ed5cce2d3de500a0bd84a64fad2b
MD5 65a5205b63d37c5a84e9980d483db3d1
SHA1 d6336e5272818a147072213c56d2fecd9092be42
SHA512 be2acb0cac45cf9775b99c4ceebc9e4c69dcc5b113fa63a83c515bcc061b490c2e51cbe8ca827e28fae45b9d4bbc330103c8ae9706b347cb5ee6bbd9a34e297b
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lU3:v+A56utgpPF8u/73
TLSH
T110965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JycNTSR.exe

Path C:\Windows\System\JycNTSR.exe
Size 8.3MB
SHA256 0bfa3dc98dcaaae6d7fc170bfcf2f4826f08155713226faa0b6f36bd8a0c1fe1
MD5 100a26209869f4b0c8890003002bebf8
SHA1 1ce6707b9ca3a12dd9359db8a00fe8865da81e53
SHA512 91f083a08f23a47ddc134d1d25d25ca762bda302bb30ce236839511eb08cb4c764de507b417b1a652c63f3bc725d091174ed8909b155fdc50320422bec0b2eea
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUD:v+A56utgpPF8u/7D
TLSH
T1AF965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KGcposQ.exe

Path C:\Windows\System\KGcposQ.exe
Size 8.3MB
SHA256 b8a176516c5d5b6c1e5c40aabb51076354ea0305e1f92a61b3ae1b2b45b08c90
MD5 3922a6d80fd9df18ce434daf7970cf58
SHA1 694a7553a513b5a7b05cf3171407a57d5345c3d8
SHA512 b9adafaea078ae1f587c54a125d364467ef244dd913c62566eb537288d7e54db881dd58049915a0bb6cb7a177d2060db00d81f2ad5c64dc8516daf6e648385a6
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUJ:v+A56utgpPF8u/7J
TLSH
T13A965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LXPngpk.exe

Path C:\Windows\System\LXPngpk.exe
Size 8.3MB
SHA256 8a90dc33e5a440e98dbbe3028fdbab34a593745f59fc875fd6d8a660fa7dec68
MD5 0a550e44d29b7484a076f0a6e0a840d2
SHA1 a6ef775a95ba387177f1384e04d52538a1275a63
SHA512 9302b2bf97e24288255d40959200fde2ff75792e0d7372493e86c9c0f8c5989ff0fdf33dc4fb215ac65a5869427d1929c4eda3712fac2b614a6784bfc3a75687
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUK:v+A56utgpPF8u/7K
TLSH
T18A965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NeZQiHa.exe

Path C:\Windows\System\NeZQiHa.exe
Size 8.3MB
SHA256 f1acd639feaa264026f7423b8a3257f7d875efdc076b8d8a91eb635ed0a3fa39
MD5 ca47088e54da30409b7fb031e8e38b1e
SHA1 4dd65a22c81a651696f9bbb6e2ca78e4cad6f4a8
SHA512 94b767486e5f7a384e051c04f83a18e9163214ee9d4e5a09fb4a1eeae9dd81866a367006a62dacae14775e106c618887755f8d85641e4c5f1b835103e6768e59
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUh:v+A56utgpPF8u/7h
TLSH
T102965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UmDtoJv.exe

Path C:\Windows\System\UmDtoJv.exe
Size 8.3MB
SHA256 fc6528b92828ffa6b837ff97f21dcde0b64051453ef258e8d9e4cad4c138921e
MD5 663b116791b55fe0627af67e3d9a5176
SHA1 5608d4d47ff79d886130e6cea0e2910a0b0f4aa0
SHA512 f58bec3c83e3c2f25c03ddf20d0635003e5dc4a672212f7f2cad81218f1cfd55e6cceb870f54e806f027c0de5622c342592628cced7907061364a2e8f5586bbb
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUO:v+A56utgpPF8u/7O
TLSH
T15D965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WENrMHn.exe

Path C:\Windows\System\WENrMHn.exe
Size 8.3MB
SHA256 582ddaef7b5a86f1679b7dbd44e7548088ff895af033d4caef212f49be30c847
MD5 03e246af29e36460d4a6c0b8321a0fb8
SHA1 3f151cc1e4a83673be646654e75beb1a0c489c1d
SHA512 15d0f908a91d6287f8d2b81badfd97897881b8011a5e666330a4ea78723ce9b37f9a79ab7c6bc047bfb7793d95cf3a1ce440399848dc428e670048c52afa0f46
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUU:v+A56utgpPF8u/7U
TLSH
T11A965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XQnaTxs.exe

Path C:\Windows\System\XQnaTxs.exe
Size 8.3MB
SHA256 301dc34bdd9fd88137551c6e64f0b9b850817f1e58c83385f54a5ef49ce7df1b
MD5 70b1d4e36ed6e6291c8856393213c20d
SHA1 eccfbc8e9224d59b4b53f2d9dfa9bd191d7e0388
SHA512 387742d8b3081df4cfa65355a9ff37e17e01a8e582fe4388a91330cea9256ee35a0c173c044a74c25290f8ca202d6182163a4d33a380092f2473ae300930a65b
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lU5:v+A56utgpPF8u/75
TLSH
T1AC965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XRBkrHH.exe

Path C:\Windows\System\XRBkrHH.exe
Size 8.3MB
SHA256 fc0378a81a54625706893782ea705afda58d4c46aba047c2e3547088c51a42f6
MD5 5d35f11c1de963e67dd360bd16a3b238
SHA1 dcc079dd4e9897a9b571ca9e03fa2bf2453459a4
SHA512 436e267e218a987479beeefe5b72b58d395edab3e84fc98bccc5175ee6ccdfbb3e49d7a6e63a4381d670ad184f128a42f352a1dc2c44ec66ad26da4e8663fd06
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUa:v+A56utgpPF8u/7a
TLSH
T1BD965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YANUCLZ.exe

Path C:\Windows\System\YANUCLZ.exe
Size 8.3MB
SHA256 556c9f2fa0386f16ec660bfbe3772f7b624cbfb3aa0d40c7745ab3e2cc6b1d7e
MD5 aee58dbabc737ee2ec8d9b304a427b81
SHA1 0a8d29f92ea3f820fa91a406960cfa4b3f85a2a1
SHA512 e209881c01b51f8c4716c26b0a8a58266335157e3ab108900d253ef1dc121aebdfd7a48d7d06e34c00e42fd9fa3e638cf86a48c6d326d3544cc768e8ce8bebf7
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUK:v+A56utgpPF8u/7K
TLSH
T1FA965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ekBEXtp.exe

Path C:\Windows\System\ekBEXtp.exe
Size 8.3MB
SHA256 a5a89cb98ed61c5d843cbc11d89273d9a28ac4462c7563f780f5aa15b996af79
MD5 fb54582fff035c489575066444679545
SHA1 7689a63c4c886317064bfc10bdeca4043695cb85
SHA512 86c00fabda0d0bd2e5c56ea07967774a57acb754c356aef59ffca056466e31ae2dcb35d34b94904be2a03856c3f1d43c36f501b88119a8449e97cbe02cb6f72c
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lU0:v+A56utgpPF8u/70
TLSH
T1D9965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fqJzyUb.exe

Path C:\Windows\System\fqJzyUb.exe
Size 8.3MB
SHA256 0ba651c9e3cdda97d15eba4f4d7d5b8c1b8206c86ec55aee464dd5b3ba7e33e5
MD5 bd20b8e40592df880bb76af7ffb82508
SHA1 27e0a33aed5088b9c557714c73f9e5eddacf8981
SHA512 94ea5b74062fa2b0839ecf57f3f71c6b98c200cf0eb638e487cfa642705a7c68be8ed5b558654ef59eb1c7e4e2a3acc165ccd5c6e15575cba9f300837169daa0
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUW:v+A56utgpPF8u/7W
TLSH
T11C965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iMqsDUI.exe

Path C:\Windows\System\iMqsDUI.exe
Size 8.3MB
SHA256 07290672c1ae4d6d2bc27e19542f288fcae84319f4a0dc32238319131a5cc324
MD5 4183a77b0232b3bcd1c8e176d29f3d21
SHA1 3120b31f901bcfab6ba9a8bffc334a9cf55b0a74
SHA512 f5540cce078d44e6699d47c50cfeff14dfad687edb96a7edee7d57a85eb5bde9bcab4ed69fe3674e7c037059d05d6682405c2d11b7784c8932f4de2832a4cc58
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUc:v+A56utgpPF8u/7c
TLSH
T140965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nUmvRqU.exe

Path C:\Windows\System\nUmvRqU.exe
Size 8.3MB
SHA256 ec313fe1f766d3ee85c772edf3706d1111ad93ea8069577b91920d7dc64aa8c0
MD5 0ddf8aa32173c19b92b2693770641837
SHA1 b758dec1b5a4721c73589b38b57b0f4294b25d54
SHA512 2885132973f7085f68abe7a2cb2e373d4aea3e91945a5f5787058030cd34abf1060f64866893feeadd03438d15735a44be89bbd2cb7f0e331ddbc0052936bd9f
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUk:v+A56utgpPF8u/7k
TLSH
T141965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oENRrDD.exe

Path C:\Windows\System\oENRrDD.exe
Size 8.3MB
SHA256 ece5b48e0f3562b2b9686d563f773b527dd6866c34a3c8b666c82344a5f9ef4c
MD5 9ff048396ced3b8dd80d519a99a262fa
SHA1 ebf2c8055847448cdbe4542df666e4278e7fdb88
SHA512 5dc2a1951bf04e2b6e203124493b875b7de45fc846db93497a5a3d5f20fe4c5affb2a8a6e65f8fe7b7b465272b340ff6a5d6ad270b0b478b69e68bcbf967dea0
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lU2:v+A56utgpPF8u/72
TLSH
T154965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ppTiuuy.exe

Path C:\Windows\System\ppTiuuy.exe
Size 8.3MB
SHA256 64a9a7892c63f7edf0bf1cd2460948f30655e2bf0536b66cb5c5d37aec08b699
MD5 18296f45cc7b83cc533ec586abe50e19
SHA1 5b209cbe6f5d8b90be5897ed67b7f0cbbc796309
SHA512 d23ea0e54ae87ee64b221852c03a65cf17e2765e53a2f3fc1b3970d7511bd6877046e58f96f2b9ceaf5ea433f204ff3ef58238b811640ea93df57b8c6f5e94a7
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUE:v+A56utgpPF8u/7E
TLSH
T13A965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rxAFqeE.exe

Path C:\Windows\System\rxAFqeE.exe
Size 8.3MB
SHA256 3a41b659f3ac7031958663813d4850491e61dba766bd9d9f7cd89d0407f13f54
MD5 f39c7e242d28b18e24677298ceaac606
SHA1 1eb1e2c19cc94adb1df82f8bca7473f8b787ce2f
SHA512 0303a0dae0a7eb1c29ebf82c8b34205ea521610a4fadd109f45a87766d13af41c3c13aa17e76437a4cee117535eb11de4fdaa3fe14a46f6d1844cdf2ac669bb5
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUJ:v+A56utgpPF8u/7J
TLSH
T177965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tyGtOWz.exe

Path C:\Windows\System\tyGtOWz.exe
Size 8.3MB
SHA256 d09acf47541c3a680acfc22ef092a4a877210911e825a53051d086ecc1dbaca9
MD5 c19a16a07a24cb8122fbef9e4b466df8
SHA1 545619c4e6b5b10cfca4c4aa7b22d75ec9f87e59
SHA512 6317bc210d382bdce2e1b06ba982c61097650618dc5f583b8d2458baef2c3ac7fdb5ea957df1499410220c89588c17fe017f4d02f8f1f34d9a0e47b2a0184399
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUd:v+A56utgpPF8u/7d
TLSH
T104965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uFqYstj.exe

Path C:\Windows\System\uFqYstj.exe
Size 8.3MB
SHA256 bc4be70587e8247480cba669895f601f15ca5a6edffb6c8557ce3d7dcb5cce7c
MD5 c9571a3157ff2dbab97655eb5fd8fe4e
SHA1 d72a8749ac79ef3c1774441ddc02d504b22d23ff
SHA512 b76d3ba03f22c274a1f67b43b0b95f4e0a3b945197beb90a8a12569ec14d5942e53d13603be59d3c598724f0d334bcb9ffd7a3c1c4441b8cc560a69e4bd56e0c
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUr:v+A56utgpPF8u/7r
TLSH
T10C965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ylsSomi.exe

Path C:\Windows\System\ylsSomi.exe
Size 8.3MB
SHA256 06ef0e77cf1181415eacefc42d115e6b73184445bb3f7979ca2105f65f822f42
MD5 fefc6e6048406c99d81f81fbb70f22da
SHA1 153a22a3b30326e1b7f6511b9c77fa3191bc76bf
SHA512 1ee3561a576270fa0b2bfb4ba1fb5b1e0fdc58b9e543bf3d7daec288e4c620651b9dcff1fb5759e6516db7e1bc927f18880bf025ee2ba394caa2facfbc273d17
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lU5:v+A56utgpPF8u/75
TLSH
T112965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yonztPR.exe

Path C:\Windows\System\yonztPR.exe
Size 8.3MB
SHA256 b1d66d6620697edc64f042a4d40270b0d537810bc111d9b1f95a10269b612d3c
MD5 c63e0f1738dea5b87ecfdcd1356bf6cc
SHA1 1dbd716f6c12e52bb248827789d8e05f4ec4b49c
SHA512 adc78e9d12ea6951484c56f17cc716afb31b72db8381c2d002679614e1272a678f99e3a8d7a4160ffbaa244ecc768aef1e7a962bab8db7d5140e0f8577bc6f8e
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUi:v+A56utgpPF8u/7i
TLSH
T122965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-153-0x00007FF6F4AE0000-0x00007FF6F4E32000-memory.dmp

Download

memory/556-67-0x00007FF6F4AE0000-0x00007FF6F4E32000-memory.dmp

Download

memory/556-32-0x00007FF6F4AE0000-0x00007FF6F4E32000-memory.dmp

Download

memory/1300-8-0x00007FF6699A0000-0x00007FF669CF2000-memory.dmp

Download

memory/1300-149-0x00007FF6699A0000-0x00007FF669CF2000-memory.dmp

Download

memory/1508-140-0x00007FF77BDD0000-0x00007FF77C122000-memory.dmp

Download

memory/1508-162-0x00007FF77BDD0000-0x00007FF77C122000-memory.dmp

Download

memory/1508-87-0x00007FF77BDD0000-0x00007FF77C122000-memory.dmp

Download

memory/1588-150-0x00007FF79DF20000-0x00007FF79E272000-memory.dmp

Download

memory/1588-12-0x00007FF79DF20000-0x00007FF79E272000-memory.dmp

Download

memory/1588-55-0x00007FF79DF20000-0x00007FF79E272000-memory.dmp

Download

memory/2232-165-0x00007FF614610000-0x00007FF614962000-memory.dmp

Download

memory/2232-130-0x00007FF614610000-0x00007FF614962000-memory.dmp

Download

memory/2232-147-0x00007FF614610000-0x00007FF614962000-memory.dmp

Download

memory/2520-139-0x00007FF6AC7B0000-0x00007FF6ACB02000-memory.dmp

Download

memory/2520-160-0x00007FF6AC7B0000-0x00007FF6ACB02000-memory.dmp

Download

memory/2520-79-0x00007FF6AC7B0000-0x00007FF6ACB02000-memory.dmp

Download

memory/3888-148-0x00007FF6E38A0000-0x00007FF6E3BF2000-memory.dmp

Download

memory/3888-168-0x00007FF6E38A0000-0x00007FF6E3BF2000-memory.dmp

Download

memory/3888-136-0x00007FF6E38A0000-0x00007FF6E3BF2000-memory.dmp

Download

memory/4268-117-0x00007FF7C8CD0000-0x00007FF7C9022000-memory.dmp

Download

memory/4268-169-0x00007FF7C8CD0000-0x00007FF7C9022000-memory.dmp

Download

memory/4268-145-0x00007FF7C8CD0000-0x00007FF7C9022000-memory.dmp

Download

memory/4392-98-0x00007FF609140000-0x00007FF609492000-memory.dmp

Download

memory/4392-142-0x00007FF609140000-0x00007FF609492000-memory.dmp

Download

memory/4392-163-0x00007FF609140000-0x00007FF609492000-memory.dmp

Download

memory/4600-66-0x00007FF6D7610000-0x00007FF6D7962000-memory.dmp

Download

memory/4600-123-0x00007FF6D7610000-0x00007FF6D7962000-memory.dmp

Download

memory/4600-158-0x00007FF6D7610000-0x00007FF6D7962000-memory.dmp

Download

memory/4724-48-0x00007FF785D20000-0x00007FF786072000-memory.dmp

Download

memory/4724-1-0x000001D0DD550000-0x000001D0DD560000-memory.dmp

Download

memory/4724-0-0x00007FF785D20000-0x00007FF786072000-memory.dmp

Download

memory/5236-42-0x00007FF617AE0000-0x00007FF617E32000-memory.dmp

Download

memory/5236-84-0x00007FF617AE0000-0x00007FF617E32000-memory.dmp

Download

memory/5236-155-0x00007FF617AE0000-0x00007FF617E32000-memory.dmp

Download

memory/5356-61-0x00007FF686D00000-0x00007FF687052000-memory.dmp

Download

memory/5356-19-0x00007FF686D00000-0x00007FF687052000-memory.dmp

Download

memory/5356-151-0x00007FF686D00000-0x00007FF687052000-memory.dmp

Download

memory/6520-91-0x00007FF712A50000-0x00007FF712DA2000-memory.dmp

Download

memory/6520-161-0x00007FF712A50000-0x00007FF712DA2000-memory.dmp

Download

memory/6520-141-0x00007FF712A50000-0x00007FF712DA2000-memory.dmp

Download

memory/6780-164-0x00007FF6C62A0000-0x00007FF6C65F2000-memory.dmp

Download

memory/6780-111-0x00007FF6C62A0000-0x00007FF6C65F2000-memory.dmp

Download

memory/6780-144-0x00007FF6C62A0000-0x00007FF6C65F2000-memory.dmp

Download

memory/6784-78-0x00007FF7E4D70000-0x00007FF7E50C2000-memory.dmp

Download

memory/6784-36-0x00007FF7E4D70000-0x00007FF7E50C2000-memory.dmp

Download

memory/6784-154-0x00007FF7E4D70000-0x00007FF7E50C2000-memory.dmp

Download

memory/6852-166-0x00007FF6ED1A0000-0x00007FF6ED4F2000-memory.dmp

Download

memory/6852-146-0x00007FF6ED1A0000-0x00007FF6ED4F2000-memory.dmp

Download

memory/6852-126-0x00007FF6ED1A0000-0x00007FF6ED4F2000-memory.dmp

Download

memory/6948-152-0x00007FF6E7590000-0x00007FF6E78E2000-memory.dmp

Download

memory/6948-30-0x00007FF6E7590000-0x00007FF6E78E2000-memory.dmp

Download

memory/6948-64-0x00007FF6E7590000-0x00007FF6E78E2000-memory.dmp

Download

memory/7036-159-0x00007FF72D280000-0x00007FF72D5D2000-memory.dmp

Download

memory/7036-72-0x00007FF72D280000-0x00007FF72D5D2000-memory.dmp

Download

memory/7036-135-0x00007FF72D280000-0x00007FF72D5D2000-memory.dmp

Download

memory/7048-157-0x00007FF683B40000-0x00007FF683E92000-memory.dmp

Download

memory/7048-56-0x00007FF683B40000-0x00007FF683E92000-memory.dmp

Download

memory/7048-110-0x00007FF683B40000-0x00007FF683E92000-memory.dmp

Download

memory/7072-143-0x00007FF7FDCC0000-0x00007FF7FE012000-memory.dmp

Download

memory/7072-104-0x00007FF7FDCC0000-0x00007FF7FE012000-memory.dmp

Download

memory/7072-167-0x00007FF7FDCC0000-0x00007FF7FE012000-memory.dmp

Download

memory/7128-156-0x00007FF61E710000-0x00007FF61EA62000-memory.dmp

Download

memory/7128-49-0x00007FF61E710000-0x00007FF61EA62000-memory.dmp

Download

memory/7128-97-0x00007FF61E710000-0x00007FF61EA62000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads