cobaltstrike | 65b7af5d3486fdf38a1a731a5ef21705e810fb9d293017cd47f11f25451599f8

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample260910-aecafatzhv
SHA256 65b7af5d3486fdf38a1a731a5ef21705e810fb9d293017cd47f11f25451599f8
MD5 11f5d55658246959f565231473b7b8c7
SHA1 3a9de8f6184028e040fd71df2ecaf57a7d641da4
SHA512 fb067bd393f1da561953b77b65c6380e360913978b5915ac6287809b1bdee7a8dab904b8588287f94ffe02ee478a3ad342a6d325a5f5af1f97553e4b619b44f1
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUb:v+A56utgpPF8u/7b
TLSH
T18A965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x0007000000024569-7.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002456c-21.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002456d-34.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002456e-64.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024579-92.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002457a-111.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024578-105.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024577-103.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024576-101.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024575-99.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024574-95.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024573-89.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024572-83.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024571-81.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024570-79.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002456f-74.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002456b-49.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002456a-46.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024568-31.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000024564-27.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002457b-125.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024569-7.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002456c-21.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002456d-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002456e-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024579-92.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002457a-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024578-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024577-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024576-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024575-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024574-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024573-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024572-83.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024571-81.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024570-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002456f-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002456b-49.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002456a-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024568-31.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0008000000024564-27.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002457b-125.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral1/memory/4128-0-0x00007FF6646C0000-0x00007FF664A12000-memory.dmp	UPX
behavioral1/files/0x0007000000024569-7.dat	UPX
behavioral1/memory/2752-17-0x00007FF69AB30000-0x00007FF69AE82000-memory.dmp	UPX
behavioral1/files/0x000700000002456c-21.dat	UPX
behavioral1/files/0x000700000002456d-34.dat	UPX
behavioral1/memory/5088-56-0x00007FF651F30000-0x00007FF652282000-memory.dmp	UPX
behavioral1/files/0x000700000002456e-64.dat	UPX
behavioral1/files/0x0007000000024579-92.dat	UPX
behavioral1/memory/1672-115-0x00007FF7F8A40000-0x00007FF7F8D92000-memory.dmp	UPX
behavioral1/memory/2316-120-0x00007FF7A0C90000-0x00007FF7A0FE2000-memory.dmp	UPX
behavioral1/memory/3428-121-0x00007FF75FD20000-0x00007FF760072000-memory.dmp	UPX
behavioral1/memory/628-119-0x00007FF74B100000-0x00007FF74B452000-memory.dmp	UPX
behavioral1/memory/4404-118-0x00007FF6B5630000-0x00007FF6B5982000-memory.dmp	UPX
behavioral1/memory/3128-117-0x00007FF7CB910000-0x00007FF7CBC62000-memory.dmp	UPX
behavioral1/memory/3356-116-0x00007FF68B6B0000-0x00007FF68BA02000-memory.dmp	UPX
behavioral1/memory/3616-114-0x00007FF676A90000-0x00007FF676DE2000-memory.dmp	UPX
behavioral1/memory/4984-113-0x00007FF7C5BB0000-0x00007FF7C5F02000-memory.dmp	UPX
behavioral1/files/0x000700000002457a-111.dat	UPX
behavioral1/memory/4316-110-0x00007FF7A60C0000-0x00007FF7A6412000-memory.dmp	UPX
behavioral1/memory/1356-109-0x00007FF65C240000-0x00007FF65C592000-memory.dmp	UPX
behavioral1/files/0x0007000000024578-105.dat	UPX
behavioral1/files/0x0007000000024577-103.dat	UPX
behavioral1/files/0x0007000000024576-101.dat	UPX
behavioral1/files/0x0007000000024575-99.dat	UPX
behavioral1/memory/4220-98-0x00007FF6D4BF0000-0x00007FF6D4F42000-memory.dmp	UPX
behavioral1/files/0x0007000000024574-95.dat	UPX
behavioral1/memory/1244-94-0x00007FF6E1BA0000-0x00007FF6E1EF2000-memory.dmp	UPX
behavioral1/memory/3324-93-0x00007FF740E90000-0x00007FF7411E2000-memory.dmp	UPX
behavioral1/files/0x0007000000024573-89.dat	UPX
behavioral1/files/0x0007000000024572-83.dat	UPX
behavioral1/files/0x0007000000024571-81.dat	UPX
behavioral1/files/0x0007000000024570-79.dat	UPX
behavioral1/memory/3436-77-0x00007FF78F1F0000-0x00007FF78F542000-memory.dmp	UPX
behavioral1/files/0x000700000002456f-74.dat	UPX
behavioral1/memory/1456-58-0x00007FF71D2D0000-0x00007FF71D622000-memory.dmp	UPX
behavioral1/files/0x000700000002456b-49.dat	UPX
behavioral1/files/0x000700000002456a-46.dat	UPX
behavioral1/memory/3200-38-0x00007FF6A2AD0000-0x00007FF6A2E22000-memory.dmp	UPX
behavioral1/memory/4520-24-0x00007FF747AC0000-0x00007FF747E12000-memory.dmp	UPX
behavioral1/files/0x0007000000024568-31.dat	UPX
behavioral1/files/0x0008000000024564-27.dat	UPX
behavioral1/files/0x000700000002457b-125.dat	UPX
behavioral1/memory/3460-127-0x00007FF7B5670000-0x00007FF7B59C2000-memory.dmp	UPX
behavioral1/memory/4128-128-0x00007FF6646C0000-0x00007FF664A12000-memory.dmp	UPX
behavioral1/memory/2752-129-0x00007FF69AB30000-0x00007FF69AE82000-memory.dmp	UPX
behavioral1/memory/4520-130-0x00007FF747AC0000-0x00007FF747E12000-memory.dmp	UPX
behavioral1/memory/3200-131-0x00007FF6A2AD0000-0x00007FF6A2E22000-memory.dmp	UPX
behavioral1/memory/3324-133-0x00007FF740E90000-0x00007FF7411E2000-memory.dmp	UPX
behavioral1/memory/5088-132-0x00007FF651F30000-0x00007FF652282000-memory.dmp	UPX
behavioral1/memory/2752-134-0x00007FF69AB30000-0x00007FF69AE82000-memory.dmp	UPX
behavioral1/memory/4520-135-0x00007FF747AC0000-0x00007FF747E12000-memory.dmp	UPX
behavioral1/memory/1356-140-0x00007FF65C240000-0x00007FF65C592000-memory.dmp	UPX
behavioral1/memory/3356-151-0x00007FF68B6B0000-0x00007FF68BA02000-memory.dmp	UPX
behavioral1/memory/1672-152-0x00007FF7F8A40000-0x00007FF7F8D92000-memory.dmp	UPX
behavioral1/memory/3428-153-0x00007FF75FD20000-0x00007FF760072000-memory.dmp	UPX
behavioral1/memory/3200-150-0x00007FF6A2AD0000-0x00007FF6A2E22000-memory.dmp	UPX
behavioral1/memory/5088-149-0x00007FF651F30000-0x00007FF652282000-memory.dmp	UPX
behavioral1/memory/1456-148-0x00007FF71D2D0000-0x00007FF71D622000-memory.dmp	UPX
behavioral1/memory/3128-147-0x00007FF7CB910000-0x00007FF7CBC62000-memory.dmp	UPX
behavioral1/memory/3436-146-0x00007FF78F1F0000-0x00007FF78F542000-memory.dmp	UPX
behavioral1/memory/3324-144-0x00007FF740E90000-0x00007FF7411E2000-memory.dmp	UPX
behavioral1/memory/1244-143-0x00007FF6E1BA0000-0x00007FF6E1EF2000-memory.dmp	UPX
behavioral1/memory/4220-142-0x00007FF6D4BF0000-0x00007FF6D4F42000-memory.dmp	UPX
behavioral1/memory/628-141-0x00007FF74B100000-0x00007FF74B452000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/4128-0-0x00007FF6646C0000-0x00007FF664A12000-memory.dmp	xmrig
behavioral1/files/0x0007000000024569-7.dat	xmrig
behavioral1/memory/2752-17-0x00007FF69AB30000-0x00007FF69AE82000-memory.dmp	xmrig
behavioral1/files/0x000700000002456c-21.dat	xmrig
behavioral1/files/0x000700000002456d-34.dat	xmrig
behavioral1/memory/5088-56-0x00007FF651F30000-0x00007FF652282000-memory.dmp	xmrig
behavioral1/files/0x000700000002456e-64.dat	xmrig
behavioral1/files/0x0007000000024579-92.dat	xmrig
behavioral1/memory/1672-115-0x00007FF7F8A40000-0x00007FF7F8D92000-memory.dmp	xmrig
behavioral1/memory/2316-120-0x00007FF7A0C90000-0x00007FF7A0FE2000-memory.dmp	xmrig
behavioral1/memory/3428-121-0x00007FF75FD20000-0x00007FF760072000-memory.dmp	xmrig
behavioral1/memory/628-119-0x00007FF74B100000-0x00007FF74B452000-memory.dmp	xmrig
behavioral1/memory/4404-118-0x00007FF6B5630000-0x00007FF6B5982000-memory.dmp	xmrig
behavioral1/memory/3128-117-0x00007FF7CB910000-0x00007FF7CBC62000-memory.dmp	xmrig
behavioral1/memory/3356-116-0x00007FF68B6B0000-0x00007FF68BA02000-memory.dmp	xmrig
behavioral1/memory/3616-114-0x00007FF676A90000-0x00007FF676DE2000-memory.dmp	xmrig
behavioral1/memory/4984-113-0x00007FF7C5BB0000-0x00007FF7C5F02000-memory.dmp	xmrig
behavioral1/files/0x000700000002457a-111.dat	xmrig
behavioral1/memory/4316-110-0x00007FF7A60C0000-0x00007FF7A6412000-memory.dmp	xmrig
behavioral1/memory/1356-109-0x00007FF65C240000-0x00007FF65C592000-memory.dmp	xmrig
behavioral1/files/0x0007000000024578-105.dat	xmrig
behavioral1/files/0x0007000000024577-103.dat	xmrig
behavioral1/files/0x0007000000024576-101.dat	xmrig
behavioral1/files/0x0007000000024575-99.dat	xmrig
behavioral1/memory/4220-98-0x00007FF6D4BF0000-0x00007FF6D4F42000-memory.dmp	xmrig
behavioral1/files/0x0007000000024574-95.dat	xmrig
behavioral1/memory/1244-94-0x00007FF6E1BA0000-0x00007FF6E1EF2000-memory.dmp	xmrig
behavioral1/memory/3324-93-0x00007FF740E90000-0x00007FF7411E2000-memory.dmp	xmrig
behavioral1/files/0x0007000000024573-89.dat	xmrig
behavioral1/files/0x0007000000024572-83.dat	xmrig
behavioral1/files/0x0007000000024571-81.dat	xmrig
behavioral1/files/0x0007000000024570-79.dat	xmrig
behavioral1/memory/3436-77-0x00007FF78F1F0000-0x00007FF78F542000-memory.dmp	xmrig
behavioral1/files/0x000700000002456f-74.dat	xmrig
behavioral1/memory/1456-58-0x00007FF71D2D0000-0x00007FF71D622000-memory.dmp	xmrig
behavioral1/files/0x000700000002456b-49.dat	xmrig
behavioral1/files/0x000700000002456a-46.dat	xmrig
behavioral1/memory/3200-38-0x00007FF6A2AD0000-0x00007FF6A2E22000-memory.dmp	xmrig
behavioral1/memory/4520-24-0x00007FF747AC0000-0x00007FF747E12000-memory.dmp	xmrig
behavioral1/files/0x0007000000024568-31.dat	xmrig
behavioral1/files/0x0008000000024564-27.dat	xmrig
behavioral1/files/0x000700000002457b-125.dat	xmrig
behavioral1/memory/3460-127-0x00007FF7B5670000-0x00007FF7B59C2000-memory.dmp	xmrig
behavioral1/memory/4128-128-0x00007FF6646C0000-0x00007FF664A12000-memory.dmp	xmrig
behavioral1/memory/2752-129-0x00007FF69AB30000-0x00007FF69AE82000-memory.dmp	xmrig
behavioral1/memory/4520-130-0x00007FF747AC0000-0x00007FF747E12000-memory.dmp	xmrig
behavioral1/memory/3200-131-0x00007FF6A2AD0000-0x00007FF6A2E22000-memory.dmp	xmrig
behavioral1/memory/3324-133-0x00007FF740E90000-0x00007FF7411E2000-memory.dmp	xmrig
behavioral1/memory/5088-132-0x00007FF651F30000-0x00007FF652282000-memory.dmp	xmrig
behavioral1/memory/2752-134-0x00007FF69AB30000-0x00007FF69AE82000-memory.dmp	xmrig
behavioral1/memory/4520-135-0x00007FF747AC0000-0x00007FF747E12000-memory.dmp	xmrig
behavioral1/memory/1356-140-0x00007FF65C240000-0x00007FF65C592000-memory.dmp	xmrig
behavioral1/memory/3356-151-0x00007FF68B6B0000-0x00007FF68BA02000-memory.dmp	xmrig
behavioral1/memory/1672-152-0x00007FF7F8A40000-0x00007FF7F8D92000-memory.dmp	xmrig
behavioral1/memory/3428-153-0x00007FF75FD20000-0x00007FF760072000-memory.dmp	xmrig
behavioral1/memory/3200-150-0x00007FF6A2AD0000-0x00007FF6A2E22000-memory.dmp	xmrig
behavioral1/memory/5088-149-0x00007FF651F30000-0x00007FF652282000-memory.dmp	xmrig
behavioral1/memory/1456-148-0x00007FF71D2D0000-0x00007FF71D622000-memory.dmp	xmrig
behavioral1/memory/3128-147-0x00007FF7CB910000-0x00007FF7CBC62000-memory.dmp	xmrig
behavioral1/memory/3436-146-0x00007FF78F1F0000-0x00007FF78F542000-memory.dmp	xmrig
behavioral1/memory/3324-144-0x00007FF740E90000-0x00007FF7411E2000-memory.dmp	xmrig
behavioral1/memory/1244-143-0x00007FF6E1BA0000-0x00007FF6E1EF2000-memory.dmp	xmrig
behavioral1/memory/4220-142-0x00007FF6D4BF0000-0x00007FF6D4F42000-memory.dmp	xmrig
behavioral1/memory/628-141-0x00007FF74B100000-0x00007FF74B452000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2752	OGBZhUP.exe
4520	wkCInKq.exe
3356	BPDUQDz.exe
3200	ogjmddW.exe
5088	mUpdvHY.exe
1456	oLliwXM.exe
3128	iTQMbpt.exe
3436	ixEpExM.exe
4404	mmIkyxN.exe
3324	REChCEl.exe
1244	TckUODx.exe
4220	sUtJYRp.exe
628	ZUlrSJM.exe
1356	VlwldYJ.exe
2316	UwvYIUM.exe
4316	pQJcKRC.exe
4984	hsquRNe.exe
3616	uGVLzTq.exe
1672	MCkpSEW.exe
3428	qUqplqe.exe
3460	ADPjzUM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4128-0-0x00007FF6646C0000-0x00007FF664A12000-memory.dmp	upx
behavioral1/files/0x0007000000024569-7.dat	upx
behavioral1/memory/2752-17-0x00007FF69AB30000-0x00007FF69AE82000-memory.dmp	upx
behavioral1/files/0x000700000002456c-21.dat	upx
behavioral1/files/0x000700000002456d-34.dat	upx
behavioral1/memory/5088-56-0x00007FF651F30000-0x00007FF652282000-memory.dmp	upx
behavioral1/files/0x000700000002456e-64.dat	upx
behavioral1/files/0x0007000000024579-92.dat	upx
behavioral1/memory/1672-115-0x00007FF7F8A40000-0x00007FF7F8D92000-memory.dmp	upx
behavioral1/memory/2316-120-0x00007FF7A0C90000-0x00007FF7A0FE2000-memory.dmp	upx
behavioral1/memory/3428-121-0x00007FF75FD20000-0x00007FF760072000-memory.dmp	upx
behavioral1/memory/628-119-0x00007FF74B100000-0x00007FF74B452000-memory.dmp	upx
behavioral1/memory/4404-118-0x00007FF6B5630000-0x00007FF6B5982000-memory.dmp	upx
behavioral1/memory/3128-117-0x00007FF7CB910000-0x00007FF7CBC62000-memory.dmp	upx
behavioral1/memory/3356-116-0x00007FF68B6B0000-0x00007FF68BA02000-memory.dmp	upx
behavioral1/memory/3616-114-0x00007FF676A90000-0x00007FF676DE2000-memory.dmp	upx
behavioral1/memory/4984-113-0x00007FF7C5BB0000-0x00007FF7C5F02000-memory.dmp	upx
behavioral1/files/0x000700000002457a-111.dat	upx
behavioral1/memory/4316-110-0x00007FF7A60C0000-0x00007FF7A6412000-memory.dmp	upx
behavioral1/memory/1356-109-0x00007FF65C240000-0x00007FF65C592000-memory.dmp	upx
behavioral1/files/0x0007000000024578-105.dat	upx
behavioral1/files/0x0007000000024577-103.dat	upx
behavioral1/files/0x0007000000024576-101.dat	upx
behavioral1/files/0x0007000000024575-99.dat	upx
behavioral1/memory/4220-98-0x00007FF6D4BF0000-0x00007FF6D4F42000-memory.dmp	upx
behavioral1/files/0x0007000000024574-95.dat	upx
behavioral1/memory/1244-94-0x00007FF6E1BA0000-0x00007FF6E1EF2000-memory.dmp	upx
behavioral1/memory/3324-93-0x00007FF740E90000-0x00007FF7411E2000-memory.dmp	upx
behavioral1/files/0x0007000000024573-89.dat	upx
behavioral1/files/0x0007000000024572-83.dat	upx
behavioral1/files/0x0007000000024571-81.dat	upx
behavioral1/files/0x0007000000024570-79.dat	upx
behavioral1/memory/3436-77-0x00007FF78F1F0000-0x00007FF78F542000-memory.dmp	upx
behavioral1/files/0x000700000002456f-74.dat	upx
behavioral1/memory/1456-58-0x00007FF71D2D0000-0x00007FF71D622000-memory.dmp	upx
behavioral1/files/0x000700000002456b-49.dat	upx
behavioral1/files/0x000700000002456a-46.dat	upx
behavioral1/memory/3200-38-0x00007FF6A2AD0000-0x00007FF6A2E22000-memory.dmp	upx
behavioral1/memory/4520-24-0x00007FF747AC0000-0x00007FF747E12000-memory.dmp	upx
behavioral1/files/0x0007000000024568-31.dat	upx
behavioral1/files/0x0008000000024564-27.dat	upx
behavioral1/files/0x000700000002457b-125.dat	upx
behavioral1/memory/3460-127-0x00007FF7B5670000-0x00007FF7B59C2000-memory.dmp	upx
behavioral1/memory/4128-128-0x00007FF6646C0000-0x00007FF664A12000-memory.dmp	upx
behavioral1/memory/2752-129-0x00007FF69AB30000-0x00007FF69AE82000-memory.dmp	upx
behavioral1/memory/4520-130-0x00007FF747AC0000-0x00007FF747E12000-memory.dmp	upx
behavioral1/memory/3200-131-0x00007FF6A2AD0000-0x00007FF6A2E22000-memory.dmp	upx
behavioral1/memory/3324-133-0x00007FF740E90000-0x00007FF7411E2000-memory.dmp	upx
behavioral1/memory/5088-132-0x00007FF651F30000-0x00007FF652282000-memory.dmp	upx
behavioral1/memory/2752-134-0x00007FF69AB30000-0x00007FF69AE82000-memory.dmp	upx
behavioral1/memory/4520-135-0x00007FF747AC0000-0x00007FF747E12000-memory.dmp	upx
behavioral1/memory/1356-140-0x00007FF65C240000-0x00007FF65C592000-memory.dmp	upx
behavioral1/memory/3356-151-0x00007FF68B6B0000-0x00007FF68BA02000-memory.dmp	upx
behavioral1/memory/1672-152-0x00007FF7F8A40000-0x00007FF7F8D92000-memory.dmp	upx
behavioral1/memory/3428-153-0x00007FF75FD20000-0x00007FF760072000-memory.dmp	upx
behavioral1/memory/3200-150-0x00007FF6A2AD0000-0x00007FF6A2E22000-memory.dmp	upx
behavioral1/memory/5088-149-0x00007FF651F30000-0x00007FF652282000-memory.dmp	upx
behavioral1/memory/1456-148-0x00007FF71D2D0000-0x00007FF71D622000-memory.dmp	upx
behavioral1/memory/3128-147-0x00007FF7CB910000-0x00007FF7CBC62000-memory.dmp	upx
behavioral1/memory/3436-146-0x00007FF78F1F0000-0x00007FF78F542000-memory.dmp	upx
behavioral1/memory/3324-144-0x00007FF740E90000-0x00007FF7411E2000-memory.dmp	upx
behavioral1/memory/1244-143-0x00007FF6E1BA0000-0x00007FF6E1EF2000-memory.dmp	upx
behavioral1/memory/4220-142-0x00007FF6D4BF0000-0x00007FF6D4F42000-memory.dmp	upx
behavioral1/memory/628-141-0x00007FF74B100000-0x00007FF74B452000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\iTQMbpt.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\hsquRNe.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ADPjzUM.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\wkCInKq.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ixEpExM.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\TckUODx.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\sUtJYRp.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ZUlrSJM.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\uGVLzTq.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\qUqplqe.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\BPDUQDz.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ogjmddW.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\mUpdvHY.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\oLliwXM.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\REChCEl.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\UwvYIUM.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\OGBZhUP.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\mmIkyxN.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\VlwldYJ.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\pQJcKRC.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\MCkpSEW.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 2752	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	85
PID 4128 wrote to memory of 4520	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	86
PID 4128 wrote to memory of 3356	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	87
PID 4128 wrote to memory of 3200	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	88
PID 4128 wrote to memory of 5088	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	89
PID 4128 wrote to memory of 1456	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 4128 wrote to memory of 3128	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 4128 wrote to memory of 3436	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 4128 wrote to memory of 4404	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 4128 wrote to memory of 3324	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 4128 wrote to memory of 1244	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 4128 wrote to memory of 4220	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 4128 wrote to memory of 628	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 4128 wrote to memory of 1356	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 4128 wrote to memory of 2316	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 4128 wrote to memory of 4316	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 4128 wrote to memory of 4984	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 4128 wrote to memory of 3616	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 4128 wrote to memory of 1672	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 4128 wrote to memory of 3428	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 4128 wrote to memory of 3460	4128	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\System\OGBZhUP.exe
  C:\Windows\System\OGBZhUP.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\wkCInKq.exe
  C:\Windows\System\wkCInKq.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\BPDUQDz.exe
  C:\Windows\System\BPDUQDz.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\ogjmddW.exe
  C:\Windows\System\ogjmddW.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\mUpdvHY.exe
  C:\Windows\System\mUpdvHY.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\oLliwXM.exe
  C:\Windows\System\oLliwXM.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\iTQMbpt.exe
  C:\Windows\System\iTQMbpt.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\ixEpExM.exe
  C:\Windows\System\ixEpExM.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\mmIkyxN.exe
  C:\Windows\System\mmIkyxN.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\REChCEl.exe
  C:\Windows\System\REChCEl.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\TckUODx.exe
  C:\Windows\System\TckUODx.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\sUtJYRp.exe
  C:\Windows\System\sUtJYRp.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\ZUlrSJM.exe
  C:\Windows\System\ZUlrSJM.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\VlwldYJ.exe
  C:\Windows\System\VlwldYJ.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\UwvYIUM.exe
  C:\Windows\System\UwvYIUM.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\pQJcKRC.exe
  C:\Windows\System\pQJcKRC.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\hsquRNe.exe
  C:\Windows\System\hsquRNe.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\uGVLzTq.exe
  C:\Windows\System\uGVLzTq.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\MCkpSEW.exe
  C:\Windows\System\MCkpSEW.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\qUqplqe.exe
  C:\Windows\System\qUqplqe.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\ADPjzUM.exe
  C:\Windows\System\ADPjzUM.exe
  2⤵
  - Executes dropped EXE
  PID:3460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ADPjzUM.exe

Path C:\Windows\System\ADPjzUM.exe
Size 8.3MB
SHA256 26a7474833a244ca5a4119564832b333b406d2330500c17ba8c779e0a0a140d2
MD5 b16cfe509661ee8285b86a7e313a5dd2
SHA1 15fc71838add416c4a15eae813bd5989e595d1e6
SHA512 484daf6d2074250ed4c01c31e8b0e0050a6acb0ace578a6aa9976ef9c5b1b65e7b2d3331d70f0ccc0a8de5854b3b3d2da2d6a4dcf157ae1559148c666a54cdb1
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUn:v+A56utgpPF8u/7n
TLSH
T120965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BPDUQDz.exe

Path C:\Windows\System\BPDUQDz.exe
Size 8.3MB
SHA256 aa5f14576fcce43c50120970490b282b5957388a2b59b1830cd231c70f757be2
MD5 654c1cbe6677be205e3035d613e48553
SHA1 ac25cf4c05e11a62aed71ef06a93d1529e1a3d10
SHA512 d3a9d9a7e5586c8e760c1759d3d85543f11aabb27735180cb0c2993c736513dea0d0056a29f4f7fa88810dcda643dd4dfb33b99fce77ffbd95fccaf68932de56
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lU0:v+A56utgpPF8u/70
TLSH
T131965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MCkpSEW.exe

Path C:\Windows\System\MCkpSEW.exe
Size 8.3MB
SHA256 21db4229bb320ca58990c904ebee3c081704213ae7100765f7bcbc9cf76220ad
MD5 bc7d40e8722bc43c0f31dc22e47bb072
SHA1 1e9c3757c5bc41c38223866873157738752df9b7
SHA512 90233052b84c57d561ddbe19148c41a2ebb4f11c7798be97c8edbaea5df3183b00b60e5f79b401718cdc4eaf75b800620a12a61b029d9901f3be5ee088243362
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lU4:v+A56utgpPF8u/74
TLSH
T117965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OGBZhUP.exe

Path C:\Windows\System\OGBZhUP.exe
Size 8.3MB
SHA256 fc3d3f88aae861a67c2a134ca175746c7ac60a66981590e53827d1b97f737fc9
MD5 187049d51a44a338750e1faa0a5d8a0a
SHA1 77c7c048811946bce73a0180d6828e2286be7671
SHA512 80f832a641294ba29be79997c01a906283bfb297ffb2c20bf1ddb029697cd76d971edbdec3314d1446ab65c1070ba2dad6ff94b52c79ff6d438fc2593a09de42
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUz:v+A56utgpPF8u/7z
TLSH
T14C965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

REChCEl.exe

Path C:\Windows\System\REChCEl.exe
Size 8.3MB
SHA256 634a63dc4b0e79faaeba5eb6bc4bf9e096b44ae5d41fa048052e8d1b3d11dc98
MD5 13005a95d7e517b4692ffe9fc1f7bb7e
SHA1 c5d42648886ac6f21e402ce29d12d5aacc9bac30
SHA512 cf964bbb7627896b3efc7d403fc7c08b18430d2d4bd0f4a99ee41d900f52945d02945bb3401a9e6ed5e55dfbfcba0921c5d0312e2cfcc242d97d90e5eaf354c2
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUG:v+A56utgpPF8u/7G
TLSH
T133965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TckUODx.exe

Path C:\Windows\System\TckUODx.exe
Size 8.3MB
SHA256 10a08bfe5fc0971a3a72bb6b983a1f5fb9d3cefa10249fe9387cbc6a324fd32a
MD5 b081105e77225ef0e09c55892489e216
SHA1 b02b7837ea27567dcd547a720e9fa3536ea29530
SHA512 e39ff2747998671544b3e10238a2cf4e97e187d32f402d37f8fcb3d81a35bb4e7f71cd6e8fc6e8d4e3d85b15ef71c348a58cfe185cd9a012f9a9e1d2fc362f8e
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUm:v+A56utgpPF8u/7m
TLSH
T1BB965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UwvYIUM.exe

Path C:\Windows\System\UwvYIUM.exe
Size 8.3MB
SHA256 3b2accda41015dca0939df74efd5e335550c8eaea1d201c6d2a795c67ef5fd84
MD5 7e139b64b3b3de18312461d1d671ee6a
SHA1 99896e0dcf36f5e8f4c7d80f525441318a834d70
SHA512 4d1a8fda25ae1cc1c00214ce57bafb412c198922f451e7cdab5d6ca7c8fec00dac6bd83a580378c014f18bfa4a4f2e0f353763ac57742b397946f1ef6128ef7a
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUq:v+A56utgpPF8u/7q
TLSH
T1C6965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VlwldYJ.exe

Path C:\Windows\System\VlwldYJ.exe
Size 8.3MB
SHA256 db56945e4e1ab60d94dbd290117a6695867ff7eac043cfa25c588080490adc51
MD5 d64d8c3d49fef7f33b096d00a10e3e6b
SHA1 a6bd18a64543bb51b4bf770096550cc2c2c31fd5
SHA512 63beccd37dcc646b93c836ffb42339e889597bdacb072a827da287bb6b727132f686680e67784e6e2482835646f99abba8b49a3782460d2e9a39402adeaf0f31
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUV:v+A56utgpPF8u/7V
TLSH
T19D965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZUlrSJM.exe

Path C:\Windows\System\ZUlrSJM.exe
Size 8.3MB
SHA256 97bc5d54b67ecb486b07dfe1e49961656aa25b365a4d7f1cc49196ddfdd25069
MD5 42b93cad720026ce5dac4a02f82c3e89
SHA1 1814c574e35a6a8362e7c4c89d1d2546012f0507
SHA512 d7b6698500bfa02d6196e08c959acc195605ae4fe17c83b3353ae1655fcf49ead2e26583f6f0887ccaf22ac7469e27fa3291ddb312c8abcd254d571570e211de
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUm:v+A56utgpPF8u/7m
TLSH
T11A965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hsquRNe.exe

Path C:\Windows\System\hsquRNe.exe
Size 8.3MB
SHA256 cb3e7b5aa068df24fa379cdabc819dc4850f2c7247e7e3e08d59c1b4af0271ab
MD5 0f1a87bc9fdab4ad943c300e575c9bc6
SHA1 cec0270226e90e555b7f19fa495a200c164da786
SHA512 02cd4d29a545dc196624ee57718f6146bb59d8319dbea9cb4b0f20058f569d0968f468594cd086a77cf265c28a9696b8ac83b86fc85533b75938796589339aba
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUK:v+A56utgpPF8u/7K
TLSH
T1AA965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iTQMbpt.exe

Path C:\Windows\System\iTQMbpt.exe
Size 8.3MB
SHA256 e44e9af134a6e5465ae9681d12346cfb9029541834a052f48ba09506381005c5
MD5 9d97e2ecac2db0244a4ef74b4e035123
SHA1 254f9fdd6839d704254f2f43d4420b449dadcc01
SHA512 5e53d86a83b07055d5a61ef26cee11a0dc3aa81b4e22a1089263b64cc287d4e7aa63515e5ea92d98a255b5855a1fc72fc1fa2e01afae13c4e353deeeeff08aa4
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUO:v+A56utgpPF8u/7O
TLSH
T1A3965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ixEpExM.exe

Path C:\Windows\System\ixEpExM.exe
Size 8.3MB
SHA256 51420cf2064f240295cc45bc6e1a1a56af89d3f450ec5b10d4f89d02ee3079af
MD5 1ed56db2d154a6ce0fe3201b6e437ad6
SHA1 0c71474355ed6d22c07ad6cb4f5cdd492e2b513d
SHA512 e1de9c2290d1aa06dc65dc84c4096ebedbc7a15f5c3e3a430f0104b476e520859b516f97fa70c8be84138fd228d1e8d322093e8257a2be385c7382435b026dd6
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUd:v+A56utgpPF8u/7d
TLSH
T1E5965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mUpdvHY.exe

Path C:\Windows\System\mUpdvHY.exe
Size 8.3MB
SHA256 452d07542ae70164c43a58df7e07b554a385f23ede9144edd1e91e63e08a0e83
MD5 bc4888f15d404724b1ca6b2fae4a4f86
SHA1 1f39227af239e0a016d1dd5797f7f40dea771ddf
SHA512 e3436f887aaf189814c4dc5a3aabaa00c687c61afa955bfe0cdec318ac0dde566915265b371a2584feca88f2893f9394a830517aaebff23c1c5afcc21b3d3e46
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUJ:v+A56utgpPF8u/7J
TLSH
T16A965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmIkyxN.exe

Path C:\Windows\System\mmIkyxN.exe
Size 8.3MB
SHA256 109315821694f18a937f690e9e52184fbdf5d60fa9c39756ddf65c7505f93428
MD5 48a961d72fc289ffc7e5883a3223c1cd
SHA1 043df2af484bf916811271b2777049778893f0c3
SHA512 8f2f4bae1b1d1e14db2457ada333a1a6de6afdac58555bf4cf4b41d69d6160f63cc728e3cecb9795fa3bf28254c24f5ce83f767beb0f10c94679c6ba635169fe
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUJ:v+A56utgpPF8u/7J
TLSH
T1A2965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oLliwXM.exe

Path C:\Windows\System\oLliwXM.exe
Size 8.3MB
SHA256 1198ae10d4fe3114cd2f0659bb10bc17a222f6ab4e881173e159d733846e2194
MD5 0755055ba538b48d8e42b0cba6c2120e
SHA1 bff94b9fbce7486648e9afc7f971a3abc50c8d59
SHA512 fdfec42b03c2541038b203c158fe6a48a388766cf15c2a9b08bbc56ca7d5ff006e629f29ede41af2bb9f034f7bcf1338455c0dceb8c06e3cf6fd9db5bc2512ae
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUw:v+A56utgpPF8u/7w
TLSH
T1AB965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ogjmddW.exe

Path C:\Windows\System\ogjmddW.exe
Size 8.3MB
SHA256 f9e472d18c1efed41c5df2483049cf300527b4c8f8887d48c28ba22d8ab83ed2
MD5 5e724b70ca6e8c27a5fec26bd91816ac
SHA1 5436d5cc8a8ce871152bf34067a28708d620f811
SHA512 d2f3853d288ebc0a9cae364eb2425944ee4769f9b4ee97ce365d1fa97bf25caabe8ac4f7700473ff067b94d6638922dfd6d6fe3034b323ce0a78e390864d4c60
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUn:v+A56utgpPF8u/7n
TLSH
T1CA965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pQJcKRC.exe

Path C:\Windows\System\pQJcKRC.exe
Size 8.3MB
SHA256 40ec66778d82df9f642134818758bda6fe0f5b4c7e003083450f7f5d50d58ec8
MD5 e1ec2f277a41d1c0ea7fe79f3564da49
SHA1 95c36a9d4b5b834132cc46d736ab1078f1f0053e
SHA512 cdeef57301ff5a08d648a32b52e380a773fa87452453ee8f59ae150bacecee1bed8a1a6d0fa720df982c4e8397fac97e7d5374fcc5a7627353a172482e3ee152
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUK:v+A56utgpPF8u/7K
TLSH
T15A965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qUqplqe.exe

Path C:\Windows\System\qUqplqe.exe
Size 8.3MB
SHA256 7f90cbe4f8b3d87c32b9838537b05670b12b9c59d27c9efb814b504c3198e2d8
MD5 747e822f62b86b0dfc1e16d98500b82c
SHA1 4a1d51634c744f817a87087f25f958bc6ee7c46b
SHA512 9e82a9d6f6b50c02a774189e24fb92b3dde82ca5accdd9925ea3aa4b36a54529453405e249460a3eadcd62484a0b8962c4e024f026618b7b367554b12ed29084
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUS:v+A56utgpPF8u/7S
TLSH
T14A965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sUtJYRp.exe

Path C:\Windows\System\sUtJYRp.exe
Size 8.3MB
SHA256 4e56e1836af70a3dab5dc170bf19ec1a2718f40b50664b1796b90bb28f86036a
MD5 302de1975c3197b418167b917532b735
SHA1 0cea5413d7a19bf0368bb328e6a9054d9ac1d540
SHA512 49db35a22818a332ac7692276739476dab8ec3c8260a67f043e6e62d5ddfe1b77e5fca018026b98ce2f42fe6f1c2ec9ffad0721b9a56cef6016e681c919058da
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUN:v+A56utgpPF8u/7N
TLSH
T1AC965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uGVLzTq.exe

Path C:\Windows\System\uGVLzTq.exe
Size 8.3MB
SHA256 c73965b44c9415e0286d55ed172b7784c24de5ae67bbe1ed187b822bb42eae77
MD5 e8da4aa1859a0fed2e7954f9ecc75564
SHA1 7c69a23f5c1f04f5f0420158a4f92ab1f716aef0
SHA512 89ad6bab808a9d457c8647c83003a28798ceec9bc306ddaaddd522685b0e12148badb2f0cee91b34da5ab87a8a885e7164d340b02225f56c622769f84029529c
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUw:v+A56utgpPF8u/7w
TLSH
T19F965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkCInKq.exe

Path C:\Windows\System\wkCInKq.exe
Size 8.3MB
SHA256 85e9fba1e755b33d140bf597f3fd0d45bbfe4fdaffc3d064500ea04823e241ba
MD5 7483bd411d9f623943a84284d2cd8aa7
SHA1 9c45fbc7c92e1ae8510c69224a791b5815920e18
SHA512 d955db892410385e6fa9593529a515eb1b42ed816e925c5c978ee0563dca17cbcd1357b963344ffabbb1535a7fdbc8adc742975e00966c72aba64d33615a59c0
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUP:v+A56utgpPF8u/7P
TLSH
T1E1965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/628-119-0x00007FF74B100000-0x00007FF74B452000-memory.dmp

Download

memory/628-141-0x00007FF74B100000-0x00007FF74B452000-memory.dmp

Download

memory/1244-94-0x00007FF6E1BA0000-0x00007FF6E1EF2000-memory.dmp

Download

memory/1244-143-0x00007FF6E1BA0000-0x00007FF6E1EF2000-memory.dmp

Download

memory/1356-140-0x00007FF65C240000-0x00007FF65C592000-memory.dmp

Download

memory/1356-109-0x00007FF65C240000-0x00007FF65C592000-memory.dmp

Download

memory/1456-148-0x00007FF71D2D0000-0x00007FF71D622000-memory.dmp

Download

memory/1456-58-0x00007FF71D2D0000-0x00007FF71D622000-memory.dmp

Download

memory/1672-115-0x00007FF7F8A40000-0x00007FF7F8D92000-memory.dmp

Download

memory/1672-152-0x00007FF7F8A40000-0x00007FF7F8D92000-memory.dmp

Download

memory/2316-120-0x00007FF7A0C90000-0x00007FF7A0FE2000-memory.dmp

Download

memory/2316-139-0x00007FF7A0C90000-0x00007FF7A0FE2000-memory.dmp

Download

memory/2752-134-0x00007FF69AB30000-0x00007FF69AE82000-memory.dmp

Download

memory/2752-129-0x00007FF69AB30000-0x00007FF69AE82000-memory.dmp

Download

memory/2752-17-0x00007FF69AB30000-0x00007FF69AE82000-memory.dmp

Download

memory/3128-147-0x00007FF7CB910000-0x00007FF7CBC62000-memory.dmp

Download

memory/3128-117-0x00007FF7CB910000-0x00007FF7CBC62000-memory.dmp

Download

memory/3200-150-0x00007FF6A2AD0000-0x00007FF6A2E22000-memory.dmp

Download

memory/3200-38-0x00007FF6A2AD0000-0x00007FF6A2E22000-memory.dmp

Download

memory/3200-131-0x00007FF6A2AD0000-0x00007FF6A2E22000-memory.dmp

Download

memory/3324-144-0x00007FF740E90000-0x00007FF7411E2000-memory.dmp

Download

memory/3324-93-0x00007FF740E90000-0x00007FF7411E2000-memory.dmp

Download

memory/3324-133-0x00007FF740E90000-0x00007FF7411E2000-memory.dmp

Download

memory/3356-116-0x00007FF68B6B0000-0x00007FF68BA02000-memory.dmp

Download

memory/3356-151-0x00007FF68B6B0000-0x00007FF68BA02000-memory.dmp

Download

memory/3428-121-0x00007FF75FD20000-0x00007FF760072000-memory.dmp

Download

memory/3428-153-0x00007FF75FD20000-0x00007FF760072000-memory.dmp

Download

memory/3436-146-0x00007FF78F1F0000-0x00007FF78F542000-memory.dmp

Download

memory/3436-77-0x00007FF78F1F0000-0x00007FF78F542000-memory.dmp

Download

memory/3460-154-0x00007FF7B5670000-0x00007FF7B59C2000-memory.dmp

Download

memory/3460-127-0x00007FF7B5670000-0x00007FF7B59C2000-memory.dmp

Download

memory/3616-136-0x00007FF676A90000-0x00007FF676DE2000-memory.dmp

Download

memory/3616-114-0x00007FF676A90000-0x00007FF676DE2000-memory.dmp

Download

memory/4128-0-0x00007FF6646C0000-0x00007FF664A12000-memory.dmp

Download

memory/4128-1-0x00000208E44B0000-0x00000208E44C0000-memory.dmp

Download

memory/4128-128-0x00007FF6646C0000-0x00007FF664A12000-memory.dmp

Download

memory/4220-142-0x00007FF6D4BF0000-0x00007FF6D4F42000-memory.dmp

Download

memory/4220-98-0x00007FF6D4BF0000-0x00007FF6D4F42000-memory.dmp

Download

memory/4316-110-0x00007FF7A60C0000-0x00007FF7A6412000-memory.dmp

Download

memory/4316-138-0x00007FF7A60C0000-0x00007FF7A6412000-memory.dmp

Download

memory/4404-118-0x00007FF6B5630000-0x00007FF6B5982000-memory.dmp

Download

memory/4404-145-0x00007FF6B5630000-0x00007FF6B5982000-memory.dmp

Download

memory/4520-24-0x00007FF747AC0000-0x00007FF747E12000-memory.dmp

Download

memory/4520-135-0x00007FF747AC0000-0x00007FF747E12000-memory.dmp

Download

memory/4520-130-0x00007FF747AC0000-0x00007FF747E12000-memory.dmp

Download

memory/4984-137-0x00007FF7C5BB0000-0x00007FF7C5F02000-memory.dmp

Download

memory/4984-113-0x00007FF7C5BB0000-0x00007FF7C5F02000-memory.dmp

Download

memory/5088-149-0x00007FF651F30000-0x00007FF652282000-memory.dmp

Download

memory/5088-56-0x00007FF651F30000-0x00007FF652282000-memory.dmp

Download

memory/5088-132-0x00007FF651F30000-0x00007FF652282000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads