cobaltstrike | 65b7af5d3486fdf38a1a731a5ef21705e810fb9d293017cd47f11f25451599f8

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample260910-aecafatzhv
SHA256 65b7af5d3486fdf38a1a731a5ef21705e810fb9d293017cd47f11f25451599f8
MD5 11f5d55658246959f565231473b7b8c7
SHA1 3a9de8f6184028e040fd71df2ecaf57a7d641da4
SHA512 fb067bd393f1da561953b77b65c6380e360913978b5915ac6287809b1bdee7a8dab904b8588287f94ffe02ee478a3ad342a6d325a5f5af1f97553e4b619b44f1
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUb:v+A56utgpPF8u/7b
TLSH
T18A965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0009000000019caa-5.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5d7-10.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5d6-12.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5db-23.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5dc-27.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5dd-35.dat	cobalt_reflective_dll
behavioral2/files/0x0003000000000436-41.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5df-47.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e0-54.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e1-59.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e2-63.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e3-75.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e4-79.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e5-85.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e6-95.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e7-101.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e8-106.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e9-111.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5eb-119.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ec-125.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ed-130.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0009000000019caa-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5d7-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5d6-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5db-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5dc-27.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5dd-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0003000000000436-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5df-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e0-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e1-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e2-63.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e3-75.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e4-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e5-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e6-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e7-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e8-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e9-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5eb-119.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ec-125.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ed-130.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/5392-0-0x00007FF6F7340000-0x00007FF6F7692000-memory.dmp	UPX
behavioral2/files/0x0009000000019caa-5.dat	UPX
behavioral2/memory/1584-8-0x00007FF6938B0000-0x00007FF693C02000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5d7-10.dat	UPX
behavioral2/files/0x000d00000001c5d6-12.dat	UPX
behavioral2/memory/5484-14-0x00007FF6C8D20000-0x00007FF6C9072000-memory.dmp	UPX
behavioral2/memory/3320-18-0x00007FF6AEF30000-0x00007FF6AF282000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5db-23.dat	UPX
behavioral2/files/0x000c00000001c5dc-27.dat	UPX
behavioral2/memory/5600-24-0x00007FF7DC270000-0x00007FF7DC5C2000-memory.dmp	UPX
behavioral2/memory/1712-32-0x00007FF732500000-0x00007FF732852000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5dd-35.dat	UPX
behavioral2/memory/2796-40-0x00007FF687CF0000-0x00007FF688042000-memory.dmp	UPX
behavioral2/files/0x0003000000000436-41.dat	UPX
behavioral2/memory/4332-42-0x00007FF68B680000-0x00007FF68B9D2000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5df-47.dat	UPX
behavioral2/files/0x000c00000001c5e0-54.dat	UPX
behavioral2/files/0x000c00000001c5e1-59.dat	UPX
behavioral2/files/0x000c00000001c5e2-63.dat	UPX
behavioral2/memory/1584-69-0x00007FF6938B0000-0x00007FF693C02000-memory.dmp	UPX
behavioral2/memory/4300-70-0x00007FF7A2380000-0x00007FF7A26D2000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5e3-75.dat	UPX
behavioral2/files/0x000c00000001c5e4-79.dat	UPX
behavioral2/memory/4964-81-0x00007FF795960000-0x00007FF795CB2000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5e5-85.dat	UPX
behavioral2/memory/5164-89-0x00007FF791B20000-0x00007FF791E72000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5e6-95.dat	UPX
behavioral2/memory/3012-94-0x00007FF7591E0000-0x00007FF759532000-memory.dmp	UPX
behavioral2/memory/5600-93-0x00007FF7DC270000-0x00007FF7DC5C2000-memory.dmp	UPX
behavioral2/memory/3320-87-0x00007FF6AEF30000-0x00007FF6AF282000-memory.dmp	UPX
behavioral2/memory/5484-80-0x00007FF6C8D20000-0x00007FF6C9072000-memory.dmp	UPX
behavioral2/memory/108-74-0x00007FF6674E0000-0x00007FF667832000-memory.dmp	UPX
behavioral2/memory/2820-68-0x00007FF6CE040000-0x00007FF6CE392000-memory.dmp	UPX
behavioral2/memory/4860-67-0x00007FF6EB990000-0x00007FF6EBCE2000-memory.dmp	UPX
behavioral2/memory/4696-64-0x00007FF6B24F0000-0x00007FF6B2842000-memory.dmp	UPX
behavioral2/memory/5392-48-0x00007FF6F7340000-0x00007FF6F7692000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5e7-101.dat	UPX
behavioral2/memory/1388-102-0x00007FF773D50000-0x00007FF7740A2000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5e8-106.dat	UPX
behavioral2/memory/3384-107-0x00007FF7B6590000-0x00007FF7B68E2000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5e9-111.dat	UPX
behavioral2/memory/4696-114-0x00007FF6B24F0000-0x00007FF6B2842000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5eb-119.dat	UPX
behavioral2/memory/2444-115-0x00007FF6BB4B0000-0x00007FF6BB802000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5ec-125.dat	UPX
behavioral2/files/0x000c00000001c5ed-130.dat	UPX
behavioral2/memory/4332-113-0x00007FF68B680000-0x00007FF68B9D2000-memory.dmp	UPX
behavioral2/memory/3120-133-0x00007FF7C0A50000-0x00007FF7C0DA2000-memory.dmp	UPX
behavioral2/memory/5100-134-0x00007FF60C780000-0x00007FF60CAD2000-memory.dmp	UPX
behavioral2/memory/5792-132-0x00007FF6FA350000-0x00007FF6FA6A2000-memory.dmp	UPX
behavioral2/memory/108-135-0x00007FF6674E0000-0x00007FF667832000-memory.dmp	UPX
behavioral2/memory/4964-136-0x00007FF795960000-0x00007FF795CB2000-memory.dmp	UPX
behavioral2/memory/5164-137-0x00007FF791B20000-0x00007FF791E72000-memory.dmp	UPX
behavioral2/memory/3012-138-0x00007FF7591E0000-0x00007FF759532000-memory.dmp	UPX
behavioral2/memory/1388-139-0x00007FF773D50000-0x00007FF7740A2000-memory.dmp	UPX
behavioral2/memory/3384-140-0x00007FF7B6590000-0x00007FF7B68E2000-memory.dmp	UPX
behavioral2/memory/2444-141-0x00007FF6BB4B0000-0x00007FF6BB802000-memory.dmp	UPX
behavioral2/memory/1584-142-0x00007FF6938B0000-0x00007FF693C02000-memory.dmp	UPX
behavioral2/memory/5484-143-0x00007FF6C8D20000-0x00007FF6C9072000-memory.dmp	UPX
behavioral2/memory/3320-144-0x00007FF6AEF30000-0x00007FF6AF282000-memory.dmp	UPX
behavioral2/memory/1712-145-0x00007FF732500000-0x00007FF732852000-memory.dmp	UPX
behavioral2/memory/5600-146-0x00007FF7DC270000-0x00007FF7DC5C2000-memory.dmp	UPX
behavioral2/memory/2796-147-0x00007FF687CF0000-0x00007FF688042000-memory.dmp	UPX
behavioral2/memory/4332-148-0x00007FF68B680000-0x00007FF68B9D2000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/5392-0-0x00007FF6F7340000-0x00007FF6F7692000-memory.dmp	xmrig
behavioral2/files/0x0009000000019caa-5.dat	xmrig
behavioral2/memory/1584-8-0x00007FF6938B0000-0x00007FF693C02000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5d7-10.dat	xmrig
behavioral2/files/0x000d00000001c5d6-12.dat	xmrig
behavioral2/memory/5484-14-0x00007FF6C8D20000-0x00007FF6C9072000-memory.dmp	xmrig
behavioral2/memory/3320-18-0x00007FF6AEF30000-0x00007FF6AF282000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5db-23.dat	xmrig
behavioral2/files/0x000c00000001c5dc-27.dat	xmrig
behavioral2/memory/5600-24-0x00007FF7DC270000-0x00007FF7DC5C2000-memory.dmp	xmrig
behavioral2/memory/1712-32-0x00007FF732500000-0x00007FF732852000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5dd-35.dat	xmrig
behavioral2/memory/2796-40-0x00007FF687CF0000-0x00007FF688042000-memory.dmp	xmrig
behavioral2/files/0x0003000000000436-41.dat	xmrig
behavioral2/memory/4332-42-0x00007FF68B680000-0x00007FF68B9D2000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5df-47.dat	xmrig
behavioral2/files/0x000c00000001c5e0-54.dat	xmrig
behavioral2/files/0x000c00000001c5e1-59.dat	xmrig
behavioral2/files/0x000c00000001c5e2-63.dat	xmrig
behavioral2/memory/1584-69-0x00007FF6938B0000-0x00007FF693C02000-memory.dmp	xmrig
behavioral2/memory/4300-70-0x00007FF7A2380000-0x00007FF7A26D2000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5e3-75.dat	xmrig
behavioral2/files/0x000c00000001c5e4-79.dat	xmrig
behavioral2/memory/4964-81-0x00007FF795960000-0x00007FF795CB2000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5e5-85.dat	xmrig
behavioral2/memory/5164-89-0x00007FF791B20000-0x00007FF791E72000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5e6-95.dat	xmrig
behavioral2/memory/3012-94-0x00007FF7591E0000-0x00007FF759532000-memory.dmp	xmrig
behavioral2/memory/5600-93-0x00007FF7DC270000-0x00007FF7DC5C2000-memory.dmp	xmrig
behavioral2/memory/3320-87-0x00007FF6AEF30000-0x00007FF6AF282000-memory.dmp	xmrig
behavioral2/memory/5484-80-0x00007FF6C8D20000-0x00007FF6C9072000-memory.dmp	xmrig
behavioral2/memory/108-74-0x00007FF6674E0000-0x00007FF667832000-memory.dmp	xmrig
behavioral2/memory/2820-68-0x00007FF6CE040000-0x00007FF6CE392000-memory.dmp	xmrig
behavioral2/memory/4860-67-0x00007FF6EB990000-0x00007FF6EBCE2000-memory.dmp	xmrig
behavioral2/memory/4696-64-0x00007FF6B24F0000-0x00007FF6B2842000-memory.dmp	xmrig
behavioral2/memory/5392-48-0x00007FF6F7340000-0x00007FF6F7692000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5e7-101.dat	xmrig
behavioral2/memory/1388-102-0x00007FF773D50000-0x00007FF7740A2000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5e8-106.dat	xmrig
behavioral2/memory/3384-107-0x00007FF7B6590000-0x00007FF7B68E2000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5e9-111.dat	xmrig
behavioral2/memory/4696-114-0x00007FF6B24F0000-0x00007FF6B2842000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5eb-119.dat	xmrig
behavioral2/memory/2444-115-0x00007FF6BB4B0000-0x00007FF6BB802000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5ec-125.dat	xmrig
behavioral2/files/0x000c00000001c5ed-130.dat	xmrig
behavioral2/memory/4332-113-0x00007FF68B680000-0x00007FF68B9D2000-memory.dmp	xmrig
behavioral2/memory/3120-133-0x00007FF7C0A50000-0x00007FF7C0DA2000-memory.dmp	xmrig
behavioral2/memory/5100-134-0x00007FF60C780000-0x00007FF60CAD2000-memory.dmp	xmrig
behavioral2/memory/5792-132-0x00007FF6FA350000-0x00007FF6FA6A2000-memory.dmp	xmrig
behavioral2/memory/108-135-0x00007FF6674E0000-0x00007FF667832000-memory.dmp	xmrig
behavioral2/memory/4964-136-0x00007FF795960000-0x00007FF795CB2000-memory.dmp	xmrig
behavioral2/memory/5164-137-0x00007FF791B20000-0x00007FF791E72000-memory.dmp	xmrig
behavioral2/memory/3012-138-0x00007FF7591E0000-0x00007FF759532000-memory.dmp	xmrig
behavioral2/memory/1388-139-0x00007FF773D50000-0x00007FF7740A2000-memory.dmp	xmrig
behavioral2/memory/3384-140-0x00007FF7B6590000-0x00007FF7B68E2000-memory.dmp	xmrig
behavioral2/memory/2444-141-0x00007FF6BB4B0000-0x00007FF6BB802000-memory.dmp	xmrig
behavioral2/memory/1584-142-0x00007FF6938B0000-0x00007FF693C02000-memory.dmp	xmrig
behavioral2/memory/5484-143-0x00007FF6C8D20000-0x00007FF6C9072000-memory.dmp	xmrig
behavioral2/memory/3320-144-0x00007FF6AEF30000-0x00007FF6AF282000-memory.dmp	xmrig
behavioral2/memory/1712-145-0x00007FF732500000-0x00007FF732852000-memory.dmp	xmrig
behavioral2/memory/5600-146-0x00007FF7DC270000-0x00007FF7DC5C2000-memory.dmp	xmrig
behavioral2/memory/2796-147-0x00007FF687CF0000-0x00007FF688042000-memory.dmp	xmrig
behavioral2/memory/4332-148-0x00007FF68B680000-0x00007FF68B9D2000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1584	RqVEzvH.exe
5484	QTwIptf.exe
3320	kGezhNC.exe
5600	OgNxqEP.exe
1712	CveYRgS.exe
2796	qUQWKFY.exe
4332	svNwTfC.exe
4696	AEqtBHq.exe
4300	oXzHePH.exe
4860	kfLyDIO.exe
2820	pwQsBys.exe
108	rupzMzY.exe
4964	fcBDmOy.exe
5164	xqCQjDX.exe
3012	TcYODjo.exe
1388	ywxoZBF.exe
3384	xswlnqJ.exe
2444	rCATHrv.exe
5792	xkkCIWn.exe
5100	GNYTamj.exe
3120	MwOGzfd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5392-0-0x00007FF6F7340000-0x00007FF6F7692000-memory.dmp	upx
behavioral2/files/0x0009000000019caa-5.dat	upx
behavioral2/memory/1584-8-0x00007FF6938B0000-0x00007FF693C02000-memory.dmp	upx
behavioral2/files/0x000d00000001c5d7-10.dat	upx
behavioral2/files/0x000d00000001c5d6-12.dat	upx
behavioral2/memory/5484-14-0x00007FF6C8D20000-0x00007FF6C9072000-memory.dmp	upx
behavioral2/memory/3320-18-0x00007FF6AEF30000-0x00007FF6AF282000-memory.dmp	upx
behavioral2/files/0x000c00000001c5db-23.dat	upx
behavioral2/files/0x000c00000001c5dc-27.dat	upx
behavioral2/memory/5600-24-0x00007FF7DC270000-0x00007FF7DC5C2000-memory.dmp	upx
behavioral2/memory/1712-32-0x00007FF732500000-0x00007FF732852000-memory.dmp	upx
behavioral2/files/0x000c00000001c5dd-35.dat	upx
behavioral2/memory/2796-40-0x00007FF687CF0000-0x00007FF688042000-memory.dmp	upx
behavioral2/files/0x0003000000000436-41.dat	upx
behavioral2/memory/4332-42-0x00007FF68B680000-0x00007FF68B9D2000-memory.dmp	upx
behavioral2/files/0x000c00000001c5df-47.dat	upx
behavioral2/files/0x000c00000001c5e0-54.dat	upx
behavioral2/files/0x000c00000001c5e1-59.dat	upx
behavioral2/files/0x000c00000001c5e2-63.dat	upx
behavioral2/memory/1584-69-0x00007FF6938B0000-0x00007FF693C02000-memory.dmp	upx
behavioral2/memory/4300-70-0x00007FF7A2380000-0x00007FF7A26D2000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e3-75.dat	upx
behavioral2/files/0x000c00000001c5e4-79.dat	upx
behavioral2/memory/4964-81-0x00007FF795960000-0x00007FF795CB2000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e5-85.dat	upx
behavioral2/memory/5164-89-0x00007FF791B20000-0x00007FF791E72000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e6-95.dat	upx
behavioral2/memory/3012-94-0x00007FF7591E0000-0x00007FF759532000-memory.dmp	upx
behavioral2/memory/5600-93-0x00007FF7DC270000-0x00007FF7DC5C2000-memory.dmp	upx
behavioral2/memory/3320-87-0x00007FF6AEF30000-0x00007FF6AF282000-memory.dmp	upx
behavioral2/memory/5484-80-0x00007FF6C8D20000-0x00007FF6C9072000-memory.dmp	upx
behavioral2/memory/108-74-0x00007FF6674E0000-0x00007FF667832000-memory.dmp	upx
behavioral2/memory/2820-68-0x00007FF6CE040000-0x00007FF6CE392000-memory.dmp	upx
behavioral2/memory/4860-67-0x00007FF6EB990000-0x00007FF6EBCE2000-memory.dmp	upx
behavioral2/memory/4696-64-0x00007FF6B24F0000-0x00007FF6B2842000-memory.dmp	upx
behavioral2/memory/5392-48-0x00007FF6F7340000-0x00007FF6F7692000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e7-101.dat	upx
behavioral2/memory/1388-102-0x00007FF773D50000-0x00007FF7740A2000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e8-106.dat	upx
behavioral2/memory/3384-107-0x00007FF7B6590000-0x00007FF7B68E2000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e9-111.dat	upx
behavioral2/memory/4696-114-0x00007FF6B24F0000-0x00007FF6B2842000-memory.dmp	upx
behavioral2/files/0x000c00000001c5eb-119.dat	upx
behavioral2/memory/2444-115-0x00007FF6BB4B0000-0x00007FF6BB802000-memory.dmp	upx
behavioral2/files/0x000c00000001c5ec-125.dat	upx
behavioral2/files/0x000c00000001c5ed-130.dat	upx
behavioral2/memory/4332-113-0x00007FF68B680000-0x00007FF68B9D2000-memory.dmp	upx
behavioral2/memory/3120-133-0x00007FF7C0A50000-0x00007FF7C0DA2000-memory.dmp	upx
behavioral2/memory/5100-134-0x00007FF60C780000-0x00007FF60CAD2000-memory.dmp	upx
behavioral2/memory/5792-132-0x00007FF6FA350000-0x00007FF6FA6A2000-memory.dmp	upx
behavioral2/memory/108-135-0x00007FF6674E0000-0x00007FF667832000-memory.dmp	upx
behavioral2/memory/4964-136-0x00007FF795960000-0x00007FF795CB2000-memory.dmp	upx
behavioral2/memory/5164-137-0x00007FF791B20000-0x00007FF791E72000-memory.dmp	upx
behavioral2/memory/3012-138-0x00007FF7591E0000-0x00007FF759532000-memory.dmp	upx
behavioral2/memory/1388-139-0x00007FF773D50000-0x00007FF7740A2000-memory.dmp	upx
behavioral2/memory/3384-140-0x00007FF7B6590000-0x00007FF7B68E2000-memory.dmp	upx
behavioral2/memory/2444-141-0x00007FF6BB4B0000-0x00007FF6BB802000-memory.dmp	upx
behavioral2/memory/1584-142-0x00007FF6938B0000-0x00007FF693C02000-memory.dmp	upx
behavioral2/memory/5484-143-0x00007FF6C8D20000-0x00007FF6C9072000-memory.dmp	upx
behavioral2/memory/3320-144-0x00007FF6AEF30000-0x00007FF6AF282000-memory.dmp	upx
behavioral2/memory/1712-145-0x00007FF732500000-0x00007FF732852000-memory.dmp	upx
behavioral2/memory/5600-146-0x00007FF7DC270000-0x00007FF7DC5C2000-memory.dmp	upx
behavioral2/memory/2796-147-0x00007FF687CF0000-0x00007FF688042000-memory.dmp	upx
behavioral2/memory/4332-148-0x00007FF68B680000-0x00007FF68B9D2000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\OgNxqEP.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\CveYRgS.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\svNwTfC.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\AEqtBHq.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ywxoZBF.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\GNYTamj.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\QTwIptf.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\pwQsBys.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\TcYODjo.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\RqVEzvH.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\oXzHePH.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\kfLyDIO.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\xkkCIWn.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\qUQWKFY.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\rupzMzY.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fcBDmOy.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\xqCQjDX.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\xswlnqJ.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\rCATHrv.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\MwOGzfd.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\kGezhNC.exe	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5392 wrote to memory of 1584	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 5392 wrote to memory of 5484	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 5392 wrote to memory of 3320	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 5392 wrote to memory of 5600	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 5392 wrote to memory of 1712	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 5392 wrote to memory of 2796	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 5392 wrote to memory of 4332	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 5392 wrote to memory of 4696	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 5392 wrote to memory of 4300	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 5392 wrote to memory of 4860	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 5392 wrote to memory of 2820	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 5392 wrote to memory of 108	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 5392 wrote to memory of 4964	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 5392 wrote to memory of 5164	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 5392 wrote to memory of 3012	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 5392 wrote to memory of 1388	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 5392 wrote to memory of 3384	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 5392 wrote to memory of 2444	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 5392 wrote to memory of 5792	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 5392 wrote to memory of 5100	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109
PID 5392 wrote to memory of 3120	5392	2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_11f5d55658246959f565231473b7b8c7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Windows\System\RqVEzvH.exe
  C:\Windows\System\RqVEzvH.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\QTwIptf.exe
  C:\Windows\System\QTwIptf.exe
  2⤵
  - Executes dropped EXE
  PID:5484
- C:\Windows\System\kGezhNC.exe
  C:\Windows\System\kGezhNC.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\OgNxqEP.exe
  C:\Windows\System\OgNxqEP.exe
  2⤵
  - Executes dropped EXE
  PID:5600
- C:\Windows\System\CveYRgS.exe
  C:\Windows\System\CveYRgS.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\qUQWKFY.exe
  C:\Windows\System\qUQWKFY.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\svNwTfC.exe
  C:\Windows\System\svNwTfC.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\AEqtBHq.exe
  C:\Windows\System\AEqtBHq.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\oXzHePH.exe
  C:\Windows\System\oXzHePH.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\kfLyDIO.exe
  C:\Windows\System\kfLyDIO.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\pwQsBys.exe
  C:\Windows\System\pwQsBys.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\rupzMzY.exe
  C:\Windows\System\rupzMzY.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\fcBDmOy.exe
  C:\Windows\System\fcBDmOy.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\xqCQjDX.exe
  C:\Windows\System\xqCQjDX.exe
  2⤵
  - Executes dropped EXE
  PID:5164
- C:\Windows\System\TcYODjo.exe
  C:\Windows\System\TcYODjo.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\ywxoZBF.exe
  C:\Windows\System\ywxoZBF.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\xswlnqJ.exe
  C:\Windows\System\xswlnqJ.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\rCATHrv.exe
  C:\Windows\System\rCATHrv.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\xkkCIWn.exe
  C:\Windows\System\xkkCIWn.exe
  2⤵
  - Executes dropped EXE
  PID:5792
- C:\Windows\System\GNYTamj.exe
  C:\Windows\System\GNYTamj.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\MwOGzfd.exe
  C:\Windows\System\MwOGzfd.exe
  2⤵
  - Executes dropped EXE
  PID:3120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AEqtBHq.exe

Path C:\Windows\System\AEqtBHq.exe
Size 8.3MB
SHA256 770180eb41ba1bb573ee140993592abb03fb7158c2180eab46aea434aa08b3bf
MD5 efc4a190ba57d2301a78e875bf48239b
SHA1 43e92412d63ae90d8e420abe4603198a0a65c28b
SHA512 91c257d61b101958c05d4f6aabda3fcde04a8e9e7fb2282d8cb962df6db7039f0abec417484ccfdf34d8b355c01b2fdfcd62d13f28c1acd94cd8f403f8fdef24
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lU+:v+A56utgpPF8u/7+
TLSH
T112965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CveYRgS.exe

Path C:\Windows\System\CveYRgS.exe
Size 8.3MB
SHA256 507168bcbfc67eade26cf5ead60078e6c26e0172aa184036a1b362cf36e017b3
MD5 8d46a209a93ecc0e9a00ed7a55436e5d
SHA1 4343691e6b0a122197a5cd11bc1537cd6b141e6c
SHA512 d8321a6ef7ca1c19d6c64fa4cdf76167135938422e77c719793241058285856beca71d19ba56811a7a09fdf56b0766ab4621d1b1b90d89986fdbdcb1271f532b
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUf:v+A56utgpPF8u/7f
TLSH
T1F0965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GNYTamj.exe

Path C:\Windows\System\GNYTamj.exe
Size 8.3MB
SHA256 23c9934bd0c7e85ff907f2a2aee01675f9f85b47da71d476ef565862488925a6
MD5 9111d685be7c9de238b3e1f62e62289b
SHA1 4997e11f6b9863d94413a58da78c3f9f08fea87d
SHA512 5a3626da0126268d7ab46efc1599aefcf6439a2e8e2fa0fe4cc0473d5815e5e093c9f80606ddeeabde49bb29604883e07e93d0c30579b90dd2eef20b772097ef
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUf:v+A56utgpPF8u/7f
TLSH
T147965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MwOGzfd.exe

Path C:\Windows\System\MwOGzfd.exe
Size 8.3MB
SHA256 83501ae33c2e1e2e979287ab0be69f97469c1c525260de02e5014cd2ddb4a173
MD5 fa8d5ea2a5f9fbd8f7d4e28c963eb2f4
SHA1 ef91f21ab55a71cf6744c9b59844d06257ff6eb5
SHA512 c1253209b9dd6f0357c3fef8d6a75a13d6b8dd57f873f1e6be7f140066703e3babfe71b8c1390982a8606e6dd9d64632ab1c631b3e7e8bafc29451b09f3f0101
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUP:v+A56utgpPF8u/7P
TLSH
T1A5965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OgNxqEP.exe

Path C:\Windows\System\OgNxqEP.exe
Size 8.3MB
SHA256 27a85e4e930c4d6c4ef7e75db04e83b086395555a085ac7b737e57a8db090bdf
MD5 4278e52ac653c692c446dea0e0700257
SHA1 a6188e9781919fa19c5688b53deedc79b67e7b94
SHA512 deb10f2799f4988df56f1e4393ad84979f6e52813ddb73643500d68196fc2883a32ccf1528f519f4793d6cca14c1697f883e95034326a2910fbcd485e2d63595
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUq:v+A56utgpPF8u/7q
TLSH
T1B2965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QTwIptf.exe

Path C:\Windows\System\QTwIptf.exe
Size 8.3MB
SHA256 3c1ff8f5edab2f86fc8a506d1caa29854ae9c18c3d4e1e45afd1612757d65491
MD5 b9680287058570512d3624e77f3e133c
SHA1 a879a26776245a63fd588d6ab741f6c94eb7f48a
SHA512 5e648b4733c468d1be3b36e4f5a2c45436f34d5d747b8434cebbf5b6e2e5dd93205e5e8ade8ad911d4b804b78bbcc76375182ac9e5503a475eb63028c0d2c9d8
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUo:v+A56utgpPF8u/7o
TLSH
T1CB965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RqVEzvH.exe

Path C:\Windows\System\RqVEzvH.exe
Size 8.3MB
SHA256 ef82771e9aa621e173b99009e69986d9f449eaa1acd3ef6e7dd5f25c73e2e20f
MD5 353b57e91507aa608c8f392237439fb6
SHA1 5265409bd90099acc03dd2b7bce89144e4c7b8fb
SHA512 f7356fb931a5df63385882049c07913750994f1e8be1b0bc6b05b62966588f527265824301f8d9ba18e735cab64a5e4852e38b2ad2ea39a9a91b605f5b4f542b
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUU:v+A56utgpPF8u/7U
TLSH
T13C965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TcYODjo.exe

Path C:\Windows\System\TcYODjo.exe
Size 8.3MB
SHA256 8ac97f7e8bfe73ee36c58b02799adcef50b86dce94600d15efd67896333a7e93
MD5 46fc366227b580fdb0b4518205cfa75f
SHA1 5cdc3faafdee3799ac2a9ff601863e88b0aeccaf
SHA512 a22bdb393f5d5f9b58af11a9fde5e7edc7ac62227905c7222b62abc08d5917ce7b93bec12725092f63940eb5c26ce7ff78f0ecc99d3c0f790e8e9ec131a59961
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUs:v+A56utgpPF8u/7s
TLSH
T12D965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcBDmOy.exe

Path C:\Windows\System\fcBDmOy.exe
Size 8.3MB
SHA256 2d1a0815da009f0524bb7fab8bb6c9fd49e01b7cc06b00cf9a678dac492370f9
MD5 10aa5badf03329ea3a9c78264173360d
SHA1 49a0a0c9440705023703c01ed8018ac9ed2e5b9c
SHA512 b2dfe10f2daa66b395de042f29509ee38e55eed3955e2f64bb0dd12a99a2070d732e89a99f95618ec1129bd6fd5c656c6cc4050ab3494a97198ab42d89f1664b
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUC:v+A56utgpPF8u/7C
TLSH
T137965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kGezhNC.exe

Path C:\Windows\System\kGezhNC.exe
Size 8.3MB
SHA256 732e4f8c79dd622d3d10d68489c02071861d0c7bab92e8474276226dd0e8545a
MD5 daebb16dde05655cfaa5fbac07fb3faf
SHA1 7a4ee8a610ec57938371fcdc978ee7f0d09763aa
SHA512 05df6621534d497017c44f62f55d16833309b9e5d2d0252464a75cc871261149ec816cc8a41ca03bc49ee87783149a4299ae0f83d60c79169bd33be20ac015f9
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUY:v+A56utgpPF8u/7Y
TLSH
T1E1965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfLyDIO.exe

Path C:\Windows\System\kfLyDIO.exe
Size 8.3MB
SHA256 562f33443b4d067c649665897d186b36c1621ec9fabed8df83a731db73823a8c
MD5 a17495f250ec0799b924996a8b92b716
SHA1 35def748709e8bb9d9b86d3383c3a57b058e0d45
SHA512 4eac2b170edd2642f7595241718505eb35dfab635083a3bab5600428b07546bb0c21cfce571acc5f30a50d13b779de28a397a86b43b67115bc7a241b1bf72532
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUM:v+A56utgpPF8u/7M
TLSH
T183965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oXzHePH.exe

Path C:\Windows\System\oXzHePH.exe
Size 8.3MB
SHA256 f2e99d928b74cbd2d76dca3dff1a194c2593d4407f2937df81adfaa7ecc4f366
MD5 f40f917d276a52d9c2e1dc9d5e0d54cd
SHA1 cc2ad3a5cf7a5238624531fa29ecbf54eb879949
SHA512 c83b1ffde7f5fa60775f05575e36dd14506ff48826c2535802b55ca642c00295a42f814b98497dd6e00828c4d664d57e898e63bc2d31deff1fadd2f444566e2a
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lU0:v+A56utgpPF8u/70
TLSH
T13C965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwQsBys.exe

Path C:\Windows\System\pwQsBys.exe
Size 8.3MB
SHA256 ce4446804e3ffccc9b55f8a10c4535ee6dd7a88fc5600f99c024f2b0a8e4cfca
MD5 2fa040ace08c82b796882255a17ecd5f
SHA1 8fb6399e10a5dfedd3a1f9683496affd3a5383e8
SHA512 2da04d9b3c61d7ae9145242658eb70c030855bd0de1d61b809433ba840bfb761037cfa62ed174f09dc3b633bb9b98a9e8ab2b0c663d65963056295a74f82ae41
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUG:v+A56utgpPF8u/7G
TLSH
T17A965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qUQWKFY.exe

Path C:\Windows\System\qUQWKFY.exe
Size 8.3MB
SHA256 312bbe6df6e7d36deecb15a7f5290cc82b6f778f37700d100da1ff665d634293
MD5 24f2e21e74432f8a0b390fefc2156f93
SHA1 aab11c0182cd2c535ac37cb717c52e85de108be4
SHA512 8fa8f62cbe66ab0a7e29d25f84487717e606167435811fbebaaa8a53678f873caaa8aadd77f6ded21f8cca466260ab45282060e3c57fbc898ad9f590ffe0936b
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lU/:v+A56utgpPF8u/7/
TLSH
T1B2965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rCATHrv.exe

Path C:\Windows\System\rCATHrv.exe
Size 8.3MB
SHA256 8cfe5f4b56aec2ada352ffa17888fdc814962736981207be5de40bef28b76159
MD5 024f73ded49ca0a82f5898063b7099b9
SHA1 7201026e3634ed908f63eb8fe2c72db09db792c6
SHA512 3458ab2efe9f38571228995dab5574854b84e6b85290f8c7591fe53c0aeae96b3413d350d53e3a3547572dbecdf36ae59275a6c9e1a96b348b8913cdf3bed4c2
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUF:v+A56utgpPF8u/7F
TLSH
T1A5965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rupzMzY.exe

Path C:\Windows\System\rupzMzY.exe
Size 8.3MB
SHA256 77783e880814583234d24f2dda1cc5195e0606f812ad506990e27b7a1a8fc894
MD5 a9b11d4ad760b23aab9822b498fa8838
SHA1 c7ae0a7718fdfde9d1237fbce9827342b16f2e70
SHA512 c03c7efe3e9831e036d7ce17fd10bed6678f30d73bdc7448c9ec5179c9c8e0234309ccf3f5f89f20d24af504c05f5eb043de4a603cc50c5556975c178800e094
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUg:v+A56utgpPF8u/7g
TLSH
T1F5965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svNwTfC.exe

Path C:\Windows\System\svNwTfC.exe
Size 8.3MB
SHA256 a113de8f983c3778d1bfe9905dbf819610a32ab401a34a5ce9abc7ad0b969283
MD5 26ecee8e253044fb9515f115327a0d62
SHA1 0059e62f529873c858b7e73b3382b424d70f2184
SHA512 ad74419706535a3468e6fdf00c980a94be4a570d753dd62b308d049d476ae5b3d0c5ae5db5fbda0096a3677f410bf1541d9d9ef436332ee8721ee1787816136f
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUB:v+A56utgpPF8u/7B
TLSH
T12F965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xkkCIWn.exe

Path C:\Windows\System\xkkCIWn.exe
Size 8.3MB
SHA256 a7825e55e4a73a052c19f237dc417c2dbeaa3636d51f11666b854b8f50639e19
MD5 60437da7ffb37c4df8d485fedf313573
SHA1 5bc08b832f02ca2479a0e9fac4c441f9c9837ab0
SHA512 35080615c24ed63073266a06c5d63bb57833ebdbdb7f60d55b06c67fad22c19fe9a4df87b2664063828e632d67e009b46d040539ad4069c3c45942b8ce064820
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUf:v+A56utgpPF8u/7f
TLSH
T179965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xqCQjDX.exe

Path C:\Windows\System\xqCQjDX.exe
Size 8.3MB
SHA256 a1ab043a9a8bcc65895022ab048395b9a8c160d7fe382788db2d90184d89ca31
MD5 22bf90944eac3e27aa5774c573de2179
SHA1 96fff2dd9f097ec52d8b3a9b85215fb84a6fc2c1
SHA512 cb4193b4a9a1af2f507cbd4f384b9d4572d16afaea674637c9251d38abd07060df31f898a14b5f5e57232ae432ecc6ec6d9d4589a8efee696bc613cca3ba1792
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUO:v+A56utgpPF8u/7O
TLSH
T135965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xswlnqJ.exe

Path C:\Windows\System\xswlnqJ.exe
Size 8.3MB
SHA256 90356e3cebc11755c1d6ea4f9809ca479d53ad633bca14f968fee82c7f9fac6c
MD5 083efcff4f30e6df72e0a322c4ef4b14
SHA1 00b9d4d6b172e0e6b5143b2ca5ced5f1b5c32b72
SHA512 a9e4fbcad26c983ae9242223d716c6e756a5d8c7b561c5894f3b0d2942bbcf588f9e354499e433f289e1d4ee278c9c17a1b5a50db5a1b6d9bbf3fe09e0b2e379
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lU+:v+A56utgpPF8u/7+
TLSH
T182965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywxoZBF.exe

Path C:\Windows\System\ywxoZBF.exe
Size 8.3MB
SHA256 5aeeccef89f55134a3f5323c22045161c88aeb4013e0f0c5ccdcc975635ae88b
MD5 11dac9fdffa1b8858beed76797bc62f1
SHA1 d0c7bfe01b4caf08874734e9d10ba417e368301d
SHA512 57c529728afdeff1f1ee584894c343dd1ff12ccae58b6991d70cce9a874e00734000f92bf07f0fc7060cf498a80c0600580400dca50a2095324836828dbd3ab5
SSDEEP 98304:MemTLkNdfE0pZbR56utgpPFotBER/mQ32lUk:v+A56utgpPF8u/7k
TLSH
T1B9965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-74-0x00007FF6674E0000-0x00007FF667832000-memory.dmp

Download

memory/108-153-0x00007FF6674E0000-0x00007FF667832000-memory.dmp

Download

memory/108-135-0x00007FF6674E0000-0x00007FF667832000-memory.dmp

Download

memory/1388-139-0x00007FF773D50000-0x00007FF7740A2000-memory.dmp

Download

memory/1388-102-0x00007FF773D50000-0x00007FF7740A2000-memory.dmp

Download

memory/1388-157-0x00007FF773D50000-0x00007FF7740A2000-memory.dmp

Download

memory/1584-69-0x00007FF6938B0000-0x00007FF693C02000-memory.dmp

Download

memory/1584-8-0x00007FF6938B0000-0x00007FF693C02000-memory.dmp

Download

memory/1584-142-0x00007FF6938B0000-0x00007FF693C02000-memory.dmp

Download

memory/1712-32-0x00007FF732500000-0x00007FF732852000-memory.dmp

Download

memory/1712-145-0x00007FF732500000-0x00007FF732852000-memory.dmp

Download

memory/2444-159-0x00007FF6BB4B0000-0x00007FF6BB802000-memory.dmp

Download

memory/2444-115-0x00007FF6BB4B0000-0x00007FF6BB802000-memory.dmp

Download

memory/2444-141-0x00007FF6BB4B0000-0x00007FF6BB802000-memory.dmp

Download

memory/2796-147-0x00007FF687CF0000-0x00007FF688042000-memory.dmp

Download

memory/2796-40-0x00007FF687CF0000-0x00007FF688042000-memory.dmp

Download

memory/2820-68-0x00007FF6CE040000-0x00007FF6CE392000-memory.dmp

Download

memory/2820-152-0x00007FF6CE040000-0x00007FF6CE392000-memory.dmp

Download

memory/3012-138-0x00007FF7591E0000-0x00007FF759532000-memory.dmp

Download

memory/3012-155-0x00007FF7591E0000-0x00007FF759532000-memory.dmp

Download

memory/3012-94-0x00007FF7591E0000-0x00007FF759532000-memory.dmp

Download

memory/3120-133-0x00007FF7C0A50000-0x00007FF7C0DA2000-memory.dmp

Download

memory/3120-161-0x00007FF7C0A50000-0x00007FF7C0DA2000-memory.dmp

Download

memory/3320-87-0x00007FF6AEF30000-0x00007FF6AF282000-memory.dmp

Download

memory/3320-18-0x00007FF6AEF30000-0x00007FF6AF282000-memory.dmp

Download

memory/3320-144-0x00007FF6AEF30000-0x00007FF6AF282000-memory.dmp

Download

memory/3384-140-0x00007FF7B6590000-0x00007FF7B68E2000-memory.dmp

Download

memory/3384-158-0x00007FF7B6590000-0x00007FF7B68E2000-memory.dmp

Download

memory/3384-107-0x00007FF7B6590000-0x00007FF7B68E2000-memory.dmp

Download

memory/4300-150-0x00007FF7A2380000-0x00007FF7A26D2000-memory.dmp

Download

memory/4300-70-0x00007FF7A2380000-0x00007FF7A26D2000-memory.dmp

Download

memory/4332-148-0x00007FF68B680000-0x00007FF68B9D2000-memory.dmp

Download

memory/4332-113-0x00007FF68B680000-0x00007FF68B9D2000-memory.dmp

Download

memory/4332-42-0x00007FF68B680000-0x00007FF68B9D2000-memory.dmp

Download

memory/4696-64-0x00007FF6B24F0000-0x00007FF6B2842000-memory.dmp

Download

memory/4696-149-0x00007FF6B24F0000-0x00007FF6B2842000-memory.dmp

Download

memory/4696-114-0x00007FF6B24F0000-0x00007FF6B2842000-memory.dmp

Download

memory/4860-67-0x00007FF6EB990000-0x00007FF6EBCE2000-memory.dmp

Download

memory/4860-151-0x00007FF6EB990000-0x00007FF6EBCE2000-memory.dmp

Download

memory/4964-81-0x00007FF795960000-0x00007FF795CB2000-memory.dmp

Download

memory/4964-136-0x00007FF795960000-0x00007FF795CB2000-memory.dmp

Download

memory/4964-154-0x00007FF795960000-0x00007FF795CB2000-memory.dmp

Download

memory/5100-134-0x00007FF60C780000-0x00007FF60CAD2000-memory.dmp

Download

memory/5100-162-0x00007FF60C780000-0x00007FF60CAD2000-memory.dmp

Download

memory/5164-137-0x00007FF791B20000-0x00007FF791E72000-memory.dmp

Download

memory/5164-89-0x00007FF791B20000-0x00007FF791E72000-memory.dmp

Download

memory/5164-156-0x00007FF791B20000-0x00007FF791E72000-memory.dmp

Download

memory/5392-48-0x00007FF6F7340000-0x00007FF6F7692000-memory.dmp

Download

memory/5392-1-0x00000183D5480000-0x00000183D5490000-memory.dmp

Download

memory/5392-0-0x00007FF6F7340000-0x00007FF6F7692000-memory.dmp

Download

memory/5484-80-0x00007FF6C8D20000-0x00007FF6C9072000-memory.dmp

Download

memory/5484-143-0x00007FF6C8D20000-0x00007FF6C9072000-memory.dmp

Download

memory/5484-14-0x00007FF6C8D20000-0x00007FF6C9072000-memory.dmp

Download

memory/5600-146-0x00007FF7DC270000-0x00007FF7DC5C2000-memory.dmp

Download

memory/5600-93-0x00007FF7DC270000-0x00007FF7DC5C2000-memory.dmp

Download

memory/5600-24-0x00007FF7DC270000-0x00007FF7DC5C2000-memory.dmp

Download

memory/5792-132-0x00007FF6FA350000-0x00007FF6FA6A2000-memory.dmp

Download

memory/5792-160-0x00007FF6FA350000-0x00007FF6FA6A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads