cobaltstrike | cb6fde30c39126022fa0a522e27e06823f626a1ddd3f353cccfbc3c2f34dc18a

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 02:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
Size 5.2MB
Sample260910-cray9awte1
SHA256 cb6fde30c39126022fa0a522e27e06823f626a1ddd3f353cccfbc3c2f34dc18a
MD5 dc6c02412da36a061c7a259c4b10c9d6
SHA1 402bb80c20b1b34d34e20828945c4ab8c05d99d0
SHA512 b97ccaf8b55e070050e152d58a776fefc52b047328a7976a7587075c3ee5f7bfb08e7c7e2d6ad079f9a1b4669d35c58c49f74a49086e9563f4f6a243e3fe2638
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibP56utgpPFotBER/mQ32lU2
TLSH
T11B465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x00070000000244e2-9.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000244e7-31.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000244eb-80.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000244f2-108.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000244f1-106.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000244f0-104.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000244ef-98.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000244ee-87.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000244ed-84.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000244ea-78.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000244e9-73.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000244e8-70.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000244ec-66.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000244e6-56.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000244e3-46.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000244e5-53.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000244e4-47.dat	cobalt_reflective_dll
behavioral1/files/0x000a0000000243ee-15.dat	cobalt_reflective_dll
behavioral1/files/0x000c0000000244b9-8.dat	cobalt_reflective_dll
behavioral1/files/0x000a0000000243f7-136.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000244f3-145.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral1/files/0x00070000000244e2-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000244e7-31.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000244eb-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000244f2-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000244f1-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000244f0-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000244ef-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000244ee-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000244ed-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000244ea-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000244e9-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000244e8-70.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000244ec-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000244e6-56.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000244e3-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000244e5-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000244e4-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000a0000000243ee-15.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000c0000000244b9-8.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000a0000000243f7-136.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00070000000244f3-145.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral1/memory/4376-0-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	UPX
behavioral1/files/0x00070000000244e2-9.dat	UPX
behavioral1/files/0x00070000000244e7-31.dat	UPX
behavioral1/memory/4696-62-0x00007FF6DCBF0000-0x00007FF6DCF41000-memory.dmp	UPX
behavioral1/memory/1700-74-0x00007FF699ED0000-0x00007FF69A221000-memory.dmp	UPX
behavioral1/files/0x00070000000244eb-80.dat	UPX
behavioral1/memory/4364-101-0x00007FF7C2A50000-0x00007FF7C2DA1000-memory.dmp	UPX
behavioral1/memory/3844-112-0x00007FF7298B0000-0x00007FF729C01000-memory.dmp	UPX
behavioral1/memory/4956-115-0x00007FF78C190000-0x00007FF78C4E1000-memory.dmp	UPX
behavioral1/memory/116-114-0x00007FF7DD430000-0x00007FF7DD781000-memory.dmp	UPX
behavioral1/memory/4260-113-0x00007FF7CF6F0000-0x00007FF7CFA41000-memory.dmp	UPX
behavioral1/memory/1264-111-0x00007FF7974E0000-0x00007FF797831000-memory.dmp	UPX
behavioral1/memory/4636-110-0x00007FF6F93E0000-0x00007FF6F9731000-memory.dmp	UPX
behavioral1/files/0x00070000000244f2-108.dat	UPX
behavioral1/files/0x00070000000244f1-106.dat	UPX
behavioral1/files/0x00070000000244f0-104.dat	UPX
behavioral1/memory/2424-103-0x00007FF79D7D0000-0x00007FF79DB21000-memory.dmp	UPX
behavioral1/memory/3124-102-0x00007FF6E8A10000-0x00007FF6E8D61000-memory.dmp	UPX
behavioral1/memory/3056-100-0x00007FF736180000-0x00007FF7364D1000-memory.dmp	UPX
behavioral1/files/0x00070000000244ef-98.dat	UPX
behavioral1/memory/3412-94-0x00007FF647250000-0x00007FF6475A1000-memory.dmp	UPX
behavioral1/memory/5032-93-0x00007FF792470000-0x00007FF7927C1000-memory.dmp	UPX
behavioral1/files/0x00070000000244ee-87.dat	UPX
behavioral1/files/0x00070000000244ed-84.dat	UPX
behavioral1/memory/3540-83-0x00007FF778CF0000-0x00007FF779041000-memory.dmp	UPX
behavioral1/files/0x00070000000244ea-78.dat	UPX
behavioral1/memory/2296-75-0x00007FF66AB70000-0x00007FF66AEC1000-memory.dmp	UPX
behavioral1/files/0x00070000000244e9-73.dat	UPX
behavioral1/files/0x00070000000244e8-70.dat	UPX
behavioral1/files/0x00070000000244ec-66.dat	UPX
behavioral1/memory/1628-63-0x00007FF6A6AF0000-0x00007FF6A6E41000-memory.dmp	UPX
behavioral1/files/0x00070000000244e6-56.dat	UPX
behavioral1/files/0x00070000000244e3-46.dat	UPX
behavioral1/files/0x00070000000244e5-53.dat	UPX
behavioral1/files/0x00070000000244e4-47.dat	UPX
behavioral1/memory/2172-36-0x00007FF7F48C0000-0x00007FF7F4C11000-memory.dmp	UPX
behavioral1/files/0x000a0000000243ee-15.dat	UPX
behavioral1/files/0x000c0000000244b9-8.dat	UPX
behavioral1/memory/4344-25-0x00007FF7648A0000-0x00007FF764BF1000-memory.dmp	UPX
behavioral1/memory/4376-117-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	UPX
behavioral1/memory/4344-119-0x00007FF7648A0000-0x00007FF764BF1000-memory.dmp	UPX
behavioral1/files/0x000a0000000243f7-136.dat	UPX
behavioral1/memory/1276-144-0x00007FF674510000-0x00007FF674861000-memory.dmp	UPX
behavioral1/memory/564-147-0x00007FF6D3B80000-0x00007FF6D3ED1000-memory.dmp	UPX
behavioral1/files/0x00070000000244f3-145.dat	UPX
behavioral1/memory/2424-142-0x00007FF79D7D0000-0x00007FF79DB21000-memory.dmp	UPX
behavioral1/memory/4696-124-0x00007FF6DCBF0000-0x00007FF6DCF41000-memory.dmp	UPX
behavioral1/memory/4376-148-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	UPX
behavioral1/memory/4376-168-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	UPX
behavioral1/memory/1276-169-0x00007FF674510000-0x00007FF674861000-memory.dmp	UPX
behavioral1/memory/4376-171-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	UPX
behavioral1/memory/4376-193-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	UPX
behavioral1/memory/2172-210-0x00007FF7F48C0000-0x00007FF7F4C11000-memory.dmp	UPX
behavioral1/memory/4344-212-0x00007FF7648A0000-0x00007FF764BF1000-memory.dmp	UPX
behavioral1/memory/1264-223-0x00007FF7974E0000-0x00007FF797831000-memory.dmp	UPX
behavioral1/memory/1628-224-0x00007FF6A6AF0000-0x00007FF6A6E41000-memory.dmp	UPX
behavioral1/memory/5032-233-0x00007FF792470000-0x00007FF7927C1000-memory.dmp	UPX
behavioral1/memory/3056-237-0x00007FF736180000-0x00007FF7364D1000-memory.dmp	UPX
behavioral1/memory/4364-239-0x00007FF7C2A50000-0x00007FF7C2DA1000-memory.dmp	UPX
behavioral1/memory/3124-241-0x00007FF6E8A10000-0x00007FF6E8D61000-memory.dmp	UPX
behavioral1/memory/3412-235-0x00007FF647250000-0x00007FF6475A1000-memory.dmp	UPX
behavioral1/memory/4260-232-0x00007FF7CF6F0000-0x00007FF7CFA41000-memory.dmp	UPX
behavioral1/memory/3844-226-0x00007FF7298B0000-0x00007FF729C01000-memory.dmp	UPX
behavioral1/memory/4696-220-0x00007FF6DCBF0000-0x00007FF6DCF41000-memory.dmp	UPX

XMRig Miner payload 57 IoCs

miner

resource	yara_rule
behavioral1/memory/1700-74-0x00007FF699ED0000-0x00007FF69A221000-memory.dmp	xmrig
behavioral1/memory/4364-101-0x00007FF7C2A50000-0x00007FF7C2DA1000-memory.dmp	xmrig
behavioral1/memory/3844-112-0x00007FF7298B0000-0x00007FF729C01000-memory.dmp	xmrig
behavioral1/memory/4956-115-0x00007FF78C190000-0x00007FF78C4E1000-memory.dmp	xmrig
behavioral1/memory/116-114-0x00007FF7DD430000-0x00007FF7DD781000-memory.dmp	xmrig
behavioral1/memory/4260-113-0x00007FF7CF6F0000-0x00007FF7CFA41000-memory.dmp	xmrig
behavioral1/memory/1264-111-0x00007FF7974E0000-0x00007FF797831000-memory.dmp	xmrig
behavioral1/memory/4636-110-0x00007FF6F93E0000-0x00007FF6F9731000-memory.dmp	xmrig
behavioral1/memory/3124-102-0x00007FF6E8A10000-0x00007FF6E8D61000-memory.dmp	xmrig
behavioral1/memory/3056-100-0x00007FF736180000-0x00007FF7364D1000-memory.dmp	xmrig
behavioral1/memory/3412-94-0x00007FF647250000-0x00007FF6475A1000-memory.dmp	xmrig
behavioral1/memory/5032-93-0x00007FF792470000-0x00007FF7927C1000-memory.dmp	xmrig
behavioral1/memory/3540-83-0x00007FF778CF0000-0x00007FF779041000-memory.dmp	xmrig
behavioral1/memory/2296-75-0x00007FF66AB70000-0x00007FF66AEC1000-memory.dmp	xmrig
behavioral1/memory/1628-63-0x00007FF6A6AF0000-0x00007FF6A6E41000-memory.dmp	xmrig
behavioral1/memory/2172-36-0x00007FF7F48C0000-0x00007FF7F4C11000-memory.dmp	xmrig
behavioral1/memory/4376-117-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	xmrig
behavioral1/memory/4344-119-0x00007FF7648A0000-0x00007FF764BF1000-memory.dmp	xmrig
behavioral1/memory/564-147-0x00007FF6D3B80000-0x00007FF6D3ED1000-memory.dmp	xmrig
behavioral1/memory/2424-142-0x00007FF79D7D0000-0x00007FF79DB21000-memory.dmp	xmrig
behavioral1/memory/4696-124-0x00007FF6DCBF0000-0x00007FF6DCF41000-memory.dmp	xmrig
behavioral1/memory/4376-148-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	xmrig
behavioral1/memory/4376-168-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	xmrig
behavioral1/memory/1276-169-0x00007FF674510000-0x00007FF674861000-memory.dmp	xmrig
behavioral1/memory/4376-171-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	xmrig
behavioral1/memory/4376-193-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	xmrig
behavioral1/memory/2172-210-0x00007FF7F48C0000-0x00007FF7F4C11000-memory.dmp	xmrig
behavioral1/memory/4344-212-0x00007FF7648A0000-0x00007FF764BF1000-memory.dmp	xmrig
behavioral1/memory/1264-223-0x00007FF7974E0000-0x00007FF797831000-memory.dmp	xmrig
behavioral1/memory/1628-224-0x00007FF6A6AF0000-0x00007FF6A6E41000-memory.dmp	xmrig
behavioral1/memory/5032-233-0x00007FF792470000-0x00007FF7927C1000-memory.dmp	xmrig
behavioral1/memory/3056-237-0x00007FF736180000-0x00007FF7364D1000-memory.dmp	xmrig
behavioral1/memory/4364-239-0x00007FF7C2A50000-0x00007FF7C2DA1000-memory.dmp	xmrig
behavioral1/memory/3124-241-0x00007FF6E8A10000-0x00007FF6E8D61000-memory.dmp	xmrig
behavioral1/memory/3412-235-0x00007FF647250000-0x00007FF6475A1000-memory.dmp	xmrig
behavioral1/memory/4260-232-0x00007FF7CF6F0000-0x00007FF7CFA41000-memory.dmp	xmrig
behavioral1/memory/3844-226-0x00007FF7298B0000-0x00007FF729C01000-memory.dmp	xmrig
behavioral1/memory/4696-220-0x00007FF6DCBF0000-0x00007FF6DCF41000-memory.dmp	xmrig
behavioral1/memory/1700-219-0x00007FF699ED0000-0x00007FF69A221000-memory.dmp	xmrig
behavioral1/memory/2296-216-0x00007FF66AB70000-0x00007FF66AEC1000-memory.dmp	xmrig
behavioral1/memory/3540-215-0x00007FF778CF0000-0x00007FF779041000-memory.dmp	xmrig
behavioral1/memory/2424-246-0x00007FF79D7D0000-0x00007FF79DB21000-memory.dmp	xmrig
behavioral1/memory/116-249-0x00007FF7DD430000-0x00007FF7DD781000-memory.dmp	xmrig
behavioral1/memory/4956-248-0x00007FF78C190000-0x00007FF78C4E1000-memory.dmp	xmrig
behavioral1/memory/4636-244-0x00007FF6F93E0000-0x00007FF6F9731000-memory.dmp	xmrig
behavioral1/memory/4376-252-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	xmrig
behavioral1/memory/564-255-0x00007FF6D3B80000-0x00007FF6D3ED1000-memory.dmp	xmrig
behavioral1/memory/1276-256-0x00007FF674510000-0x00007FF674861000-memory.dmp	xmrig
behavioral1/memory/4376-257-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	xmrig
behavioral1/memory/4376-258-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	xmrig
behavioral1/memory/4376-259-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	xmrig
behavioral1/memory/4376-260-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	xmrig
behavioral1/memory/4376-261-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	xmrig
behavioral1/memory/4376-262-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	xmrig
behavioral1/memory/4376-263-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	xmrig
behavioral1/memory/4376-264-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	xmrig
behavioral1/memory/4376-265-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4344	lYBvgpX.exe
2172	KpQGghM.exe
1264	RFXLkkA.exe
4696	Liafpoz.exe
1628	reUjGvI.exe
1700	yYTRJMJ.exe
2296	thjJwps.exe
3540	hANfSCs.exe
3844	PSoedfN.exe
5032	bywEPcE.exe
3412	iJorXYl.exe
3056	GsmaXXx.exe
4260	accCJLn.exe
4364	tiMeLVj.exe
3124	RvgHsCA.exe
116	eBELmRD.exe
4956	gRymAns.exe
2424	LVboosO.exe
4636	sAdlfvv.exe
1276	zMDupOw.exe
564	lmahJQM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4376-0-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	upx
behavioral1/files/0x00070000000244e2-9.dat	upx
behavioral1/files/0x00070000000244e7-31.dat	upx
behavioral1/memory/4696-62-0x00007FF6DCBF0000-0x00007FF6DCF41000-memory.dmp	upx
behavioral1/memory/1700-74-0x00007FF699ED0000-0x00007FF69A221000-memory.dmp	upx
behavioral1/files/0x00070000000244eb-80.dat	upx
behavioral1/memory/4364-101-0x00007FF7C2A50000-0x00007FF7C2DA1000-memory.dmp	upx
behavioral1/memory/3844-112-0x00007FF7298B0000-0x00007FF729C01000-memory.dmp	upx
behavioral1/memory/4956-115-0x00007FF78C190000-0x00007FF78C4E1000-memory.dmp	upx
behavioral1/memory/116-114-0x00007FF7DD430000-0x00007FF7DD781000-memory.dmp	upx
behavioral1/memory/4260-113-0x00007FF7CF6F0000-0x00007FF7CFA41000-memory.dmp	upx
behavioral1/memory/1264-111-0x00007FF7974E0000-0x00007FF797831000-memory.dmp	upx
behavioral1/memory/4636-110-0x00007FF6F93E0000-0x00007FF6F9731000-memory.dmp	upx
behavioral1/files/0x00070000000244f2-108.dat	upx
behavioral1/files/0x00070000000244f1-106.dat	upx
behavioral1/files/0x00070000000244f0-104.dat	upx
behavioral1/memory/2424-103-0x00007FF79D7D0000-0x00007FF79DB21000-memory.dmp	upx
behavioral1/memory/3124-102-0x00007FF6E8A10000-0x00007FF6E8D61000-memory.dmp	upx
behavioral1/memory/3056-100-0x00007FF736180000-0x00007FF7364D1000-memory.dmp	upx
behavioral1/files/0x00070000000244ef-98.dat	upx
behavioral1/memory/3412-94-0x00007FF647250000-0x00007FF6475A1000-memory.dmp	upx
behavioral1/memory/5032-93-0x00007FF792470000-0x00007FF7927C1000-memory.dmp	upx
behavioral1/files/0x00070000000244ee-87.dat	upx
behavioral1/files/0x00070000000244ed-84.dat	upx
behavioral1/memory/3540-83-0x00007FF778CF0000-0x00007FF779041000-memory.dmp	upx
behavioral1/files/0x00070000000244ea-78.dat	upx
behavioral1/memory/2296-75-0x00007FF66AB70000-0x00007FF66AEC1000-memory.dmp	upx
behavioral1/files/0x00070000000244e9-73.dat	upx
behavioral1/files/0x00070000000244e8-70.dat	upx
behavioral1/files/0x00070000000244ec-66.dat	upx
behavioral1/memory/1628-63-0x00007FF6A6AF0000-0x00007FF6A6E41000-memory.dmp	upx
behavioral1/files/0x00070000000244e6-56.dat	upx
behavioral1/files/0x00070000000244e3-46.dat	upx
behavioral1/files/0x00070000000244e5-53.dat	upx
behavioral1/files/0x00070000000244e4-47.dat	upx
behavioral1/memory/2172-36-0x00007FF7F48C0000-0x00007FF7F4C11000-memory.dmp	upx
behavioral1/files/0x000a0000000243ee-15.dat	upx
behavioral1/files/0x000c0000000244b9-8.dat	upx
behavioral1/memory/4344-25-0x00007FF7648A0000-0x00007FF764BF1000-memory.dmp	upx
behavioral1/memory/4376-117-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	upx
behavioral1/memory/4344-119-0x00007FF7648A0000-0x00007FF764BF1000-memory.dmp	upx
behavioral1/files/0x000a0000000243f7-136.dat	upx
behavioral1/memory/1276-144-0x00007FF674510000-0x00007FF674861000-memory.dmp	upx
behavioral1/memory/564-147-0x00007FF6D3B80000-0x00007FF6D3ED1000-memory.dmp	upx
behavioral1/files/0x00070000000244f3-145.dat	upx
behavioral1/memory/2424-142-0x00007FF79D7D0000-0x00007FF79DB21000-memory.dmp	upx
behavioral1/memory/4696-124-0x00007FF6DCBF0000-0x00007FF6DCF41000-memory.dmp	upx
behavioral1/memory/4376-148-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	upx
behavioral1/memory/4376-168-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	upx
behavioral1/memory/1276-169-0x00007FF674510000-0x00007FF674861000-memory.dmp	upx
behavioral1/memory/4376-171-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	upx
behavioral1/memory/4376-193-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp	upx
behavioral1/memory/2172-210-0x00007FF7F48C0000-0x00007FF7F4C11000-memory.dmp	upx
behavioral1/memory/4344-212-0x00007FF7648A0000-0x00007FF764BF1000-memory.dmp	upx
behavioral1/memory/1264-223-0x00007FF7974E0000-0x00007FF797831000-memory.dmp	upx
behavioral1/memory/1628-224-0x00007FF6A6AF0000-0x00007FF6A6E41000-memory.dmp	upx
behavioral1/memory/5032-233-0x00007FF792470000-0x00007FF7927C1000-memory.dmp	upx
behavioral1/memory/3056-237-0x00007FF736180000-0x00007FF7364D1000-memory.dmp	upx
behavioral1/memory/4364-239-0x00007FF7C2A50000-0x00007FF7C2DA1000-memory.dmp	upx
behavioral1/memory/3124-241-0x00007FF6E8A10000-0x00007FF6E8D61000-memory.dmp	upx
behavioral1/memory/3412-235-0x00007FF647250000-0x00007FF6475A1000-memory.dmp	upx
behavioral1/memory/4260-232-0x00007FF7CF6F0000-0x00007FF7CFA41000-memory.dmp	upx
behavioral1/memory/3844-226-0x00007FF7298B0000-0x00007FF729C01000-memory.dmp	upx
behavioral1/memory/4696-220-0x00007FF6DCBF0000-0x00007FF6DCF41000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\yYTRJMJ.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\hANfSCs.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\accCJLn.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\zMDupOw.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\lmahJQM.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\reUjGvI.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\iJorXYl.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\GsmaXXx.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\RvgHsCA.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\gRymAns.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\LVboosO.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\thjJwps.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\tiMeLVj.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\Liafpoz.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\PSoedfN.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\bywEPcE.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\eBELmRD.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\sAdlfvv.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\lYBvgpX.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\KpQGghM.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\RFXLkkA.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
Token: SeLockMemoryPrivilege	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 4344	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	87
PID 4376 wrote to memory of 2172	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	88
PID 4376 wrote to memory of 1264	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	89
PID 4376 wrote to memory of 4696	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	90
PID 4376 wrote to memory of 1628	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	91
PID 4376 wrote to memory of 1700	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	92
PID 4376 wrote to memory of 2296	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	93
PID 4376 wrote to memory of 3540	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	94
PID 4376 wrote to memory of 3844	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	95
PID 4376 wrote to memory of 5032	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	96
PID 4376 wrote to memory of 3412	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	97
PID 4376 wrote to memory of 3056	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	98
PID 4376 wrote to memory of 4260	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	99
PID 4376 wrote to memory of 4364	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	100
PID 4376 wrote to memory of 3124	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	101
PID 4376 wrote to memory of 116	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	102
PID 4376 wrote to memory of 4956	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	103
PID 4376 wrote to memory of 2424	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	104
PID 4376 wrote to memory of 4636	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	105
PID 4376 wrote to memory of 1276	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	106
PID 4376 wrote to memory of 564	4376	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\System\lYBvgpX.exe
  C:\Windows\System\lYBvgpX.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\KpQGghM.exe
  C:\Windows\System\KpQGghM.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\RFXLkkA.exe
  C:\Windows\System\RFXLkkA.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\Liafpoz.exe
  C:\Windows\System\Liafpoz.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\reUjGvI.exe
  C:\Windows\System\reUjGvI.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\yYTRJMJ.exe
  C:\Windows\System\yYTRJMJ.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\thjJwps.exe
  C:\Windows\System\thjJwps.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\hANfSCs.exe
  C:\Windows\System\hANfSCs.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\PSoedfN.exe
  C:\Windows\System\PSoedfN.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\bywEPcE.exe
  C:\Windows\System\bywEPcE.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\iJorXYl.exe
  C:\Windows\System\iJorXYl.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\GsmaXXx.exe
  C:\Windows\System\GsmaXXx.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\accCJLn.exe
  C:\Windows\System\accCJLn.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\tiMeLVj.exe
  C:\Windows\System\tiMeLVj.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\RvgHsCA.exe
  C:\Windows\System\RvgHsCA.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\eBELmRD.exe
  C:\Windows\System\eBELmRD.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\gRymAns.exe
  C:\Windows\System\gRymAns.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\LVboosO.exe
  C:\Windows\System\LVboosO.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\sAdlfvv.exe
  C:\Windows\System\sAdlfvv.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\zMDupOw.exe
  C:\Windows\System\zMDupOw.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\lmahJQM.exe
  C:\Windows\System\lmahJQM.exe
  2⤵
  - Executes dropped EXE
  PID:564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

GsmaXXx.exe

Path C:\Windows\System\GsmaXXx.exe
Size 5.2MB
SHA256 c8fcccd9fef6b47703d4ae63b15f0dda08ad0479beb4c0fc004fd4016e6b1561
MD5 2fc41a46679e04aaea5bc2eedac69dc4
SHA1 8a3bafd3be7003dd8786c5fdc9ff5e6e885fef41
SHA512 845d098628ed2f706cceb9ef1705fa0911723c7b3a827020ce5ef2b34a86940bf288f89346e2a932474c42d6aeeb9f88ce7b0ca3d623e6f0de664b3c064712f9
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lN:RWWBibP56utgpPFotBER/mQ32lUR
TLSH
T1B5465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KpQGghM.exe

Path C:\Windows\System\KpQGghM.exe
Size 5.2MB
SHA256 b17852c5c86f1265d59b96e8e7acbe1d6e1f5952a9be95917b5206efbb72af5c
MD5 42212828f561e0a01c6941845dbb2043
SHA1 77a105901e66cb17aa41152c25778628a40fa668
SHA512 9112f0c59acdc2d4e9a6b2edc412d263044d3479a5dd4983da3b0b09e3f2ee3c6dea474e119d804bbaf5613ff491974aa333b08e8cb5aeee8eece94d2d7f42db
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l9:RWWBibP56utgpPFotBER/mQ32lUB
TLSH
T141465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LVboosO.exe

Path C:\Windows\System\LVboosO.exe
Size 5.2MB
SHA256 77c9ca9559a96e0fc8b15d69ae68af606d9b0b763cc2b40c7e99278704289a55
MD5 f69455383eec3691edd2655b6e2e6422
SHA1 7038b39e2a65d484fd48f807fe15207a0e1e2ac1
SHA512 a38a2568ed411509d9c12b2c7cbf5fdc360d13462d7858d35c1f0d8deb9c84e667ff807f49e60d4663c93e2debbc443671a81dd966ff358612215142f4d47d85
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibP56utgpPFotBER/mQ32lUl
TLSH
T1B2465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Liafpoz.exe

Path C:\Windows\System\Liafpoz.exe
Size 5.2MB
SHA256 4107b1f28520f1d656fa3a20d5aee5faba08e07ac80541274f9307511b081d7b
MD5 6bdc2a74f144f6fbd833f97e65af74f5
SHA1 7a81805a6462dba1d15724af0ffb2394504faf8e
SHA512 ee94dd445c20772bb86be5d37c4c792a221a4bcb58f4a9aa6d0c4dc3378041102dc2dafc3ba8450a9b23fe09256cd2df7d52e4f2e6f8096013cff130261aa3d3
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lT:RWWBibP56utgpPFotBER/mQ32lUf
TLSH
T1A6465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSoedfN.exe

Path C:\Windows\System\PSoedfN.exe
Size 5.2MB
SHA256 84a0d7dc4957119b94abc8c12cbf62cfae1447dba6735693112a398e0103cfcb
MD5 9bfe5a4fb0c33d4b6d5f3d7a0bfa4245
SHA1 f68b2f00178816c1235846dd98c12e25ff71952f
SHA512 c3abc33c491f16a116a95b17898ee38f35892bcfa4a51ae215fe2fd224be42cbe5d5abf02ddf73e4a730d1339c535140e2daec08d2878d83fe20cb3ee29cb0b1
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lU:RWWBibP56utgpPFotBER/mQ32lUY
TLSH
T1F3465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RFXLkkA.exe

Path C:\Windows\System\RFXLkkA.exe
Size 5.2MB
SHA256 25756c83056c5856cdda93e34f1948d03dccd5564a4ad29b216b43fcbb4bf41e
MD5 c0f2f811fea58997808d6078afaf71cb
SHA1 36bc68026c6838b6bbbb8bcfd7ef81dff66f4e77
SHA512 3a45a71c107c43e9adc8ba1ee2292f42039414a208f7940bf483a87a4756cd7f24a08ea2940000b417ea90a7b2da47e3ac482022fda5854fb547e8b18ff53562
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l7:RWWBibP56utgpPFotBER/mQ32lU3
TLSH
T16C465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RvgHsCA.exe

Path C:\Windows\System\RvgHsCA.exe
Size 5.2MB
SHA256 e4664ffb76aa86b74c9900768995ed0ea7e9dc2d5819b82b524300baa7e24283
MD5 16a4e13e944ea2b53b152b0999aecff5
SHA1 44435ba866abe46e0d948bf7abbc3824f342e73f
SHA512 e8c68a31fad285d92df2a3577c018640563a90abff6287aa7783d7b712175fab64886e99cb043f5255e61c7ad8ddc5b9414770e148bc6fd3b07988836591015f
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lf:RWWBibP56utgpPFotBER/mQ32lUD
TLSH
T133465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accCJLn.exe

Path C:\Windows\System\accCJLn.exe
Size 5.2MB
SHA256 43435f8a74e51babf1c8fe306d25aa732015633400121c48de7760b191aa473a
MD5 44a617ad024584cefdfc39070312b63e
SHA1 361bf8ea9a41c33a848f35c91c40c653fdb290d2
SHA512 90f502aaacf45fc49218bdf0815290683176e9d83c7c602d9bfe24edbd5a66c2601a5989e824b3ffe1ba760d6bba54eaf872c647973d63c371636ce5e9e77748
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lW:RWWBibP56utgpPFotBER/mQ32lUi
TLSH
T142465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bywEPcE.exe

Path C:\Windows\System\bywEPcE.exe
Size 5.2MB
SHA256 0878d00f592540f8f6ebf2dc88b68ec821d894c15246fec2c913e7fd7c8edbc3
MD5 26082b9dded838a62993d0c60bbc0eb6
SHA1 60df5e6723ee95d427f0d1228a7709f803e1f2c6
SHA512 ca70e41b100c8b471ca7fc2c6fac122230e03abd4ed6faedb97ce3f88b087e60eb5be6f3ad605bbf3b71c67c9e564936733520622e63c7e06c77037c78b82bb8
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibP56utgpPFotBER/mQ32lUV
TLSH
T14A465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eBELmRD.exe

Path C:\Windows\System\eBELmRD.exe
Size 5.2MB
SHA256 ff44a876b1225648245642759a8af5364d6b5917d497c5fc77092a7d2de9cc70
MD5 569a6a5e0590e173a4be64e6178e5b66
SHA1 c492e31adbb73eef6affb5d6e6b344d5108953f4
SHA512 0b9c35a0170918616478780c22d78b047f102402cafffef2e3f666d7e6ac329e3c62c42baeb8af948bf72c2f3f8398b6d8fc212b4b3fe0a8967b85b62aa9c48d
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lv:RWWBibP56utgpPFotBER/mQ32lUD
TLSH
T13B465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gRymAns.exe

Path C:\Windows\System\gRymAns.exe
Size 5.2MB
SHA256 69246f8214ef87817b212c0beffada30c721456d732772f7920fdfc8ffe0370b
MD5 ef333fcd74c9c700b1b03ab8f1720afd
SHA1 bc89f431af6d0624f66753468a130f321af99676
SHA512 c6275336b2964605e78339689bdcd0dec3682f4e216f916770d6536cba81e3de2ede6411c610254eaf07cb0f4bff74c708ba6addbae6e7f18be9f7b58d5aac5c
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibP56utgpPFotBER/mQ32lUJ
TLSH
T126465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hANfSCs.exe

Path C:\Windows\System\hANfSCs.exe
Size 5.2MB
SHA256 7d451d1d4eb0f8a06c606e6d2616378a13d7b1ec7a36a4f7478f5e6970e84662
MD5 3223e4c06b45d2fc903356024504e346
SHA1 96f36ed33438d8026bc80e4c26f3686709bec87b
SHA512 9c55eca3c85e86fdf8f0abbc3fe73b9d0746c0c8b427445ed7c013149c645b19b574768c088e03bbfc0beb85b40102d02affcb25ebb82569fefc4e4753923067
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lw:RWWBibP56utgpPFotBER/mQ32lUM
TLSH
T1BC465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iJorXYl.exe

Path C:\Windows\System\iJorXYl.exe
Size 5.2MB
SHA256 b6f7c63bcdef0da8c593effcf7702608f6aec8c5dea2f92419235544d074ddf7
MD5 1c40f15c0a30badb605bccdc50c94788
SHA1 5304ed4c421b2d98fdb84029c7181513ba2adf76
SHA512 d69675019a3cf430532c2220869a93cc690858fba9229e2bb0d1d9c9d9054ea2fcf59a6932815cec211eb82c0297ee5267c2f1fe03b529f6f4417a9cfc5c77e4
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lB:RWWBibP56utgpPFotBER/mQ32lUt
TLSH
T1EA465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lYBvgpX.exe

Path C:\Windows\System\lYBvgpX.exe
Size 5.2MB
SHA256 3cfb93186bed26b790b348fc96a857790a81434c76521860a89595c4cab9e0e3
MD5 49b559f6f1ea8aca0ceb62ed3a00c5b1
SHA1 609dc5d374b27095bc32033c42dab99f3af50ac4
SHA512 8cb87dea387d6c22deacb47aa898539351fe0523dcf1fbbf2e4a27e5ce00903183e78e1c88ef8ba3e45d8921811dd89d2d33f9b3e51c2367ad102c02e9d69493
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lK:RWWBibP56utgpPFotBER/mQ32lUG
TLSH
T18B465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lmahJQM.exe

Path C:\Windows\System\lmahJQM.exe
Size 5.2MB
SHA256 6c597148bdd0f634e33513119de50b92c068d169cd0122c46f35fda5295a9379
MD5 f22529e90fe31c51380aec254da906be
SHA1 1dbce71a56110b304326e24d67fcc351a1fd2ea9
SHA512 328091ab15fd0e4413e4e7958233905ebce5fbae6ecfe033fa42af5519a77e478a409661a4b6b5757ab1d67ebef3d5fbba7675bfd5ca3ff3d07565f9c22d6942
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lE:RWWBibP56utgpPFotBER/mQ32lU4
TLSH
T1E7465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reUjGvI.exe

Path C:\Windows\System\reUjGvI.exe
Size 5.2MB
SHA256 501ce2459a4d35f97b8dba8e8bb978946371f5cb88a6d13457f958b82fa67e66
MD5 bc62271f2a24059b5b3de5b44da3a7f4
SHA1 3fe2698b4ea0da0262192e6ed41009a449593af9
SHA512 57fdcf57bf4dbbdbfd29f2a597f8f038f54516084c48b1aa415114e862d4a3828f70e54c277a4adaa74d3d6acc9c93fd2d5b11a5fff44e116710dfb519f046ee
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l1:RWWBibP56utgpPFotBER/mQ32lUh
TLSH
T157465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sAdlfvv.exe

Path C:\Windows\System\sAdlfvv.exe
Size 5.2MB
SHA256 68cc232a00ad8e9a8f0ab895d42ad2d5758d41c94879cf134b2f0d069b9c4ee0
MD5 cb294a88e0411d53be1d46a03ebbdf25
SHA1 10deec9aee1dbd0ca3e0081d52b3d03a4ee0f94d
SHA512 09c59a3857b05718720a4efa00bd5e471ecec61ef637326e415031a493d39424957a300702d6318754b6e41553a512f7d203c96fc270ba68a777fdd5c4cda6da
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lb:RWWBibP56utgpPFotBER/mQ32lUn
TLSH
T153465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thjJwps.exe

Path C:\Windows\System\thjJwps.exe
Size 5.2MB
SHA256 8167cfd6883626abfa947e255aa3ca915fc8abd19d2f8fb5b6abd149018d690c
MD5 5486456633cb869c3e3da04917bddc20
SHA1 3159791adca1f85984021c09c1f7abf88f7173e2
SHA512 16330ebfcd3ada915097ac3cf5a768a953347d883afe17c73de8de8f2b48a3dc1ca82881bb66c117fe8697182eb4d77e69acba8a2ae16cb3815852cc9d9af1a9
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lL:RWWBibP56utgpPFotBER/mQ32lUP
TLSH
T1CF465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tiMeLVj.exe

Path C:\Windows\System\tiMeLVj.exe
Size 5.2MB
SHA256 44a276e0106abaf69793ab1876ba259a4ce724855dee6decfbab7ba330a07f07
MD5 1d12db5527c1f610f917a3909409e699
SHA1 fbf748dc7fde62ab66492f69f941a2853a1c41a1
SHA512 4713822ce881cbdaa90d7a39765f08fe2325b55618d90a58d83cd2d57f3c3655d60ce8862d3c7f0847e6dd6f706243873967e725a2fa2f567e0f23bf9504e59c
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lI:RWWBibP56utgpPFotBER/mQ32lUM
TLSH
T11C465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yYTRJMJ.exe

Path C:\Windows\System\yYTRJMJ.exe
Size 5.2MB
SHA256 bf5c959a3c5f9c3a9a2eeea890fa4dc7afe183c16924490f2cc2cf0401a340d3
MD5 25809ad76b942f01588d76d1b2434f62
SHA1 b8397c56aeafa292c5c6a66fb4f52119a29fdbc5
SHA512 ae03424899c6758f7024336503e3ce27b706c92a9027e15f66b65544db3cb033a71dc9a1ef2ffaab05d7263c61c56f2fd774e566c674d032e0f04a57271f1177
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibP56utgpPFotBER/mQ32lUf
TLSH
T1D2465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zMDupOw.exe

Path C:\Windows\System\zMDupOw.exe
Size 5.2MB
SHA256 564b3418b339c83ee5f3995d71bec9f315ed1b5945700608f773090b44dc3896
MD5 a6c0ea593b3fe397b33e7988d5e94208
SHA1 d1c6c1612d6fe300485e86e9cb7226fdcc5e33ab
SHA512 cbb46609c025bd3e2031210e646e47365a608df82e5f43eef0d31e2fc3bcfbf35c253749a6d4dc56f0cb6caef428ab78ff0344ecb2acf2f8e753f3abe51e4e07
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lx:RWWBibP56utgpPFotBER/mQ32lUV
TLSH
T154465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-249-0x00007FF7DD430000-0x00007FF7DD781000-memory.dmp

Download

memory/116-114-0x00007FF7DD430000-0x00007FF7DD781000-memory.dmp

Download

memory/564-147-0x00007FF6D3B80000-0x00007FF6D3ED1000-memory.dmp

Download

memory/564-255-0x00007FF6D3B80000-0x00007FF6D3ED1000-memory.dmp

Download

memory/1264-111-0x00007FF7974E0000-0x00007FF797831000-memory.dmp

Download

memory/1264-223-0x00007FF7974E0000-0x00007FF797831000-memory.dmp

Download

memory/1276-144-0x00007FF674510000-0x00007FF674861000-memory.dmp

Download

memory/1276-169-0x00007FF674510000-0x00007FF674861000-memory.dmp

Download

memory/1276-256-0x00007FF674510000-0x00007FF674861000-memory.dmp

Download

memory/1628-224-0x00007FF6A6AF0000-0x00007FF6A6E41000-memory.dmp

Download

memory/1628-63-0x00007FF6A6AF0000-0x00007FF6A6E41000-memory.dmp

Download

memory/1700-74-0x00007FF699ED0000-0x00007FF69A221000-memory.dmp

Download

memory/1700-219-0x00007FF699ED0000-0x00007FF69A221000-memory.dmp

Download

memory/2172-210-0x00007FF7F48C0000-0x00007FF7F4C11000-memory.dmp

Download

memory/2172-36-0x00007FF7F48C0000-0x00007FF7F4C11000-memory.dmp

Download

memory/2296-75-0x00007FF66AB70000-0x00007FF66AEC1000-memory.dmp

Download

memory/2296-216-0x00007FF66AB70000-0x00007FF66AEC1000-memory.dmp

Download

memory/2424-103-0x00007FF79D7D0000-0x00007FF79DB21000-memory.dmp

Download

memory/2424-142-0x00007FF79D7D0000-0x00007FF79DB21000-memory.dmp

Download

memory/2424-246-0x00007FF79D7D0000-0x00007FF79DB21000-memory.dmp

Download

memory/3056-100-0x00007FF736180000-0x00007FF7364D1000-memory.dmp

Download

memory/3056-237-0x00007FF736180000-0x00007FF7364D1000-memory.dmp

Download

memory/3124-241-0x00007FF6E8A10000-0x00007FF6E8D61000-memory.dmp

Download

memory/3124-102-0x00007FF6E8A10000-0x00007FF6E8D61000-memory.dmp

Download

memory/3412-94-0x00007FF647250000-0x00007FF6475A1000-memory.dmp

Download

memory/3412-235-0x00007FF647250000-0x00007FF6475A1000-memory.dmp

Download

memory/3540-83-0x00007FF778CF0000-0x00007FF779041000-memory.dmp

Download

memory/3540-215-0x00007FF778CF0000-0x00007FF779041000-memory.dmp

Download

memory/3844-112-0x00007FF7298B0000-0x00007FF729C01000-memory.dmp

Download

memory/3844-226-0x00007FF7298B0000-0x00007FF729C01000-memory.dmp

Download

memory/4260-113-0x00007FF7CF6F0000-0x00007FF7CFA41000-memory.dmp

Download

memory/4260-232-0x00007FF7CF6F0000-0x00007FF7CFA41000-memory.dmp

Download

memory/4344-25-0x00007FF7648A0000-0x00007FF764BF1000-memory.dmp

Download

memory/4344-212-0x00007FF7648A0000-0x00007FF764BF1000-memory.dmp

Download

memory/4344-119-0x00007FF7648A0000-0x00007FF764BF1000-memory.dmp

Download

memory/4364-239-0x00007FF7C2A50000-0x00007FF7C2DA1000-memory.dmp

Download

memory/4364-101-0x00007FF7C2A50000-0x00007FF7C2DA1000-memory.dmp

Download

memory/4376-148-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp

Download

memory/4376-265-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp

Download

memory/4376-258-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp

Download

memory/4376-263-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp

Download

memory/4376-171-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp

Download

memory/4376-117-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp

Download

memory/4376-259-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp

Download

memory/4376-168-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp

Download

memory/4376-264-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp

Download

memory/4376-262-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp

Download

memory/4376-193-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp

Download

memory/4376-0-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp

Download

memory/4376-261-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp

Download

memory/4376-257-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp

Download

memory/4376-252-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp

Download

memory/4376-260-0x00007FF7FC6A0000-0x00007FF7FC9F1000-memory.dmp

Download

memory/4376-1-0x00000165E8740000-0x00000165E8750000-memory.dmp

Download

memory/4636-244-0x00007FF6F93E0000-0x00007FF6F9731000-memory.dmp

Download

memory/4636-110-0x00007FF6F93E0000-0x00007FF6F9731000-memory.dmp

Download

memory/4696-220-0x00007FF6DCBF0000-0x00007FF6DCF41000-memory.dmp

Download

memory/4696-62-0x00007FF6DCBF0000-0x00007FF6DCF41000-memory.dmp

Download

memory/4696-124-0x00007FF6DCBF0000-0x00007FF6DCF41000-memory.dmp

Download

memory/4956-248-0x00007FF78C190000-0x00007FF78C4E1000-memory.dmp

Download

memory/4956-115-0x00007FF78C190000-0x00007FF78C4E1000-memory.dmp

Download

memory/5032-233-0x00007FF792470000-0x00007FF7927C1000-memory.dmp

Download

memory/5032-93-0x00007FF792470000-0x00007FF7927C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads