cobaltstrike | cb6fde30c39126022fa0a522e27e06823f626a1ddd3f353cccfbc3c2f34dc18a

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
Size 5.2MB
Sample260910-cray9awte1
SHA256 cb6fde30c39126022fa0a522e27e06823f626a1ddd3f353cccfbc3c2f34dc18a
MD5 dc6c02412da36a061c7a259c4b10c9d6
SHA1 402bb80c20b1b34d34e20828945c4ab8c05d99d0
SHA512 b97ccaf8b55e070050e152d58a776fefc52b047328a7976a7587075c3ee5f7bfb08e7c7e2d6ad079f9a1b4669d35c58c49f74a49086e9563f4f6a243e3fe2638
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibP56utgpPFotBER/mQ32lU2
TLSH
T11B465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0007000000016cdb-5.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5a8-11.dat	cobalt_reflective_dll
behavioral2/files/0x000e00000001c5a3-10.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5a9-22.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ab-32.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ac-38.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ad-43.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ae-48.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5b0-53.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5b1-58.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5b2-63.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5b3-68.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5b4-73.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5b9-97.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ba-103.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5bb-107.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5b8-93.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5b7-88.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5b5-83.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5b6-81.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5aa-28.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0007000000016cdb-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5a8-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000e00000001c5a3-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5a9-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ab-32.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ac-38.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ad-43.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ae-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5b0-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5b1-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5b2-63.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5b3-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5b4-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5b9-97.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ba-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5bb-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5b8-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5b7-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5b5-83.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5b6-81.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5aa-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4964-0-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	UPX
behavioral2/files/0x0007000000016cdb-5.dat	UPX
behavioral2/memory/4392-8-0x00007FF723E90000-0x00007FF7241E1000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5a8-11.dat	UPX
behavioral2/files/0x000e00000001c5a3-10.dat	UPX
behavioral2/memory/4772-13-0x00007FF71A4D0000-0x00007FF71A821000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5a9-22.dat	UPX
behavioral2/files/0x000c00000001c5ab-32.dat	UPX
behavioral2/files/0x000c00000001c5ac-38.dat	UPX
behavioral2/files/0x000c00000001c5ad-43.dat	UPX
behavioral2/files/0x000c00000001c5ae-48.dat	UPX
behavioral2/files/0x000c00000001c5b0-53.dat	UPX
behavioral2/files/0x000c00000001c5b1-58.dat	UPX
behavioral2/files/0x000c00000001c5b2-63.dat	UPX
behavioral2/files/0x000c00000001c5b3-68.dat	UPX
behavioral2/files/0x000c00000001c5b4-73.dat	UPX
behavioral2/files/0x000c00000001c5b9-97.dat	UPX
behavioral2/files/0x000c00000001c5ba-103.dat	UPX
behavioral2/files/0x000c00000001c5bb-107.dat	UPX
behavioral2/files/0x000c00000001c5b8-93.dat	UPX
behavioral2/files/0x000c00000001c5b7-88.dat	UPX
behavioral2/files/0x000c00000001c5b5-83.dat	UPX
behavioral2/files/0x000c00000001c5b6-81.dat	UPX
behavioral2/files/0x000c00000001c5aa-28.dat	UPX
behavioral2/memory/4964-109-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	UPX
behavioral2/memory/4392-110-0x00007FF723E90000-0x00007FF7241E1000-memory.dmp	UPX
behavioral2/memory/4976-115-0x00007FF70B180000-0x00007FF70B4D1000-memory.dmp	UPX
behavioral2/memory/4668-116-0x00007FF7167F0000-0x00007FF716B41000-memory.dmp	UPX
behavioral2/memory/5428-120-0x00007FF6AC8B0000-0x00007FF6ACC01000-memory.dmp	UPX
behavioral2/memory/2052-125-0x00007FF6837C0000-0x00007FF683B11000-memory.dmp	UPX
behavioral2/memory/1000-130-0x00007FF7EB190000-0x00007FF7EB4E1000-memory.dmp	UPX
behavioral2/memory/3584-129-0x00007FF6C74D0000-0x00007FF6C7821000-memory.dmp	UPX
behavioral2/memory/1680-128-0x00007FF6BDE00000-0x00007FF6BE151000-memory.dmp	UPX
behavioral2/memory/2864-127-0x00007FF7C7660000-0x00007FF7C79B1000-memory.dmp	UPX
behavioral2/memory/5688-126-0x00007FF6A8AD0000-0x00007FF6A8E21000-memory.dmp	UPX
behavioral2/memory/3144-124-0x00007FF668520000-0x00007FF668871000-memory.dmp	UPX
behavioral2/memory/6096-123-0x00007FF71C8E0000-0x00007FF71CC31000-memory.dmp	UPX
behavioral2/memory/5408-122-0x00007FF6FA5E0000-0x00007FF6FA931000-memory.dmp	UPX
behavioral2/memory/5372-121-0x00007FF6EE990000-0x00007FF6EECE1000-memory.dmp	UPX
behavioral2/memory/2012-119-0x00007FF6658C0000-0x00007FF665C11000-memory.dmp	UPX
behavioral2/memory/1548-118-0x00007FF7DD250000-0x00007FF7DD5A1000-memory.dmp	UPX
behavioral2/memory/896-117-0x00007FF6D7DC0000-0x00007FF6D8111000-memory.dmp	UPX
behavioral2/memory/4168-114-0x00007FF701BD0000-0x00007FF701F21000-memory.dmp	UPX
behavioral2/memory/1600-112-0x00007FF7C5B90000-0x00007FF7C5EE1000-memory.dmp	UPX
behavioral2/memory/2120-113-0x00007FF74FEC0000-0x00007FF750211000-memory.dmp	UPX
behavioral2/memory/4772-111-0x00007FF71A4D0000-0x00007FF71A821000-memory.dmp	UPX
behavioral2/memory/4964-131-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	UPX
behavioral2/memory/4964-153-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	UPX
behavioral2/memory/4964-154-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	UPX
behavioral2/memory/4964-176-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	UPX
behavioral2/memory/4392-187-0x00007FF723E90000-0x00007FF7241E1000-memory.dmp	UPX
behavioral2/memory/4772-188-0x00007FF71A4D0000-0x00007FF71A821000-memory.dmp	UPX
behavioral2/memory/1600-190-0x00007FF7C5B90000-0x00007FF7C5EE1000-memory.dmp	UPX
behavioral2/memory/4168-192-0x00007FF701BD0000-0x00007FF701F21000-memory.dmp	UPX
behavioral2/memory/2120-194-0x00007FF74FEC0000-0x00007FF750211000-memory.dmp	UPX
behavioral2/memory/4976-195-0x00007FF70B180000-0x00007FF70B4D1000-memory.dmp	UPX
behavioral2/memory/1548-200-0x00007FF7DD250000-0x00007FF7DD5A1000-memory.dmp	UPX
behavioral2/memory/896-205-0x00007FF6D7DC0000-0x00007FF6D8111000-memory.dmp	UPX
behavioral2/memory/5428-204-0x00007FF6AC8B0000-0x00007FF6ACC01000-memory.dmp	UPX
behavioral2/memory/5372-207-0x00007FF6EE990000-0x00007FF6EECE1000-memory.dmp	UPX
behavioral2/memory/2012-220-0x00007FF6658C0000-0x00007FF665C11000-memory.dmp	UPX
behavioral2/memory/5408-219-0x00007FF6FA5E0000-0x00007FF6FA931000-memory.dmp	UPX
behavioral2/memory/6096-222-0x00007FF71C8E0000-0x00007FF71CC31000-memory.dmp	UPX
behavioral2/memory/4668-217-0x00007FF7167F0000-0x00007FF716B41000-memory.dmp	UPX

XMRig Miner payload 58 IoCs

miner

resource	yara_rule
behavioral2/memory/4392-8-0x00007FF723E90000-0x00007FF7241E1000-memory.dmp	xmrig
behavioral2/memory/4964-109-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	xmrig
behavioral2/memory/4392-110-0x00007FF723E90000-0x00007FF7241E1000-memory.dmp	xmrig
behavioral2/memory/4976-115-0x00007FF70B180000-0x00007FF70B4D1000-memory.dmp	xmrig
behavioral2/memory/4668-116-0x00007FF7167F0000-0x00007FF716B41000-memory.dmp	xmrig
behavioral2/memory/5428-120-0x00007FF6AC8B0000-0x00007FF6ACC01000-memory.dmp	xmrig
behavioral2/memory/2052-125-0x00007FF6837C0000-0x00007FF683B11000-memory.dmp	xmrig
behavioral2/memory/1000-130-0x00007FF7EB190000-0x00007FF7EB4E1000-memory.dmp	xmrig
behavioral2/memory/3584-129-0x00007FF6C74D0000-0x00007FF6C7821000-memory.dmp	xmrig
behavioral2/memory/1680-128-0x00007FF6BDE00000-0x00007FF6BE151000-memory.dmp	xmrig
behavioral2/memory/2864-127-0x00007FF7C7660000-0x00007FF7C79B1000-memory.dmp	xmrig
behavioral2/memory/5688-126-0x00007FF6A8AD0000-0x00007FF6A8E21000-memory.dmp	xmrig
behavioral2/memory/3144-124-0x00007FF668520000-0x00007FF668871000-memory.dmp	xmrig
behavioral2/memory/6096-123-0x00007FF71C8E0000-0x00007FF71CC31000-memory.dmp	xmrig
behavioral2/memory/5408-122-0x00007FF6FA5E0000-0x00007FF6FA931000-memory.dmp	xmrig
behavioral2/memory/5372-121-0x00007FF6EE990000-0x00007FF6EECE1000-memory.dmp	xmrig
behavioral2/memory/2012-119-0x00007FF6658C0000-0x00007FF665C11000-memory.dmp	xmrig
behavioral2/memory/1548-118-0x00007FF7DD250000-0x00007FF7DD5A1000-memory.dmp	xmrig
behavioral2/memory/896-117-0x00007FF6D7DC0000-0x00007FF6D8111000-memory.dmp	xmrig
behavioral2/memory/4168-114-0x00007FF701BD0000-0x00007FF701F21000-memory.dmp	xmrig
behavioral2/memory/1600-112-0x00007FF7C5B90000-0x00007FF7C5EE1000-memory.dmp	xmrig
behavioral2/memory/2120-113-0x00007FF74FEC0000-0x00007FF750211000-memory.dmp	xmrig
behavioral2/memory/4772-111-0x00007FF71A4D0000-0x00007FF71A821000-memory.dmp	xmrig
behavioral2/memory/4964-131-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	xmrig
behavioral2/memory/4964-153-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	xmrig
behavioral2/memory/4964-154-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	xmrig
behavioral2/memory/4964-176-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	xmrig
behavioral2/memory/4392-187-0x00007FF723E90000-0x00007FF7241E1000-memory.dmp	xmrig
behavioral2/memory/4772-188-0x00007FF71A4D0000-0x00007FF71A821000-memory.dmp	xmrig
behavioral2/memory/1600-190-0x00007FF7C5B90000-0x00007FF7C5EE1000-memory.dmp	xmrig
behavioral2/memory/4168-192-0x00007FF701BD0000-0x00007FF701F21000-memory.dmp	xmrig
behavioral2/memory/2120-194-0x00007FF74FEC0000-0x00007FF750211000-memory.dmp	xmrig
behavioral2/memory/4976-195-0x00007FF70B180000-0x00007FF70B4D1000-memory.dmp	xmrig
behavioral2/memory/1548-200-0x00007FF7DD250000-0x00007FF7DD5A1000-memory.dmp	xmrig
behavioral2/memory/896-205-0x00007FF6D7DC0000-0x00007FF6D8111000-memory.dmp	xmrig
behavioral2/memory/5428-204-0x00007FF6AC8B0000-0x00007FF6ACC01000-memory.dmp	xmrig
behavioral2/memory/5372-207-0x00007FF6EE990000-0x00007FF6EECE1000-memory.dmp	xmrig
behavioral2/memory/2012-220-0x00007FF6658C0000-0x00007FF665C11000-memory.dmp	xmrig
behavioral2/memory/5408-219-0x00007FF6FA5E0000-0x00007FF6FA931000-memory.dmp	xmrig
behavioral2/memory/6096-222-0x00007FF71C8E0000-0x00007FF71CC31000-memory.dmp	xmrig
behavioral2/memory/4668-217-0x00007FF7167F0000-0x00007FF716B41000-memory.dmp	xmrig
behavioral2/memory/1680-231-0x00007FF6BDE00000-0x00007FF6BE151000-memory.dmp	xmrig
behavioral2/memory/3584-230-0x00007FF6C74D0000-0x00007FF6C7821000-memory.dmp	xmrig
behavioral2/memory/1000-232-0x00007FF7EB190000-0x00007FF7EB4E1000-memory.dmp	xmrig
behavioral2/memory/2052-236-0x00007FF6837C0000-0x00007FF683B11000-memory.dmp	xmrig
behavioral2/memory/3144-235-0x00007FF668520000-0x00007FF668871000-memory.dmp	xmrig
behavioral2/memory/5688-226-0x00007FF6A8AD0000-0x00007FF6A8E21000-memory.dmp	xmrig
behavioral2/memory/2864-225-0x00007FF7C7660000-0x00007FF7C79B1000-memory.dmp	xmrig
behavioral2/memory/4964-237-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	xmrig
behavioral2/memory/4964-238-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	xmrig
behavioral2/memory/4964-239-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	xmrig
behavioral2/memory/4964-240-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	xmrig
behavioral2/memory/4964-241-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	xmrig
behavioral2/memory/4964-242-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	xmrig
behavioral2/memory/4964-243-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	xmrig
behavioral2/memory/4964-244-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	xmrig
behavioral2/memory/4964-245-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	xmrig
behavioral2/memory/4964-246-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4392	oIVayQQ.exe
4772	XgKGiIJ.exe
1600	AoGqBvE.exe
2120	liEyKQl.exe
4168	HNJeccD.exe
4976	AhyFXtV.exe
4668	DSgtofC.exe
896	IPyjPEV.exe
1548	RCftJFP.exe
2012	uZOUYgh.exe
5428	EVUISLg.exe
5372	GKhRLGn.exe
5408	hksOlQh.exe
6096	VvRJRAy.exe
3144	QUREnQc.exe
2052	ngtPBBy.exe
5688	oSEdWJX.exe
2864	ISFowRU.exe
1680	midxeOM.exe
3584	GxlXeKA.exe
1000	xfiEIbd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4964-0-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	upx
behavioral2/files/0x0007000000016cdb-5.dat	upx
behavioral2/memory/4392-8-0x00007FF723E90000-0x00007FF7241E1000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a8-11.dat	upx
behavioral2/files/0x000e00000001c5a3-10.dat	upx
behavioral2/memory/4772-13-0x00007FF71A4D0000-0x00007FF71A821000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a9-22.dat	upx
behavioral2/files/0x000c00000001c5ab-32.dat	upx
behavioral2/files/0x000c00000001c5ac-38.dat	upx
behavioral2/files/0x000c00000001c5ad-43.dat	upx
behavioral2/files/0x000c00000001c5ae-48.dat	upx
behavioral2/files/0x000c00000001c5b0-53.dat	upx
behavioral2/files/0x000c00000001c5b1-58.dat	upx
behavioral2/files/0x000c00000001c5b2-63.dat	upx
behavioral2/files/0x000c00000001c5b3-68.dat	upx
behavioral2/files/0x000c00000001c5b4-73.dat	upx
behavioral2/files/0x000c00000001c5b9-97.dat	upx
behavioral2/files/0x000c00000001c5ba-103.dat	upx
behavioral2/files/0x000c00000001c5bb-107.dat	upx
behavioral2/files/0x000c00000001c5b8-93.dat	upx
behavioral2/files/0x000c00000001c5b7-88.dat	upx
behavioral2/files/0x000c00000001c5b5-83.dat	upx
behavioral2/files/0x000c00000001c5b6-81.dat	upx
behavioral2/files/0x000c00000001c5aa-28.dat	upx
behavioral2/memory/4964-109-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	upx
behavioral2/memory/4392-110-0x00007FF723E90000-0x00007FF7241E1000-memory.dmp	upx
behavioral2/memory/4976-115-0x00007FF70B180000-0x00007FF70B4D1000-memory.dmp	upx
behavioral2/memory/4668-116-0x00007FF7167F0000-0x00007FF716B41000-memory.dmp	upx
behavioral2/memory/5428-120-0x00007FF6AC8B0000-0x00007FF6ACC01000-memory.dmp	upx
behavioral2/memory/2052-125-0x00007FF6837C0000-0x00007FF683B11000-memory.dmp	upx
behavioral2/memory/1000-130-0x00007FF7EB190000-0x00007FF7EB4E1000-memory.dmp	upx
behavioral2/memory/3584-129-0x00007FF6C74D0000-0x00007FF6C7821000-memory.dmp	upx
behavioral2/memory/1680-128-0x00007FF6BDE00000-0x00007FF6BE151000-memory.dmp	upx
behavioral2/memory/2864-127-0x00007FF7C7660000-0x00007FF7C79B1000-memory.dmp	upx
behavioral2/memory/5688-126-0x00007FF6A8AD0000-0x00007FF6A8E21000-memory.dmp	upx
behavioral2/memory/3144-124-0x00007FF668520000-0x00007FF668871000-memory.dmp	upx
behavioral2/memory/6096-123-0x00007FF71C8E0000-0x00007FF71CC31000-memory.dmp	upx
behavioral2/memory/5408-122-0x00007FF6FA5E0000-0x00007FF6FA931000-memory.dmp	upx
behavioral2/memory/5372-121-0x00007FF6EE990000-0x00007FF6EECE1000-memory.dmp	upx
behavioral2/memory/2012-119-0x00007FF6658C0000-0x00007FF665C11000-memory.dmp	upx
behavioral2/memory/1548-118-0x00007FF7DD250000-0x00007FF7DD5A1000-memory.dmp	upx
behavioral2/memory/896-117-0x00007FF6D7DC0000-0x00007FF6D8111000-memory.dmp	upx
behavioral2/memory/4168-114-0x00007FF701BD0000-0x00007FF701F21000-memory.dmp	upx
behavioral2/memory/1600-112-0x00007FF7C5B90000-0x00007FF7C5EE1000-memory.dmp	upx
behavioral2/memory/2120-113-0x00007FF74FEC0000-0x00007FF750211000-memory.dmp	upx
behavioral2/memory/4772-111-0x00007FF71A4D0000-0x00007FF71A821000-memory.dmp	upx
behavioral2/memory/4964-131-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	upx
behavioral2/memory/4964-153-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	upx
behavioral2/memory/4964-154-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	upx
behavioral2/memory/4964-176-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp	upx
behavioral2/memory/4392-187-0x00007FF723E90000-0x00007FF7241E1000-memory.dmp	upx
behavioral2/memory/4772-188-0x00007FF71A4D0000-0x00007FF71A821000-memory.dmp	upx
behavioral2/memory/1600-190-0x00007FF7C5B90000-0x00007FF7C5EE1000-memory.dmp	upx
behavioral2/memory/4168-192-0x00007FF701BD0000-0x00007FF701F21000-memory.dmp	upx
behavioral2/memory/2120-194-0x00007FF74FEC0000-0x00007FF750211000-memory.dmp	upx
behavioral2/memory/4976-195-0x00007FF70B180000-0x00007FF70B4D1000-memory.dmp	upx
behavioral2/memory/1548-200-0x00007FF7DD250000-0x00007FF7DD5A1000-memory.dmp	upx
behavioral2/memory/896-205-0x00007FF6D7DC0000-0x00007FF6D8111000-memory.dmp	upx
behavioral2/memory/5428-204-0x00007FF6AC8B0000-0x00007FF6ACC01000-memory.dmp	upx
behavioral2/memory/5372-207-0x00007FF6EE990000-0x00007FF6EECE1000-memory.dmp	upx
behavioral2/memory/2012-220-0x00007FF6658C0000-0x00007FF665C11000-memory.dmp	upx
behavioral2/memory/5408-219-0x00007FF6FA5E0000-0x00007FF6FA931000-memory.dmp	upx
behavioral2/memory/6096-222-0x00007FF71C8E0000-0x00007FF71CC31000-memory.dmp	upx
behavioral2/memory/4668-217-0x00007FF7167F0000-0x00007FF716B41000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\uZOUYgh.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\EVUISLg.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\GKhRLGn.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\ISFowRU.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\GxlXeKA.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\oIVayQQ.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\AoGqBvE.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\liEyKQl.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\RCftJFP.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\oSEdWJX.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\xfiEIbd.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\hksOlQh.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\QUREnQc.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\ngtPBBy.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\midxeOM.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\XgKGiIJ.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\IPyjPEV.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\VvRJRAy.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\HNJeccD.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\AhyFXtV.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
File created	C:\Windows\System\DSgtofC.exe	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
Token: SeLockMemoryPrivilege	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4392	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	90
PID 4964 wrote to memory of 4772	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	91
PID 4964 wrote to memory of 1600	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	92
PID 4964 wrote to memory of 2120	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	93
PID 4964 wrote to memory of 4168	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	94
PID 4964 wrote to memory of 4976	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	95
PID 4964 wrote to memory of 4668	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	96
PID 4964 wrote to memory of 896	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	97
PID 4964 wrote to memory of 1548	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	98
PID 4964 wrote to memory of 2012	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	99
PID 4964 wrote to memory of 5428	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	100
PID 4964 wrote to memory of 5372	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	101
PID 4964 wrote to memory of 5408	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	102
PID 4964 wrote to memory of 6096	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	103
PID 4964 wrote to memory of 3144	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	104
PID 4964 wrote to memory of 2052	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	105
PID 4964 wrote to memory of 5688	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	106
PID 4964 wrote to memory of 2864	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	107
PID 4964 wrote to memory of 1680	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	108
PID 4964 wrote to memory of 3584	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	109
PID 4964 wrote to memory of 1000	4964	2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_dc6c02412da36a061c7a259c4b10c9d6_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\System\oIVayQQ.exe
  C:\Windows\System\oIVayQQ.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\XgKGiIJ.exe
  C:\Windows\System\XgKGiIJ.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\AoGqBvE.exe
  C:\Windows\System\AoGqBvE.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\liEyKQl.exe
  C:\Windows\System\liEyKQl.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\HNJeccD.exe
  C:\Windows\System\HNJeccD.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\AhyFXtV.exe
  C:\Windows\System\AhyFXtV.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\DSgtofC.exe
  C:\Windows\System\DSgtofC.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\IPyjPEV.exe
  C:\Windows\System\IPyjPEV.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\RCftJFP.exe
  C:\Windows\System\RCftJFP.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\uZOUYgh.exe
  C:\Windows\System\uZOUYgh.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\EVUISLg.exe
  C:\Windows\System\EVUISLg.exe
  2⤵
  - Executes dropped EXE
  PID:5428
- C:\Windows\System\GKhRLGn.exe
  C:\Windows\System\GKhRLGn.exe
  2⤵
  - Executes dropped EXE
  PID:5372
- C:\Windows\System\hksOlQh.exe
  C:\Windows\System\hksOlQh.exe
  2⤵
  - Executes dropped EXE
  PID:5408
- C:\Windows\System\VvRJRAy.exe
  C:\Windows\System\VvRJRAy.exe
  2⤵
  - Executes dropped EXE
  PID:6096
- C:\Windows\System\QUREnQc.exe
  C:\Windows\System\QUREnQc.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\ngtPBBy.exe
  C:\Windows\System\ngtPBBy.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\oSEdWJX.exe
  C:\Windows\System\oSEdWJX.exe
  2⤵
  - Executes dropped EXE
  PID:5688
- C:\Windows\System\ISFowRU.exe
  C:\Windows\System\ISFowRU.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\midxeOM.exe
  C:\Windows\System\midxeOM.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\GxlXeKA.exe
  C:\Windows\System\GxlXeKA.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\xfiEIbd.exe
  C:\Windows\System\xfiEIbd.exe
  2⤵
  - Executes dropped EXE
  PID:1000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AhyFXtV.exe

Path C:\Windows\System\AhyFXtV.exe
Size 5.2MB
SHA256 094cf3fc2d429e755f6388a59c5c5a488e9171bdc2c1d7120d37a56f21dc5922
MD5 539cb06d56769f9951c370ba64a844c1
SHA1 76d2053702f13cb31fdcdee2e41dadad0cd49247
SHA512 21f63a205186a5ba12c813a5e7d796d9c3f0e74ac49ebd76088b03eac9f842bf85d53d47e18f6beef21038a26eaa24693bba79a558233a51fd7a67c44e659cd5
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibP56utgpPFotBER/mQ32lU8
TLSH
T1D7465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AoGqBvE.exe

Path C:\Windows\System\AoGqBvE.exe
Size 5.2MB
SHA256 298c6e4881f568d761df651d47a2077d87f40fed2701f4167754735a3b624afb
MD5 3a4c914f4ffa18caa86a8747e33de18f
SHA1 ca64f090e02982081622e9fe55b274615a5bf25c
SHA512 55ea619324269e9f6e3ecbc877968ffe63f219440f43e4e36b3d1a2b49aa8d55acb085a64718a89e6cd378462e6bf2a445477b15ca8e5ecc691d2f20967e01bd
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lG:RWWBibP56utgpPFotBER/mQ32lUq
TLSH
T1B2465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DSgtofC.exe

Path C:\Windows\System\DSgtofC.exe
Size 5.2MB
SHA256 2c13d722f425bafee196977035a461916f1c887a98db91c0d2c94132aed2384a
MD5 a0c591db85de16d122d00ac0e3645a0b
SHA1 3be029091295c146c311f4e8d63828b6e8f657e2
SHA512 f1394c1ee3d67051781abc96ad2a201a0598d9b66b5f97eaa645ec5022b419736c8736f396ac540c9db711dc06aac62679ca2109fee081c4cbf5a88ce161d805
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lY:RWWBibP56utgpPFotBER/mQ32lUM
TLSH
T163465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EVUISLg.exe

Path C:\Windows\System\EVUISLg.exe
Size 5.2MB
SHA256 65c2793116fa08a43853dc35fa01a8137755b640cef51ad97fbf1df2a14cea9c
MD5 fdbe329727feb00951e86f4f734cdff8
SHA1 b3d35cd37d3191fcd2f30d44a7e7e908e2ed3100
SHA512 81cd171772206499195b3c9891f522c830dbc139a85c024c449acb12e5c97ccb666d229904366e90d168dae38335310de07f0b54e8f26ca245fac6913b636365
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibP56utgpPFotBER/mQ32lUc
TLSH
T122465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GKhRLGn.exe

Path C:\Windows\System\GKhRLGn.exe
Size 5.2MB
SHA256 1359f26315e5baad2a477742c2f74f15882d2c285709b6a0f1af68b0899a931f
MD5 880e11e8cddb971d13bf5cbf4174f4bd
SHA1 5f41f44426b632a5d0c502bd09088ac4c98428ef
SHA512 21af6b230f61e8b55468690131b2a4318b34586240d066307562badbff53f88cc7f4909a24f5d8abb4084bf1593a46d0e54553744f861309c86f63ca62716729
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibP56utgpPFotBER/mQ32lUJ
TLSH
T1CB465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GxlXeKA.exe

Path C:\Windows\System\GxlXeKA.exe
Size 5.2MB
SHA256 25e08caf50fef8f1718fa52d73eb6dc7ac386f8955ad07f7326af9677a63c766
MD5 70462520d5628147b59d969df45a359e
SHA1 5dc90bc1be63e365e38bc0cc86d72c5606324f9a
SHA512 e6ce3e2ed322165d96c41c83cc1a3055c43abe53e8db85dd631061be5106788e4473d04135048baebf2f98ee131806169ad651284a0c37d9e7cbe09377d73b37
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l2:RWWBibP56utgpPFotBER/mQ32lUK
TLSH
T14A465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HNJeccD.exe

Path C:\Windows\System\HNJeccD.exe
Size 5.2MB
SHA256 b8d2b073c90a05be668da20194ec29e99c16d85c13619ed0e030c0852234b28e
MD5 5c26d02d2c6765c9b6c98c583f0d4934
SHA1 6b6fc2a717cac4d7df24302215ed672789ee7cc7
SHA512 9e83d47eb22c6f325f6aa323100caa221beca3544fddc4c54518cf07560f2396c4c1533381e8b2acdd2b9a81ecd38dc0acdcad5ad911b92eb389a0b9de1158da
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lr:RWWBibP56utgpPFotBER/mQ32lUv
TLSH
T14C465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IPyjPEV.exe

Path C:\Windows\System\IPyjPEV.exe
Size 5.2MB
SHA256 ce8363edaeb5f63fd1a2711486e15d40c8f3bb2f151785d4dba40fe0d89c4e13
MD5 5a71b67527942aa224b06c27b510de2c
SHA1 69a4eb7ef44022f2b0cab8c20e9f92e9489399cc
SHA512 234f879fe408d60c9c25cb0080d65e10eeca24c46c199868b63b77ddfffb8d75bce9d6c0dc3d3b0df35480cd2807f9afb1f4b697f30f99213bb8ae2cae344a72
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lB:RWWBibP56utgpPFotBER/mQ32lU1
TLSH
T125465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISFowRU.exe

Path C:\Windows\System\ISFowRU.exe
Size 5.2MB
SHA256 4d275b5fd24362a3775e68624d3ef8f55bff1128b07e173e54ceb7b7c2df6ee8
MD5 482ea9eff653a8ced68a0dd5677c956e
SHA1 cf07f0293a79e45ccc5175109b49d9624511986c
SHA512 027b21f96a9c9871a826884aa025851a2bfc4e4e1b0648991d60d0991bf0cc3289c21a8b8b3a0bbad14d65879ce1cbe31808b88ce9d00d4b2b887816a248af7e
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBibP56utgpPFotBER/mQ32lUH
TLSH
T135465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QUREnQc.exe

Path C:\Windows\System\QUREnQc.exe
Size 5.2MB
SHA256 b13ea43b5949882b1705390a8e44e579a2d9b6b9aed4a915d046bc536efdaba5
MD5 f88b12915fbb83981adde3997eb23a5a
SHA1 4b3298be9026cd1f074310bc3b5f6cf2925f16ba
SHA512 2b74bf2f5d6728b773df64a8e47c5a1771a94ba502b7e0d2cc34a21b5ff088a853046f15b6ea3def6ffc7314899541b97478426b2567be469fb2bd56a2a59d4f
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibP56utgpPFotBER/mQ32lUa
TLSH
T158465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCftJFP.exe

Path C:\Windows\System\RCftJFP.exe
Size 5.2MB
SHA256 acebf11597dae1ebb52f8a5b80745f2c382e28adde605417cdd3b15799627f1f
MD5 3259a55f3e6334c6d72d79138d4e285e
SHA1 610a224c358052c437eb1f873da9a24294829b8a
SHA512 b0d3b37621b461a9c741ad069b80447be2db8295712a6284f6bd1c13c4a1d7ce4250ad9029ffbd8972ed73b16ab325a1d9ced5ffefa5e15940270995e2deaa73
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l9:RWWBibP56utgpPFotBER/mQ32lUZ
TLSH
T1B9465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VvRJRAy.exe

Path C:\Windows\System\VvRJRAy.exe
Size 5.2MB
SHA256 c99972db1e6b57d192747f459407e6db122466e4a7f286e5a38e4d6e6f8c6d4b
MD5 2edd1f8875e7b7b1512c68ecccd827fd
SHA1 beef640ebe59dead929c097cfae46e4e1478a1bf
SHA512 55b0eafd21f62680019a7b255fc8e57c8ce3632b1f1fc9d8b08f6f9724dded6c6287042a3c19f0c0505d5f69d6cd0e49ffeca8537b7dd832c6c70ff402b16dca
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibP56utgpPFotBER/mQ32lUa
TLSH
T1B4465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XgKGiIJ.exe

Path C:\Windows\System\XgKGiIJ.exe
Size 5.2MB
SHA256 f23c646f618a48f0a45276f2c26c912b00ebe2f8328f1de322f174b8519bbc43
MD5 6b4b600666f6b05c45462161464cb60a
SHA1 3b8df2ba8980ecb5b03f2248ba494d46a4202ed5
SHA512 f2d4f98b47c43202552100d788482da592564578168dac481efba26768d55c82eb604d66cd55b12e35ad97a34826a22b96187f190ff2ad3282804eb62e3894fa
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibP56utgpPFotBER/mQ32lUN
TLSH
T1D7465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hksOlQh.exe

Path C:\Windows\System\hksOlQh.exe
Size 5.2MB
SHA256 61367b99a05407659a77edae66c083958b9a3c17218f14ebbf0b994b08b89193
MD5 e35eee3a3595ce9dd43b737cd8b335b2
SHA1 266b4c536a51404be8288672216033b95657ef6a
SHA512 0f7c06488fabe849dd6fa3d35fadcea96bf4e9862309af713c587a5e891ece3b3c958261fab0c8c62bf10221b47e44ccc7f688f78ec69d704756aa09bc559a10
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l3:RWWBibP56utgpPFotBER/mQ32lUD
TLSH
T127465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liEyKQl.exe

Path C:\Windows\System\liEyKQl.exe
Size 5.2MB
SHA256 b59787651b6299d866056fa57f07c70b9a364e5b25324d5a79b35aa094198e18
MD5 abeff0bc9b27acc6bd0931f840bc755b
SHA1 08c52088a18a70e40df5ea2369fa01f2c4844752
SHA512 29777a356c09ed2d43ad5d043d957d9d6b141dfe66aa95e3ff03325ec9df6b346ae8a2a7a9d71a2692bb211f98698ea481430976fe3662e146a7dc8f95b54087
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ly:RWWBibP56utgpPFotBER/mQ32lU2
TLSH
T187465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

midxeOM.exe

Path C:\Windows\System\midxeOM.exe
Size 5.2MB
SHA256 acd2e5eab3f8497913ec67924d8b370cdfc47d3a58f7759d47765cb15655e1e2
MD5 88afbc6bfdae06c32c70abbafde40b8d
SHA1 6297c33a32dc9f3ea29e6578d35f021c18dc2f1e
SHA512 f085244784afcf70ff8fd807a6df11073c032d11dd7119e60a9e0bc3f2e98064f59b158676802e5baaf78c137c9fcf925fc293745f321e91e0d35cc2f15a0de1
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibP56utgpPFotBER/mQ32lUj
TLSH
T1E0465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ngtPBBy.exe

Path C:\Windows\System\ngtPBBy.exe
Size 5.2MB
SHA256 5a2f2940a85962f0e3c5f65517f84dcd23a3abf6d4cbf692ff98f8d8c25ec8f5
MD5 86d2157ab03457c0625308ad89a011fd
SHA1 e2d2b8d0aaafd4b49e08a868fb935fcd70d05dbe
SHA512 1c34acc192107d48dd399df0bff78f20548992e60cf8b76cf476173ed9bca91a67bcefae22e6f3c20892a771d92cb9c6bbe1564993d4a3a0b7c86f3cbf9ba2d8
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lP:RWWBibP56utgpPFotBER/mQ32lU7
TLSH
T1F4465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oIVayQQ.exe

Path C:\Windows\System\oIVayQQ.exe
Size 5.2MB
SHA256 3deea7971040acdacea52235f33177989c21dc7dbb95ad1c75031a98a8f8524c
MD5 512f1a982343b118568232f8c6c98c6a
SHA1 bd82ad99dccca0795c1e498863bed2fb404796d8
SHA512 52ba0acff026eab346d2b6943219812712cf702677a6b846f8634468d05b0141598c74aae59d82ad040c96d49aeb9f608566cca6694eef0d8984a89eb8c76392
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibP56utgpPFotBER/mQ32lUm
TLSH
T153465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oSEdWJX.exe

Path C:\Windows\System\oSEdWJX.exe
Size 5.2MB
SHA256 cc0345b888814b9157f4608dd15efce26d7138c8ac2e314d24549b6671a2093e
MD5 4610b6ad8ad584acac2d26e43a120d62
SHA1 bf10aa2fed8d322c170986f1035097047a93b7c6
SHA512 8bda9f9c615a1d60abbc7358a8e5855306ab85329b4683369c82511b9824c05406157e789d184926c34804f83b37a623fe902f072e49763c7e5fe85fb7ec6a96
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l2:RWWBibP56utgpPFotBER/mQ32lUa
TLSH
T12C465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uZOUYgh.exe

Path C:\Windows\System\uZOUYgh.exe
Size 5.2MB
SHA256 1e920acbfb75145391a847d37c601d54e13967d194d02ec7e0def62d63bc5579
MD5 a64788822179948bc1b5e3497a84d2b8
SHA1 c424d8aaaace08ff75219a10da0854955307de50
SHA512 f48a076f620b4165cd0ae670347f79c22db6ce2309ac98bfc7f773e511f7e0324af78006e1f87755891022f0875ebc2c2ea6e64e5fa8a8c79372629e8e4680e9
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBibP56utgpPFotBER/mQ32lUB
TLSH
T182465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xfiEIbd.exe

Path C:\Windows\System\xfiEIbd.exe
Size 5.2MB
SHA256 9855f2622af52864fcf89e8ef63c77563fbba2fb3d3e61efa2da80920845f4a7
MD5 d3a3e1671e79a42d0030c1d19858eff4
SHA1 2cbe842570b1f6a468a9e9be8c0d69b67158522b
SHA512 656d7b2100228c8251570d2ffa2b43ef77e644565acbe0d2660f7ea569a65d5b797639e677fd9c98578147e608f8afc448cc119de2beb4c491487cc986474cb9
SSDEEP 49152:ROdWCCi7/raE56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l8:RWWBibP56utgpPFotBER/mQ32lUI
TLSH
T153465C41ED9B45F2EB8712308CB31E5F6333B2190335EAC3DA654A6FE5276E46B36241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/896-205-0x00007FF6D7DC0000-0x00007FF6D8111000-memory.dmp

Download

memory/896-117-0x00007FF6D7DC0000-0x00007FF6D8111000-memory.dmp

Download

memory/1000-130-0x00007FF7EB190000-0x00007FF7EB4E1000-memory.dmp

Download

memory/1000-232-0x00007FF7EB190000-0x00007FF7EB4E1000-memory.dmp

Download

memory/1548-200-0x00007FF7DD250000-0x00007FF7DD5A1000-memory.dmp

Download

memory/1548-118-0x00007FF7DD250000-0x00007FF7DD5A1000-memory.dmp

Download

memory/1600-190-0x00007FF7C5B90000-0x00007FF7C5EE1000-memory.dmp

Download

memory/1600-112-0x00007FF7C5B90000-0x00007FF7C5EE1000-memory.dmp

Download

memory/1680-231-0x00007FF6BDE00000-0x00007FF6BE151000-memory.dmp

Download

memory/1680-128-0x00007FF6BDE00000-0x00007FF6BE151000-memory.dmp

Download

memory/2012-119-0x00007FF6658C0000-0x00007FF665C11000-memory.dmp

Download

memory/2012-220-0x00007FF6658C0000-0x00007FF665C11000-memory.dmp

Download

memory/2052-125-0x00007FF6837C0000-0x00007FF683B11000-memory.dmp

Download

memory/2052-236-0x00007FF6837C0000-0x00007FF683B11000-memory.dmp

Download

memory/2120-194-0x00007FF74FEC0000-0x00007FF750211000-memory.dmp

Download

memory/2120-113-0x00007FF74FEC0000-0x00007FF750211000-memory.dmp

Download

memory/2864-127-0x00007FF7C7660000-0x00007FF7C79B1000-memory.dmp

Download

memory/2864-225-0x00007FF7C7660000-0x00007FF7C79B1000-memory.dmp

Download

memory/3144-124-0x00007FF668520000-0x00007FF668871000-memory.dmp

Download

memory/3144-235-0x00007FF668520000-0x00007FF668871000-memory.dmp

Download

memory/3584-129-0x00007FF6C74D0000-0x00007FF6C7821000-memory.dmp

Download

memory/3584-230-0x00007FF6C74D0000-0x00007FF6C7821000-memory.dmp

Download

memory/4168-114-0x00007FF701BD0000-0x00007FF701F21000-memory.dmp

Download

memory/4168-192-0x00007FF701BD0000-0x00007FF701F21000-memory.dmp

Download

memory/4392-8-0x00007FF723E90000-0x00007FF7241E1000-memory.dmp

Download

memory/4392-187-0x00007FF723E90000-0x00007FF7241E1000-memory.dmp

Download

memory/4392-110-0x00007FF723E90000-0x00007FF7241E1000-memory.dmp

Download

memory/4668-217-0x00007FF7167F0000-0x00007FF716B41000-memory.dmp

Download

memory/4668-116-0x00007FF7167F0000-0x00007FF716B41000-memory.dmp

Download

memory/4772-111-0x00007FF71A4D0000-0x00007FF71A821000-memory.dmp

Download

memory/4772-13-0x00007FF71A4D0000-0x00007FF71A821000-memory.dmp

Download

memory/4772-188-0x00007FF71A4D0000-0x00007FF71A821000-memory.dmp

Download

memory/4964-241-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp

Download

memory/4964-242-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp

Download

memory/4964-246-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp

Download

memory/4964-238-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp

Download

memory/4964-109-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp

Download

memory/4964-153-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp

Download

memory/4964-176-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp

Download

memory/4964-154-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp

Download

memory/4964-0-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp

Download

memory/4964-237-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp

Download

memory/4964-244-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp

Download

memory/4964-240-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp

Download

memory/4964-239-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp

Download

memory/4964-245-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp

Download

memory/4964-1-0x000001AF8A610000-0x000001AF8A620000-memory.dmp

Download

memory/4964-243-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp

Download

memory/4964-131-0x00007FF7D5A30000-0x00007FF7D5D81000-memory.dmp

Download

memory/4976-115-0x00007FF70B180000-0x00007FF70B4D1000-memory.dmp

Download

memory/4976-195-0x00007FF70B180000-0x00007FF70B4D1000-memory.dmp

Download

memory/5372-207-0x00007FF6EE990000-0x00007FF6EECE1000-memory.dmp

Download

memory/5372-121-0x00007FF6EE990000-0x00007FF6EECE1000-memory.dmp

Download

memory/5408-219-0x00007FF6FA5E0000-0x00007FF6FA931000-memory.dmp

Download

memory/5408-122-0x00007FF6FA5E0000-0x00007FF6FA931000-memory.dmp

Download

memory/5428-204-0x00007FF6AC8B0000-0x00007FF6ACC01000-memory.dmp

Download

memory/5428-120-0x00007FF6AC8B0000-0x00007FF6ACC01000-memory.dmp

Download

memory/5688-126-0x00007FF6A8AD0000-0x00007FF6A8E21000-memory.dmp

Download

memory/5688-226-0x00007FF6A8AD0000-0x00007FF6A8E21000-memory.dmp

Download

memory/6096-123-0x00007FF71C8E0000-0x00007FF71CC31000-memory.dmp

Download

memory/6096-222-0x00007FF71C8E0000-0x00007FF71CC31000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads