cobaltstrike | f3f5690459ceb90b1169450071e3ef463eaba58bc56edf78dfd7a83104b3bc25

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 08:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample260910-j8w2dagb95
SHA256 f3f5690459ceb90b1169450071e3ef463eaba58bc56edf78dfd7a83104b3bc25
MD5 ffd22a3c1fe12de945f8d19de89b8b29
SHA1 85bd33f58eeed1e50e599f17cb4112307d0d503c
SHA512 4b4dc4443ca1a127340b29ebd8aacd1abea1aa398def203bd692a08198c1d2d80d00932e450a5e8fbf9115a1908d4463b86fcf657d250bef169d645f003cebf5
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUC:v+D56utgpPF8u/7C
TLSH
T116965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x000700000002444c-26.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002444d-48.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024455-102.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002445a-113.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024459-111.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024458-109.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024457-106.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024456-104.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024454-100.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024450-96.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002444f-94.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002444e-92.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024451-83.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024453-77.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002444b-70.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024452-68.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002444a-63.dat	cobalt_reflective_dll
behavioral1/files/0x000a000000024443-32.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024449-44.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024448-37.dat	cobalt_reflective_dll
behavioral1/files/0x000b0000000242c8-15.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral1/files/0x000700000002444c-26.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002444d-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024455-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002445a-113.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024459-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024458-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024457-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024456-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024454-100.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024450-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002444f-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002444e-92.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024451-83.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024453-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002444b-70.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024452-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002444a-63.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000a000000024443-32.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024449-44.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024448-37.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000b0000000242c8-15.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral1/memory/4352-0-0x00007FF6B17E0000-0x00007FF6B1B32000-memory.dmp	UPX
behavioral1/memory/2292-10-0x00007FF76D650000-0x00007FF76D9A2000-memory.dmp	UPX
behavioral1/files/0x000700000002444c-26.dat	UPX
behavioral1/files/0x000700000002444d-48.dat	UPX
behavioral1/files/0x0007000000024455-102.dat	UPX
behavioral1/memory/4732-115-0x00007FF6355C0000-0x00007FF635912000-memory.dmp	UPX
behavioral1/memory/5076-120-0x00007FF7B2800000-0x00007FF7B2B52000-memory.dmp	UPX
behavioral1/memory/2504-125-0x00007FF7CC0D0000-0x00007FF7CC422000-memory.dmp	UPX
behavioral1/memory/2036-127-0x00007FF7847C0000-0x00007FF784B12000-memory.dmp	UPX
behavioral1/memory/5028-126-0x00007FF75C080000-0x00007FF75C3D2000-memory.dmp	UPX
behavioral1/memory/4312-124-0x00007FF66A130000-0x00007FF66A482000-memory.dmp	UPX
behavioral1/memory/4960-123-0x00007FF71C960000-0x00007FF71CCB2000-memory.dmp	UPX
behavioral1/memory/2116-122-0x00007FF6C1580000-0x00007FF6C18D2000-memory.dmp	UPX
behavioral1/memory/4368-121-0x00007FF6E7A60000-0x00007FF6E7DB2000-memory.dmp	UPX
behavioral1/memory/4728-119-0x00007FF6EAEA0000-0x00007FF6EB1F2000-memory.dmp	UPX
behavioral1/memory/4404-118-0x00007FF6E4A00000-0x00007FF6E4D52000-memory.dmp	UPX
behavioral1/memory/4316-117-0x00007FF6F88E0000-0x00007FF6F8C32000-memory.dmp	UPX
behavioral1/memory/4320-116-0x00007FF7C9E00000-0x00007FF7CA152000-memory.dmp	UPX
behavioral1/files/0x000700000002445a-113.dat	UPX
behavioral1/files/0x0007000000024459-111.dat	UPX
behavioral1/files/0x0007000000024458-109.dat	UPX
behavioral1/memory/1348-108-0x00007FF762100000-0x00007FF762452000-memory.dmp	UPX
behavioral1/files/0x0007000000024457-106.dat	UPX
behavioral1/files/0x0007000000024456-104.dat	UPX
behavioral1/files/0x0007000000024454-100.dat	UPX
behavioral1/memory/2924-99-0x00007FF7C4E80000-0x00007FF7C51D2000-memory.dmp	UPX
behavioral1/memory/816-98-0x00007FF7BB3B0000-0x00007FF7BB702000-memory.dmp	UPX
behavioral1/files/0x0007000000024450-96.dat	UPX
behavioral1/files/0x000700000002444f-94.dat	UPX
behavioral1/files/0x000700000002444e-92.dat	UPX
behavioral1/memory/452-86-0x00007FF7B5B70000-0x00007FF7B5EC2000-memory.dmp	UPX
behavioral1/memory/4276-85-0x00007FF7323D0000-0x00007FF732722000-memory.dmp	UPX
behavioral1/files/0x0007000000024451-83.dat	UPX
behavioral1/files/0x0007000000024453-77.dat	UPX
behavioral1/files/0x000700000002444b-70.dat	UPX
behavioral1/files/0x0007000000024452-68.dat	UPX
behavioral1/files/0x000700000002444a-63.dat	UPX
behavioral1/memory/776-52-0x00007FF6FB610000-0x00007FF6FB962000-memory.dmp	UPX
behavioral1/files/0x000a000000024443-32.dat	UPX
behavioral1/memory/820-29-0x00007FF613730000-0x00007FF613A82000-memory.dmp	UPX
behavioral1/files/0x0007000000024449-44.dat	UPX
behavioral1/files/0x0007000000024448-37.dat	UPX
behavioral1/files/0x000b0000000242c8-15.dat	UPX
behavioral1/memory/4352-128-0x00007FF6B17E0000-0x00007FF6B1B32000-memory.dmp	UPX
behavioral1/memory/2292-129-0x00007FF76D650000-0x00007FF76D9A2000-memory.dmp	UPX
behavioral1/memory/820-130-0x00007FF613730000-0x00007FF613A82000-memory.dmp	UPX
behavioral1/memory/776-131-0x00007FF6FB610000-0x00007FF6FB962000-memory.dmp	UPX
behavioral1/memory/2292-132-0x00007FF76D650000-0x00007FF76D9A2000-memory.dmp	UPX
behavioral1/memory/820-133-0x00007FF613730000-0x00007FF613A82000-memory.dmp	UPX
behavioral1/memory/776-134-0x00007FF6FB610000-0x00007FF6FB962000-memory.dmp	UPX
behavioral1/memory/4276-135-0x00007FF7323D0000-0x00007FF732722000-memory.dmp	UPX
behavioral1/memory/4320-150-0x00007FF7C9E00000-0x00007FF7CA152000-memory.dmp	UPX
behavioral1/memory/4312-151-0x00007FF66A130000-0x00007FF66A482000-memory.dmp	UPX
behavioral1/memory/452-149-0x00007FF7B5B70000-0x00007FF7B5EC2000-memory.dmp	UPX
behavioral1/memory/816-148-0x00007FF7BB3B0000-0x00007FF7BB702000-memory.dmp	UPX
behavioral1/memory/4316-147-0x00007FF6F88E0000-0x00007FF6F8C32000-memory.dmp	UPX
behavioral1/memory/5028-146-0x00007FF75C080000-0x00007FF75C3D2000-memory.dmp	UPX
behavioral1/memory/2504-145-0x00007FF7CC0D0000-0x00007FF7CC422000-memory.dmp	UPX
behavioral1/memory/2924-144-0x00007FF7C4E80000-0x00007FF7C51D2000-memory.dmp	UPX
behavioral1/memory/1348-143-0x00007FF762100000-0x00007FF762452000-memory.dmp	UPX
behavioral1/memory/4404-142-0x00007FF6E4A00000-0x00007FF6E4D52000-memory.dmp	UPX
behavioral1/memory/4728-141-0x00007FF6EAEA0000-0x00007FF6EB1F2000-memory.dmp	UPX
behavioral1/memory/5076-140-0x00007FF7B2800000-0x00007FF7B2B52000-memory.dmp	UPX
behavioral1/memory/4368-139-0x00007FF6E7A60000-0x00007FF6E7DB2000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/4352-0-0x00007FF6B17E0000-0x00007FF6B1B32000-memory.dmp	xmrig
behavioral1/memory/2292-10-0x00007FF76D650000-0x00007FF76D9A2000-memory.dmp	xmrig
behavioral1/files/0x000700000002444c-26.dat	xmrig
behavioral1/files/0x000700000002444d-48.dat	xmrig
behavioral1/files/0x0007000000024455-102.dat	xmrig
behavioral1/memory/4732-115-0x00007FF6355C0000-0x00007FF635912000-memory.dmp	xmrig
behavioral1/memory/5076-120-0x00007FF7B2800000-0x00007FF7B2B52000-memory.dmp	xmrig
behavioral1/memory/2504-125-0x00007FF7CC0D0000-0x00007FF7CC422000-memory.dmp	xmrig
behavioral1/memory/2036-127-0x00007FF7847C0000-0x00007FF784B12000-memory.dmp	xmrig
behavioral1/memory/5028-126-0x00007FF75C080000-0x00007FF75C3D2000-memory.dmp	xmrig
behavioral1/memory/4312-124-0x00007FF66A130000-0x00007FF66A482000-memory.dmp	xmrig
behavioral1/memory/4960-123-0x00007FF71C960000-0x00007FF71CCB2000-memory.dmp	xmrig
behavioral1/memory/2116-122-0x00007FF6C1580000-0x00007FF6C18D2000-memory.dmp	xmrig
behavioral1/memory/4368-121-0x00007FF6E7A60000-0x00007FF6E7DB2000-memory.dmp	xmrig
behavioral1/memory/4728-119-0x00007FF6EAEA0000-0x00007FF6EB1F2000-memory.dmp	xmrig
behavioral1/memory/4404-118-0x00007FF6E4A00000-0x00007FF6E4D52000-memory.dmp	xmrig
behavioral1/memory/4316-117-0x00007FF6F88E0000-0x00007FF6F8C32000-memory.dmp	xmrig
behavioral1/memory/4320-116-0x00007FF7C9E00000-0x00007FF7CA152000-memory.dmp	xmrig
behavioral1/files/0x000700000002445a-113.dat	xmrig
behavioral1/files/0x0007000000024459-111.dat	xmrig
behavioral1/files/0x0007000000024458-109.dat	xmrig
behavioral1/memory/1348-108-0x00007FF762100000-0x00007FF762452000-memory.dmp	xmrig
behavioral1/files/0x0007000000024457-106.dat	xmrig
behavioral1/files/0x0007000000024456-104.dat	xmrig
behavioral1/files/0x0007000000024454-100.dat	xmrig
behavioral1/memory/2924-99-0x00007FF7C4E80000-0x00007FF7C51D2000-memory.dmp	xmrig
behavioral1/memory/816-98-0x00007FF7BB3B0000-0x00007FF7BB702000-memory.dmp	xmrig
behavioral1/files/0x0007000000024450-96.dat	xmrig
behavioral1/files/0x000700000002444f-94.dat	xmrig
behavioral1/files/0x000700000002444e-92.dat	xmrig
behavioral1/memory/452-86-0x00007FF7B5B70000-0x00007FF7B5EC2000-memory.dmp	xmrig
behavioral1/memory/4276-85-0x00007FF7323D0000-0x00007FF732722000-memory.dmp	xmrig
behavioral1/files/0x0007000000024451-83.dat	xmrig
behavioral1/files/0x0007000000024453-77.dat	xmrig
behavioral1/files/0x000700000002444b-70.dat	xmrig
behavioral1/files/0x0007000000024452-68.dat	xmrig
behavioral1/files/0x000700000002444a-63.dat	xmrig
behavioral1/memory/776-52-0x00007FF6FB610000-0x00007FF6FB962000-memory.dmp	xmrig
behavioral1/files/0x000a000000024443-32.dat	xmrig
behavioral1/memory/820-29-0x00007FF613730000-0x00007FF613A82000-memory.dmp	xmrig
behavioral1/files/0x0007000000024449-44.dat	xmrig
behavioral1/files/0x0007000000024448-37.dat	xmrig
behavioral1/files/0x000b0000000242c8-15.dat	xmrig
behavioral1/memory/4352-128-0x00007FF6B17E0000-0x00007FF6B1B32000-memory.dmp	xmrig
behavioral1/memory/2292-129-0x00007FF76D650000-0x00007FF76D9A2000-memory.dmp	xmrig
behavioral1/memory/820-130-0x00007FF613730000-0x00007FF613A82000-memory.dmp	xmrig
behavioral1/memory/776-131-0x00007FF6FB610000-0x00007FF6FB962000-memory.dmp	xmrig
behavioral1/memory/2292-132-0x00007FF76D650000-0x00007FF76D9A2000-memory.dmp	xmrig
behavioral1/memory/820-133-0x00007FF613730000-0x00007FF613A82000-memory.dmp	xmrig
behavioral1/memory/776-134-0x00007FF6FB610000-0x00007FF6FB962000-memory.dmp	xmrig
behavioral1/memory/4276-135-0x00007FF7323D0000-0x00007FF732722000-memory.dmp	xmrig
behavioral1/memory/4320-150-0x00007FF7C9E00000-0x00007FF7CA152000-memory.dmp	xmrig
behavioral1/memory/4312-151-0x00007FF66A130000-0x00007FF66A482000-memory.dmp	xmrig
behavioral1/memory/452-149-0x00007FF7B5B70000-0x00007FF7B5EC2000-memory.dmp	xmrig
behavioral1/memory/816-148-0x00007FF7BB3B0000-0x00007FF7BB702000-memory.dmp	xmrig
behavioral1/memory/4316-147-0x00007FF6F88E0000-0x00007FF6F8C32000-memory.dmp	xmrig
behavioral1/memory/5028-146-0x00007FF75C080000-0x00007FF75C3D2000-memory.dmp	xmrig
behavioral1/memory/2504-145-0x00007FF7CC0D0000-0x00007FF7CC422000-memory.dmp	xmrig
behavioral1/memory/2924-144-0x00007FF7C4E80000-0x00007FF7C51D2000-memory.dmp	xmrig
behavioral1/memory/1348-143-0x00007FF762100000-0x00007FF762452000-memory.dmp	xmrig
behavioral1/memory/4404-142-0x00007FF6E4A00000-0x00007FF6E4D52000-memory.dmp	xmrig
behavioral1/memory/4728-141-0x00007FF6EAEA0000-0x00007FF6EB1F2000-memory.dmp	xmrig
behavioral1/memory/5076-140-0x00007FF7B2800000-0x00007FF7B2B52000-memory.dmp	xmrig
behavioral1/memory/4368-139-0x00007FF6E7A60000-0x00007FF6E7DB2000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2292	WORAAFJ.exe
820	torYMXC.exe
776	nKeBzxU.exe
4276	LsXPAce.exe
4312	IQgnOLd.exe
452	lFmXpVF.exe
816	KMfUWmR.exe
2504	kTlqdyp.exe
2924	OKmxekV.exe
1348	pSCdmcO.exe
4732	pKXmodE.exe
5028	fgLooGi.exe
4320	KRzhBzx.exe
4316	JXdkkeO.exe
4404	AoumrSE.exe
4728	spQopeH.exe
5076	lwNsxwL.exe
4368	CtQoUyF.exe
2036	eIKgdXb.exe
2116	fgroKXJ.exe
4960	oJIvMCY.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4352-0-0x00007FF6B17E0000-0x00007FF6B1B32000-memory.dmp	upx
behavioral1/memory/2292-10-0x00007FF76D650000-0x00007FF76D9A2000-memory.dmp	upx
behavioral1/files/0x000700000002444c-26.dat	upx
behavioral1/files/0x000700000002444d-48.dat	upx
behavioral1/files/0x0007000000024455-102.dat	upx
behavioral1/memory/4732-115-0x00007FF6355C0000-0x00007FF635912000-memory.dmp	upx
behavioral1/memory/5076-120-0x00007FF7B2800000-0x00007FF7B2B52000-memory.dmp	upx
behavioral1/memory/2504-125-0x00007FF7CC0D0000-0x00007FF7CC422000-memory.dmp	upx
behavioral1/memory/2036-127-0x00007FF7847C0000-0x00007FF784B12000-memory.dmp	upx
behavioral1/memory/5028-126-0x00007FF75C080000-0x00007FF75C3D2000-memory.dmp	upx
behavioral1/memory/4312-124-0x00007FF66A130000-0x00007FF66A482000-memory.dmp	upx
behavioral1/memory/4960-123-0x00007FF71C960000-0x00007FF71CCB2000-memory.dmp	upx
behavioral1/memory/2116-122-0x00007FF6C1580000-0x00007FF6C18D2000-memory.dmp	upx
behavioral1/memory/4368-121-0x00007FF6E7A60000-0x00007FF6E7DB2000-memory.dmp	upx
behavioral1/memory/4728-119-0x00007FF6EAEA0000-0x00007FF6EB1F2000-memory.dmp	upx
behavioral1/memory/4404-118-0x00007FF6E4A00000-0x00007FF6E4D52000-memory.dmp	upx
behavioral1/memory/4316-117-0x00007FF6F88E0000-0x00007FF6F8C32000-memory.dmp	upx
behavioral1/memory/4320-116-0x00007FF7C9E00000-0x00007FF7CA152000-memory.dmp	upx
behavioral1/files/0x000700000002445a-113.dat	upx
behavioral1/files/0x0007000000024459-111.dat	upx
behavioral1/files/0x0007000000024458-109.dat	upx
behavioral1/memory/1348-108-0x00007FF762100000-0x00007FF762452000-memory.dmp	upx
behavioral1/files/0x0007000000024457-106.dat	upx
behavioral1/files/0x0007000000024456-104.dat	upx
behavioral1/files/0x0007000000024454-100.dat	upx
behavioral1/memory/2924-99-0x00007FF7C4E80000-0x00007FF7C51D2000-memory.dmp	upx
behavioral1/memory/816-98-0x00007FF7BB3B0000-0x00007FF7BB702000-memory.dmp	upx
behavioral1/files/0x0007000000024450-96.dat	upx
behavioral1/files/0x000700000002444f-94.dat	upx
behavioral1/files/0x000700000002444e-92.dat	upx
behavioral1/memory/452-86-0x00007FF7B5B70000-0x00007FF7B5EC2000-memory.dmp	upx
behavioral1/memory/4276-85-0x00007FF7323D0000-0x00007FF732722000-memory.dmp	upx
behavioral1/files/0x0007000000024451-83.dat	upx
behavioral1/files/0x0007000000024453-77.dat	upx
behavioral1/files/0x000700000002444b-70.dat	upx
behavioral1/files/0x0007000000024452-68.dat	upx
behavioral1/files/0x000700000002444a-63.dat	upx
behavioral1/memory/776-52-0x00007FF6FB610000-0x00007FF6FB962000-memory.dmp	upx
behavioral1/files/0x000a000000024443-32.dat	upx
behavioral1/memory/820-29-0x00007FF613730000-0x00007FF613A82000-memory.dmp	upx
behavioral1/files/0x0007000000024449-44.dat	upx
behavioral1/files/0x0007000000024448-37.dat	upx
behavioral1/files/0x000b0000000242c8-15.dat	upx
behavioral1/memory/4352-128-0x00007FF6B17E0000-0x00007FF6B1B32000-memory.dmp	upx
behavioral1/memory/2292-129-0x00007FF76D650000-0x00007FF76D9A2000-memory.dmp	upx
behavioral1/memory/820-130-0x00007FF613730000-0x00007FF613A82000-memory.dmp	upx
behavioral1/memory/776-131-0x00007FF6FB610000-0x00007FF6FB962000-memory.dmp	upx
behavioral1/memory/2292-132-0x00007FF76D650000-0x00007FF76D9A2000-memory.dmp	upx
behavioral1/memory/820-133-0x00007FF613730000-0x00007FF613A82000-memory.dmp	upx
behavioral1/memory/776-134-0x00007FF6FB610000-0x00007FF6FB962000-memory.dmp	upx
behavioral1/memory/4276-135-0x00007FF7323D0000-0x00007FF732722000-memory.dmp	upx
behavioral1/memory/4320-150-0x00007FF7C9E00000-0x00007FF7CA152000-memory.dmp	upx
behavioral1/memory/4312-151-0x00007FF66A130000-0x00007FF66A482000-memory.dmp	upx
behavioral1/memory/452-149-0x00007FF7B5B70000-0x00007FF7B5EC2000-memory.dmp	upx
behavioral1/memory/816-148-0x00007FF7BB3B0000-0x00007FF7BB702000-memory.dmp	upx
behavioral1/memory/4316-147-0x00007FF6F88E0000-0x00007FF6F8C32000-memory.dmp	upx
behavioral1/memory/5028-146-0x00007FF75C080000-0x00007FF75C3D2000-memory.dmp	upx
behavioral1/memory/2504-145-0x00007FF7CC0D0000-0x00007FF7CC422000-memory.dmp	upx
behavioral1/memory/2924-144-0x00007FF7C4E80000-0x00007FF7C51D2000-memory.dmp	upx
behavioral1/memory/1348-143-0x00007FF762100000-0x00007FF762452000-memory.dmp	upx
behavioral1/memory/4404-142-0x00007FF6E4A00000-0x00007FF6E4D52000-memory.dmp	upx
behavioral1/memory/4728-141-0x00007FF6EAEA0000-0x00007FF6EB1F2000-memory.dmp	upx
behavioral1/memory/5076-140-0x00007FF7B2800000-0x00007FF7B2B52000-memory.dmp	upx
behavioral1/memory/4368-139-0x00007FF6E7A60000-0x00007FF6E7DB2000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\CtQoUyF.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\oJIvMCY.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\torYMXC.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\OKmxekV.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fgLooGi.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\KRzhBzx.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\AoumrSE.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\spQopeH.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\eIKgdXb.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\nKeBzxU.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\lFmXpVF.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\kTlqdyp.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\lwNsxwL.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fgroKXJ.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\LsXPAce.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\IQgnOLd.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\KMfUWmR.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\pSCdmcO.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\JXdkkeO.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\WORAAFJ.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\pKXmodE.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 2292	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	86
PID 4352 wrote to memory of 820	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	87
PID 4352 wrote to memory of 776	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	88
PID 4352 wrote to memory of 4276	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	89
PID 4352 wrote to memory of 4312	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 4352 wrote to memory of 452	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 4352 wrote to memory of 816	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 4352 wrote to memory of 2504	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 4352 wrote to memory of 2924	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 4352 wrote to memory of 1348	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 4352 wrote to memory of 4732	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 4352 wrote to memory of 5028	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 4352 wrote to memory of 4320	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 4352 wrote to memory of 4316	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 4352 wrote to memory of 4404	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 4352 wrote to memory of 4728	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 4352 wrote to memory of 5076	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 4352 wrote to memory of 4368	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 4352 wrote to memory of 2036	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 4352 wrote to memory of 2116	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 4352 wrote to memory of 4960	4352	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\System\WORAAFJ.exe
  C:\Windows\System\WORAAFJ.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\torYMXC.exe
  C:\Windows\System\torYMXC.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\nKeBzxU.exe
  C:\Windows\System\nKeBzxU.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\LsXPAce.exe
  C:\Windows\System\LsXPAce.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\IQgnOLd.exe
  C:\Windows\System\IQgnOLd.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\lFmXpVF.exe
  C:\Windows\System\lFmXpVF.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\KMfUWmR.exe
  C:\Windows\System\KMfUWmR.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\kTlqdyp.exe
  C:\Windows\System\kTlqdyp.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\OKmxekV.exe
  C:\Windows\System\OKmxekV.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\pSCdmcO.exe
  C:\Windows\System\pSCdmcO.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\pKXmodE.exe
  C:\Windows\System\pKXmodE.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\fgLooGi.exe
  C:\Windows\System\fgLooGi.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\KRzhBzx.exe
  C:\Windows\System\KRzhBzx.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\JXdkkeO.exe
  C:\Windows\System\JXdkkeO.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\AoumrSE.exe
  C:\Windows\System\AoumrSE.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\spQopeH.exe
  C:\Windows\System\spQopeH.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\lwNsxwL.exe
  C:\Windows\System\lwNsxwL.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\CtQoUyF.exe
  C:\Windows\System\CtQoUyF.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\eIKgdXb.exe
  C:\Windows\System\eIKgdXb.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\fgroKXJ.exe
  C:\Windows\System\fgroKXJ.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\oJIvMCY.exe
  C:\Windows\System\oJIvMCY.exe
  2⤵
  - Executes dropped EXE
  PID:4960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AoumrSE.exe

Path C:\Windows\System\AoumrSE.exe
Size 8.3MB
SHA256 7663524c95268491c3df109922a76cefc51e9d04b5b4a0f5b78ae28d4ff4f6f7
MD5 ccc53761872d0903d1ead323bf34bc68
SHA1 69a5837e7d5c40537f095ae665d38a1a09c19b27
SHA512 0a19b6ad3cca73fc8d87b646bced28b47f4e56eace10bae2579db188a4ccb3da96ec08a1e6904e853bd62cf12d0c9962f1ee89d4a5614a2767ce1adac71f7fad
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUn:v+D56utgpPF8u/7n
TLSH
T1AE965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CtQoUyF.exe

Path C:\Windows\System\CtQoUyF.exe
Size 8.3MB
SHA256 cd1f636c6eeb16073a60890f3c76b5b434c6e76ea8d80402455ed1753a244ff4
MD5 c638c56dfcb7fe426c60519ccfb08f28
SHA1 6671390845f25c28d8b47bd8cd074898c5a40723
SHA512 8346763f5ad6d8a7dc716bd1bce681b8d4c766596de10684f6aa0fc599fb22a460f080baf1ee1afafd77031bec77c12e6cd0e9189ea21cf5eeb4ca32929fc288
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUf:v+D56utgpPF8u/7f
TLSH
T174965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IQgnOLd.exe

Path C:\Windows\System\IQgnOLd.exe
Size 8.3MB
SHA256 5317b2d5178146981570ba9371d09d1e5b4819c86833b5f9ae60ba7cc465d7c0
MD5 a1c8e2f4ba0a839dd9dcbf9fbcf85eff
SHA1 9909701f6fe6ae067cde04aec8b2c4214e6df388
SHA512 c2bed497e996119fb0237d208d20c260c610b3ee034762045dfae470bd520b89907c9ee630d49b99852c3bd139be8cd06907e97f76956a146a35795ca4a6cbdf
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUP:v+D56utgpPF8u/7P
TLSH
T132965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JXdkkeO.exe

Path C:\Windows\System\JXdkkeO.exe
Size 8.3MB
SHA256 8a9f02aecf2f008ce847c535b371b52b65c2a26a0a888f8cb8777ef73b5fb139
MD5 4c90a4fb9c1b2e9c5eabd39f0b07d7c8
SHA1 e271b19900ee65323af976edcdd5d8d523c376ba
SHA512 dc371d2b138fb4d55f5e240d13bae0ddbadb72de8f7e3103fd96271159af3fe71cd11d911f046689efcf3fb523dcb97149810e239ab43620f065b49eec7ae6d7
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUu:v+D56utgpPF8u/7u
TLSH
T1FC965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KMfUWmR.exe

Path C:\Windows\System\KMfUWmR.exe
Size 8.3MB
SHA256 00a0a58d1d044afed951d7e3e77c4f12536a30c6e6e09bfb9f943030a10d4d35
MD5 4027a04b141cb3eb674a7414412a5d57
SHA1 26680199a23ffe64b4e0f56c4db78a8b3a474316
SHA512 d5d40677c7c34346c3c3937596a8c56d28ccc2c5eb7887645f08cce9ab60cb6a29c32a50b78030fd89c439a21ac1df5c9f53241ca4f64a79aa1c6275deb23a76
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU8:v+D56utgpPF8u/78
TLSH
T1D7965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KRzhBzx.exe

Path C:\Windows\System\KRzhBzx.exe
Size 8.3MB
SHA256 9f3a039a9fffa7bcfa038b9f6e05e3f88bb9e992d720bfe1b90d7f6e77b6254c
MD5 f78b9c365bee18528e156a31920c6f53
SHA1 181c2e3dcc58914491064a69c0f826ce9182d69e
SHA512 93e525060d48ee3e8e404e4413631811325a93a092256373c8c267ededd8c92d77004faa5dfb6870c432126e40330cb29d02046d992d2a2dba13ec5a50cfb7c0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU8:v+D56utgpPF8u/78
TLSH
T15E965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LsXPAce.exe

Path C:\Windows\System\LsXPAce.exe
Size 8.3MB
SHA256 4cdfd548ef2e65bbd89096eea118d6b2e2b8799dbf45d7bfb1bb6f7234ba66bc
MD5 926d40f1821b836d327418ccf446bee4
SHA1 953aeafe226a0d17df41b22f03d4b188e13af72c
SHA512 b5c71807cb552af09c5f3ec4a0242150d8ca9d78f362d1014ac6edd42dde386ca124a74f33f7c17ffec8bb3e3e0e0f81fa166557ad01bbdc2779664f879ac847
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUr:v+D56utgpPF8u/7r
TLSH
T106965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OKmxekV.exe

Path C:\Windows\System\OKmxekV.exe
Size 8.3MB
SHA256 f7d5166b30956f69126fcea5cb159c6b4100c3c799f1c47c5ae664f069c0c5a1
MD5 5ad6e76796947dea29723bbfd5e8e42a
SHA1 a7bfd63ceb44e668c9dca7e45946c9c81df8d3a6
SHA512 35ac5a04c2acb544f3e91b4bb62baa0886a83421f17a1ff26659fd09dc603f6589b060c845f72a9962296d607080fa8abe7cf3aa91618fad3d71604deb3026e8
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUO:v+D56utgpPF8u/7O
TLSH
T14C965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WORAAFJ.exe

Path C:\Windows\System\WORAAFJ.exe
Size 8.3MB
SHA256 345f44b350e49af07790edea9885c94eab5df27e6ca2d97fb0303ad4895957fd
MD5 2e1e83367303f18048689de237d27f2c
SHA1 b2f8ea2d63f8024e7c53dbead8678106f29ef0d9
SHA512 399984966a5ea1ad8e13cf251476ed70ab6763cfc3210b886ecb670894d7bd2ea6b4c9c5a80be090a75b6ea73d94b12ee22469bcee7997a748e0a97ce57875f7
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU8:v+D56utgpPF8u/78
TLSH
T1AD965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eIKgdXb.exe

Path C:\Windows\System\eIKgdXb.exe
Size 8.3MB
SHA256 7aa914e621f2b23fbbbfee4e54d2253735c9796b7267498edd4661e1c7d3a59b
MD5 421cf160de18515c38a0fa39cdb58dea
SHA1 69302294991cd19cde174ed1f9169927959aa562
SHA512 26e779915976f3b387b35c927bc45eee95424fdfbb4ab44ad7a30e70170f62a6a55a503dc4375a4dc7ea19dc0998ce155fdaa5928c0a1b5cfd0b5b79137b8874
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUK:v+D56utgpPF8u/7K
TLSH
T15C965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fgLooGi.exe

Path C:\Windows\System\fgLooGi.exe
Size 8.3MB
SHA256 393d58d8ccdb03f58c8a65600d1b361dde64c4cbb7a9c6a0bcad597e88132545
MD5 11ff687a76b353662d8346682e0d2579
SHA1 633aac5493d61dc5fd21b1679326178af0b25ae6
SHA512 433ad0c80071eb6e3a00580d4ededc73aedbdcedb15b3e2689017f2c128c1f392b28766f776b5c058b0bdb14e9d95e57ae77d27add06d0712d477a31d72a73bc
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUw:v+D56utgpPF8u/7w
TLSH
T169965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fgroKXJ.exe

Path C:\Windows\System\fgroKXJ.exe
Size 8.3MB
SHA256 d8cfe283ec1d00b56f3a2adb7eb8d1f58b706cc85b7ec5229ad9a563ab8a73fa
MD5 b1559478922a1717725e5b47cba7ca3f
SHA1 517daec9414c9a4a06d89eb27d08fa24a182f538
SHA512 47a61f1aa47a089078c5f9d2660c400c148f21942998c3dfeb097125a705df689729adff9680340355f1e608f319f62f11f177d5cc9603726b1bb58680bf1e3a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUH:v+D56utgpPF8u/7H
TLSH
T112965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kTlqdyp.exe

Path C:\Windows\System\kTlqdyp.exe
Size 8.3MB
SHA256 fe692a0e66b6ebcfd314933fda11048a56675037a3612793a331eb1015221503
MD5 5919987542f05b8a2637b310b26aea88
SHA1 47b62bb3e5b123fc991893e51d4ca3c9f9f07674
SHA512 a6d65bbd2782effd328f6d6e31111921a4487d1892da94dbe823a48386d38678026c58bca5c8010df43450af1246bada9dea70988cd2134a146b012b39e435dd
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUZ:v+D56utgpPF8u/7Z
TLSH
T168965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lFmXpVF.exe

Path C:\Windows\System\lFmXpVF.exe
Size 8.3MB
SHA256 2c826a3f724e338822b253f0f3032f37acf0ccf5df6d88d9107eda3062fb85e9
MD5 daf07f68e61af1d27e2f510905464903
SHA1 cffcebf2891ec965bfa6cf141dc3077cda2c2a1b
SHA512 6147cfe5449e3823b1b7daa3834ab980198b0bbdba62d522cd0819695a3a983f8091579fcdf71ca3b1d694641d7a8d9fff702fd5107d5ae138a641240264f346
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUn:v+D56utgpPF8u/7n
TLSH
T116965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwNsxwL.exe

Path C:\Windows\System\lwNsxwL.exe
Size 8.3MB
SHA256 7fdbbab31e1cc451ed9a8cf760f7b823853da55d567870b5960b10a2ba188c97
MD5 53bc247521b31f8d25ed727cdc1a4d9e
SHA1 8245940ce1d2c0b52e0f21b6462792a601dc3b89
SHA512 8bdda39e4bf4a9e01ec39cc3df3a939072cc54d8de597a7ccfe41f607e668c52071f5d535a0fb97e9729984268409348efcf4dc41d820643656d91fa5b661088
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUI:v+D56utgpPF8u/7I
TLSH
T10C965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nKeBzxU.exe

Path C:\Windows\System\nKeBzxU.exe
Size 8.3MB
SHA256 40fae385b88d88143010cd327792d124556686dee9c5ad814dd16b029985cc0f
MD5 f7145fba5df3791338c804f156d517b2
SHA1 d265e933d47738ed300ce613a43b54aaac3b4b9c
SHA512 1214889b020cccd2b999f6f95da6771afacd2b8731acc7cc765f1677f27cc24f0a981afe12f822b760c127c1b52beb9ab98f182a838190e6ae5ff3762cbe37c2
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUn:v+D56utgpPF8u/7n
TLSH
T13E965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oJIvMCY.exe

Path C:\Windows\System\oJIvMCY.exe
Size 8.3MB
SHA256 e547eb27c9d0937110666fe513f87ed3dd9dddeb624c297d9763b50de7aaea1a
MD5 ca5ae9a0b565d81e806edf6c78b0a215
SHA1 e0eb91ce4b82b0c960c0a4e5c64ec5567adeb064
SHA512 01e4ddaa2686857a6a09af5a493c320767f8055f4d36e86db723733ba3b157174588be0e3ee11a399b77cb7665c90da09eb3906b39c2bc074250d57220eddb48
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUS:v+D56utgpPF8u/7S
TLSH
T160965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pKXmodE.exe

Path C:\Windows\System\pKXmodE.exe
Size 8.3MB
SHA256 25385e00081356e2709d5b39c0d747bc6f34529e216230cf4b37260d17736c35
MD5 9517392f47b0d64c990c8b959b7d93ab
SHA1 fdeb992d530bf83d1fb74452d74a3c957e6279c9
SHA512 7e34a58f67527df74cacd9870404599982610524bc4a73a1266686ed931724c1a13f10276329706cbc9fba521af4a303259f516f6c610b9ad34591db3250a999
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUs:v+D56utgpPF8u/7s
TLSH
T1B8965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pSCdmcO.exe

Path C:\Windows\System\pSCdmcO.exe
Size 8.3MB
SHA256 15ef30df20f31c89bf0e49d12568021a72cc6bd9e4de2b3cef9e0b86bdc954ee
MD5 4ff52be613adecb036cad6e4ad18c082
SHA1 7f04628497e543ef0c3e2d53f9e5230d2cc81a82
SHA512 cc4c6b5b77f88b21c4bb442eae11a2fa6b5f5e8316c15d22e429db19fba74be90af5ed7db5a844941ba43058a892cf71dad2081cf54ce1d7aadd82bba75b551e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUi:v+D56utgpPF8u/7i
TLSH
T186965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spQopeH.exe

Path C:\Windows\System\spQopeH.exe
Size 8.3MB
SHA256 8ca0796a2f7fe2cab519117b7671688e3b094606bf0361fecc201ac000055fb5
MD5 cc66c107de3bdccee1adadfa24690512
SHA1 2635be51ee507a03eddd1be035d4ea512306f4b3
SHA512 96c2a78b289218422bb57cb80f37cb3934b9e90353ed722b4372aa13b4cf7a997ab96775161edda9933f83bbaef2d2203ae8233a5295582b0aea16c7f4a0002e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUS:v+D56utgpPF8u/7S
TLSH
T1D3965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

torYMXC.exe

Path C:\Windows\System\torYMXC.exe
Size 8.3MB
SHA256 93a1c196596da2b7f94cf6a69b9295aa826c75f469f88d0fd0e3f27d4df42efc
MD5 c387acf5fe1e0f85fb3915cda7d90b35
SHA1 b135c28fbac8a12f3a0465a597cd2678b33a8b01
SHA512 6a794501b630070eead498434780e9106b6a2b9a100ff8c342156f09350593fd8f891989a58dec97420deefd6f70c1278b0ce4a6265b0fd2877660d49b24009b
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUd:v+D56utgpPF8u/7d
TLSH
T102965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/452-149-0x00007FF7B5B70000-0x00007FF7B5EC2000-memory.dmp

Download

memory/452-86-0x00007FF7B5B70000-0x00007FF7B5EC2000-memory.dmp

Download

memory/776-131-0x00007FF6FB610000-0x00007FF6FB962000-memory.dmp

Download

memory/776-134-0x00007FF6FB610000-0x00007FF6FB962000-memory.dmp

Download

memory/776-52-0x00007FF6FB610000-0x00007FF6FB962000-memory.dmp

Download

memory/816-98-0x00007FF7BB3B0000-0x00007FF7BB702000-memory.dmp

Download

memory/816-148-0x00007FF7BB3B0000-0x00007FF7BB702000-memory.dmp

Download

memory/820-133-0x00007FF613730000-0x00007FF613A82000-memory.dmp

Download

memory/820-130-0x00007FF613730000-0x00007FF613A82000-memory.dmp

Download

memory/820-29-0x00007FF613730000-0x00007FF613A82000-memory.dmp

Download

memory/1348-108-0x00007FF762100000-0x00007FF762452000-memory.dmp

Download

memory/1348-143-0x00007FF762100000-0x00007FF762452000-memory.dmp

Download

memory/2036-127-0x00007FF7847C0000-0x00007FF784B12000-memory.dmp

Download

memory/2036-138-0x00007FF7847C0000-0x00007FF784B12000-memory.dmp

Download

memory/2116-122-0x00007FF6C1580000-0x00007FF6C18D2000-memory.dmp

Download

memory/2116-137-0x00007FF6C1580000-0x00007FF6C18D2000-memory.dmp

Download

memory/2292-129-0x00007FF76D650000-0x00007FF76D9A2000-memory.dmp

Download

memory/2292-132-0x00007FF76D650000-0x00007FF76D9A2000-memory.dmp

Download

memory/2292-10-0x00007FF76D650000-0x00007FF76D9A2000-memory.dmp

Download

memory/2504-145-0x00007FF7CC0D0000-0x00007FF7CC422000-memory.dmp

Download

memory/2504-125-0x00007FF7CC0D0000-0x00007FF7CC422000-memory.dmp

Download

memory/2924-99-0x00007FF7C4E80000-0x00007FF7C51D2000-memory.dmp

Download

memory/2924-144-0x00007FF7C4E80000-0x00007FF7C51D2000-memory.dmp

Download

memory/4276-135-0x00007FF7323D0000-0x00007FF732722000-memory.dmp

Download

memory/4276-85-0x00007FF7323D0000-0x00007FF732722000-memory.dmp

Download

memory/4312-124-0x00007FF66A130000-0x00007FF66A482000-memory.dmp

Download

memory/4312-151-0x00007FF66A130000-0x00007FF66A482000-memory.dmp

Download

memory/4316-117-0x00007FF6F88E0000-0x00007FF6F8C32000-memory.dmp

Download

memory/4316-147-0x00007FF6F88E0000-0x00007FF6F8C32000-memory.dmp

Download

memory/4320-150-0x00007FF7C9E00000-0x00007FF7CA152000-memory.dmp

Download

memory/4320-116-0x00007FF7C9E00000-0x00007FF7CA152000-memory.dmp

Download

memory/4352-128-0x00007FF6B17E0000-0x00007FF6B1B32000-memory.dmp

Download

memory/4352-0-0x00007FF6B17E0000-0x00007FF6B1B32000-memory.dmp

Download

memory/4352-1-0x0000022526AC0000-0x0000022526AD0000-memory.dmp

Download

memory/4368-121-0x00007FF6E7A60000-0x00007FF6E7DB2000-memory.dmp

Download

memory/4368-139-0x00007FF6E7A60000-0x00007FF6E7DB2000-memory.dmp

Download

memory/4404-118-0x00007FF6E4A00000-0x00007FF6E4D52000-memory.dmp

Download

memory/4404-142-0x00007FF6E4A00000-0x00007FF6E4D52000-memory.dmp

Download

memory/4728-119-0x00007FF6EAEA0000-0x00007FF6EB1F2000-memory.dmp

Download

memory/4728-141-0x00007FF6EAEA0000-0x00007FF6EB1F2000-memory.dmp

Download

memory/4732-115-0x00007FF6355C0000-0x00007FF635912000-memory.dmp

Download

memory/4732-152-0x00007FF6355C0000-0x00007FF635912000-memory.dmp

Download

memory/4960-123-0x00007FF71C960000-0x00007FF71CCB2000-memory.dmp

Download

memory/4960-136-0x00007FF71C960000-0x00007FF71CCB2000-memory.dmp

Download

memory/5028-146-0x00007FF75C080000-0x00007FF75C3D2000-memory.dmp

Download

memory/5028-126-0x00007FF75C080000-0x00007FF75C3D2000-memory.dmp

Download

memory/5076-140-0x00007FF7B2800000-0x00007FF7B2B52000-memory.dmp

Download

memory/5076-120-0x00007FF7B2800000-0x00007FF7B2B52000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads