cobaltstrike | f3f5690459ceb90b1169450071e3ef463eaba58bc56edf78dfd7a83104b3bc25

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 08:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample260910-j8w2dagb95
SHA256 f3f5690459ceb90b1169450071e3ef463eaba58bc56edf78dfd7a83104b3bc25
MD5 ffd22a3c1fe12de945f8d19de89b8b29
SHA1 85bd33f58eeed1e50e599f17cb4112307d0d503c
SHA512 4b4dc4443ca1a127340b29ebd8aacd1abea1aa398def203bd692a08198c1d2d80d00932e450a5e8fbf9115a1908d4463b86fcf657d250bef169d645f003cebf5
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUC:v+D56utgpPF8u/7C
TLSH
T116965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000d00000001b1e8-5.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c46d-10.dat	cobalt_reflective_dll
behavioral2/files/0x000e00000001c466-11.dat	cobalt_reflective_dll
behavioral2/files/0x0006000000000405-22.dat	cobalt_reflective_dll
behavioral2/files/0x000e00000001c469-28.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c46e-35.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c46f-41.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c470-45.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c473-56.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c475-65.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c476-71.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c477-76.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c479-81.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c47a-86.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c47b-91.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c481-104.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c484-114.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c485-118.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c483-109.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c474-61.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c472-51.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001b1e8-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c46d-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000e00000001c466-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0006000000000405-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000e00000001c469-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c46e-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c46f-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c470-45.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c473-56.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c475-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c476-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c477-76.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c479-81.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c47a-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c47b-91.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c481-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c484-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c485-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c483-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c474-61.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c472-51.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4260-0-0x00007FF794380000-0x00007FF7946D2000-memory.dmp	UPX
behavioral2/files/0x000d00000001b1e8-5.dat	UPX
behavioral2/memory/4920-7-0x00007FF617DC0000-0x00007FF618112000-memory.dmp	UPX
behavioral2/files/0x000d00000001c46d-10.dat	UPX
behavioral2/files/0x000e00000001c466-11.dat	UPX
behavioral2/memory/5436-14-0x00007FF731840000-0x00007FF731B92000-memory.dmp	UPX
behavioral2/memory/3196-20-0x00007FF6981B0000-0x00007FF698502000-memory.dmp	UPX
behavioral2/files/0x0006000000000405-22.dat	UPX
behavioral2/memory/3272-23-0x00007FF6A6DD0000-0x00007FF6A7122000-memory.dmp	UPX
behavioral2/files/0x000e00000001c469-28.dat	UPX
behavioral2/files/0x000d00000001c46e-35.dat	UPX
behavioral2/files/0x000d00000001c46f-41.dat	UPX
behavioral2/files/0x000d00000001c470-45.dat	UPX
behavioral2/files/0x000d00000001c473-56.dat	UPX
behavioral2/files/0x000d00000001c475-65.dat	UPX
behavioral2/files/0x000d00000001c476-71.dat	UPX
behavioral2/files/0x000d00000001c477-76.dat	UPX
behavioral2/files/0x000d00000001c479-81.dat	UPX
behavioral2/files/0x000d00000001c47a-86.dat	UPX
behavioral2/files/0x000d00000001c47b-91.dat	UPX
behavioral2/memory/3020-98-0x00007FF73C7D0000-0x00007FF73CB22000-memory.dmp	UPX
behavioral2/files/0x000d00000001c481-104.dat	UPX
behavioral2/files/0x000d00000001c484-114.dat	UPX
behavioral2/files/0x000d00000001c485-118.dat	UPX
behavioral2/files/0x000d00000001c483-109.dat	UPX
behavioral2/memory/4812-103-0x00007FF67CE60000-0x00007FF67D1B2000-memory.dmp	UPX
behavioral2/memory/5060-102-0x00007FF783C90000-0x00007FF783FE2000-memory.dmp	UPX
behavioral2/memory/3472-101-0x00007FF758EB0000-0x00007FF759202000-memory.dmp	UPX
behavioral2/memory/2596-100-0x00007FF6A7030000-0x00007FF6A7382000-memory.dmp	UPX
behavioral2/memory/956-99-0x00007FF6E2F20000-0x00007FF6E3272000-memory.dmp	UPX
behavioral2/memory/1652-97-0x00007FF7017F0000-0x00007FF701B42000-memory.dmp	UPX
behavioral2/memory/5676-96-0x00007FF6819B0000-0x00007FF681D02000-memory.dmp	UPX
behavioral2/files/0x000d00000001c474-61.dat	UPX
behavioral2/files/0x000d00000001c472-51.dat	UPX
behavioral2/memory/2400-30-0x00007FF7D5ED0000-0x00007FF7D6222000-memory.dmp	UPX
behavioral2/memory/1268-120-0x00007FF738570000-0x00007FF7388C2000-memory.dmp	UPX
behavioral2/memory/5016-121-0x00007FF6BBA70000-0x00007FF6BBDC2000-memory.dmp	UPX
behavioral2/memory/3396-122-0x00007FF6DA8A0000-0x00007FF6DABF2000-memory.dmp	UPX
behavioral2/memory/368-123-0x00007FF718240000-0x00007FF718592000-memory.dmp	UPX
behavioral2/memory/3940-124-0x00007FF78C560000-0x00007FF78C8B2000-memory.dmp	UPX
behavioral2/memory/1320-126-0x00007FF6B5D90000-0x00007FF6B60E2000-memory.dmp	UPX
behavioral2/memory/5492-127-0x00007FF776620000-0x00007FF776972000-memory.dmp	UPX
behavioral2/memory/5784-125-0x00007FF623710000-0x00007FF623A62000-memory.dmp	UPX
behavioral2/memory/4260-128-0x00007FF794380000-0x00007FF7946D2000-memory.dmp	UPX
behavioral2/memory/4920-129-0x00007FF617DC0000-0x00007FF618112000-memory.dmp	UPX
behavioral2/memory/5436-130-0x00007FF731840000-0x00007FF731B92000-memory.dmp	UPX
behavioral2/memory/3196-131-0x00007FF6981B0000-0x00007FF698502000-memory.dmp	UPX
behavioral2/memory/3272-132-0x00007FF6A6DD0000-0x00007FF6A7122000-memory.dmp	UPX
behavioral2/memory/2400-133-0x00007FF7D5ED0000-0x00007FF7D6222000-memory.dmp	UPX
behavioral2/memory/5676-134-0x00007FF6819B0000-0x00007FF681D02000-memory.dmp	UPX
behavioral2/memory/4920-135-0x00007FF617DC0000-0x00007FF618112000-memory.dmp	UPX
behavioral2/memory/5436-136-0x00007FF731840000-0x00007FF731B92000-memory.dmp	UPX
behavioral2/memory/3196-137-0x00007FF6981B0000-0x00007FF698502000-memory.dmp	UPX
behavioral2/memory/3272-138-0x00007FF6A6DD0000-0x00007FF6A7122000-memory.dmp	UPX
behavioral2/memory/2400-139-0x00007FF7D5ED0000-0x00007FF7D6222000-memory.dmp	UPX
behavioral2/memory/5676-140-0x00007FF6819B0000-0x00007FF681D02000-memory.dmp	UPX
behavioral2/memory/1320-141-0x00007FF6B5D90000-0x00007FF6B60E2000-memory.dmp	UPX
behavioral2/memory/1652-142-0x00007FF7017F0000-0x00007FF701B42000-memory.dmp	UPX
behavioral2/memory/956-143-0x00007FF6E2F20000-0x00007FF6E3272000-memory.dmp	UPX
behavioral2/memory/3020-144-0x00007FF73C7D0000-0x00007FF73CB22000-memory.dmp	UPX
behavioral2/memory/5060-145-0x00007FF783C90000-0x00007FF783FE2000-memory.dmp	UPX
behavioral2/memory/4812-148-0x00007FF67CE60000-0x00007FF67D1B2000-memory.dmp	UPX
behavioral2/memory/3472-149-0x00007FF758EB0000-0x00007FF759202000-memory.dmp	UPX
behavioral2/memory/5016-150-0x00007FF6BBA70000-0x00007FF6BBDC2000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4260-0-0x00007FF794380000-0x00007FF7946D2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001b1e8-5.dat	xmrig
behavioral2/memory/4920-7-0x00007FF617DC0000-0x00007FF618112000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c46d-10.dat	xmrig
behavioral2/files/0x000e00000001c466-11.dat	xmrig
behavioral2/memory/5436-14-0x00007FF731840000-0x00007FF731B92000-memory.dmp	xmrig
behavioral2/memory/3196-20-0x00007FF6981B0000-0x00007FF698502000-memory.dmp	xmrig
behavioral2/files/0x0006000000000405-22.dat	xmrig
behavioral2/memory/3272-23-0x00007FF6A6DD0000-0x00007FF6A7122000-memory.dmp	xmrig
behavioral2/files/0x000e00000001c469-28.dat	xmrig
behavioral2/files/0x000d00000001c46e-35.dat	xmrig
behavioral2/files/0x000d00000001c46f-41.dat	xmrig
behavioral2/files/0x000d00000001c470-45.dat	xmrig
behavioral2/files/0x000d00000001c473-56.dat	xmrig
behavioral2/files/0x000d00000001c475-65.dat	xmrig
behavioral2/files/0x000d00000001c476-71.dat	xmrig
behavioral2/files/0x000d00000001c477-76.dat	xmrig
behavioral2/files/0x000d00000001c479-81.dat	xmrig
behavioral2/files/0x000d00000001c47a-86.dat	xmrig
behavioral2/files/0x000d00000001c47b-91.dat	xmrig
behavioral2/memory/3020-98-0x00007FF73C7D0000-0x00007FF73CB22000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c481-104.dat	xmrig
behavioral2/files/0x000d00000001c484-114.dat	xmrig
behavioral2/files/0x000d00000001c485-118.dat	xmrig
behavioral2/files/0x000d00000001c483-109.dat	xmrig
behavioral2/memory/4812-103-0x00007FF67CE60000-0x00007FF67D1B2000-memory.dmp	xmrig
behavioral2/memory/5060-102-0x00007FF783C90000-0x00007FF783FE2000-memory.dmp	xmrig
behavioral2/memory/3472-101-0x00007FF758EB0000-0x00007FF759202000-memory.dmp	xmrig
behavioral2/memory/2596-100-0x00007FF6A7030000-0x00007FF6A7382000-memory.dmp	xmrig
behavioral2/memory/956-99-0x00007FF6E2F20000-0x00007FF6E3272000-memory.dmp	xmrig
behavioral2/memory/1652-97-0x00007FF7017F0000-0x00007FF701B42000-memory.dmp	xmrig
behavioral2/memory/5676-96-0x00007FF6819B0000-0x00007FF681D02000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c474-61.dat	xmrig
behavioral2/files/0x000d00000001c472-51.dat	xmrig
behavioral2/memory/2400-30-0x00007FF7D5ED0000-0x00007FF7D6222000-memory.dmp	xmrig
behavioral2/memory/1268-120-0x00007FF738570000-0x00007FF7388C2000-memory.dmp	xmrig
behavioral2/memory/5016-121-0x00007FF6BBA70000-0x00007FF6BBDC2000-memory.dmp	xmrig
behavioral2/memory/3396-122-0x00007FF6DA8A0000-0x00007FF6DABF2000-memory.dmp	xmrig
behavioral2/memory/368-123-0x00007FF718240000-0x00007FF718592000-memory.dmp	xmrig
behavioral2/memory/3940-124-0x00007FF78C560000-0x00007FF78C8B2000-memory.dmp	xmrig
behavioral2/memory/1320-126-0x00007FF6B5D90000-0x00007FF6B60E2000-memory.dmp	xmrig
behavioral2/memory/5492-127-0x00007FF776620000-0x00007FF776972000-memory.dmp	xmrig
behavioral2/memory/5784-125-0x00007FF623710000-0x00007FF623A62000-memory.dmp	xmrig
behavioral2/memory/4260-128-0x00007FF794380000-0x00007FF7946D2000-memory.dmp	xmrig
behavioral2/memory/4920-129-0x00007FF617DC0000-0x00007FF618112000-memory.dmp	xmrig
behavioral2/memory/5436-130-0x00007FF731840000-0x00007FF731B92000-memory.dmp	xmrig
behavioral2/memory/3196-131-0x00007FF6981B0000-0x00007FF698502000-memory.dmp	xmrig
behavioral2/memory/3272-132-0x00007FF6A6DD0000-0x00007FF6A7122000-memory.dmp	xmrig
behavioral2/memory/2400-133-0x00007FF7D5ED0000-0x00007FF7D6222000-memory.dmp	xmrig
behavioral2/memory/5676-134-0x00007FF6819B0000-0x00007FF681D02000-memory.dmp	xmrig
behavioral2/memory/4920-135-0x00007FF617DC0000-0x00007FF618112000-memory.dmp	xmrig
behavioral2/memory/5436-136-0x00007FF731840000-0x00007FF731B92000-memory.dmp	xmrig
behavioral2/memory/3196-137-0x00007FF6981B0000-0x00007FF698502000-memory.dmp	xmrig
behavioral2/memory/3272-138-0x00007FF6A6DD0000-0x00007FF6A7122000-memory.dmp	xmrig
behavioral2/memory/2400-139-0x00007FF7D5ED0000-0x00007FF7D6222000-memory.dmp	xmrig
behavioral2/memory/5676-140-0x00007FF6819B0000-0x00007FF681D02000-memory.dmp	xmrig
behavioral2/memory/1320-141-0x00007FF6B5D90000-0x00007FF6B60E2000-memory.dmp	xmrig
behavioral2/memory/1652-142-0x00007FF7017F0000-0x00007FF701B42000-memory.dmp	xmrig
behavioral2/memory/956-143-0x00007FF6E2F20000-0x00007FF6E3272000-memory.dmp	xmrig
behavioral2/memory/3020-144-0x00007FF73C7D0000-0x00007FF73CB22000-memory.dmp	xmrig
behavioral2/memory/5060-145-0x00007FF783C90000-0x00007FF783FE2000-memory.dmp	xmrig
behavioral2/memory/4812-148-0x00007FF67CE60000-0x00007FF67D1B2000-memory.dmp	xmrig
behavioral2/memory/3472-149-0x00007FF758EB0000-0x00007FF759202000-memory.dmp	xmrig
behavioral2/memory/5016-150-0x00007FF6BBA70000-0x00007FF6BBDC2000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4920	azlfSgB.exe
5436	GfkYOyr.exe
3196	WCOgIIX.exe
3272	tsBhVDP.exe
2400	Yzdiklf.exe
5676	nWRLDDR.exe
1320	MxUFOca.exe
1652	DiXmaAS.exe
3020	QmlUKCX.exe
956	BtTtvgr.exe
2596	UeDDjQz.exe
3472	fGGecpZ.exe
5060	RZPtVFj.exe
4812	ldjOyJd.exe
1268	rMfjuZo.exe
5016	BNEAwOK.exe
3396	BxabbRq.exe
368	HpnocXT.exe
5492	PpLtUxA.exe
3940	uYZSGTO.exe
5784	zDQSUFp.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4260-0-0x00007FF794380000-0x00007FF7946D2000-memory.dmp	upx
behavioral2/files/0x000d00000001b1e8-5.dat	upx
behavioral2/memory/4920-7-0x00007FF617DC0000-0x00007FF618112000-memory.dmp	upx
behavioral2/files/0x000d00000001c46d-10.dat	upx
behavioral2/files/0x000e00000001c466-11.dat	upx
behavioral2/memory/5436-14-0x00007FF731840000-0x00007FF731B92000-memory.dmp	upx
behavioral2/memory/3196-20-0x00007FF6981B0000-0x00007FF698502000-memory.dmp	upx
behavioral2/files/0x0006000000000405-22.dat	upx
behavioral2/memory/3272-23-0x00007FF6A6DD0000-0x00007FF6A7122000-memory.dmp	upx
behavioral2/files/0x000e00000001c469-28.dat	upx
behavioral2/files/0x000d00000001c46e-35.dat	upx
behavioral2/files/0x000d00000001c46f-41.dat	upx
behavioral2/files/0x000d00000001c470-45.dat	upx
behavioral2/files/0x000d00000001c473-56.dat	upx
behavioral2/files/0x000d00000001c475-65.dat	upx
behavioral2/files/0x000d00000001c476-71.dat	upx
behavioral2/files/0x000d00000001c477-76.dat	upx
behavioral2/files/0x000d00000001c479-81.dat	upx
behavioral2/files/0x000d00000001c47a-86.dat	upx
behavioral2/files/0x000d00000001c47b-91.dat	upx
behavioral2/memory/3020-98-0x00007FF73C7D0000-0x00007FF73CB22000-memory.dmp	upx
behavioral2/files/0x000d00000001c481-104.dat	upx
behavioral2/files/0x000d00000001c484-114.dat	upx
behavioral2/files/0x000d00000001c485-118.dat	upx
behavioral2/files/0x000d00000001c483-109.dat	upx
behavioral2/memory/4812-103-0x00007FF67CE60000-0x00007FF67D1B2000-memory.dmp	upx
behavioral2/memory/5060-102-0x00007FF783C90000-0x00007FF783FE2000-memory.dmp	upx
behavioral2/memory/3472-101-0x00007FF758EB0000-0x00007FF759202000-memory.dmp	upx
behavioral2/memory/2596-100-0x00007FF6A7030000-0x00007FF6A7382000-memory.dmp	upx
behavioral2/memory/956-99-0x00007FF6E2F20000-0x00007FF6E3272000-memory.dmp	upx
behavioral2/memory/1652-97-0x00007FF7017F0000-0x00007FF701B42000-memory.dmp	upx
behavioral2/memory/5676-96-0x00007FF6819B0000-0x00007FF681D02000-memory.dmp	upx
behavioral2/files/0x000d00000001c474-61.dat	upx
behavioral2/files/0x000d00000001c472-51.dat	upx
behavioral2/memory/2400-30-0x00007FF7D5ED0000-0x00007FF7D6222000-memory.dmp	upx
behavioral2/memory/1268-120-0x00007FF738570000-0x00007FF7388C2000-memory.dmp	upx
behavioral2/memory/5016-121-0x00007FF6BBA70000-0x00007FF6BBDC2000-memory.dmp	upx
behavioral2/memory/3396-122-0x00007FF6DA8A0000-0x00007FF6DABF2000-memory.dmp	upx
behavioral2/memory/368-123-0x00007FF718240000-0x00007FF718592000-memory.dmp	upx
behavioral2/memory/3940-124-0x00007FF78C560000-0x00007FF78C8B2000-memory.dmp	upx
behavioral2/memory/1320-126-0x00007FF6B5D90000-0x00007FF6B60E2000-memory.dmp	upx
behavioral2/memory/5492-127-0x00007FF776620000-0x00007FF776972000-memory.dmp	upx
behavioral2/memory/5784-125-0x00007FF623710000-0x00007FF623A62000-memory.dmp	upx
behavioral2/memory/4260-128-0x00007FF794380000-0x00007FF7946D2000-memory.dmp	upx
behavioral2/memory/4920-129-0x00007FF617DC0000-0x00007FF618112000-memory.dmp	upx
behavioral2/memory/5436-130-0x00007FF731840000-0x00007FF731B92000-memory.dmp	upx
behavioral2/memory/3196-131-0x00007FF6981B0000-0x00007FF698502000-memory.dmp	upx
behavioral2/memory/3272-132-0x00007FF6A6DD0000-0x00007FF6A7122000-memory.dmp	upx
behavioral2/memory/2400-133-0x00007FF7D5ED0000-0x00007FF7D6222000-memory.dmp	upx
behavioral2/memory/5676-134-0x00007FF6819B0000-0x00007FF681D02000-memory.dmp	upx
behavioral2/memory/4920-135-0x00007FF617DC0000-0x00007FF618112000-memory.dmp	upx
behavioral2/memory/5436-136-0x00007FF731840000-0x00007FF731B92000-memory.dmp	upx
behavioral2/memory/3196-137-0x00007FF6981B0000-0x00007FF698502000-memory.dmp	upx
behavioral2/memory/3272-138-0x00007FF6A6DD0000-0x00007FF6A7122000-memory.dmp	upx
behavioral2/memory/2400-139-0x00007FF7D5ED0000-0x00007FF7D6222000-memory.dmp	upx
behavioral2/memory/5676-140-0x00007FF6819B0000-0x00007FF681D02000-memory.dmp	upx
behavioral2/memory/1320-141-0x00007FF6B5D90000-0x00007FF6B60E2000-memory.dmp	upx
behavioral2/memory/1652-142-0x00007FF7017F0000-0x00007FF701B42000-memory.dmp	upx
behavioral2/memory/956-143-0x00007FF6E2F20000-0x00007FF6E3272000-memory.dmp	upx
behavioral2/memory/3020-144-0x00007FF73C7D0000-0x00007FF73CB22000-memory.dmp	upx
behavioral2/memory/5060-145-0x00007FF783C90000-0x00007FF783FE2000-memory.dmp	upx
behavioral2/memory/4812-148-0x00007FF67CE60000-0x00007FF67D1B2000-memory.dmp	upx
behavioral2/memory/3472-149-0x00007FF758EB0000-0x00007FF759202000-memory.dmp	upx
behavioral2/memory/5016-150-0x00007FF6BBA70000-0x00007FF6BBDC2000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\WCOgIIX.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\BtTtvgr.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fGGecpZ.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\rMfjuZo.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ldjOyJd.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\GfkYOyr.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\nWRLDDR.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\MxUFOca.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\RZPtVFj.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\zDQSUFp.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\azlfSgB.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\QmlUKCX.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\BNEAwOK.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\BxabbRq.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\HpnocXT.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\PpLtUxA.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\tsBhVDP.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\Yzdiklf.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\DiXmaAS.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\UeDDjQz.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\uYZSGTO.exe	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 4920	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 4260 wrote to memory of 5436	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 4260 wrote to memory of 3196	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 4260 wrote to memory of 3272	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 4260 wrote to memory of 2400	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 4260 wrote to memory of 5676	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 4260 wrote to memory of 1320	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 4260 wrote to memory of 1652	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 4260 wrote to memory of 3020	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 4260 wrote to memory of 956	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 4260 wrote to memory of 2596	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 4260 wrote to memory of 3472	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 4260 wrote to memory of 5060	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 4260 wrote to memory of 4812	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 4260 wrote to memory of 1268	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 4260 wrote to memory of 5016	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 4260 wrote to memory of 3396	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 4260 wrote to memory of 368	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 4260 wrote to memory of 5492	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 4260 wrote to memory of 3940	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109
PID 4260 wrote to memory of 5784	4260	2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_ffd22a3c1fe12de945f8d19de89b8b29_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\System\azlfSgB.exe
  C:\Windows\System\azlfSgB.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\GfkYOyr.exe
  C:\Windows\System\GfkYOyr.exe
  2⤵
  - Executes dropped EXE
  PID:5436
- C:\Windows\System\WCOgIIX.exe
  C:\Windows\System\WCOgIIX.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\tsBhVDP.exe
  C:\Windows\System\tsBhVDP.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\Yzdiklf.exe
  C:\Windows\System\Yzdiklf.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\nWRLDDR.exe
  C:\Windows\System\nWRLDDR.exe
  2⤵
  - Executes dropped EXE
  PID:5676
- C:\Windows\System\MxUFOca.exe
  C:\Windows\System\MxUFOca.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\DiXmaAS.exe
  C:\Windows\System\DiXmaAS.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\QmlUKCX.exe
  C:\Windows\System\QmlUKCX.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\BtTtvgr.exe
  C:\Windows\System\BtTtvgr.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\UeDDjQz.exe
  C:\Windows\System\UeDDjQz.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\fGGecpZ.exe
  C:\Windows\System\fGGecpZ.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\RZPtVFj.exe
  C:\Windows\System\RZPtVFj.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\ldjOyJd.exe
  C:\Windows\System\ldjOyJd.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\rMfjuZo.exe
  C:\Windows\System\rMfjuZo.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\BNEAwOK.exe
  C:\Windows\System\BNEAwOK.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\BxabbRq.exe
  C:\Windows\System\BxabbRq.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\HpnocXT.exe
  C:\Windows\System\HpnocXT.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\PpLtUxA.exe
  C:\Windows\System\PpLtUxA.exe
  2⤵
  - Executes dropped EXE
  PID:5492
- C:\Windows\System\uYZSGTO.exe
  C:\Windows\System\uYZSGTO.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\zDQSUFp.exe
  C:\Windows\System\zDQSUFp.exe
  2⤵
  - Executes dropped EXE
  PID:5784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BNEAwOK.exe

Path C:\Windows\System\BNEAwOK.exe
Size 8.3MB
SHA256 6ecdb7fa46b69fee217f2b209b712ae1f48376888f070b119e363d430481a924
MD5 73bb100fc75f03dec86d6cab6889f9a4
SHA1 3104ba8f195e6269a6dcc9f6bdae6a8368567f53
SHA512 a008f1f948e76d0b9d9fdac3a83bfc75ace54c7fe2728a844b5c40e1c49b3314c60cc476338f5208d3ef5a6318fd12c1262a3cb334b3c5c752900e2e3a57a643
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUj:v+D56utgpPF8u/7j
TLSH
T11F965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BtTtvgr.exe

Path C:\Windows\System\BtTtvgr.exe
Size 8.3MB
SHA256 254bade3a67d491c9b3b5f0318c0fd90f8fa538043531725b8049076245c15ca
MD5 2910b82c4963c7fed3bf0eecdb2b590a
SHA1 c8546fdf4f05c10e94c22c0678646808fe4707a9
SHA512 55501549bd12d798d6bdf43d46104d5d043774e6c5c0951ea677000afad5141ab24d81a8ed3208dde2af6d7647e40d7e6b007cf9ee12cce1a8c53a5a80fbfcc1
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU6:v+D56utgpPF8u/76
TLSH
T100965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BxabbRq.exe

Path C:\Windows\System\BxabbRq.exe
Size 8.3MB
SHA256 d7a7f1c79c7e1951a1f2e583f2990f3f4baea6d3b82f1aa9c9dc2b13e2e6da36
MD5 e577e20a5068d98066fe44ddc8485848
SHA1 8ea0ea087f3afdba8d4e97a60e707117b2eb3538
SHA512 e7294938221441a927ee595ed49b7808798e4c876bdcf6df11e6eeccef05ae28498bc2213ef526e02547c1c728ffd0c97a62e3e17ed71a6a2f539760ae8f27b9
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUr:v+D56utgpPF8u/7r
TLSH
T1FC965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiXmaAS.exe

Path C:\Windows\System\DiXmaAS.exe
Size 8.3MB
SHA256 104feb90a3365b4e3843658dd2ac6e86434fc5bbf0b844ec41340cf2684ebb09
MD5 90d8114c3820172bd00437cd396dd0b5
SHA1 d16bb3526216fbc2d937eb0baf072f6c8bef96f4
SHA512 eada2e2f1ea4ada771cafef842e6f446148c06ffabeb7cd78eb888e38e9966deffaef8037f1867a9ac17c5cc654404a042d6f1cf9e32c6d200bbafeee815237b
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUg:v+D56utgpPF8u/7g
TLSH
T14B965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GfkYOyr.exe

Path C:\Windows\System\GfkYOyr.exe
Size 8.3MB
SHA256 87a9f85de76acd7ff740b843d6ffe6b10c396c4d306f881c276864a5fe7927b7
MD5 36fdd95a5a1a718bf87a17f158f2bfa5
SHA1 39c1223f2f4ade883609db61ca396e47274afe21
SHA512 2ee11f1fb6fc8ca282fe036e66fe64c3b611cde801d0484c3a3ade227c6d9acd6297439609e04a0c256956c3701ecb72f0d6212faa083a5e7e35c2d7ab344c85
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUj:v+D56utgpPF8u/7j
TLSH
T1C2965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HpnocXT.exe

Path C:\Windows\System\HpnocXT.exe
Size 8.3MB
SHA256 a5991e4ba6de4e7f33ef07856fd4722241618fbab5f94cc7a6a204acab4d54d5
MD5 c9252a9b60e19b59de3e351e2126e225
SHA1 e7491a3fe8f2dade57ec233dd80dd4f7a431c5d1
SHA512 20bfd93a86218d93a0d60b9f1387ce45cd5e635c7ce97bb37fb736b082b99398e95d5a52191a84b6866a83d48ca5cb8a75a9d9ba2a1c4711f5ad8732e6f8a950
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU/:v+D56utgpPF8u/7/
TLSH
T1B2965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MxUFOca.exe

Path C:\Windows\System\MxUFOca.exe
Size 8.3MB
SHA256 015594f785726984556b780877379bc37e9510fefaa3b218eaf176021e736904
MD5 7e1f97eca57455695b6bddb330b90ea3
SHA1 d62878b9644f566415dfbce7b5621c6e8a82a0eb
SHA512 ab43d4ab3c2d13987d6b73bfdfe83d35f1d5121c10f2e44b1dd5eccc1a79ec05a5b35748206a414d7258ccd58cb7ab4e1a9f9273b8d65ff011b841f7858cfb36
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUI:v+D56utgpPF8u/7I
TLSH
T130965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PpLtUxA.exe

Path C:\Windows\System\PpLtUxA.exe
Size 8.3MB
SHA256 b51df2db1494fc98e0b864ee63a42b69e57fedfba0716486012b8fc07b350c1f
MD5 57ccfc9d18d0219e7b425a0717f07cbd
SHA1 93e79bb658bef01d0a0a817c483ac86b5879383d
SHA512 05424f5d3d62c36d24f9c9e3da17b69c84d1acfa0971e65850031d0f3244d65379d920b23096937a940093e4dfe71cc923eb274a85475b3fbe30adcd48aba06b
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUX:v+D56utgpPF8u/7X
TLSH
T134965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QmlUKCX.exe

Path C:\Windows\System\QmlUKCX.exe
Size 8.3MB
SHA256 ced85c05ff4f9cdd1e08d3b3175a813cb5612d94ba697fa0816e281cf4e8d843
MD5 a9a2feb8bc6b831b8c45f5f2e2dcb1fa
SHA1 1e8d9a58711dd303771f51022fd81bb9c8a553cd
SHA512 592103249fc8f2c35dc86485d7d611e301947baa34104a7d3e6eabd52689b7a0611eb23f7b1628abeb37fa89dfb82f07bd61d56f5f8476cbfd6a703886d5e6d8
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUS:v+D56utgpPF8u/7S
TLSH
T1D7965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RZPtVFj.exe

Path C:\Windows\System\RZPtVFj.exe
Size 8.3MB
SHA256 7d2dafacc59a2da2988d929ba3adca62e3a296940818e392920e0030a6b0b320
MD5 c85caa0c645348fc343f88cd40ef8eee
SHA1 6c3497d2a22848f05eefa6ca721a740f467af8f9
SHA512 810b1f4edea1310760c75d075e3489884815ed7388378399115c745e49c6eaf6d1a229fc796d1132bc90f68a7c0ea9c75a352d94ea4754df8d0a4dc0afe10720
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUz:v+D56utgpPF8u/7z
TLSH
T105965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UeDDjQz.exe

Path C:\Windows\System\UeDDjQz.exe
Size 8.3MB
SHA256 0362ae7e6f650260e321e3114b22dfe814634bb0c41aa165a7418066677b3d08
MD5 c59f7ab4a814ba25534ffa9e0ce2a373
SHA1 d39b5676e680e2a212a8df6f5bb71e8c13bde16d
SHA512 3f6d425f0c1d30cb2661d8b65ff9036e26bd697fc3081908a391d0fb95e49f8d8acf33c275230d614b10ec131d2239a07674d7a1b168273d583882764281bf8f
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU2:v+D56utgpPF8u/72
TLSH
T17D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WCOgIIX.exe

Path C:\Windows\System\WCOgIIX.exe
Size 8.3MB
SHA256 2efb41f0578bd1ee317cdebd603dc131ec8e263527ade7bd0ee63841352ecbe6
MD5 761ec5257c17dbe789815c3eeafcad36
SHA1 1d7afa85a04e099f8814ea4e06ba40e7441160a3
SHA512 bc91d9aa1afcd3479b6edf0bb2640a1b915bc07e1423995cb2e57515b53c079decb506da6e353105b9055023e8a321be2f04d0a29d930c1fc4f5750335ec6df0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUo:v+D56utgpPF8u/7o
TLSH
T1C0965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Yzdiklf.exe

Path C:\Windows\System\Yzdiklf.exe
Size 8.3MB
SHA256 b82f70a136a1cae97f4fb92c3d25361cc37b361be8353b4c67fc21157b3f7af2
MD5 107ff3501cae8f117c1197982f8f4f16
SHA1 8927b11c7f3372c53ba0f0383ecb9e16d17e2f17
SHA512 3cec061b8bb990c12e454ba053acb5dcf040e23dfdf5b2f6b09a7cb2650141bf95bbba7b392bda2de063c797bda2845149f183c36d981e05293212450b13c19e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUt:v+D56utgpPF8u/7t
TLSH
T136965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

azlfSgB.exe

Path C:\Windows\System\azlfSgB.exe
Size 8.3MB
SHA256 d48fe770365090fd12145e5f7e3b4ec8813613256c9d24b19e72401db3cbd802
MD5 19418efcec61a91fa4449195f019a640
SHA1 db01735512b42d20305786dd057c0d66c6d21210
SHA512 1031ca62a1e22e121fa1cd8dbd7397fe575721899a20fbbed73a116670063ef92148f0660fb9ded899294f9ab6ac9efb2cc3ee338a9cb1d5aab63694d001334c
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUx:v+D56utgpPF8u/7x
TLSH
T150965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fGGecpZ.exe

Path C:\Windows\System\fGGecpZ.exe
Size 8.3MB
SHA256 73d6dd2f1db111b67214b5378e1296a340dfaa20e66030582e58e1069f525377
MD5 3acaaeb0abb977c4154f34ea2e553b42
SHA1 146f4754adf295ca5d59f2d1a435e5bad7167a1d
SHA512 7d4b843e6f67cf415396a75aa9192e41309be82082fd86b1d38284c2d007039f75d21e441219ba58630cacbd10ea8b38d65fd834c8f6574814de8f0ac9a638df
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUu:v+D56utgpPF8u/7u
TLSH
T189965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ldjOyJd.exe

Path C:\Windows\System\ldjOyJd.exe
Size 8.3MB
SHA256 9f06db858506be07170f39a0bd353494fb0ba30ee6df41b8539b12aab73d2873
MD5 30e815147cd43cdc1413b8fe01c75ced
SHA1 8b5f767f408c71b71551d979dbd48c59de3b2c6a
SHA512 3b43efe668404ea3979dbb54b038055d986bf3419144e5694c029880b48fe0db23d082e07cbafc4aa7ae9802fda6ae52117f604bf41a2908f06a7d9fac1a147e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUX:v+D56utgpPF8u/7X
TLSH
T172965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nWRLDDR.exe

Path C:\Windows\System\nWRLDDR.exe
Size 8.3MB
SHA256 ec258aa827ee894ff66c540effa8509938d965b001a6648f4469a8d5adaa0816
MD5 50653bb3e84a4961a8ce1c360c0863f2
SHA1 6564992d5fadcc63f74bb22a44a21bcb2368a87b
SHA512 bff3e612e9f13c42256213b3c373b6715627eb2ac9e46739aae8f1c5ac8c762496027f4a700b0790c2eab12f2619579522aab74f982e85585ad50607b7eba429
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUU:v+D56utgpPF8u/7U
TLSH
T16B965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rMfjuZo.exe

Path C:\Windows\System\rMfjuZo.exe
Size 8.3MB
SHA256 8be2f41d94a1d8cd0a89ef83387a8432d5b2691aa5169a121b015bb0456b3bd3
MD5 342c5ee1969d734367896a914c4e3125
SHA1 0e204a1f1d46574d23a426ef00180102ed380502
SHA512 06ed8b317a705595f531e91cbf75e85f69a0846ff5ed97aaf9fabbaa534d1bdc6d09bf73686f51dcf72830c7cde9ff0e978f57567abfea405b0b14aba38ba0cd
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUB:v+D56utgpPF8u/7B
TLSH
T159965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tsBhVDP.exe

Path C:\Windows\System\tsBhVDP.exe
Size 8.3MB
SHA256 5c19a6c91b36c60bb21a8da21df8ef520ed2f2d0da9e46a173a3074f49da8f2e
MD5 85c4f1b9502ad783e8ad07c7fff4e677
SHA1 eea821a5fc2a374643de64abe2930eec2386ff06
SHA512 7b956e69d9702298d1fcd36326c35bc08dfd6a18d4e8835bfc3af8473ae801dd9a4225f755dc9494619d539451cf01008f9e3d6d01e323c9b8305a379751c8b2
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUj:v+D56utgpPF8u/7j
TLSH
T19D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uYZSGTO.exe

Path C:\Windows\System\uYZSGTO.exe
Size 8.3MB
SHA256 c30167097c1c3135bdcbdbafbdba8000edc830775771dc9479f70773968098c3
MD5 c3687c4db0889111c35243c6666144f2
SHA1 21f374f89ffaff1c0fabcf5015bfa685130d9437
SHA512 daa1f92b8b600b77449d890f81056d85348f79cecfe223ae06730bb99a604b04eaf20b55d4a051935a31f8d1deb3e3f55f8aea33cad4872c7f213b53ab370d4e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUw:v+D56utgpPF8u/7w
TLSH
T160965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zDQSUFp.exe

Path C:\Windows\System\zDQSUFp.exe
Size 8.3MB
SHA256 40cc4aa5903d4d1fca1e6f5f064990f42b65fda3144d99b4958edd5c655584bb
MD5 6683788a38b840af806f588116041ed2
SHA1 b5370244e5613f06a0bbfbe1baf83d5ca5c678cd
SHA512 e4e55cad843b1322dd1cfa9c38c3ee2c38a787b24a501609611066d15603b2cfadc0f19ddcc44d8386c5cef9bf15460d7c29a862f6db31eb48e4f8d68a6e245d
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUG:v+D56utgpPF8u/7G
TLSH
T142965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/368-153-0x00007FF718240000-0x00007FF718592000-memory.dmp

Download

memory/368-123-0x00007FF718240000-0x00007FF718592000-memory.dmp

Download

memory/956-99-0x00007FF6E2F20000-0x00007FF6E3272000-memory.dmp

Download

memory/956-143-0x00007FF6E2F20000-0x00007FF6E3272000-memory.dmp

Download

memory/1268-120-0x00007FF738570000-0x00007FF7388C2000-memory.dmp

Download

memory/1268-147-0x00007FF738570000-0x00007FF7388C2000-memory.dmp

Download

memory/1320-126-0x00007FF6B5D90000-0x00007FF6B60E2000-memory.dmp

Download

memory/1320-141-0x00007FF6B5D90000-0x00007FF6B60E2000-memory.dmp

Download

memory/1652-97-0x00007FF7017F0000-0x00007FF701B42000-memory.dmp

Download

memory/1652-142-0x00007FF7017F0000-0x00007FF701B42000-memory.dmp

Download

memory/2400-30-0x00007FF7D5ED0000-0x00007FF7D6222000-memory.dmp

Download

memory/2400-139-0x00007FF7D5ED0000-0x00007FF7D6222000-memory.dmp

Download

memory/2400-133-0x00007FF7D5ED0000-0x00007FF7D6222000-memory.dmp

Download

memory/2596-100-0x00007FF6A7030000-0x00007FF6A7382000-memory.dmp

Download

memory/2596-146-0x00007FF6A7030000-0x00007FF6A7382000-memory.dmp

Download

memory/3020-144-0x00007FF73C7D0000-0x00007FF73CB22000-memory.dmp

Download

memory/3020-98-0x00007FF73C7D0000-0x00007FF73CB22000-memory.dmp

Download

memory/3196-137-0x00007FF6981B0000-0x00007FF698502000-memory.dmp

Download

memory/3196-20-0x00007FF6981B0000-0x00007FF698502000-memory.dmp

Download

memory/3196-131-0x00007FF6981B0000-0x00007FF698502000-memory.dmp

Download

memory/3272-23-0x00007FF6A6DD0000-0x00007FF6A7122000-memory.dmp

Download

memory/3272-138-0x00007FF6A6DD0000-0x00007FF6A7122000-memory.dmp

Download

memory/3272-132-0x00007FF6A6DD0000-0x00007FF6A7122000-memory.dmp

Download

memory/3396-122-0x00007FF6DA8A0000-0x00007FF6DABF2000-memory.dmp

Download

memory/3396-155-0x00007FF6DA8A0000-0x00007FF6DABF2000-memory.dmp

Download

memory/3472-149-0x00007FF758EB0000-0x00007FF759202000-memory.dmp

Download

memory/3472-101-0x00007FF758EB0000-0x00007FF759202000-memory.dmp

Download

memory/3940-152-0x00007FF78C560000-0x00007FF78C8B2000-memory.dmp

Download

memory/3940-124-0x00007FF78C560000-0x00007FF78C8B2000-memory.dmp

Download

memory/4260-0-0x00007FF794380000-0x00007FF7946D2000-memory.dmp

Download

memory/4260-128-0x00007FF794380000-0x00007FF7946D2000-memory.dmp

Download

memory/4260-1-0x000001BA2A3C0000-0x000001BA2A3D0000-memory.dmp

Download

memory/4812-103-0x00007FF67CE60000-0x00007FF67D1B2000-memory.dmp

Download

memory/4812-148-0x00007FF67CE60000-0x00007FF67D1B2000-memory.dmp

Download

memory/4920-129-0x00007FF617DC0000-0x00007FF618112000-memory.dmp

Download

memory/4920-135-0x00007FF617DC0000-0x00007FF618112000-memory.dmp

Download

memory/4920-7-0x00007FF617DC0000-0x00007FF618112000-memory.dmp

Download

memory/5016-150-0x00007FF6BBA70000-0x00007FF6BBDC2000-memory.dmp

Download

memory/5016-121-0x00007FF6BBA70000-0x00007FF6BBDC2000-memory.dmp

Download

memory/5060-102-0x00007FF783C90000-0x00007FF783FE2000-memory.dmp

Download

memory/5060-145-0x00007FF783C90000-0x00007FF783FE2000-memory.dmp

Download

memory/5436-136-0x00007FF731840000-0x00007FF731B92000-memory.dmp

Download

memory/5436-14-0x00007FF731840000-0x00007FF731B92000-memory.dmp

Download

memory/5436-130-0x00007FF731840000-0x00007FF731B92000-memory.dmp

Download

memory/5492-154-0x00007FF776620000-0x00007FF776972000-memory.dmp

Download

memory/5492-127-0x00007FF776620000-0x00007FF776972000-memory.dmp

Download

memory/5676-140-0x00007FF6819B0000-0x00007FF681D02000-memory.dmp

Download

memory/5676-96-0x00007FF6819B0000-0x00007FF681D02000-memory.dmp

Download

memory/5676-134-0x00007FF6819B0000-0x00007FF681D02000-memory.dmp

Download

memory/5784-151-0x00007FF623710000-0x00007FF623A62000-memory.dmp

Download

memory/5784-125-0x00007FF623710000-0x00007FF623A62000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads