cobaltstrike | bcb67a60f2ab8435f27e63f5cc544549190d631c6678ed1547007bb40ca751a5

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample260910-m5d8yagf43
SHA256 bcb67a60f2ab8435f27e63f5cc544549190d631c6678ed1547007bb40ca751a5
MD5 c20732c31eb7dfaa56e8773fdbc1cbf7
SHA1 fed7599098d0f6b0fa6f9d4b97b9d0f12fe3675c
SHA512 d69be0c0ec76b34b7948b498712b888ca0e798bd4e7db284aa60110b2b578f278b4b3e7e2ce97156d0d1267397e98dcc4680c3d75df59f7b2c6cf29d04644d53
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU6:v+D56utgpPF8u/76
TLSH
T139965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x000800000002453a-4.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002453e-17.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002453f-7.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024546-48.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024551-115.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024550-111.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002454f-109.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002454e-107.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002454d-105.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002454c-102.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002454b-96.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002454a-91.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024549-89.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024548-87.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024547-84.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024545-71.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024544-66.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024543-60.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024542-49.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024541-40.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024540-38.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral1/files/0x000800000002453a-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002453e-17.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002453f-7.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024546-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024551-115.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024550-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002454f-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002454e-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002454d-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002454c-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002454b-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002454a-91.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024549-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024548-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024547-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024545-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024544-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024543-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024542-49.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024541-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024540-38.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral1/memory/2336-0-0x00007FF706E70000-0x00007FF7071C2000-memory.dmp	UPX
behavioral1/files/0x000800000002453a-4.dat	UPX
behavioral1/files/0x000700000002453e-17.dat	UPX
behavioral1/memory/1536-15-0x00007FF7E0F00000-0x00007FF7E1252000-memory.dmp	UPX
behavioral1/files/0x000700000002453f-7.dat	UPX
behavioral1/memory/1800-28-0x00007FF7B0DA0000-0x00007FF7B10F2000-memory.dmp	UPX
behavioral1/files/0x0007000000024546-48.dat	UPX
behavioral1/memory/856-64-0x00007FF66A900000-0x00007FF66AC52000-memory.dmp	UPX
behavioral1/memory/1332-99-0x00007FF64DAF0000-0x00007FF64DE42000-memory.dmp	UPX
behavioral1/memory/2280-113-0x00007FF73D040000-0x00007FF73D392000-memory.dmp	UPX
behavioral1/memory/4064-119-0x00007FF75E740000-0x00007FF75EA92000-memory.dmp	UPX
behavioral1/memory/1508-125-0x00007FF7F8DE0000-0x00007FF7F9132000-memory.dmp	UPX
behavioral1/memory/3668-126-0x00007FF6664B0000-0x00007FF666802000-memory.dmp	UPX
behavioral1/memory/1300-124-0x00007FF702B20000-0x00007FF702E72000-memory.dmp	UPX
behavioral1/memory/4984-123-0x00007FF6941C0000-0x00007FF694512000-memory.dmp	UPX
behavioral1/memory/1388-122-0x00007FF681FE0000-0x00007FF682332000-memory.dmp	UPX
behavioral1/memory/2676-121-0x00007FF624E10000-0x00007FF625162000-memory.dmp	UPX
behavioral1/memory/1804-120-0x00007FF605450000-0x00007FF6057A2000-memory.dmp	UPX
behavioral1/memory/4564-118-0x00007FF754780000-0x00007FF754AD2000-memory.dmp	UPX
behavioral1/memory/1212-117-0x00007FF7B1630000-0x00007FF7B1982000-memory.dmp	UPX
behavioral1/files/0x0007000000024551-115.dat	UPX
behavioral1/memory/2296-114-0x00007FF764AB0000-0x00007FF764E02000-memory.dmp	UPX
behavioral1/files/0x0007000000024550-111.dat	UPX
behavioral1/files/0x000700000002454f-109.dat	UPX
behavioral1/files/0x000700000002454e-107.dat	UPX
behavioral1/files/0x000700000002454d-105.dat	UPX
behavioral1/memory/2236-104-0x00007FF65EC30000-0x00007FF65EF82000-memory.dmp	UPX
behavioral1/files/0x000700000002454c-102.dat	UPX
behavioral1/memory/3260-100-0x00007FF72F310000-0x00007FF72F662000-memory.dmp	UPX
behavioral1/files/0x000700000002454b-96.dat	UPX
behavioral1/files/0x000700000002454a-91.dat	UPX
behavioral1/files/0x0007000000024549-89.dat	UPX
behavioral1/files/0x0007000000024548-87.dat	UPX
behavioral1/files/0x0007000000024547-84.dat	UPX
behavioral1/memory/5084-82-0x00007FF6AD390000-0x00007FF6AD6E2000-memory.dmp	UPX
behavioral1/files/0x0007000000024545-71.dat	UPX
behavioral1/memory/2520-69-0x00007FF7A9010000-0x00007FF7A9362000-memory.dmp	UPX
behavioral1/files/0x0007000000024544-66.dat	UPX
behavioral1/files/0x0007000000024543-60.dat	UPX
behavioral1/memory/1576-53-0x00007FF73F6C0000-0x00007FF73FA12000-memory.dmp	UPX
behavioral1/files/0x0007000000024542-49.dat	UPX
behavioral1/files/0x0007000000024541-40.dat	UPX
behavioral1/files/0x0007000000024540-38.dat	UPX
behavioral1/memory/2336-128-0x00007FF706E70000-0x00007FF7071C2000-memory.dmp	UPX
behavioral1/memory/1536-129-0x00007FF7E0F00000-0x00007FF7E1252000-memory.dmp	UPX
behavioral1/memory/1800-130-0x00007FF7B0DA0000-0x00007FF7B10F2000-memory.dmp	UPX
behavioral1/memory/1576-131-0x00007FF73F6C0000-0x00007FF73FA12000-memory.dmp	UPX
behavioral1/memory/2236-132-0x00007FF65EC30000-0x00007FF65EF82000-memory.dmp	UPX
behavioral1/memory/1536-133-0x00007FF7E0F00000-0x00007FF7E1252000-memory.dmp	UPX
behavioral1/memory/1576-135-0x00007FF73F6C0000-0x00007FF73FA12000-memory.dmp	UPX
behavioral1/memory/2520-137-0x00007FF7A9010000-0x00007FF7A9362000-memory.dmp	UPX
behavioral1/memory/1800-136-0x00007FF7B0DA0000-0x00007FF7B10F2000-memory.dmp	UPX
behavioral1/memory/856-134-0x00007FF66A900000-0x00007FF66AC52000-memory.dmp	UPX
behavioral1/memory/1388-140-0x00007FF681FE0000-0x00007FF682332000-memory.dmp	UPX
behavioral1/memory/2280-141-0x00007FF73D040000-0x00007FF73D392000-memory.dmp	UPX
behavioral1/memory/1804-146-0x00007FF605450000-0x00007FF6057A2000-memory.dmp	UPX
behavioral1/memory/1300-147-0x00007FF702B20000-0x00007FF702E72000-memory.dmp	UPX
behavioral1/memory/1332-145-0x00007FF64DAF0000-0x00007FF64DE42000-memory.dmp	UPX
behavioral1/memory/2676-144-0x00007FF624E10000-0x00007FF625162000-memory.dmp	UPX
behavioral1/memory/5084-143-0x00007FF6AD390000-0x00007FF6AD6E2000-memory.dmp	UPX
behavioral1/memory/3260-142-0x00007FF72F310000-0x00007FF72F662000-memory.dmp	UPX
behavioral1/memory/4984-139-0x00007FF6941C0000-0x00007FF694512000-memory.dmp	UPX
behavioral1/memory/2296-138-0x00007FF764AB0000-0x00007FF764E02000-memory.dmp	UPX
behavioral1/memory/1508-152-0x00007FF7F8DE0000-0x00007FF7F9132000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2336-0-0x00007FF706E70000-0x00007FF7071C2000-memory.dmp	xmrig
behavioral1/files/0x000800000002453a-4.dat	xmrig
behavioral1/files/0x000700000002453e-17.dat	xmrig
behavioral1/memory/1536-15-0x00007FF7E0F00000-0x00007FF7E1252000-memory.dmp	xmrig
behavioral1/files/0x000700000002453f-7.dat	xmrig
behavioral1/memory/1800-28-0x00007FF7B0DA0000-0x00007FF7B10F2000-memory.dmp	xmrig
behavioral1/files/0x0007000000024546-48.dat	xmrig
behavioral1/memory/856-64-0x00007FF66A900000-0x00007FF66AC52000-memory.dmp	xmrig
behavioral1/memory/1332-99-0x00007FF64DAF0000-0x00007FF64DE42000-memory.dmp	xmrig
behavioral1/memory/2280-113-0x00007FF73D040000-0x00007FF73D392000-memory.dmp	xmrig
behavioral1/memory/4064-119-0x00007FF75E740000-0x00007FF75EA92000-memory.dmp	xmrig
behavioral1/memory/1508-125-0x00007FF7F8DE0000-0x00007FF7F9132000-memory.dmp	xmrig
behavioral1/memory/3668-126-0x00007FF6664B0000-0x00007FF666802000-memory.dmp	xmrig
behavioral1/memory/1300-124-0x00007FF702B20000-0x00007FF702E72000-memory.dmp	xmrig
behavioral1/memory/4984-123-0x00007FF6941C0000-0x00007FF694512000-memory.dmp	xmrig
behavioral1/memory/1388-122-0x00007FF681FE0000-0x00007FF682332000-memory.dmp	xmrig
behavioral1/memory/2676-121-0x00007FF624E10000-0x00007FF625162000-memory.dmp	xmrig
behavioral1/memory/1804-120-0x00007FF605450000-0x00007FF6057A2000-memory.dmp	xmrig
behavioral1/memory/4564-118-0x00007FF754780000-0x00007FF754AD2000-memory.dmp	xmrig
behavioral1/memory/1212-117-0x00007FF7B1630000-0x00007FF7B1982000-memory.dmp	xmrig
behavioral1/files/0x0007000000024551-115.dat	xmrig
behavioral1/memory/2296-114-0x00007FF764AB0000-0x00007FF764E02000-memory.dmp	xmrig
behavioral1/files/0x0007000000024550-111.dat	xmrig
behavioral1/files/0x000700000002454f-109.dat	xmrig
behavioral1/files/0x000700000002454e-107.dat	xmrig
behavioral1/files/0x000700000002454d-105.dat	xmrig
behavioral1/memory/2236-104-0x00007FF65EC30000-0x00007FF65EF82000-memory.dmp	xmrig
behavioral1/files/0x000700000002454c-102.dat	xmrig
behavioral1/memory/3260-100-0x00007FF72F310000-0x00007FF72F662000-memory.dmp	xmrig
behavioral1/files/0x000700000002454b-96.dat	xmrig
behavioral1/files/0x000700000002454a-91.dat	xmrig
behavioral1/files/0x0007000000024549-89.dat	xmrig
behavioral1/files/0x0007000000024548-87.dat	xmrig
behavioral1/files/0x0007000000024547-84.dat	xmrig
behavioral1/memory/5084-82-0x00007FF6AD390000-0x00007FF6AD6E2000-memory.dmp	xmrig
behavioral1/files/0x0007000000024545-71.dat	xmrig
behavioral1/memory/2520-69-0x00007FF7A9010000-0x00007FF7A9362000-memory.dmp	xmrig
behavioral1/files/0x0007000000024544-66.dat	xmrig
behavioral1/files/0x0007000000024543-60.dat	xmrig
behavioral1/memory/1576-53-0x00007FF73F6C0000-0x00007FF73FA12000-memory.dmp	xmrig
behavioral1/files/0x0007000000024542-49.dat	xmrig
behavioral1/files/0x0007000000024541-40.dat	xmrig
behavioral1/files/0x0007000000024540-38.dat	xmrig
behavioral1/memory/2336-128-0x00007FF706E70000-0x00007FF7071C2000-memory.dmp	xmrig
behavioral1/memory/1536-129-0x00007FF7E0F00000-0x00007FF7E1252000-memory.dmp	xmrig
behavioral1/memory/1800-130-0x00007FF7B0DA0000-0x00007FF7B10F2000-memory.dmp	xmrig
behavioral1/memory/1576-131-0x00007FF73F6C0000-0x00007FF73FA12000-memory.dmp	xmrig
behavioral1/memory/2236-132-0x00007FF65EC30000-0x00007FF65EF82000-memory.dmp	xmrig
behavioral1/memory/1536-133-0x00007FF7E0F00000-0x00007FF7E1252000-memory.dmp	xmrig
behavioral1/memory/1576-135-0x00007FF73F6C0000-0x00007FF73FA12000-memory.dmp	xmrig
behavioral1/memory/2520-137-0x00007FF7A9010000-0x00007FF7A9362000-memory.dmp	xmrig
behavioral1/memory/1800-136-0x00007FF7B0DA0000-0x00007FF7B10F2000-memory.dmp	xmrig
behavioral1/memory/856-134-0x00007FF66A900000-0x00007FF66AC52000-memory.dmp	xmrig
behavioral1/memory/1388-140-0x00007FF681FE0000-0x00007FF682332000-memory.dmp	xmrig
behavioral1/memory/2280-141-0x00007FF73D040000-0x00007FF73D392000-memory.dmp	xmrig
behavioral1/memory/1804-146-0x00007FF605450000-0x00007FF6057A2000-memory.dmp	xmrig
behavioral1/memory/1300-147-0x00007FF702B20000-0x00007FF702E72000-memory.dmp	xmrig
behavioral1/memory/1332-145-0x00007FF64DAF0000-0x00007FF64DE42000-memory.dmp	xmrig
behavioral1/memory/2676-144-0x00007FF624E10000-0x00007FF625162000-memory.dmp	xmrig
behavioral1/memory/5084-143-0x00007FF6AD390000-0x00007FF6AD6E2000-memory.dmp	xmrig
behavioral1/memory/3260-142-0x00007FF72F310000-0x00007FF72F662000-memory.dmp	xmrig
behavioral1/memory/4984-139-0x00007FF6941C0000-0x00007FF694512000-memory.dmp	xmrig
behavioral1/memory/2296-138-0x00007FF764AB0000-0x00007FF764E02000-memory.dmp	xmrig
behavioral1/memory/1508-152-0x00007FF7F8DE0000-0x00007FF7F9132000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1536	TUQwpqX.exe
1800	GOSATIi.exe
1576	XNNqKLV.exe
856	FBsVZQk.exe
2520	IIgLurf.exe
1804	siAbUYZ.exe
5084	MUvpSmU.exe
2676	vzHqPeF.exe
1332	EeyZfRj.exe
3260	fllZwju.exe
1388	YpeSvau.exe
2236	mKpqUSA.exe
2280	QfQabkK.exe
2296	gxvHfdL.exe
4984	VFQwGdr.exe
1300	EyZdNQg.exe
1508	eWwIHgv.exe
1212	AJrjnxA.exe
4564	AhHxlnQ.exe
4064	XdPvSlA.exe
3668	ckRIcGW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2336-0-0x00007FF706E70000-0x00007FF7071C2000-memory.dmp	upx
behavioral1/files/0x000800000002453a-4.dat	upx
behavioral1/files/0x000700000002453e-17.dat	upx
behavioral1/memory/1536-15-0x00007FF7E0F00000-0x00007FF7E1252000-memory.dmp	upx
behavioral1/files/0x000700000002453f-7.dat	upx
behavioral1/memory/1800-28-0x00007FF7B0DA0000-0x00007FF7B10F2000-memory.dmp	upx
behavioral1/files/0x0007000000024546-48.dat	upx
behavioral1/memory/856-64-0x00007FF66A900000-0x00007FF66AC52000-memory.dmp	upx
behavioral1/memory/1332-99-0x00007FF64DAF0000-0x00007FF64DE42000-memory.dmp	upx
behavioral1/memory/2280-113-0x00007FF73D040000-0x00007FF73D392000-memory.dmp	upx
behavioral1/memory/4064-119-0x00007FF75E740000-0x00007FF75EA92000-memory.dmp	upx
behavioral1/memory/1508-125-0x00007FF7F8DE0000-0x00007FF7F9132000-memory.dmp	upx
behavioral1/memory/3668-126-0x00007FF6664B0000-0x00007FF666802000-memory.dmp	upx
behavioral1/memory/1300-124-0x00007FF702B20000-0x00007FF702E72000-memory.dmp	upx
behavioral1/memory/4984-123-0x00007FF6941C0000-0x00007FF694512000-memory.dmp	upx
behavioral1/memory/1388-122-0x00007FF681FE0000-0x00007FF682332000-memory.dmp	upx
behavioral1/memory/2676-121-0x00007FF624E10000-0x00007FF625162000-memory.dmp	upx
behavioral1/memory/1804-120-0x00007FF605450000-0x00007FF6057A2000-memory.dmp	upx
behavioral1/memory/4564-118-0x00007FF754780000-0x00007FF754AD2000-memory.dmp	upx
behavioral1/memory/1212-117-0x00007FF7B1630000-0x00007FF7B1982000-memory.dmp	upx
behavioral1/files/0x0007000000024551-115.dat	upx
behavioral1/memory/2296-114-0x00007FF764AB0000-0x00007FF764E02000-memory.dmp	upx
behavioral1/files/0x0007000000024550-111.dat	upx
behavioral1/files/0x000700000002454f-109.dat	upx
behavioral1/files/0x000700000002454e-107.dat	upx
behavioral1/files/0x000700000002454d-105.dat	upx
behavioral1/memory/2236-104-0x00007FF65EC30000-0x00007FF65EF82000-memory.dmp	upx
behavioral1/files/0x000700000002454c-102.dat	upx
behavioral1/memory/3260-100-0x00007FF72F310000-0x00007FF72F662000-memory.dmp	upx
behavioral1/files/0x000700000002454b-96.dat	upx
behavioral1/files/0x000700000002454a-91.dat	upx
behavioral1/files/0x0007000000024549-89.dat	upx
behavioral1/files/0x0007000000024548-87.dat	upx
behavioral1/files/0x0007000000024547-84.dat	upx
behavioral1/memory/5084-82-0x00007FF6AD390000-0x00007FF6AD6E2000-memory.dmp	upx
behavioral1/files/0x0007000000024545-71.dat	upx
behavioral1/memory/2520-69-0x00007FF7A9010000-0x00007FF7A9362000-memory.dmp	upx
behavioral1/files/0x0007000000024544-66.dat	upx
behavioral1/files/0x0007000000024543-60.dat	upx
behavioral1/memory/1576-53-0x00007FF73F6C0000-0x00007FF73FA12000-memory.dmp	upx
behavioral1/files/0x0007000000024542-49.dat	upx
behavioral1/files/0x0007000000024541-40.dat	upx
behavioral1/files/0x0007000000024540-38.dat	upx
behavioral1/memory/2336-128-0x00007FF706E70000-0x00007FF7071C2000-memory.dmp	upx
behavioral1/memory/1536-129-0x00007FF7E0F00000-0x00007FF7E1252000-memory.dmp	upx
behavioral1/memory/1800-130-0x00007FF7B0DA0000-0x00007FF7B10F2000-memory.dmp	upx
behavioral1/memory/1576-131-0x00007FF73F6C0000-0x00007FF73FA12000-memory.dmp	upx
behavioral1/memory/2236-132-0x00007FF65EC30000-0x00007FF65EF82000-memory.dmp	upx
behavioral1/memory/1536-133-0x00007FF7E0F00000-0x00007FF7E1252000-memory.dmp	upx
behavioral1/memory/1576-135-0x00007FF73F6C0000-0x00007FF73FA12000-memory.dmp	upx
behavioral1/memory/2520-137-0x00007FF7A9010000-0x00007FF7A9362000-memory.dmp	upx
behavioral1/memory/1800-136-0x00007FF7B0DA0000-0x00007FF7B10F2000-memory.dmp	upx
behavioral1/memory/856-134-0x00007FF66A900000-0x00007FF66AC52000-memory.dmp	upx
behavioral1/memory/1388-140-0x00007FF681FE0000-0x00007FF682332000-memory.dmp	upx
behavioral1/memory/2280-141-0x00007FF73D040000-0x00007FF73D392000-memory.dmp	upx
behavioral1/memory/1804-146-0x00007FF605450000-0x00007FF6057A2000-memory.dmp	upx
behavioral1/memory/1300-147-0x00007FF702B20000-0x00007FF702E72000-memory.dmp	upx
behavioral1/memory/1332-145-0x00007FF64DAF0000-0x00007FF64DE42000-memory.dmp	upx
behavioral1/memory/2676-144-0x00007FF624E10000-0x00007FF625162000-memory.dmp	upx
behavioral1/memory/5084-143-0x00007FF6AD390000-0x00007FF6AD6E2000-memory.dmp	upx
behavioral1/memory/3260-142-0x00007FF72F310000-0x00007FF72F662000-memory.dmp	upx
behavioral1/memory/4984-139-0x00007FF6941C0000-0x00007FF694512000-memory.dmp	upx
behavioral1/memory/2296-138-0x00007FF764AB0000-0x00007FF764E02000-memory.dmp	upx
behavioral1/memory/1508-152-0x00007FF7F8DE0000-0x00007FF7F9132000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\gxvHfdL.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\EyZdNQg.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\AJrjnxA.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\AhHxlnQ.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\TUQwpqX.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\VFQwGdr.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\XdPvSlA.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\GOSATIi.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\XNNqKLV.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\vzHqPeF.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\YpeSvau.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\FBsVZQk.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\IIgLurf.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\siAbUYZ.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\MUvpSmU.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\EeyZfRj.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\QfQabkK.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\eWwIHgv.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ckRIcGW.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fllZwju.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\mKpqUSA.exe	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1536	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	86
PID 2336 wrote to memory of 1800	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	87
PID 2336 wrote to memory of 1576	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	88
PID 2336 wrote to memory of 856	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	89
PID 2336 wrote to memory of 2520	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 2336 wrote to memory of 1804	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 2336 wrote to memory of 5084	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 2336 wrote to memory of 2676	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 2336 wrote to memory of 1332	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 2336 wrote to memory of 3260	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 2336 wrote to memory of 1388	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 2336 wrote to memory of 2236	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 2336 wrote to memory of 2280	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 2336 wrote to memory of 2296	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 2336 wrote to memory of 4984	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 2336 wrote to memory of 1300	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 2336 wrote to memory of 1508	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 2336 wrote to memory of 1212	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 2336 wrote to memory of 4564	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 2336 wrote to memory of 4064	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 2336 wrote to memory of 3668	2336	2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_c20732c31eb7dfaa56e8773fdbc1cbf7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\System\TUQwpqX.exe
  C:\Windows\System\TUQwpqX.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\GOSATIi.exe
  C:\Windows\System\GOSATIi.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\XNNqKLV.exe
  C:\Windows\System\XNNqKLV.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\FBsVZQk.exe
  C:\Windows\System\FBsVZQk.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\IIgLurf.exe
  C:\Windows\System\IIgLurf.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\siAbUYZ.exe
  C:\Windows\System\siAbUYZ.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\MUvpSmU.exe
  C:\Windows\System\MUvpSmU.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\vzHqPeF.exe
  C:\Windows\System\vzHqPeF.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\EeyZfRj.exe
  C:\Windows\System\EeyZfRj.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\fllZwju.exe
  C:\Windows\System\fllZwju.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\YpeSvau.exe
  C:\Windows\System\YpeSvau.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\mKpqUSA.exe
  C:\Windows\System\mKpqUSA.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\QfQabkK.exe
  C:\Windows\System\QfQabkK.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\gxvHfdL.exe
  C:\Windows\System\gxvHfdL.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\VFQwGdr.exe
  C:\Windows\System\VFQwGdr.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\EyZdNQg.exe
  C:\Windows\System\EyZdNQg.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\eWwIHgv.exe
  C:\Windows\System\eWwIHgv.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\AJrjnxA.exe
  C:\Windows\System\AJrjnxA.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\AhHxlnQ.exe
  C:\Windows\System\AhHxlnQ.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\XdPvSlA.exe
  C:\Windows\System\XdPvSlA.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\ckRIcGW.exe
  C:\Windows\System\ckRIcGW.exe
  2⤵
  - Executes dropped EXE
  PID:3668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AJrjnxA.exe

Path C:\Windows\System\AJrjnxA.exe
Size 8.3MB
SHA256 af961ea302ddfa7fee721663f5d5da6177443f5212c7087852535f04cdd9bc2b
MD5 eb44ed6d2f0421a29a4c7254a3ee9cd0
SHA1 ca65b4b6501622b550671cb40c6192125341fb3b
SHA512 d4bf25f19ad260f899ba412965e336b6f62cb23fc826ede1a7b0537a46d2fbe47430048dc33ee6bcd0e0c43f1a69325a44e8e33881fb6471cb17e5a5284e7978
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUl:v+D56utgpPF8u/7l
TLSH
T125965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AhHxlnQ.exe

Path C:\Windows\System\AhHxlnQ.exe
Size 8.3MB
SHA256 1867fdbd3bdda49e2760678edb13eb67192307301f3307a2d249064e72b40cfc
MD5 d9c3972940499e7c4b80839f2c43d317
SHA1 d2dc5cb142b942574ce6c412b15e15b4f3a571d0
SHA512 33235f80aec22dbc5c8dfc81be76f05633a71efc9fe6b87c0905aa0695c0112986f6bf7c681b9987085a9a431151d2990a4bb7890ac241fac97fc8811ab68835
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUF:v+D56utgpPF8u/7F
TLSH
T196965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EeyZfRj.exe

Path C:\Windows\System\EeyZfRj.exe
Size 8.3MB
SHA256 2cc458a5620b89eac895e6fc9cf323c154e6031d257c86924ce72543d4f9e1aa
MD5 4b94395034f3c15f8e730581dd520387
SHA1 955d2e7860159b5317f6d15164bbb5455ec0c914
SHA512 05c15c49fdf7483cd4fe96994b53bd6b5b5f81922c1d9717bab1c1b4821760b9c0aafa77afd766b4fd4ce7d608481dcfe420c508dad30eff29542c76deaea3b3
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUt:v+D56utgpPF8u/7t
TLSH
T1C7965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EyZdNQg.exe

Path C:\Windows\System\EyZdNQg.exe
Size 8.3MB
SHA256 5af1a90b849182c610471c30b47d2faa54d7b7107afb3ba176e4ebc04cd0c9f2
MD5 e0196ec963fb278d04bcce1354aeb8b7
SHA1 29bd0436c26e17c0d312f5df32e9350f57049da9
SHA512 7a442133527fc613b56827d51e72c4c08ef37c790af65e43328c44d0b23f87cf1449e7fc213869df328fa12f1f0229f81d66b5ee3b33c7a4e97ea21e610d05db
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUH:v+D56utgpPF8u/7H
TLSH
T121965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FBsVZQk.exe

Path C:\Windows\System\FBsVZQk.exe
Size 8.3MB
SHA256 e5e7c1dfeb5c83dc388de07bd21ccc1009dca8469d77a38654eaf85df928fb7c
MD5 b3eb1f4004553e9758878a634f677be1
SHA1 84fcbc58d7753f825453f164bff95b2a7241bfc3
SHA512 5598deb9e9775aa630f4140112fa54f65b7ed6075ad4360577d4e3909e23d31d36bf345f4ae997ef54047a0ff7a341fc89a2866bdc276f98c385582171d33b8a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUD:v+D56utgpPF8u/7D
TLSH
T1F2965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GOSATIi.exe

Path C:\Windows\System\GOSATIi.exe
Size 8.3MB
SHA256 faac1b5af0dd16b4d3dfe3cafb2bcf4db76ed89f981964da676d2d503c9ffb48
MD5 48f3b85b67996f148de624658a76ae5d
SHA1 f7a0a4ee8d122c53898622e52ab9d1b9e00f25df
SHA512 9b1ae61a93db149626d1431f07fe5c212f33a7364221e7d5eef3f291dbeb178e45a0630eaf77c9f5c9188f0226256109d9b340a18745a6b3e5bf7db786fb65b0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUz:v+D56utgpPF8u/7z
TLSH
T1AE965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IIgLurf.exe

Path C:\Windows\System\IIgLurf.exe
Size 8.3MB
SHA256 c845689947c0127406514079e36afbd937287fc7b7245bf7d7b7bf1f490ae49b
MD5 bd1faeef0ad2d6c07e1c31660dfa580e
SHA1 d3378d4126acedfd341af67c36cdfcb963baf7f0
SHA512 e1ad180c427ccd6897ea38ee1d5b513a352a47e96a638fda3e0c09ad410cc2a31edd8d9565fb256b42be025d14fdad8950c080c0ec093b89948a3214112a8353
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUq:v+D56utgpPF8u/7q
TLSH
T1E4965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MUvpSmU.exe

Path C:\Windows\System\MUvpSmU.exe
Size 8.3MB
SHA256 5c4c186ee7e807f44cbba9a4240fb8479f890abf5075c56624d93085a2fde7fd
MD5 e4ffc0f5bdf3e2d4fa6fe5fa3c1e60ba
SHA1 d178edb9823e31409b7950a6b4b649087b13fc72
SHA512 b7f5102abff815fe5b2494969f0fae15c3110da67803a9b581ba27ebbe9e52fbc485bb37d69ec2a55658863af590f0774d9785647eb49423012803b4e22248ed
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU+:v+D56utgpPF8u/7+
TLSH
T1A3965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QfQabkK.exe

Path C:\Windows\System\QfQabkK.exe
Size 8.3MB
SHA256 3eccab8820e60e89c23bbcb710acc169de25a9872e0a23c5d36caee5db2ce242
MD5 eee66b1a9ff4d506b3d0161dfa8b680d
SHA1 347da855c030b55218d87cad0127d8fb9efda42c
SHA512 b32ec2ba517fdc23e7de9cfd27296c495fd66f45eac7a3f96bc59907bbc9e8369e70cd99532949051a9856ca8479607682793cae0264f258d91cf02cb1418cac
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUa:v+D56utgpPF8u/7a
TLSH
T10B965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TUQwpqX.exe

Path C:\Windows\System\TUQwpqX.exe
Size 8.3MB
SHA256 e4a0dfb6acd3a13d95c41b9796084d29479d63f4d974940d99a9b8dc5a6f1fbf
MD5 1bea176365d63cb5e9c898fe0f338fcf
SHA1 e30652e956107337cf4b2f4b40831eff424386a0
SHA512 d7496f28e5d129d0f218c6ae2c8e9ec8fb0af6bc81e443a366d6da0782292b7eb53f483ddcb04b4ff330953e5ffcc08fdfd1165f42464965f93787966e244205
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUn:v+D56utgpPF8u/7n
TLSH
T1D3965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VFQwGdr.exe

Path C:\Windows\System\VFQwGdr.exe
Size 8.3MB
SHA256 34cc55a5168da023a85a950c62eca27537459176c28568f72d4cf4d3d94189b6
MD5 63cdb8f6c2f483c51acb6c3ce2d63f1f
SHA1 37c0ac770b1db5b5e38fc433f34af31f1bb7167d
SHA512 f253d512dacdf2e72c4c349f1ec44aefc682a01f4749025774a9d07a9ebbe663ccc89ef6c4361c01a559537c5de658c10acf18a3ff514727d95d80ba274d06df
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUE:v+D56utgpPF8u/7E
TLSH
T16F965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XNNqKLV.exe

Path C:\Windows\System\XNNqKLV.exe
Size 8.3MB
SHA256 3685d3de2a4f3844c38542ce93c7567eb84fb4d6c6bb9e4112aa5a5594342f50
MD5 b37b23179832ca833a2b45acbb3ca73a
SHA1 30dda603dd1e1980e165ffc525fdad51260012cd
SHA512 7fb94cdffeb8638a8e082d2475565e6abae7a014d3767c8f299a5c30f66e16a977399891fba19dcd2c343a531122d7ca493910cd0e37cb2f790e088a89a490bd
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUX:v+D56utgpPF8u/7X
TLSH
T13C965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XdPvSlA.exe

Path C:\Windows\System\XdPvSlA.exe
Size 8.3MB
SHA256 2a481231b9b609ded924fc77051889441aee17ea0b5e88db5d1af8e30508321f
MD5 2a0de80dbb9f5fca02d027784446eb4e
SHA1 862b8582058f43455dd9061fbfa39533ea3b5516
SHA512 47883c7ed99cc4cc751879b8122c72fcbfec4a664f8fcb1988c8d37eb33bad15c2462c42cfc3d66064b29f3221406e53b2f2580f7a6a026a33fadf97bdd47b5b
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUJ:v+D56utgpPF8u/7J
TLSH
T1A6965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YpeSvau.exe

Path C:\Windows\System\YpeSvau.exe
Size 8.3MB
SHA256 07c09d5c27bd44f3c9053173c580f4eabe4b349dcbf8164fff6d6d96bbdd86c1
MD5 c292d57087cf35c3d958420de81fc8eb
SHA1 f26d9cf9c62685286648fb2656bf566a7112f6b5
SHA512 0e07d909131dd6afff5b48c328d9b1c67e73fd5f9f6eb7b5de596208a091fc6051b12c790e68975024a26a5dc77d5fefded69da8592a3b7d5814727e07b6c9a5
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUj:v+D56utgpPF8u/7j
TLSH
T14B965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ckRIcGW.exe

Path C:\Windows\System\ckRIcGW.exe
Size 8.3MB
SHA256 4a2e72c48842e9cb66c9778c1ae354b55e359753b5a80044b607182eb1cab3af
MD5 3c6c54b53e85e17ff02b569161e28351
SHA1 dba362af39992b310ec7e35a75be3bfd02380992
SHA512 7264d091b73ec83cbdfc6d3331d82188b9de6d2db7ae18eb39bc5a8e2a9d00ef088dadddac945b14fa8ec93f0911fb3d858776089b11ee874315ab56b5d6afa3
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUk:v+D56utgpPF8u/7k
TLSH
T1F8965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eWwIHgv.exe

Path C:\Windows\System\eWwIHgv.exe
Size 8.3MB
SHA256 04d1bff86b640e67221aa00dd242a3a14c95fced5f77e4811b84bc12476b9f7c
MD5 8a6f7c7179e909b0e6297750c308ba33
SHA1 cd81705045704bb336e926bfcfcf2d05a6615197
SHA512 2b9ac058b7faab121ae12eb172bf8221b42e54b89eb48074381580923f61e3035b2f7e0d30979b22121164feca16ffc177f910f4284db2cace116745cfc72322
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUF:v+D56utgpPF8u/7F
TLSH
T1FB965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fllZwju.exe

Path C:\Windows\System\fllZwju.exe
Size 8.3MB
SHA256 f8ac2765a66b377d2f694cc569b4975fbdabe59482ea6dba1099fc2eb2664ddf
MD5 3d6cd8800b80aabbc8f5dbeb5f6f34a6
SHA1 1378ef5c7c96ab27ad36bcc8fb97883b9863865b
SHA512 e71fc6dbe035adb09aca54a00ea2a03ebe6df02c8b964313fcf9433c63f5a319d191a4449d12c8555938f7b1075b4eb6f8b4c006d6cdc5b9d6b27db9f0ba331b
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUB:v+D56utgpPF8u/7B
TLSH
T194965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gxvHfdL.exe

Path C:\Windows\System\gxvHfdL.exe
Size 8.3MB
SHA256 44339a9419b5df9379cef1817d18026dad32c4f45b9d030f7f416da37bf1f441
MD5 e4d8980c6bbfa58c794f9a1ebba8f72a
SHA1 4322b42f79109473719c25d0f1113fd3a98162d1
SHA512 6ac881a0a42c4a691d64ba070a3be69ca04b1847f559d112cbbe2e688314dceaea74692fa0cf42fcfabc3192b6d7ce692299be9571d989b0bbcc0c1fc7df7d88
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUn:v+D56utgpPF8u/7n
TLSH
T1EC965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mKpqUSA.exe

Path C:\Windows\System\mKpqUSA.exe
Size 8.3MB
SHA256 8c7379b27649b3074de01ba95512c7ef8041ba0afff4de514f869388f6ae7777
MD5 da23622bfb95bcc48019a2f584d1ee2b
SHA1 fec0be366709634e831e55db82fb2d9245678424
SHA512 75718212e474b01736e7578a994ea9f77ffb0e9bc74d7d042b6ef8d40fdcccf929c03b310afc31793bc3d8ecdc7d63afd0b1360c25b975035c3f0a1c60c347de
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUb:v+D56utgpPF8u/7b
TLSH
T1CD965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

siAbUYZ.exe

Path C:\Windows\System\siAbUYZ.exe
Size 8.3MB
SHA256 f89e179ce94c2adb5a4dce1165d9e3e48f47c49af839bf02521a2d5581268741
MD5 925669f41a5d91b4c542a7048d2b3b1a
SHA1 c5610b27e6f4b929394d2dff636844cc65d7f51e
SHA512 61397fd1ac251a5bfbdf5f1e06852afa271d8d1fa787a81c8ee60dfb4bca15230657300e8ad64f7178f7d4a111d744045cbd9ea56c669330cfe19e439fabe892
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUk:v+D56utgpPF8u/7k
TLSH
T1A2965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vzHqPeF.exe

Path C:\Windows\System\vzHqPeF.exe
Size 8.3MB
SHA256 01f5ec0b2295e7e09811568cf5aa83c2ef681de6bd2a61b04a28f0d66aa4215a
MD5 2cdce4a7c3b3e7edd8fecd849a3b5e9c
SHA1 720756d05b7fafad68d5611d165468c6984ea2da
SHA512 23133681887974df1db71be299b4a58374aeaa011874802faff96801c8b8737793071198df7290661d064d54a65374e401b1106049dbbbb3bc05fc5fece50e36
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUN:v+D56utgpPF8u/7N
TLSH
T13E965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/856-64-0x00007FF66A900000-0x00007FF66AC52000-memory.dmp

Download

memory/856-134-0x00007FF66A900000-0x00007FF66AC52000-memory.dmp

Download

memory/1212-117-0x00007FF7B1630000-0x00007FF7B1982000-memory.dmp

Download

memory/1212-151-0x00007FF7B1630000-0x00007FF7B1982000-memory.dmp

Download

memory/1300-147-0x00007FF702B20000-0x00007FF702E72000-memory.dmp

Download

memory/1300-124-0x00007FF702B20000-0x00007FF702E72000-memory.dmp

Download

memory/1332-99-0x00007FF64DAF0000-0x00007FF64DE42000-memory.dmp

Download

memory/1332-145-0x00007FF64DAF0000-0x00007FF64DE42000-memory.dmp

Download

memory/1388-122-0x00007FF681FE0000-0x00007FF682332000-memory.dmp

Download

memory/1388-140-0x00007FF681FE0000-0x00007FF682332000-memory.dmp

Download

memory/1508-125-0x00007FF7F8DE0000-0x00007FF7F9132000-memory.dmp

Download

memory/1508-152-0x00007FF7F8DE0000-0x00007FF7F9132000-memory.dmp

Download

memory/1536-129-0x00007FF7E0F00000-0x00007FF7E1252000-memory.dmp

Download

memory/1536-133-0x00007FF7E0F00000-0x00007FF7E1252000-memory.dmp

Download

memory/1536-15-0x00007FF7E0F00000-0x00007FF7E1252000-memory.dmp

Download

memory/1576-131-0x00007FF73F6C0000-0x00007FF73FA12000-memory.dmp

Download

memory/1576-135-0x00007FF73F6C0000-0x00007FF73FA12000-memory.dmp

Download

memory/1576-53-0x00007FF73F6C0000-0x00007FF73FA12000-memory.dmp

Download

memory/1800-136-0x00007FF7B0DA0000-0x00007FF7B10F2000-memory.dmp

Download

memory/1800-130-0x00007FF7B0DA0000-0x00007FF7B10F2000-memory.dmp

Download

memory/1800-28-0x00007FF7B0DA0000-0x00007FF7B10F2000-memory.dmp

Download

memory/1804-120-0x00007FF605450000-0x00007FF6057A2000-memory.dmp

Download

memory/1804-146-0x00007FF605450000-0x00007FF6057A2000-memory.dmp

Download

memory/2236-153-0x00007FF65EC30000-0x00007FF65EF82000-memory.dmp

Download

memory/2236-104-0x00007FF65EC30000-0x00007FF65EF82000-memory.dmp

Download

memory/2236-132-0x00007FF65EC30000-0x00007FF65EF82000-memory.dmp

Download

memory/2280-113-0x00007FF73D040000-0x00007FF73D392000-memory.dmp

Download

memory/2280-141-0x00007FF73D040000-0x00007FF73D392000-memory.dmp

Download

memory/2296-114-0x00007FF764AB0000-0x00007FF764E02000-memory.dmp

Download

memory/2296-138-0x00007FF764AB0000-0x00007FF764E02000-memory.dmp

Download

memory/2336-0-0x00007FF706E70000-0x00007FF7071C2000-memory.dmp

Download

memory/2336-1-0x0000026038E80000-0x0000026038E90000-memory.dmp

Download

memory/2336-128-0x00007FF706E70000-0x00007FF7071C2000-memory.dmp

Download

memory/2520-137-0x00007FF7A9010000-0x00007FF7A9362000-memory.dmp

Download

memory/2520-69-0x00007FF7A9010000-0x00007FF7A9362000-memory.dmp

Download

memory/2676-121-0x00007FF624E10000-0x00007FF625162000-memory.dmp

Download

memory/2676-144-0x00007FF624E10000-0x00007FF625162000-memory.dmp

Download

memory/3260-142-0x00007FF72F310000-0x00007FF72F662000-memory.dmp

Download

memory/3260-100-0x00007FF72F310000-0x00007FF72F662000-memory.dmp

Download

memory/3668-126-0x00007FF6664B0000-0x00007FF666802000-memory.dmp

Download

memory/3668-148-0x00007FF6664B0000-0x00007FF666802000-memory.dmp

Download

memory/4064-119-0x00007FF75E740000-0x00007FF75EA92000-memory.dmp

Download

memory/4064-149-0x00007FF75E740000-0x00007FF75EA92000-memory.dmp

Download

memory/4564-118-0x00007FF754780000-0x00007FF754AD2000-memory.dmp

Download

memory/4564-150-0x00007FF754780000-0x00007FF754AD2000-memory.dmp

Download

memory/4984-139-0x00007FF6941C0000-0x00007FF694512000-memory.dmp

Download

memory/4984-123-0x00007FF6941C0000-0x00007FF694512000-memory.dmp

Download

memory/5084-143-0x00007FF6AD390000-0x00007FF6AD6E2000-memory.dmp

Download

memory/5084-82-0x00007FF6AD390000-0x00007FF6AD6E2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads