cobaltstrike | 8431c6ca4b1bfaafee43ecc027a3f92ca0330f51202a1b3209d738574033c282

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 14:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample260910-r8971ayyay
SHA256 8431c6ca4b1bfaafee43ecc027a3f92ca0330f51202a1b3209d738574033c282
MD5 7d9777fe6d764d6443f281a33fbfc944
SHA1 c902b379c3a6d0e0cea95708c942ab4776bead1d
SHA512 e8df32efb9ba1ae1e3127a4e3e13d80f122cae874bc63b8cd45f2877fc31393a74b0bf70f2a265f1eb76d5a9a730035f787ad88b847564dbd28340c39668619a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU8:v+D56utgpPF8u/78
TLSH
T1F0965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000d000000016cdc-6.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5df-11.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e5-10.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e6-24.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5e0-30.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e7-35.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e8-41.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e9-47.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ea-53.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5eb-58.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ec-63.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ed-68.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ee-73.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ef-78.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5f0-82.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5f1-99.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5f3-109.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5f6-131.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5f5-126.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5f4-119.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5f2-106.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000d000000016cdc-6.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5df-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e5-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e6-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5e0-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e7-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e8-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e9-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ea-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5eb-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ec-63.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ed-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ee-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ef-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5f0-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5f1-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5f3-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5f6-131.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5f5-126.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5f4-119.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5f2-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4600-0-0x00007FF7C7CF0000-0x00007FF7C8042000-memory.dmp	UPX
behavioral2/files/0x000d000000016cdc-6.dat	UPX
behavioral2/memory/1260-8-0x00007FF6A1400000-0x00007FF6A1752000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5df-11.dat	UPX
behavioral2/memory/1540-14-0x00007FF71BC20000-0x00007FF71BF72000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5e5-10.dat	UPX
behavioral2/memory/3652-19-0x00007FF66B0D0000-0x00007FF66B422000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5e6-24.dat	UPX
behavioral2/memory/2456-26-0x00007FF6B18B0000-0x00007FF6B1C02000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5e0-30.dat	UPX
behavioral2/memory/4488-32-0x00007FF6245C0000-0x00007FF624912000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5e7-35.dat	UPX
behavioral2/memory/5680-36-0x00007FF6D4C70000-0x00007FF6D4FC2000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5e8-41.dat	UPX
behavioral2/memory/6036-42-0x00007FF6E37B0000-0x00007FF6E3B02000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5e9-47.dat	UPX
behavioral2/files/0x000c00000001c5ea-53.dat	UPX
behavioral2/files/0x000c00000001c5eb-58.dat	UPX
behavioral2/files/0x000c00000001c5ec-63.dat	UPX
behavioral2/files/0x000c00000001c5ed-68.dat	UPX
behavioral2/files/0x000c00000001c5ee-73.dat	UPX
behavioral2/files/0x000c00000001c5ef-78.dat	UPX
behavioral2/files/0x000c00000001c5f0-82.dat	UPX
behavioral2/memory/5844-87-0x00007FF7798A0000-0x00007FF779BF2000-memory.dmp	UPX
behavioral2/memory/3692-93-0x00007FF660250000-0x00007FF6605A2000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5f1-99.dat	UPX
behavioral2/files/0x000c00000001c5f3-109.dat	UPX
behavioral2/memory/3652-117-0x00007FF66B0D0000-0x00007FF66B422000-memory.dmp	UPX
behavioral2/memory/5688-125-0x00007FF702170000-0x00007FF7024C2000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5f6-131.dat	UPX
behavioral2/memory/1984-130-0x00007FF6F4620000-0x00007FF6F4972000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5f5-126.dat	UPX
behavioral2/memory/2456-124-0x00007FF6B18B0000-0x00007FF6B1C02000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5f4-119.dat	UPX
behavioral2/memory/2284-118-0x00007FF71F380000-0x00007FF71F6D2000-memory.dmp	UPX
behavioral2/memory/3196-111-0x00007FF6891D0000-0x00007FF689522000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5f2-106.dat	UPX
behavioral2/memory/5960-105-0x00007FF6E7B10000-0x00007FF6E7E62000-memory.dmp	UPX
behavioral2/memory/1540-104-0x00007FF71BC20000-0x00007FF71BF72000-memory.dmp	UPX
behavioral2/memory/5144-98-0x00007FF7EE8B0000-0x00007FF7EEC02000-memory.dmp	UPX
behavioral2/memory/1260-97-0x00007FF6A1400000-0x00007FF6A1752000-memory.dmp	UPX
behavioral2/memory/4600-92-0x00007FF7C7CF0000-0x00007FF7C8042000-memory.dmp	UPX
behavioral2/memory/3000-89-0x00007FF7295D0000-0x00007FF729922000-memory.dmp	UPX
behavioral2/memory/2776-88-0x00007FF673560000-0x00007FF6738B2000-memory.dmp	UPX
behavioral2/memory/4112-86-0x00007FF7B6F30000-0x00007FF7B7282000-memory.dmp	UPX
behavioral2/memory/1564-85-0x00007FF77A6D0000-0x00007FF77AA22000-memory.dmp	UPX
behavioral2/memory/5584-84-0x00007FF66D4B0000-0x00007FF66D802000-memory.dmp	UPX
behavioral2/memory/1336-83-0x00007FF7B6FE0000-0x00007FF7B7332000-memory.dmp	UPX
behavioral2/memory/5680-133-0x00007FF6D4C70000-0x00007FF6D4FC2000-memory.dmp	UPX
behavioral2/memory/6036-134-0x00007FF6E37B0000-0x00007FF6E3B02000-memory.dmp	UPX
behavioral2/memory/1336-135-0x00007FF7B6FE0000-0x00007FF7B7332000-memory.dmp	UPX
behavioral2/memory/3000-136-0x00007FF7295D0000-0x00007FF729922000-memory.dmp	UPX
behavioral2/memory/5144-137-0x00007FF7EE8B0000-0x00007FF7EEC02000-memory.dmp	UPX
behavioral2/memory/5960-138-0x00007FF6E7B10000-0x00007FF6E7E62000-memory.dmp	UPX
behavioral2/memory/3196-139-0x00007FF6891D0000-0x00007FF689522000-memory.dmp	UPX
behavioral2/memory/2284-140-0x00007FF71F380000-0x00007FF71F6D2000-memory.dmp	UPX
behavioral2/memory/5688-141-0x00007FF702170000-0x00007FF7024C2000-memory.dmp	UPX
behavioral2/memory/1984-142-0x00007FF6F4620000-0x00007FF6F4972000-memory.dmp	UPX
behavioral2/memory/1260-143-0x00007FF6A1400000-0x00007FF6A1752000-memory.dmp	UPX
behavioral2/memory/1540-144-0x00007FF71BC20000-0x00007FF71BF72000-memory.dmp	UPX
behavioral2/memory/3652-145-0x00007FF66B0D0000-0x00007FF66B422000-memory.dmp	UPX
behavioral2/memory/2456-146-0x00007FF6B18B0000-0x00007FF6B1C02000-memory.dmp	UPX
behavioral2/memory/4488-147-0x00007FF6245C0000-0x00007FF624912000-memory.dmp	UPX
behavioral2/memory/5680-148-0x00007FF6D4C70000-0x00007FF6D4FC2000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4600-0-0x00007FF7C7CF0000-0x00007FF7C8042000-memory.dmp	xmrig
behavioral2/files/0x000d000000016cdc-6.dat	xmrig
behavioral2/memory/1260-8-0x00007FF6A1400000-0x00007FF6A1752000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5df-11.dat	xmrig
behavioral2/memory/1540-14-0x00007FF71BC20000-0x00007FF71BF72000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5e5-10.dat	xmrig
behavioral2/memory/3652-19-0x00007FF66B0D0000-0x00007FF66B422000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5e6-24.dat	xmrig
behavioral2/memory/2456-26-0x00007FF6B18B0000-0x00007FF6B1C02000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5e0-30.dat	xmrig
behavioral2/memory/4488-32-0x00007FF6245C0000-0x00007FF624912000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5e7-35.dat	xmrig
behavioral2/memory/5680-36-0x00007FF6D4C70000-0x00007FF6D4FC2000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5e8-41.dat	xmrig
behavioral2/memory/6036-42-0x00007FF6E37B0000-0x00007FF6E3B02000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5e9-47.dat	xmrig
behavioral2/files/0x000c00000001c5ea-53.dat	xmrig
behavioral2/files/0x000c00000001c5eb-58.dat	xmrig
behavioral2/files/0x000c00000001c5ec-63.dat	xmrig
behavioral2/files/0x000c00000001c5ed-68.dat	xmrig
behavioral2/files/0x000c00000001c5ee-73.dat	xmrig
behavioral2/files/0x000c00000001c5ef-78.dat	xmrig
behavioral2/files/0x000c00000001c5f0-82.dat	xmrig
behavioral2/memory/5844-87-0x00007FF7798A0000-0x00007FF779BF2000-memory.dmp	xmrig
behavioral2/memory/3692-93-0x00007FF660250000-0x00007FF6605A2000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5f1-99.dat	xmrig
behavioral2/files/0x000c00000001c5f3-109.dat	xmrig
behavioral2/memory/3652-117-0x00007FF66B0D0000-0x00007FF66B422000-memory.dmp	xmrig
behavioral2/memory/5688-125-0x00007FF702170000-0x00007FF7024C2000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5f6-131.dat	xmrig
behavioral2/memory/1984-130-0x00007FF6F4620000-0x00007FF6F4972000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5f5-126.dat	xmrig
behavioral2/memory/2456-124-0x00007FF6B18B0000-0x00007FF6B1C02000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5f4-119.dat	xmrig
behavioral2/memory/2284-118-0x00007FF71F380000-0x00007FF71F6D2000-memory.dmp	xmrig
behavioral2/memory/3196-111-0x00007FF6891D0000-0x00007FF689522000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5f2-106.dat	xmrig
behavioral2/memory/5960-105-0x00007FF6E7B10000-0x00007FF6E7E62000-memory.dmp	xmrig
behavioral2/memory/1540-104-0x00007FF71BC20000-0x00007FF71BF72000-memory.dmp	xmrig
behavioral2/memory/5144-98-0x00007FF7EE8B0000-0x00007FF7EEC02000-memory.dmp	xmrig
behavioral2/memory/1260-97-0x00007FF6A1400000-0x00007FF6A1752000-memory.dmp	xmrig
behavioral2/memory/4600-92-0x00007FF7C7CF0000-0x00007FF7C8042000-memory.dmp	xmrig
behavioral2/memory/3000-89-0x00007FF7295D0000-0x00007FF729922000-memory.dmp	xmrig
behavioral2/memory/2776-88-0x00007FF673560000-0x00007FF6738B2000-memory.dmp	xmrig
behavioral2/memory/4112-86-0x00007FF7B6F30000-0x00007FF7B7282000-memory.dmp	xmrig
behavioral2/memory/1564-85-0x00007FF77A6D0000-0x00007FF77AA22000-memory.dmp	xmrig
behavioral2/memory/5584-84-0x00007FF66D4B0000-0x00007FF66D802000-memory.dmp	xmrig
behavioral2/memory/1336-83-0x00007FF7B6FE0000-0x00007FF7B7332000-memory.dmp	xmrig
behavioral2/memory/5680-133-0x00007FF6D4C70000-0x00007FF6D4FC2000-memory.dmp	xmrig
behavioral2/memory/6036-134-0x00007FF6E37B0000-0x00007FF6E3B02000-memory.dmp	xmrig
behavioral2/memory/1336-135-0x00007FF7B6FE0000-0x00007FF7B7332000-memory.dmp	xmrig
behavioral2/memory/3000-136-0x00007FF7295D0000-0x00007FF729922000-memory.dmp	xmrig
behavioral2/memory/5144-137-0x00007FF7EE8B0000-0x00007FF7EEC02000-memory.dmp	xmrig
behavioral2/memory/5960-138-0x00007FF6E7B10000-0x00007FF6E7E62000-memory.dmp	xmrig
behavioral2/memory/3196-139-0x00007FF6891D0000-0x00007FF689522000-memory.dmp	xmrig
behavioral2/memory/2284-140-0x00007FF71F380000-0x00007FF71F6D2000-memory.dmp	xmrig
behavioral2/memory/5688-141-0x00007FF702170000-0x00007FF7024C2000-memory.dmp	xmrig
behavioral2/memory/1984-142-0x00007FF6F4620000-0x00007FF6F4972000-memory.dmp	xmrig
behavioral2/memory/1260-143-0x00007FF6A1400000-0x00007FF6A1752000-memory.dmp	xmrig
behavioral2/memory/1540-144-0x00007FF71BC20000-0x00007FF71BF72000-memory.dmp	xmrig
behavioral2/memory/3652-145-0x00007FF66B0D0000-0x00007FF66B422000-memory.dmp	xmrig
behavioral2/memory/2456-146-0x00007FF6B18B0000-0x00007FF6B1C02000-memory.dmp	xmrig
behavioral2/memory/4488-147-0x00007FF6245C0000-0x00007FF624912000-memory.dmp	xmrig
behavioral2/memory/5680-148-0x00007FF6D4C70000-0x00007FF6D4FC2000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1260	mEsVJAd.exe
1540	CdNmcTo.exe
3652	JQiqkSY.exe
2456	tqJdAoc.exe
4488	UzudeQW.exe
5680	YwtxizT.exe
6036	eyDAPnJ.exe
1336	pDOTWhb.exe
3692	nIYebvi.exe
5584	BtpfqiA.exe
1564	lSadJDT.exe
4112	CnIwgBS.exe
5844	DLZIrfc.exe
2776	vXPYDEA.exe
3000	dtFUwYt.exe
5144	fGrUNYz.exe
5960	ocOxKKy.exe
3196	MbXJbMP.exe
2284	RZAUdlB.exe
5688	KewOzun.exe
1984	HSVYtoj.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4600-0-0x00007FF7C7CF0000-0x00007FF7C8042000-memory.dmp	upx
behavioral2/files/0x000d000000016cdc-6.dat	upx
behavioral2/memory/1260-8-0x00007FF6A1400000-0x00007FF6A1752000-memory.dmp	upx
behavioral2/files/0x000d00000001c5df-11.dat	upx
behavioral2/memory/1540-14-0x00007FF71BC20000-0x00007FF71BF72000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e5-10.dat	upx
behavioral2/memory/3652-19-0x00007FF66B0D0000-0x00007FF66B422000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e6-24.dat	upx
behavioral2/memory/2456-26-0x00007FF6B18B0000-0x00007FF6B1C02000-memory.dmp	upx
behavioral2/files/0x000d00000001c5e0-30.dat	upx
behavioral2/memory/4488-32-0x00007FF6245C0000-0x00007FF624912000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e7-35.dat	upx
behavioral2/memory/5680-36-0x00007FF6D4C70000-0x00007FF6D4FC2000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e8-41.dat	upx
behavioral2/memory/6036-42-0x00007FF6E37B0000-0x00007FF6E3B02000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e9-47.dat	upx
behavioral2/files/0x000c00000001c5ea-53.dat	upx
behavioral2/files/0x000c00000001c5eb-58.dat	upx
behavioral2/files/0x000c00000001c5ec-63.dat	upx
behavioral2/files/0x000c00000001c5ed-68.dat	upx
behavioral2/files/0x000c00000001c5ee-73.dat	upx
behavioral2/files/0x000c00000001c5ef-78.dat	upx
behavioral2/files/0x000c00000001c5f0-82.dat	upx
behavioral2/memory/5844-87-0x00007FF7798A0000-0x00007FF779BF2000-memory.dmp	upx
behavioral2/memory/3692-93-0x00007FF660250000-0x00007FF6605A2000-memory.dmp	upx
behavioral2/files/0x000c00000001c5f1-99.dat	upx
behavioral2/files/0x000c00000001c5f3-109.dat	upx
behavioral2/memory/3652-117-0x00007FF66B0D0000-0x00007FF66B422000-memory.dmp	upx
behavioral2/memory/5688-125-0x00007FF702170000-0x00007FF7024C2000-memory.dmp	upx
behavioral2/files/0x000c00000001c5f6-131.dat	upx
behavioral2/memory/1984-130-0x00007FF6F4620000-0x00007FF6F4972000-memory.dmp	upx
behavioral2/files/0x000c00000001c5f5-126.dat	upx
behavioral2/memory/2456-124-0x00007FF6B18B0000-0x00007FF6B1C02000-memory.dmp	upx
behavioral2/files/0x000c00000001c5f4-119.dat	upx
behavioral2/memory/2284-118-0x00007FF71F380000-0x00007FF71F6D2000-memory.dmp	upx
behavioral2/memory/3196-111-0x00007FF6891D0000-0x00007FF689522000-memory.dmp	upx
behavioral2/files/0x000c00000001c5f2-106.dat	upx
behavioral2/memory/5960-105-0x00007FF6E7B10000-0x00007FF6E7E62000-memory.dmp	upx
behavioral2/memory/1540-104-0x00007FF71BC20000-0x00007FF71BF72000-memory.dmp	upx
behavioral2/memory/5144-98-0x00007FF7EE8B0000-0x00007FF7EEC02000-memory.dmp	upx
behavioral2/memory/1260-97-0x00007FF6A1400000-0x00007FF6A1752000-memory.dmp	upx
behavioral2/memory/4600-92-0x00007FF7C7CF0000-0x00007FF7C8042000-memory.dmp	upx
behavioral2/memory/3000-89-0x00007FF7295D0000-0x00007FF729922000-memory.dmp	upx
behavioral2/memory/2776-88-0x00007FF673560000-0x00007FF6738B2000-memory.dmp	upx
behavioral2/memory/4112-86-0x00007FF7B6F30000-0x00007FF7B7282000-memory.dmp	upx
behavioral2/memory/1564-85-0x00007FF77A6D0000-0x00007FF77AA22000-memory.dmp	upx
behavioral2/memory/5584-84-0x00007FF66D4B0000-0x00007FF66D802000-memory.dmp	upx
behavioral2/memory/1336-83-0x00007FF7B6FE0000-0x00007FF7B7332000-memory.dmp	upx
behavioral2/memory/5680-133-0x00007FF6D4C70000-0x00007FF6D4FC2000-memory.dmp	upx
behavioral2/memory/6036-134-0x00007FF6E37B0000-0x00007FF6E3B02000-memory.dmp	upx
behavioral2/memory/1336-135-0x00007FF7B6FE0000-0x00007FF7B7332000-memory.dmp	upx
behavioral2/memory/3000-136-0x00007FF7295D0000-0x00007FF729922000-memory.dmp	upx
behavioral2/memory/5144-137-0x00007FF7EE8B0000-0x00007FF7EEC02000-memory.dmp	upx
behavioral2/memory/5960-138-0x00007FF6E7B10000-0x00007FF6E7E62000-memory.dmp	upx
behavioral2/memory/3196-139-0x00007FF6891D0000-0x00007FF689522000-memory.dmp	upx
behavioral2/memory/2284-140-0x00007FF71F380000-0x00007FF71F6D2000-memory.dmp	upx
behavioral2/memory/5688-141-0x00007FF702170000-0x00007FF7024C2000-memory.dmp	upx
behavioral2/memory/1984-142-0x00007FF6F4620000-0x00007FF6F4972000-memory.dmp	upx
behavioral2/memory/1260-143-0x00007FF6A1400000-0x00007FF6A1752000-memory.dmp	upx
behavioral2/memory/1540-144-0x00007FF71BC20000-0x00007FF71BF72000-memory.dmp	upx
behavioral2/memory/3652-145-0x00007FF66B0D0000-0x00007FF66B422000-memory.dmp	upx
behavioral2/memory/2456-146-0x00007FF6B18B0000-0x00007FF6B1C02000-memory.dmp	upx
behavioral2/memory/4488-147-0x00007FF6245C0000-0x00007FF624912000-memory.dmp	upx
behavioral2/memory/5680-148-0x00007FF6D4C70000-0x00007FF6D4FC2000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\UzudeQW.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\eyDAPnJ.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\DLZIrfc.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ocOxKKy.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\RZAUdlB.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\KewOzun.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\HSVYtoj.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\mEsVJAd.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\nIYebvi.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\BtpfqiA.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\dtFUwYt.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\MbXJbMP.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\YwtxizT.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\pDOTWhb.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\lSadJDT.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\vXPYDEA.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fGrUNYz.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\CnIwgBS.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\CdNmcTo.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\JQiqkSY.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\tqJdAoc.exe	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 1260	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 4600 wrote to memory of 1540	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 4600 wrote to memory of 3652	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 4600 wrote to memory of 2456	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 4600 wrote to memory of 4488	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 4600 wrote to memory of 5680	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 4600 wrote to memory of 6036	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 4600 wrote to memory of 1336	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 4600 wrote to memory of 3692	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 4600 wrote to memory of 5584	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 4600 wrote to memory of 1564	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 4600 wrote to memory of 4112	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 4600 wrote to memory of 5844	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 4600 wrote to memory of 2776	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 4600 wrote to memory of 3000	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 4600 wrote to memory of 5144	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 4600 wrote to memory of 5960	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 4600 wrote to memory of 3196	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 4600 wrote to memory of 2284	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 4600 wrote to memory of 5688	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109
PID 4600 wrote to memory of 1984	4600	2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_7d9777fe6d764d6443f281a33fbfc944_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\System\mEsVJAd.exe
  C:\Windows\System\mEsVJAd.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\CdNmcTo.exe
  C:\Windows\System\CdNmcTo.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\JQiqkSY.exe
  C:\Windows\System\JQiqkSY.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\tqJdAoc.exe
  C:\Windows\System\tqJdAoc.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\UzudeQW.exe
  C:\Windows\System\UzudeQW.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\YwtxizT.exe
  C:\Windows\System\YwtxizT.exe
  2⤵
  - Executes dropped EXE
  PID:5680
- C:\Windows\System\eyDAPnJ.exe
  C:\Windows\System\eyDAPnJ.exe
  2⤵
  - Executes dropped EXE
  PID:6036
- C:\Windows\System\pDOTWhb.exe
  C:\Windows\System\pDOTWhb.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\nIYebvi.exe
  C:\Windows\System\nIYebvi.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\BtpfqiA.exe
  C:\Windows\System\BtpfqiA.exe
  2⤵
  - Executes dropped EXE
  PID:5584
- C:\Windows\System\lSadJDT.exe
  C:\Windows\System\lSadJDT.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\CnIwgBS.exe
  C:\Windows\System\CnIwgBS.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\DLZIrfc.exe
  C:\Windows\System\DLZIrfc.exe
  2⤵
  - Executes dropped EXE
  PID:5844
- C:\Windows\System\vXPYDEA.exe
  C:\Windows\System\vXPYDEA.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\dtFUwYt.exe
  C:\Windows\System\dtFUwYt.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\fGrUNYz.exe
  C:\Windows\System\fGrUNYz.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\ocOxKKy.exe
  C:\Windows\System\ocOxKKy.exe
  2⤵
  - Executes dropped EXE
  PID:5960
- C:\Windows\System\MbXJbMP.exe
  C:\Windows\System\MbXJbMP.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\RZAUdlB.exe
  C:\Windows\System\RZAUdlB.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\KewOzun.exe
  C:\Windows\System\KewOzun.exe
  2⤵
  - Executes dropped EXE
  PID:5688
- C:\Windows\System\HSVYtoj.exe
  C:\Windows\System\HSVYtoj.exe
  2⤵
  - Executes dropped EXE
  PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BtpfqiA.exe

Path C:\Windows\System\BtpfqiA.exe
Size 8.3MB
SHA256 d000fcecae3078b432b0ef3c9650bb485d55ad78d5c4855d07f6e4ad33b6e291
MD5 0ff709d506166404f98f0cce31d083a8
SHA1 fe7bd720b04d8ff05640f16c5d9e436233731c3e
SHA512 04cb18a44eececb13f14161142f08e479d39474daef1835fa792abacbcb192b920f0a3bc482f4085099e1b08cd872ea530a64bf5b7731274797df45434e2ad9a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUC:v+D56utgpPF8u/7C
TLSH
T1FD965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CdNmcTo.exe

Path C:\Windows\System\CdNmcTo.exe
Size 8.3MB
SHA256 55da4002adc1b7ecf29ee30ed1b5c27be4d75aa572f9d9bd9581af242e5f8e69
MD5 155174a1e39a7d0dad4a5b14ef0a114f
SHA1 1bdeb70b53bf73263f66b7bc0aa4e8a59de8c8aa
SHA512 d3c53f40df47e07c4641bbdc474a8456fd96b7aeafd255999668d43554a8a74156593caa6613dc02399a717e2eb6ddafa5c3ab7b70d17599c5f424455e7c3f74
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUA:v+D56utgpPF8u/7A
TLSH
T1D5965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CnIwgBS.exe

Path C:\Windows\System\CnIwgBS.exe
Size 8.3MB
SHA256 ba12d7e16bbb8bfecc8915646335d86a0a30a9863cba8d3610149166487c70d1
MD5 c344bb11b60b867a77248cb625692821
SHA1 894ef3500f56f5eeebe31a1d81e7aa0218b50539
SHA512 90e08085fa96f0f7f39710baf409706066867792a6735a941dbbcafcfcd1772958ef6e02fa8526f7ef0e8baed69846d566df8a3073806aae3828529a200e2606
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUv:v+D56utgpPF8u/7v
TLSH
T176965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DLZIrfc.exe

Path C:\Windows\System\DLZIrfc.exe
Size 8.3MB
SHA256 3ba21048740f3cb2deb716921fe78ced2a7b87ecede0b45da6c0cf5ab6c3c50c
MD5 4e2fadce6992f55ee9f6a09db500b2c2
SHA1 ee47611bb977d2c478aa77ad77609d9c0449333c
SHA512 d420e88a203e7018c0bf843e30a8781a38e8f773bd2c070ef61b00d7f3fcd78e22735c66cb296810f847321a74215f54f74864531a3eea2a1e593a27125c757e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUF:v+D56utgpPF8u/7F
TLSH
T135965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HSVYtoj.exe

Path C:\Windows\System\HSVYtoj.exe
Size 8.3MB
SHA256 31ea658fa49b2f0161ae5f7dd312af0dbf366393443660569a47dd532a8e506d
MD5 0041a71d630843459bf72c5e12cda8dc
SHA1 2e3de4e1b0f8f90743695b5aa8307fff96dc72f9
SHA512 699d5a28a0a5878ad124c22dab4ab520bc2856033e074979233f4d06b8241316a9b73545192c1c9f5f59a9ddb06b04e59daf23bf1469171b19c009075c9ec83c
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUr:v+D56utgpPF8u/7r
TLSH
T1FD965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JQiqkSY.exe

Path C:\Windows\System\JQiqkSY.exe
Size 8.3MB
SHA256 2b30c13f64c0641c1f1f644edc60fedb7901abc01be05fe0916ddaf737089c52
MD5 d0b5413fb27701bcf9921e5a584115a6
SHA1 bcd730afa80b7c2ac21834f56eeb059f97c2eef1
SHA512 070b39dc901e17731245090980783ea17e747a55714da307c7bc396ef95674e6028531589956bf9deecb498dc2878660548560eb78a9c0cadbd711f943c860cf
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUq:v+D56utgpPF8u/7q
TLSH
T1D3965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KewOzun.exe

Path C:\Windows\System\KewOzun.exe
Size 8.3MB
SHA256 5511294ae929ee88075cf31c8f01d9fb10112a9df32735b34e77687f28d6747b
MD5 6d07a2f8efb93d19e8a62081b04f77c0
SHA1 ef456c798b726401e40f96a268c04d3a435e9ff2
SHA512 7cb96cbc372ddc6d0e8d6f80a3de4ffbdac9b04cd78efb938a965bd5405f6c3a0c3866027026981c03744b45e2bb2289131a7140b5340f6649a75d9dba661a04
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUr:v+D56utgpPF8u/7r
TLSH
T1C9965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MbXJbMP.exe

Path C:\Windows\System\MbXJbMP.exe
Size 8.3MB
SHA256 5595ebe85c98a137ed72978baea5c2c458c13e3276e9e02c2cdb4b6142e00bd6
MD5 6fefb1333a51d31d3be2dd99360b5df3
SHA1 da028079b2074a51fc36f852bfe6cd29fcb686a1
SHA512 a53112c4c88b945d6b826941031031ec4f7cbbaa47ac6bf7ecf6da3a3e6266198bd311d2a3d6ae3137779251235651491f5626aa806c8ad59621c032d231fff0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU3:v+D56utgpPF8u/73
TLSH
T147965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RZAUdlB.exe

Path C:\Windows\System\RZAUdlB.exe
Size 8.3MB
SHA256 def5108b635306d70e62b9959a7306822d47ae4ccca242f4ccb9214016cb31ae
MD5 234e0dfbe711efd5794a4d36ff86865f
SHA1 c19c97dfa4ffea274dfd51a4d135891422b22d40
SHA512 20e963b33094dff413d6c71947a8e0cd9e2d1ca1766e15325bbd74cfe6a4c88b6aa9e490e8741eff0d69bf05ff0b3b74350723eaaccabf08e0dc7a5d4a2613ac
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUx:v+D56utgpPF8u/7x
TLSH
T17A965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UzudeQW.exe

Path C:\Windows\System\UzudeQW.exe
Size 8.3MB
SHA256 17fd5148426f62df86a648caae5a4c953696c2d6498bb7025da8a394d0982f80
MD5 77db579ce22901219eac2f5f0a4d0500
SHA1 8be7d37883733f6b7b27dc56af1f65debb20b401
SHA512 28daae3fc4a77a031ec4fdc1785c71d956061305715744186edc0c229c4f9f039aa79f95c663552d29c6fda2b53bff23c39463511aec4b37af3d584e985c06d2
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUk:v+D56utgpPF8u/7k
TLSH
T1FC965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YwtxizT.exe

Path C:\Windows\System\YwtxizT.exe
Size 8.3MB
SHA256 a3d6e80d02539f9cea603dfc835fc5b4ed7ecb85e8195c2039a15836afb5fcce
MD5 69447357a7c6db181b2908ab366c0518
SHA1 4f33618b5fc6c4df77802c50d719aacd97210a80
SHA512 945c825ad77da86b6192e5d1956c49d44c03fa3a06b723502bb54d52c50110885bdf7d3654c44c4537c4c85e56ebfdae013aab1d43573da77e979c295b31742a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUP:v+D56utgpPF8u/7P
TLSH
T1C8965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dtFUwYt.exe

Path C:\Windows\System\dtFUwYt.exe
Size 8.3MB
SHA256 d0a3b67168ecbc03e23c2b3fcb05be1c9f3796ce5635b08147643bac6afab125
MD5 503c1183d15e9cdf0fa016850a897d78
SHA1 eb8f70e03782b21429ca9c0f618ab67120977d66
SHA512 ab204e3144eedd4e01276f7b0fdd3e638113f256046efa84176b265ad0aafa6adce2fee449bf40e87086bda35cce0b56803a16aa44b29f665fa53a3513fb3f60
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUS:v+D56utgpPF8u/7S
TLSH
T1E5965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eyDAPnJ.exe

Path C:\Windows\System\eyDAPnJ.exe
Size 8.3MB
SHA256 e98535161de0480fc850b6628c590e7ab7044e4db765b1b5ba93d1948126f127
MD5 c9aa5c2d070610ef0e864a312d94c8a0
SHA1 3724f4956c744fd573a32a613eda0da3e161a815
SHA512 3024a049f6dc9ec88b8c38339342363e649fd91644ef470be83f5549fc0b8ece1331327d923f5766baa48f557d26dd2bc8b3789530d3a81c576973bb1b37cbdc
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUX:v+D56utgpPF8u/7X
TLSH
T1C2965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fGrUNYz.exe

Path C:\Windows\System\fGrUNYz.exe
Size 8.3MB
SHA256 380136f2ca34bf834a790f6632f041d1ebe97b1742358d208854e0046a42b91c
MD5 246b10d68dbe9cdc9d82d97604e98b49
SHA1 f2ed732cba26eb92c27a6ce6cb4001be301f8230
SHA512 2e2bdcf61b9b4b0833fc20c9b818455100d854b3826e9754ecd1c25945c5fa064fa82cb918f78765786bb2bc6a32fe894e8929f629823e29b694b7a022c115e0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUY:v+D56utgpPF8u/7Y
TLSH
T118965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lSadJDT.exe

Path C:\Windows\System\lSadJDT.exe
Size 8.3MB
SHA256 2819e6358050ff896fc9782a1950ab01a8f777c787fa38528ab01ad80bef7a6e
MD5 1428118c642e36de44df86cd20673650
SHA1 cd3398019fa7ec76dd5be2631582f41204c52315
SHA512 0a61df4335779fcf40462df74ddc1d9fabc91b3d3b6afa7a794c41823ea7fcd1e44e6fe5f94d9ae511120707325dcd66250e7f84e0988487bf0922c40a79b2ef
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU6:v+D56utgpPF8u/76
TLSH
T160965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mEsVJAd.exe

Path C:\Windows\System\mEsVJAd.exe
Size 8.3MB
SHA256 a33a84c569430a164b6cf5c1d3803eb2577ae375515f1650987283c87b771603
MD5 1974402b476b72dc3bde46a7b8853e9d
SHA1 bcf55da61cbad42a0ae4c8b8302e284caadf479c
SHA512 862c696992b2270a9536d68bc2d305d6868233ed1b1bd3fda2e3dd982a0963e2af7008ff78ffdb44f53e6ab3c9921c439c5ec5a5139847dc2b7ad9a70b0ee7b4
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUv:v+D56utgpPF8u/7v
TLSH
T165965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nIYebvi.exe

Path C:\Windows\System\nIYebvi.exe
Size 8.3MB
SHA256 548fde13f956d2ec27cb3dbc7960e816b9fd8174f5131cdc9f5d089fcf631243
MD5 6a522af34cbcb0145dbae4d260e4b816
SHA1 7036a8a7d4db8a477181972fe3c8a1cc5378450e
SHA512 bbeadfdf6d42d27a3879a6ed83de6f799fadcd6797d08d0019d9072ef0a7e7a8787025ba39b0665817fdd2d25426dfceae80bd1ffc1daf3e83d4a037f130e63f
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUE:v+D56utgpPF8u/7E
TLSH
T18D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ocOxKKy.exe

Path C:\Windows\System\ocOxKKy.exe
Size 8.3MB
SHA256 3696cf083596addc97e61731ffc18eec24fc6dc11502015e72bfa6fd628d7363
MD5 9e7746c9747f0d8cab2577386dc76787
SHA1 f879862eb918c085cbe4fb4adc8ce209f796e523
SHA512 2479ae1f9eeb174485687f930226c8c3e34770ea7fccf6423711a5fdec9ca6d72e496c55310301cd964cca53bdd938dbe613c07675688b5a1a03d83842d52e33
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU/:v+D56utgpPF8u/7/
TLSH
T119965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pDOTWhb.exe

Path C:\Windows\System\pDOTWhb.exe
Size 8.3MB
SHA256 5455f9484c37ca608ae6952216b61066c3ea1cd3f9ba23aee5c109f9a9ef1842
MD5 151ef73da1f24ad8cd07f865b7badc66
SHA1 302df21dce70ed13d542f5df0f49465c93007344
SHA512 c4f78000661892c9c3485966742f11ec12ec56b6c513c64a0c82615bbae0d9a5e546d532bf35c90fa077478042e57500fb541cb17a81412eaa367d94472897aa
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUh:v+D56utgpPF8u/7h
TLSH
T1A1965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqJdAoc.exe

Path C:\Windows\System\tqJdAoc.exe
Size 8.3MB
SHA256 0091fef35bdcf7552ed551751e79f778deab7a081e2ea5b6d237f36f8f4b3a9f
MD5 6afc6de953d6410622e0110ff6fedeb1
SHA1 ae2871983924e4db2eb06cd97f87c35a67a39011
SHA512 0db128fddf9bd7676f5bdc72a64e7abbdcd3b493b5f1a33f14ad50407a270b6ecd7c191446ae6e5ad06c4fadb6e9e5c956b87c9ca11de3614735b154bfed01c6
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUZ:v+D56utgpPF8u/7Z
TLSH
T186965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vXPYDEA.exe

Path C:\Windows\System\vXPYDEA.exe
Size 8.3MB
SHA256 e12436aaa4b45d0176418d70aed43216951c21d0c720aa50acc4e2765c851399
MD5 38f10694f683723888085d1a75062d24
SHA1 864ddec01bb7ea2d391b4ecedfe31fb0b4c0aa66
SHA512 3324d155728e0669211911af1a119a7c87ee76bf89fbf67ab7bc1209eb4b11f7b047803dbc5ee5f23e8852f9b48d3ebb86f6ce198b38ebeaeddcbcc61cd41a22
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU8:v+D56utgpPF8u/78
TLSH
T12D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1260-143-0x00007FF6A1400000-0x00007FF6A1752000-memory.dmp

Download

memory/1260-8-0x00007FF6A1400000-0x00007FF6A1752000-memory.dmp

Download

memory/1260-97-0x00007FF6A1400000-0x00007FF6A1752000-memory.dmp

Download

memory/1336-83-0x00007FF7B6FE0000-0x00007FF7B7332000-memory.dmp

Download

memory/1336-150-0x00007FF7B6FE0000-0x00007FF7B7332000-memory.dmp

Download

memory/1336-135-0x00007FF7B6FE0000-0x00007FF7B7332000-memory.dmp

Download

memory/1540-104-0x00007FF71BC20000-0x00007FF71BF72000-memory.dmp

Download

memory/1540-14-0x00007FF71BC20000-0x00007FF71BF72000-memory.dmp

Download

memory/1540-144-0x00007FF71BC20000-0x00007FF71BF72000-memory.dmp

Download

memory/1564-85-0x00007FF77A6D0000-0x00007FF77AA22000-memory.dmp

Download

memory/1564-153-0x00007FF77A6D0000-0x00007FF77AA22000-memory.dmp

Download

memory/1984-142-0x00007FF6F4620000-0x00007FF6F4972000-memory.dmp

Download

memory/1984-163-0x00007FF6F4620000-0x00007FF6F4972000-memory.dmp

Download

memory/1984-130-0x00007FF6F4620000-0x00007FF6F4972000-memory.dmp

Download

memory/2284-161-0x00007FF71F380000-0x00007FF71F6D2000-memory.dmp

Download

memory/2284-140-0x00007FF71F380000-0x00007FF71F6D2000-memory.dmp

Download

memory/2284-118-0x00007FF71F380000-0x00007FF71F6D2000-memory.dmp

Download

memory/2456-146-0x00007FF6B18B0000-0x00007FF6B1C02000-memory.dmp

Download

memory/2456-26-0x00007FF6B18B0000-0x00007FF6B1C02000-memory.dmp

Download

memory/2456-124-0x00007FF6B18B0000-0x00007FF6B1C02000-memory.dmp

Download

memory/2776-156-0x00007FF673560000-0x00007FF6738B2000-memory.dmp

Download

memory/2776-88-0x00007FF673560000-0x00007FF6738B2000-memory.dmp

Download

memory/3000-157-0x00007FF7295D0000-0x00007FF729922000-memory.dmp

Download

memory/3000-136-0x00007FF7295D0000-0x00007FF729922000-memory.dmp

Download

memory/3000-89-0x00007FF7295D0000-0x00007FF729922000-memory.dmp

Download

memory/3196-111-0x00007FF6891D0000-0x00007FF689522000-memory.dmp

Download

memory/3196-139-0x00007FF6891D0000-0x00007FF689522000-memory.dmp

Download

memory/3196-160-0x00007FF6891D0000-0x00007FF689522000-memory.dmp

Download

memory/3652-117-0x00007FF66B0D0000-0x00007FF66B422000-memory.dmp

Download

memory/3652-145-0x00007FF66B0D0000-0x00007FF66B422000-memory.dmp

Download

memory/3652-19-0x00007FF66B0D0000-0x00007FF66B422000-memory.dmp

Download

memory/3692-151-0x00007FF660250000-0x00007FF6605A2000-memory.dmp

Download

memory/3692-93-0x00007FF660250000-0x00007FF6605A2000-memory.dmp

Download

memory/4112-86-0x00007FF7B6F30000-0x00007FF7B7282000-memory.dmp

Download

memory/4112-154-0x00007FF7B6F30000-0x00007FF7B7282000-memory.dmp

Download

memory/4488-147-0x00007FF6245C0000-0x00007FF624912000-memory.dmp

Download

memory/4488-32-0x00007FF6245C0000-0x00007FF624912000-memory.dmp

Download

memory/4600-1-0x0000021630630000-0x0000021630640000-memory.dmp

Download

memory/4600-92-0x00007FF7C7CF0000-0x00007FF7C8042000-memory.dmp

Download

memory/4600-0-0x00007FF7C7CF0000-0x00007FF7C8042000-memory.dmp

Download

memory/5144-158-0x00007FF7EE8B0000-0x00007FF7EEC02000-memory.dmp

Download

memory/5144-98-0x00007FF7EE8B0000-0x00007FF7EEC02000-memory.dmp

Download

memory/5144-137-0x00007FF7EE8B0000-0x00007FF7EEC02000-memory.dmp

Download

memory/5584-84-0x00007FF66D4B0000-0x00007FF66D802000-memory.dmp

Download

memory/5584-152-0x00007FF66D4B0000-0x00007FF66D802000-memory.dmp

Download

memory/5680-133-0x00007FF6D4C70000-0x00007FF6D4FC2000-memory.dmp

Download

memory/5680-148-0x00007FF6D4C70000-0x00007FF6D4FC2000-memory.dmp

Download

memory/5680-36-0x00007FF6D4C70000-0x00007FF6D4FC2000-memory.dmp

Download

memory/5688-141-0x00007FF702170000-0x00007FF7024C2000-memory.dmp

Download

memory/5688-162-0x00007FF702170000-0x00007FF7024C2000-memory.dmp

Download

memory/5688-125-0x00007FF702170000-0x00007FF7024C2000-memory.dmp

Download

memory/5844-155-0x00007FF7798A0000-0x00007FF779BF2000-memory.dmp

Download

memory/5844-87-0x00007FF7798A0000-0x00007FF779BF2000-memory.dmp

Download

memory/5960-138-0x00007FF6E7B10000-0x00007FF6E7E62000-memory.dmp

Download

memory/5960-105-0x00007FF6E7B10000-0x00007FF6E7E62000-memory.dmp

Download

memory/5960-159-0x00007FF6E7B10000-0x00007FF6E7E62000-memory.dmp

Download

memory/6036-149-0x00007FF6E37B0000-0x00007FF6E3B02000-memory.dmp

Download

memory/6036-134-0x00007FF6E37B0000-0x00007FF6E3B02000-memory.dmp

Download

memory/6036-42-0x00007FF6E37B0000-0x00007FF6E3B02000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads