cobaltstrike | dab00b854b617e0bd69e52f4b87c5ce699769b4ab5d15604f7ed8dfc11e9801f

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 5.9MB
Sample260930-sl48xaxgph
SHA256 dab00b854b617e0bd69e52f4b87c5ce699769b4ab5d15604f7ed8dfc11e9801f
MD5 ef941f9f1837844c7a1b01316b3cb05e
SHA1 4efe61be0b74dc5d2d24d08e0b18d7552c2b0b65
SHA512 b022dd06632185a499b502e15d90538058b3378a9e7270accbfe0986bd31f46fbb7096c431a23c9fc5264f29ae6eb320e448ba8cd869eb0b9db0f6274af42bcf
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUu:Q+p56utgpPF8u/7u
TLSH
T192565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x001000000001c596-4.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5a6-10.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5a5-11.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5a7-22.dat	cobalt_reflective_dll
behavioral2/files/0x001300000001c5a2-28.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5a8-32.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5a9-38.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5aa-43.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ab-46.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ac-52.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ad-57.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5af-67.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5b0-73.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5b2-78.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5b3-83.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5b8-107.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5b7-103.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5b6-98.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5b5-93.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5b4-88.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ae-63.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x001000000001c596-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5a6-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5a5-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5a7-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x001300000001c5a2-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5a8-32.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5a9-38.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5aa-43.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ab-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ac-52.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ad-57.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5af-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5b0-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5b2-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5b3-83.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5b8-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5b7-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5b6-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5b5-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5b4-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ae-63.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2168-0-0x00007FF60FF80000-0x00007FF6102D4000-memory.dmp	UPX
behavioral2/files/0x001000000001c596-4.dat	UPX
behavioral2/memory/2964-7-0x00007FF6D2C60000-0x00007FF6D2FB4000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5a6-10.dat	UPX
behavioral2/files/0x000c00000001c5a5-11.dat	UPX
behavioral2/memory/5656-14-0x00007FF603120000-0x00007FF603474000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5a7-22.dat	UPX
behavioral2/files/0x001300000001c5a2-28.dat	UPX
behavioral2/files/0x000c00000001c5a8-32.dat	UPX
behavioral2/files/0x000c00000001c5a9-38.dat	UPX
behavioral2/files/0x000c00000001c5aa-43.dat	UPX
behavioral2/files/0x000c00000001c5ab-46.dat	UPX
behavioral2/files/0x000c00000001c5ac-52.dat	UPX
behavioral2/files/0x000c00000001c5ad-57.dat	UPX
behavioral2/files/0x000c00000001c5af-67.dat	UPX
behavioral2/files/0x000c00000001c5b0-73.dat	UPX
behavioral2/files/0x000c00000001c5b2-78.dat	UPX
behavioral2/files/0x000c00000001c5b3-83.dat	UPX
behavioral2/files/0x000c00000001c5b8-107.dat	UPX
behavioral2/files/0x000c00000001c5b7-103.dat	UPX
behavioral2/files/0x000c00000001c5b6-98.dat	UPX
behavioral2/files/0x000c00000001c5b5-93.dat	UPX
behavioral2/files/0x000c00000001c5b4-88.dat	UPX
behavioral2/files/0x000c00000001c5ae-63.dat	UPX
behavioral2/memory/5708-109-0x00007FF724710000-0x00007FF724A64000-memory.dmp	UPX
behavioral2/memory/1184-113-0x00007FF6AEB50000-0x00007FF6AEEA4000-memory.dmp	UPX
behavioral2/memory/948-115-0x00007FF6A86D0000-0x00007FF6A8A24000-memory.dmp	UPX
behavioral2/memory/4364-114-0x00007FF6DFBF0000-0x00007FF6DFF44000-memory.dmp	UPX
behavioral2/memory/5636-112-0x00007FF624250000-0x00007FF6245A4000-memory.dmp	UPX
behavioral2/memory/2348-111-0x00007FF6153F0000-0x00007FF615744000-memory.dmp	UPX
behavioral2/memory/5652-110-0x00007FF614A60000-0x00007FF614DB4000-memory.dmp	UPX
behavioral2/memory/2732-116-0x00007FF608760000-0x00007FF608AB4000-memory.dmp	UPX
behavioral2/memory/5808-117-0x00007FF727310000-0x00007FF727664000-memory.dmp	UPX
behavioral2/memory/1268-118-0x00007FF6919B0000-0x00007FF691D04000-memory.dmp	UPX
behavioral2/memory/5676-120-0x00007FF670200000-0x00007FF670554000-memory.dmp	UPX
behavioral2/memory/1980-119-0x00007FF79BDB0000-0x00007FF79C104000-memory.dmp	UPX
behavioral2/memory/5988-121-0x00007FF68E340000-0x00007FF68E694000-memory.dmp	UPX
behavioral2/memory/1696-122-0x00007FF67FCB0000-0x00007FF680004000-memory.dmp	UPX
behavioral2/memory/4596-123-0x00007FF79CC90000-0x00007FF79CFE4000-memory.dmp	UPX
behavioral2/memory/2904-124-0x00007FF730B60000-0x00007FF730EB4000-memory.dmp	UPX
behavioral2/memory/852-125-0x00007FF6FBEB0000-0x00007FF6FC204000-memory.dmp	UPX
behavioral2/memory/5420-126-0x00007FF659440000-0x00007FF659794000-memory.dmp	UPX
behavioral2/memory/4628-127-0x00007FF6B2E30000-0x00007FF6B3184000-memory.dmp	UPX
behavioral2/memory/2168-128-0x00007FF60FF80000-0x00007FF6102D4000-memory.dmp	UPX
behavioral2/memory/2964-129-0x00007FF6D2C60000-0x00007FF6D2FB4000-memory.dmp	UPX
behavioral2/memory/5656-130-0x00007FF603120000-0x00007FF603474000-memory.dmp	UPX
behavioral2/memory/5708-131-0x00007FF724710000-0x00007FF724A64000-memory.dmp	UPX
behavioral2/memory/2964-132-0x00007FF6D2C60000-0x00007FF6D2FB4000-memory.dmp	UPX
behavioral2/memory/5656-133-0x00007FF603120000-0x00007FF603474000-memory.dmp	UPX
behavioral2/memory/5708-134-0x00007FF724710000-0x00007FF724A64000-memory.dmp	UPX
behavioral2/memory/4628-135-0x00007FF6B2E30000-0x00007FF6B3184000-memory.dmp	UPX
behavioral2/memory/5652-136-0x00007FF614A60000-0x00007FF614DB4000-memory.dmp	UPX
behavioral2/memory/2348-137-0x00007FF6153F0000-0x00007FF615744000-memory.dmp	UPX
behavioral2/memory/5636-138-0x00007FF624250000-0x00007FF6245A4000-memory.dmp	UPX
behavioral2/memory/1184-139-0x00007FF6AEB50000-0x00007FF6AEEA4000-memory.dmp	UPX
behavioral2/memory/2732-140-0x00007FF608760000-0x00007FF608AB4000-memory.dmp	UPX
behavioral2/memory/948-141-0x00007FF6A86D0000-0x00007FF6A8A24000-memory.dmp	UPX
behavioral2/memory/4364-142-0x00007FF6DFBF0000-0x00007FF6DFF44000-memory.dmp	UPX
behavioral2/memory/5808-144-0x00007FF727310000-0x00007FF727664000-memory.dmp	UPX
behavioral2/memory/1980-145-0x00007FF79BDB0000-0x00007FF79C104000-memory.dmp	UPX
behavioral2/memory/1268-143-0x00007FF6919B0000-0x00007FF691D04000-memory.dmp	UPX
behavioral2/memory/5988-147-0x00007FF68E340000-0x00007FF68E694000-memory.dmp	UPX
behavioral2/memory/1696-146-0x00007FF67FCB0000-0x00007FF680004000-memory.dmp	UPX
behavioral2/memory/4596-149-0x00007FF79CC90000-0x00007FF79CFE4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2168-0-0x00007FF60FF80000-0x00007FF6102D4000-memory.dmp	xmrig
behavioral2/files/0x001000000001c596-4.dat	xmrig
behavioral2/memory/2964-7-0x00007FF6D2C60000-0x00007FF6D2FB4000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5a6-10.dat	xmrig
behavioral2/files/0x000c00000001c5a5-11.dat	xmrig
behavioral2/memory/5656-14-0x00007FF603120000-0x00007FF603474000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5a7-22.dat	xmrig
behavioral2/files/0x001300000001c5a2-28.dat	xmrig
behavioral2/files/0x000c00000001c5a8-32.dat	xmrig
behavioral2/files/0x000c00000001c5a9-38.dat	xmrig
behavioral2/files/0x000c00000001c5aa-43.dat	xmrig
behavioral2/files/0x000c00000001c5ab-46.dat	xmrig
behavioral2/files/0x000c00000001c5ac-52.dat	xmrig
behavioral2/files/0x000c00000001c5ad-57.dat	xmrig
behavioral2/files/0x000c00000001c5af-67.dat	xmrig
behavioral2/files/0x000c00000001c5b0-73.dat	xmrig
behavioral2/files/0x000c00000001c5b2-78.dat	xmrig
behavioral2/files/0x000c00000001c5b3-83.dat	xmrig
behavioral2/files/0x000c00000001c5b8-107.dat	xmrig
behavioral2/files/0x000c00000001c5b7-103.dat	xmrig
behavioral2/files/0x000c00000001c5b6-98.dat	xmrig
behavioral2/files/0x000c00000001c5b5-93.dat	xmrig
behavioral2/files/0x000c00000001c5b4-88.dat	xmrig
behavioral2/files/0x000c00000001c5ae-63.dat	xmrig
behavioral2/memory/5708-109-0x00007FF724710000-0x00007FF724A64000-memory.dmp	xmrig
behavioral2/memory/1184-113-0x00007FF6AEB50000-0x00007FF6AEEA4000-memory.dmp	xmrig
behavioral2/memory/948-115-0x00007FF6A86D0000-0x00007FF6A8A24000-memory.dmp	xmrig
behavioral2/memory/4364-114-0x00007FF6DFBF0000-0x00007FF6DFF44000-memory.dmp	xmrig
behavioral2/memory/5636-112-0x00007FF624250000-0x00007FF6245A4000-memory.dmp	xmrig
behavioral2/memory/2348-111-0x00007FF6153F0000-0x00007FF615744000-memory.dmp	xmrig
behavioral2/memory/5652-110-0x00007FF614A60000-0x00007FF614DB4000-memory.dmp	xmrig
behavioral2/memory/2732-116-0x00007FF608760000-0x00007FF608AB4000-memory.dmp	xmrig
behavioral2/memory/5808-117-0x00007FF727310000-0x00007FF727664000-memory.dmp	xmrig
behavioral2/memory/1268-118-0x00007FF6919B0000-0x00007FF691D04000-memory.dmp	xmrig
behavioral2/memory/5676-120-0x00007FF670200000-0x00007FF670554000-memory.dmp	xmrig
behavioral2/memory/1980-119-0x00007FF79BDB0000-0x00007FF79C104000-memory.dmp	xmrig
behavioral2/memory/5988-121-0x00007FF68E340000-0x00007FF68E694000-memory.dmp	xmrig
behavioral2/memory/1696-122-0x00007FF67FCB0000-0x00007FF680004000-memory.dmp	xmrig
behavioral2/memory/4596-123-0x00007FF79CC90000-0x00007FF79CFE4000-memory.dmp	xmrig
behavioral2/memory/2904-124-0x00007FF730B60000-0x00007FF730EB4000-memory.dmp	xmrig
behavioral2/memory/852-125-0x00007FF6FBEB0000-0x00007FF6FC204000-memory.dmp	xmrig
behavioral2/memory/5420-126-0x00007FF659440000-0x00007FF659794000-memory.dmp	xmrig
behavioral2/memory/4628-127-0x00007FF6B2E30000-0x00007FF6B3184000-memory.dmp	xmrig
behavioral2/memory/2168-128-0x00007FF60FF80000-0x00007FF6102D4000-memory.dmp	xmrig
behavioral2/memory/2964-129-0x00007FF6D2C60000-0x00007FF6D2FB4000-memory.dmp	xmrig
behavioral2/memory/5656-130-0x00007FF603120000-0x00007FF603474000-memory.dmp	xmrig
behavioral2/memory/5708-131-0x00007FF724710000-0x00007FF724A64000-memory.dmp	xmrig
behavioral2/memory/2964-132-0x00007FF6D2C60000-0x00007FF6D2FB4000-memory.dmp	xmrig
behavioral2/memory/5656-133-0x00007FF603120000-0x00007FF603474000-memory.dmp	xmrig
behavioral2/memory/5708-134-0x00007FF724710000-0x00007FF724A64000-memory.dmp	xmrig
behavioral2/memory/4628-135-0x00007FF6B2E30000-0x00007FF6B3184000-memory.dmp	xmrig
behavioral2/memory/5652-136-0x00007FF614A60000-0x00007FF614DB4000-memory.dmp	xmrig
behavioral2/memory/2348-137-0x00007FF6153F0000-0x00007FF615744000-memory.dmp	xmrig
behavioral2/memory/5636-138-0x00007FF624250000-0x00007FF6245A4000-memory.dmp	xmrig
behavioral2/memory/1184-139-0x00007FF6AEB50000-0x00007FF6AEEA4000-memory.dmp	xmrig
behavioral2/memory/2732-140-0x00007FF608760000-0x00007FF608AB4000-memory.dmp	xmrig
behavioral2/memory/948-141-0x00007FF6A86D0000-0x00007FF6A8A24000-memory.dmp	xmrig
behavioral2/memory/4364-142-0x00007FF6DFBF0000-0x00007FF6DFF44000-memory.dmp	xmrig
behavioral2/memory/5808-144-0x00007FF727310000-0x00007FF727664000-memory.dmp	xmrig
behavioral2/memory/1980-145-0x00007FF79BDB0000-0x00007FF79C104000-memory.dmp	xmrig
behavioral2/memory/1268-143-0x00007FF6919B0000-0x00007FF691D04000-memory.dmp	xmrig
behavioral2/memory/5988-147-0x00007FF68E340000-0x00007FF68E694000-memory.dmp	xmrig
behavioral2/memory/1696-146-0x00007FF67FCB0000-0x00007FF680004000-memory.dmp	xmrig
behavioral2/memory/4596-149-0x00007FF79CC90000-0x00007FF79CFE4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2964	JblanpZ.exe
5656	aRykXIu.exe
5708	UhiuRUq.exe
4628	csbWcLe.exe
5652	QIjskde.exe
2348	stHdASd.exe
5636	pfCFbpb.exe
1184	WeQTrbE.exe
4364	FRyfWsm.exe
948	jQvrQZy.exe
2732	wJPhAOb.exe
5808	DQpUDFV.exe
1268	eSpcXmt.exe
1980	HUDpXFF.exe
5676	VjPDexb.exe
5988	aARITJm.exe
1696	kuNLozf.exe
4596	BZtlCzr.exe
2904	jZjXbrt.exe
852	YmezZsV.exe
5420	jNbIgrk.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2168-0-0x00007FF60FF80000-0x00007FF6102D4000-memory.dmp	upx
behavioral2/files/0x001000000001c596-4.dat	upx
behavioral2/memory/2964-7-0x00007FF6D2C60000-0x00007FF6D2FB4000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a6-10.dat	upx
behavioral2/files/0x000c00000001c5a5-11.dat	upx
behavioral2/memory/5656-14-0x00007FF603120000-0x00007FF603474000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a7-22.dat	upx
behavioral2/files/0x001300000001c5a2-28.dat	upx
behavioral2/files/0x000c00000001c5a8-32.dat	upx
behavioral2/files/0x000c00000001c5a9-38.dat	upx
behavioral2/files/0x000c00000001c5aa-43.dat	upx
behavioral2/files/0x000c00000001c5ab-46.dat	upx
behavioral2/files/0x000c00000001c5ac-52.dat	upx
behavioral2/files/0x000c00000001c5ad-57.dat	upx
behavioral2/files/0x000c00000001c5af-67.dat	upx
behavioral2/files/0x000c00000001c5b0-73.dat	upx
behavioral2/files/0x000c00000001c5b2-78.dat	upx
behavioral2/files/0x000c00000001c5b3-83.dat	upx
behavioral2/files/0x000c00000001c5b8-107.dat	upx
behavioral2/files/0x000c00000001c5b7-103.dat	upx
behavioral2/files/0x000c00000001c5b6-98.dat	upx
behavioral2/files/0x000c00000001c5b5-93.dat	upx
behavioral2/files/0x000c00000001c5b4-88.dat	upx
behavioral2/files/0x000c00000001c5ae-63.dat	upx
behavioral2/memory/5708-109-0x00007FF724710000-0x00007FF724A64000-memory.dmp	upx
behavioral2/memory/1184-113-0x00007FF6AEB50000-0x00007FF6AEEA4000-memory.dmp	upx
behavioral2/memory/948-115-0x00007FF6A86D0000-0x00007FF6A8A24000-memory.dmp	upx
behavioral2/memory/4364-114-0x00007FF6DFBF0000-0x00007FF6DFF44000-memory.dmp	upx
behavioral2/memory/5636-112-0x00007FF624250000-0x00007FF6245A4000-memory.dmp	upx
behavioral2/memory/2348-111-0x00007FF6153F0000-0x00007FF615744000-memory.dmp	upx
behavioral2/memory/5652-110-0x00007FF614A60000-0x00007FF614DB4000-memory.dmp	upx
behavioral2/memory/2732-116-0x00007FF608760000-0x00007FF608AB4000-memory.dmp	upx
behavioral2/memory/5808-117-0x00007FF727310000-0x00007FF727664000-memory.dmp	upx
behavioral2/memory/1268-118-0x00007FF6919B0000-0x00007FF691D04000-memory.dmp	upx
behavioral2/memory/5676-120-0x00007FF670200000-0x00007FF670554000-memory.dmp	upx
behavioral2/memory/1980-119-0x00007FF79BDB0000-0x00007FF79C104000-memory.dmp	upx
behavioral2/memory/5988-121-0x00007FF68E340000-0x00007FF68E694000-memory.dmp	upx
behavioral2/memory/1696-122-0x00007FF67FCB0000-0x00007FF680004000-memory.dmp	upx
behavioral2/memory/4596-123-0x00007FF79CC90000-0x00007FF79CFE4000-memory.dmp	upx
behavioral2/memory/2904-124-0x00007FF730B60000-0x00007FF730EB4000-memory.dmp	upx
behavioral2/memory/852-125-0x00007FF6FBEB0000-0x00007FF6FC204000-memory.dmp	upx
behavioral2/memory/5420-126-0x00007FF659440000-0x00007FF659794000-memory.dmp	upx
behavioral2/memory/4628-127-0x00007FF6B2E30000-0x00007FF6B3184000-memory.dmp	upx
behavioral2/memory/2168-128-0x00007FF60FF80000-0x00007FF6102D4000-memory.dmp	upx
behavioral2/memory/2964-129-0x00007FF6D2C60000-0x00007FF6D2FB4000-memory.dmp	upx
behavioral2/memory/5656-130-0x00007FF603120000-0x00007FF603474000-memory.dmp	upx
behavioral2/memory/5708-131-0x00007FF724710000-0x00007FF724A64000-memory.dmp	upx
behavioral2/memory/2964-132-0x00007FF6D2C60000-0x00007FF6D2FB4000-memory.dmp	upx
behavioral2/memory/5656-133-0x00007FF603120000-0x00007FF603474000-memory.dmp	upx
behavioral2/memory/5708-134-0x00007FF724710000-0x00007FF724A64000-memory.dmp	upx
behavioral2/memory/4628-135-0x00007FF6B2E30000-0x00007FF6B3184000-memory.dmp	upx
behavioral2/memory/5652-136-0x00007FF614A60000-0x00007FF614DB4000-memory.dmp	upx
behavioral2/memory/2348-137-0x00007FF6153F0000-0x00007FF615744000-memory.dmp	upx
behavioral2/memory/5636-138-0x00007FF624250000-0x00007FF6245A4000-memory.dmp	upx
behavioral2/memory/1184-139-0x00007FF6AEB50000-0x00007FF6AEEA4000-memory.dmp	upx
behavioral2/memory/2732-140-0x00007FF608760000-0x00007FF608AB4000-memory.dmp	upx
behavioral2/memory/948-141-0x00007FF6A86D0000-0x00007FF6A8A24000-memory.dmp	upx
behavioral2/memory/4364-142-0x00007FF6DFBF0000-0x00007FF6DFF44000-memory.dmp	upx
behavioral2/memory/5808-144-0x00007FF727310000-0x00007FF727664000-memory.dmp	upx
behavioral2/memory/1980-145-0x00007FF79BDB0000-0x00007FF79C104000-memory.dmp	upx
behavioral2/memory/1268-143-0x00007FF6919B0000-0x00007FF691D04000-memory.dmp	upx
behavioral2/memory/5988-147-0x00007FF68E340000-0x00007FF68E694000-memory.dmp	upx
behavioral2/memory/1696-146-0x00007FF67FCB0000-0x00007FF680004000-memory.dmp	upx
behavioral2/memory/4596-149-0x00007FF79CC90000-0x00007FF79CFE4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\WeQTrbE.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\FRyfWsm.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\QIjskde.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\stHdASd.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\kuNLozf.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\YmezZsV.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\JblanpZ.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\aRykXIu.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\UhiuRUq.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\csbWcLe.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\pfCFbpb.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\jQvrQZy.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\wJPhAOb.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\aARITJm.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\DQpUDFV.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\eSpcXmt.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\HUDpXFF.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\VjPDexb.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\BZtlCzr.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\jZjXbrt.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\jNbIgrk.exe	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2964	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 2168 wrote to memory of 5656	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 2168 wrote to memory of 5708	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 2168 wrote to memory of 4628	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 2168 wrote to memory of 5652	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 2168 wrote to memory of 2348	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 2168 wrote to memory of 5636	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 2168 wrote to memory of 1184	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 2168 wrote to memory of 4364	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 2168 wrote to memory of 948	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 2168 wrote to memory of 2732	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 2168 wrote to memory of 5808	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 2168 wrote to memory of 1268	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 2168 wrote to memory of 1980	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 2168 wrote to memory of 5676	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 2168 wrote to memory of 5988	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 2168 wrote to memory of 1696	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 2168 wrote to memory of 4596	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 2168 wrote to memory of 2904	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109
PID 2168 wrote to memory of 852	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	110
PID 2168 wrote to memory of 5420	2168	2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ef941f9f1837844c7a1b01316b3cb05e_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\System\JblanpZ.exe
  C:\Windows\System\JblanpZ.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\aRykXIu.exe
  C:\Windows\System\aRykXIu.exe
  2⤵
  - Executes dropped EXE
  PID:5656
- C:\Windows\System\UhiuRUq.exe
  C:\Windows\System\UhiuRUq.exe
  2⤵
  - Executes dropped EXE
  PID:5708
- C:\Windows\System\csbWcLe.exe
  C:\Windows\System\csbWcLe.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\QIjskde.exe
  C:\Windows\System\QIjskde.exe
  2⤵
  - Executes dropped EXE
  PID:5652
- C:\Windows\System\stHdASd.exe
  C:\Windows\System\stHdASd.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\pfCFbpb.exe
  C:\Windows\System\pfCFbpb.exe
  2⤵
  - Executes dropped EXE
  PID:5636
- C:\Windows\System\WeQTrbE.exe
  C:\Windows\System\WeQTrbE.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\FRyfWsm.exe
  C:\Windows\System\FRyfWsm.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\jQvrQZy.exe
  C:\Windows\System\jQvrQZy.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\wJPhAOb.exe
  C:\Windows\System\wJPhAOb.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\DQpUDFV.exe
  C:\Windows\System\DQpUDFV.exe
  2⤵
  - Executes dropped EXE
  PID:5808
- C:\Windows\System\eSpcXmt.exe
  C:\Windows\System\eSpcXmt.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\HUDpXFF.exe
  C:\Windows\System\HUDpXFF.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\VjPDexb.exe
  C:\Windows\System\VjPDexb.exe
  2⤵
  - Executes dropped EXE
  PID:5676
- C:\Windows\System\aARITJm.exe
  C:\Windows\System\aARITJm.exe
  2⤵
  - Executes dropped EXE
  PID:5988
- C:\Windows\System\kuNLozf.exe
  C:\Windows\System\kuNLozf.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\BZtlCzr.exe
  C:\Windows\System\BZtlCzr.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\jZjXbrt.exe
  C:\Windows\System\jZjXbrt.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\YmezZsV.exe
  C:\Windows\System\YmezZsV.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\jNbIgrk.exe
  C:\Windows\System\jNbIgrk.exe
  2⤵
  - Executes dropped EXE
  PID:5420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BZtlCzr.exe

Path C:\Windows\System\BZtlCzr.exe
Size 5.9MB
SHA256 1fbe2d07e7ba530b6665b6d3b1e0334e027299af99876e84c03f3b5f8bef7167
MD5 11dfdbb9c3e99413746e67d866891858
SHA1 b718f5486718906787db3431f6b8b5c78e4fd2e2
SHA512 d0690b53d4f271de91b694ea7c825685c706aebdbb411d50cae81beb716d98e141a4b79c57fd31d1804f218933d14a0557db46b9f067e46d403632d1728f6e3d
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lU8:Q+p56utgpPF8u/78
TLSH
T171565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DQpUDFV.exe

Path C:\Windows\System\DQpUDFV.exe
Size 5.9MB
SHA256 9602e52917aab9fa84d19076bcdb61e38517c6deae5dcd258084a1f564607ef6
MD5 5c91c9b7219804183bc22b143535fc5e
SHA1 2c0c0b2daace56dd324d2fe254d62bc848278451
SHA512 91cb3f3cb55cbbbb05d4e83a22c711f8850b1a36516690cb64f75b7d6285bd3aa85dc9f27eb668cc4e5a036f5d26f6065af3317b5266aebdc361aa94b721bc48
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUb:Q+p56utgpPF8u/7b
TLSH
T1BB565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FRyfWsm.exe

Path C:\Windows\System\FRyfWsm.exe
Size 5.9MB
SHA256 cd72ab73f14813ade4e939417b57b5dbd1e19b6d4ecb798423879f79c75cde97
MD5 b550bcdfd5bffa3590ad5a65728c8ce7
SHA1 e4079257a56757541cbc730c7801b21b1887a3fe
SHA512 3bca18f9270dcb3856bdd6cb28074671dfdf1fce13c60e8a79c3133a40308b9e0b8b5681ddecf21df58b5053db590f29fee016d31ea31a2b9c6e2901480c1333
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUj:Q+p56utgpPF8u/7j
TLSH
T176565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HUDpXFF.exe

Path C:\Windows\System\HUDpXFF.exe
Size 5.9MB
SHA256 9c08f71ec7e1385415b200beeedb4bceda7c24a23f97c3517327abb2cbd9e9b2
MD5 a3973cb3c90a6d9d7f3ba75741258149
SHA1 51fc6175ea9f23f2778f3db42a188db57f42bc32
SHA512 ef9d566ef9e0dd15539e30e229205d14facbcecb28d4a8b268517e6b750c77f87654516f7040f0c51944b607d844331a8d654777a61c920548a6383f22433562
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUa:Q+p56utgpPF8u/7a
TLSH
T164565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JblanpZ.exe

Path C:\Windows\System\JblanpZ.exe
Size 5.9MB
SHA256 88b574ee1934e86287ea65c52d48c4e16147c7bce0cbfbd9801c449a697d0b77
MD5 e9b1e6a1cc2dfe952ec8308fa848cbb2
SHA1 45ca01fb031799b7980c534daac0f2a9974e995b
SHA512 20b20120fe1406dc2a58197fdd07f4789262bc30e88eb23322821210fbcbad90d486705ec1cc310f7bc4190bf592f6cea59712dc222bac4704d390084c106514
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lU/:Q+p56utgpPF8u/7/
TLSH
T107565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QIjskde.exe

Path C:\Windows\System\QIjskde.exe
Size 5.9MB
SHA256 5f98fe85041fdec1b208a5660a427c15f56ea842ecd640283de658b749d00177
MD5 b9f2e17e2acfda69f1f9184f0ee0bac1
SHA1 133972c916423069f59e203e0297c4e769a34181
SHA512 d4795445454e1bdcc7c4ed59c7742cf07a863c961b4143a00a6ccbe649781bff21bd37b1df2c64e118d888c3e35b3f768c5eca10b3e3768775b95250c359e837
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lU9:Q+p56utgpPF8u/79
TLSH
T138565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UhiuRUq.exe

Path C:\Windows\System\UhiuRUq.exe
Size 5.9MB
SHA256 bc7a559a53937397c942c76bca57513ef4553bae9de8b861e029bb563df78f83
MD5 d40fc183910a19933ce3546b94eaa06c
SHA1 ddf54e49817fb94562d7b83ebb66585c410aad0d
SHA512 d2fc72e9f18ccdb0845d1e394cf39868f8f2028e96af596850f334f2b83c785d09412cadd8b7597e1434811ad9b5d577e1f597f0e355e9ac0baa6953ce127c85
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUH:Q+p56utgpPF8u/7H
TLSH
T1AC565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VjPDexb.exe

Path C:\Windows\System\VjPDexb.exe
Size 5.9MB
SHA256 591f541303af09e8f5d47beae81a32aee8d1df8546482e15e5b288f266c34a8a
MD5 b41bbdd0da9108d2e9f64dba0960982c
SHA1 20ab7ff025b56d8307612f1b53c9c0a23e6ecba4
SHA512 e2c97c4fa6bef28ef1534427df7b0f730d833d4baf2b57a6b4e3f8c38095a2c3dc342dcbe9c85d1e6c26703d905962276c344d399136b36aba3874474d338dd1
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUm:Q+p56utgpPF8u/7m
TLSH
T198565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WeQTrbE.exe

Path C:\Windows\System\WeQTrbE.exe
Size 5.9MB
SHA256 b527b393f9d4d3a7a3981818be4aefc97143c81c595d290758c94ef9434c6711
MD5 7af5a4bef46195288a63a7dd297ab9e4
SHA1 133316202033dab918724ea9ac156c034c2b8ba6
SHA512 36964d7a032b9d5dc14f2297aaba3fe045a17e323195ad00d5952594819f66f5eb9f2a18b8c9a690f55f91b578f17e3151dd97c756aa7337ffcd6814013db87e
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUe:Q+p56utgpPF8u/7e
TLSH
T1A1565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YmezZsV.exe

Path C:\Windows\System\YmezZsV.exe
Size 5.9MB
SHA256 fd42049f672592e28d930892f386190536e7760e27644b7eb223bd1feea16042
MD5 ee384cba849551ab24e4fc6bc006ef7b
SHA1 ca750197d5f2123e07af07633a1166cf44866fb1
SHA512 1bd6352210747f3a72ee18276489f7ed1ed395f635cfe877c3a76d7ee1529fc16e83ddb1bd9ee074dc37a2871709167f5715179feee70f4b31aae27426e223ed
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUd:Q+p56utgpPF8u/7d
TLSH
T1C3565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aARITJm.exe

Path C:\Windows\System\aARITJm.exe
Size 5.9MB
SHA256 be5b0d7a7a2baf34bab8c917401b288de282bb92675a15ddecf746570bdbdca8
MD5 60a1df8c6162d6aa2f240c66218a3413
SHA1 4040c6a1c5e4fc7c92818e91125c60ad9f688c19
SHA512 77b373a844ec595f29e6ef9824c517ddfabc487fbff0eaa393472e1279eae2a3087f57948ed1b1f1a16e14c152106536ab2dcb4f631a4c80c3c0bfd3b3c36e05
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lU1:Q+p56utgpPF8u/71
TLSH
T11D565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aRykXIu.exe

Path C:\Windows\System\aRykXIu.exe
Size 5.9MB
SHA256 ef6b2a05608607dc74b99bf561e87f53f1aa80a899e72cc1bcc5e5dc71dcb70b
MD5 2349aac1739e17f26f9ba11db27f47b1
SHA1 a213b4201da5da74fd45f70445cc2bc1fd8db716
SHA512 b42cf46b7fbcdfa065d026541cdb077258f06e4c78b69d7d7c139dd30d1e3fa22ac124ee6614e5e36b28bec8e55f0c2403a44f5e8cd1ac6593fa6b314238ec1b
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUV:Q+p56utgpPF8u/7V
TLSH
T115565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csbWcLe.exe

Path C:\Windows\System\csbWcLe.exe
Size 5.9MB
SHA256 6478ad45275dd6af6f6c215aee5fd1ab94621c1a3a510b0d371464dc9d7c5ce7
MD5 278168d006cd6dab3b52b73e5e4244ef
SHA1 6dca77f08f9f6b06a87597f13ffbce19dcc8d44d
SHA512 4fe850e9a1b6b60bef36ca39bda09cc4e4dc44ebe90252465ec6e18d89ee77bbdad498bbfce7a5c017bbfca5ce8e4f94dfdcc67c50ae1f1c943d89346e9b2556
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUH:Q+p56utgpPF8u/7H
TLSH
T10A565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eSpcXmt.exe

Path C:\Windows\System\eSpcXmt.exe
Size 5.9MB
SHA256 9599c4166221362af49283616938201b4998c94d34c974d0bec4846781a168c1
MD5 204d553c57de12117acfab8a96b53ba0
SHA1 90ecf8d3e1adccd1cda2c4c6f120b1ae545fe8b8
SHA512 72ed35cdf5a95f5f1d2f454cbc8bac128fe2869495a0d03b9a36315ad0e9e37a781bc872c39bc58cb1c62040f38f51d0d7fcf19c36464aeb5c5362e5a93a599c
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUH:Q+p56utgpPF8u/7H
TLSH
T1A1565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jNbIgrk.exe

Path C:\Windows\System\jNbIgrk.exe
Size 5.9MB
SHA256 0561ef8650d307e4a1b6fc0f3def4d7157d02361fcf131df98890ef505c65781
MD5 76ef6f62e28292b76e0485f6760be615
SHA1 d8e9522957466063ac8babeb178b8e6bd9e49c13
SHA512 92215422a83a986d3e8e8656509112222b618438aa5021c0a19befca649971a441c8d347ef68d837940070cbb355ddd13bd071e71aa1164e3813524345a824d7
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUc:Q+p56utgpPF8u/7c
TLSH
T1AC565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jQvrQZy.exe

Path C:\Windows\System\jQvrQZy.exe
Size 5.9MB
SHA256 9456c60e616bd9b483155a90b7a23142e78de2951fd03735f7faba3eab4b733c
MD5 6ffed08d6a1132120cd1dba58badec36
SHA1 f9afba16f2df3378043271f3cb53643f3019cd7b
SHA512 940118092785326b2db7e5eb713ab09a04db3c91f2160a65bee711fbfaf832bf9f959997ad38060bfaccc39251fff0fd4dc16d49b8c9a266790adbd24021f6a4
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUa:Q+p56utgpPF8u/7a
TLSH
T124565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jZjXbrt.exe

Path C:\Windows\System\jZjXbrt.exe
Size 5.9MB
SHA256 08f2270ce124146abefd6bfc01199fca1ab933bffe77903c831e4162f7c7f398
MD5 780e5d30cff78249029da240a2f8e889
SHA1 c652718d113be84da4b492d1c002f516936cfe14
SHA512 50dddbdc3941f55a333a7bcedaae4b1ee62a08156891dbf3dc0e7046b3ebc1970bc0086b198796795f12441d96068dd1c94617d72f599c8ef2647915e78a2818
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lU+:Q+p56utgpPF8u/7+
TLSH
T1CA565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kuNLozf.exe

Path C:\Windows\System\kuNLozf.exe
Size 5.9MB
SHA256 adff62a0836b08a50b6feb193a27935550858f15060229dec6d7a734821cb99f
MD5 242ab75847ec2d736471e348bbd2e17b
SHA1 9c843ad724becc5f06723684d4916f0f3d04c1e3
SHA512 d451688ebc1db9862b0ca123bc108a9611f6e3e27ff6f3560dadd754d86af0646c60c50ebd4efdc838cbd23019b77e125b93ce3f466866be90f49f5ae42f4713
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUi:Q+p56utgpPF8u/7i
TLSH
T1F4565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pfCFbpb.exe

Path C:\Windows\System\pfCFbpb.exe
Size 5.9MB
SHA256 b697181d9687c9db4aa4a9f3ba18b0b8fa730100436663523375bf2daa085b4e
MD5 615e176156ad44e78dd8ff36a7ae7004
SHA1 9831bac2d2c775a8d50858666212dd3aa60a313f
SHA512 52fdd5d08c4f5d02c83b5387494a0dc0d745b10c9bd6520d8f1ab9795c23d0896d37fcda47ec05e4dd8114d0ff6929a0ea85f2e92507ec1fe6774a15807d91f0
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUc:Q+p56utgpPF8u/7c
TLSH
T1E7565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stHdASd.exe

Path C:\Windows\System\stHdASd.exe
Size 5.9MB
SHA256 c794dd13ab33671117e7c4355e6863b4e2157844a4966c458d09c1b2c8adfd87
MD5 0bba918e9b6abe9f55697ab3cc783207
SHA1 423dd6f528c96d8ff7ee2776b65e1760af85c55e
SHA512 cadc0e70c65e1c4df35dff399c42e9a1a3f3a0b15a76c57d1a96bdda1b9c5109838760b783f9361a8e4f6e2718c9421f77d16b4376b4a0768f1d11ee5d594562
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUd:Q+p56utgpPF8u/7d
TLSH
T119565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wJPhAOb.exe

Path C:\Windows\System\wJPhAOb.exe
Size 5.9MB
SHA256 61db6f4e4f29be05de63054abd960ed90d10c6f5f3440b5a7a7f48f2374c0844
MD5 eb9222afc6e2ec8876ad323187af5a48
SHA1 998f5dd6c9e8d1284e4260bea5476cff46185190
SHA512 f586fa324572616da96ae92ef98571df0d423eb475b7ea0a5bf9098ef8c4c9f2f16e6cb08fb5e4c19bbee0e49cf5818eb4d9c929afee8355d1978f1a91e5d20c
SSDEEP 98304:BemTLkNdfE0pZrw56utgpPFotBER/mQ32lUD:Q+p56utgpPF8u/7D
TLSH
T1A8565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/852-125-0x00007FF6FBEB0000-0x00007FF6FC204000-memory.dmp

Download

memory/852-150-0x00007FF6FBEB0000-0x00007FF6FC204000-memory.dmp

Download

memory/948-115-0x00007FF6A86D0000-0x00007FF6A8A24000-memory.dmp

Download

memory/948-141-0x00007FF6A86D0000-0x00007FF6A8A24000-memory.dmp

Download

memory/1184-113-0x00007FF6AEB50000-0x00007FF6AEEA4000-memory.dmp

Download

memory/1184-139-0x00007FF6AEB50000-0x00007FF6AEEA4000-memory.dmp

Download

memory/1268-118-0x00007FF6919B0000-0x00007FF691D04000-memory.dmp

Download

memory/1268-143-0x00007FF6919B0000-0x00007FF691D04000-memory.dmp

Download

memory/1696-122-0x00007FF67FCB0000-0x00007FF680004000-memory.dmp

Download

memory/1696-146-0x00007FF67FCB0000-0x00007FF680004000-memory.dmp

Download

memory/1980-145-0x00007FF79BDB0000-0x00007FF79C104000-memory.dmp

Download

memory/1980-119-0x00007FF79BDB0000-0x00007FF79C104000-memory.dmp

Download

memory/2168-1-0x0000025341910000-0x0000025341920000-memory.dmp

Download

memory/2168-0-0x00007FF60FF80000-0x00007FF6102D4000-memory.dmp

Download

memory/2168-128-0x00007FF60FF80000-0x00007FF6102D4000-memory.dmp

Download

memory/2348-111-0x00007FF6153F0000-0x00007FF615744000-memory.dmp

Download

memory/2348-137-0x00007FF6153F0000-0x00007FF615744000-memory.dmp

Download

memory/2732-140-0x00007FF608760000-0x00007FF608AB4000-memory.dmp

Download

memory/2732-116-0x00007FF608760000-0x00007FF608AB4000-memory.dmp

Download

memory/2904-124-0x00007FF730B60000-0x00007FF730EB4000-memory.dmp

Download

memory/2904-148-0x00007FF730B60000-0x00007FF730EB4000-memory.dmp

Download

memory/2964-129-0x00007FF6D2C60000-0x00007FF6D2FB4000-memory.dmp

Download

memory/2964-132-0x00007FF6D2C60000-0x00007FF6D2FB4000-memory.dmp

Download

memory/2964-7-0x00007FF6D2C60000-0x00007FF6D2FB4000-memory.dmp

Download

memory/4364-142-0x00007FF6DFBF0000-0x00007FF6DFF44000-memory.dmp

Download

memory/4364-114-0x00007FF6DFBF0000-0x00007FF6DFF44000-memory.dmp

Download

memory/4596-123-0x00007FF79CC90000-0x00007FF79CFE4000-memory.dmp

Download

memory/4596-149-0x00007FF79CC90000-0x00007FF79CFE4000-memory.dmp

Download

memory/4628-127-0x00007FF6B2E30000-0x00007FF6B3184000-memory.dmp

Download

memory/4628-135-0x00007FF6B2E30000-0x00007FF6B3184000-memory.dmp

Download

memory/5420-126-0x00007FF659440000-0x00007FF659794000-memory.dmp

Download

memory/5420-152-0x00007FF659440000-0x00007FF659794000-memory.dmp

Download

memory/5636-112-0x00007FF624250000-0x00007FF6245A4000-memory.dmp

Download

memory/5636-138-0x00007FF624250000-0x00007FF6245A4000-memory.dmp

Download

memory/5652-136-0x00007FF614A60000-0x00007FF614DB4000-memory.dmp

Download

memory/5652-110-0x00007FF614A60000-0x00007FF614DB4000-memory.dmp

Download

memory/5656-133-0x00007FF603120000-0x00007FF603474000-memory.dmp

Download

memory/5656-130-0x00007FF603120000-0x00007FF603474000-memory.dmp

Download

memory/5656-14-0x00007FF603120000-0x00007FF603474000-memory.dmp

Download

memory/5676-151-0x00007FF670200000-0x00007FF670554000-memory.dmp

Download

memory/5676-120-0x00007FF670200000-0x00007FF670554000-memory.dmp

Download

memory/5708-131-0x00007FF724710000-0x00007FF724A64000-memory.dmp

Download

memory/5708-134-0x00007FF724710000-0x00007FF724A64000-memory.dmp

Download

memory/5708-109-0x00007FF724710000-0x00007FF724A64000-memory.dmp

Download

memory/5808-144-0x00007FF727310000-0x00007FF727664000-memory.dmp

Download

memory/5808-117-0x00007FF727310000-0x00007FF727664000-memory.dmp

Download

memory/5988-147-0x00007FF68E340000-0x00007FF68E694000-memory.dmp

Download

memory/5988-121-0x00007FF68E340000-0x00007FF68E694000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads