xmrig | 6a8beed343b41802de638cfba56d72b031ecd0494a125bb800359e0b8434df41

Resubmissions

09/10/2026, 17:38

261009-v72e9act5x10

09/10/2026, 17:33

261009-v45y9s1whs10

Analysis

user interaction
yes
max time kernel
2s
max time network
20s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-08_3430067162f22b35e2193a4c032c709b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 6.1MB
Sample261009-v72e9act5x
SHA256 6a8beed343b41802de638cfba56d72b031ecd0494a125bb800359e0b8434df41
MD5 3430067162f22b35e2193a4c032c709b
SHA1 ed248ba5ff090434e6077904b7bb695c2afd7b16
SHA512 da71d5899310e79dc35d8982d82c148e64a46166a18481655db5c7038d208685dff701b36ff95ed7ff262cea37ff6c2ef2887d49371f62de2b3b227495c4c05d
SSDEEP 98304:oemTLkNdfE0pZrD56utgpPFotBER/mQ32lUt:T+q56utgpPF8u/7t
TLSH
T105565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 26 IoCs

miner

resource	yara_rule
behavioral1/memory/680-0-0x00007FF6C08E0000-0x00007FF6C0C34000-memory.dmp	xmrig
behavioral1/files/0x00080000000244db-6.dat	xmrig
behavioral1/files/0x00070000000244e1-18.dat	xmrig
behavioral1/memory/1084-38-0x00007FF79AA20000-0x00007FF79AD74000-memory.dmp	xmrig
behavioral1/files/0x00070000000244e6-42.dat	xmrig
behavioral1/memory/884-72-0x00007FF64B070000-0x00007FF64B3C4000-memory.dmp	xmrig
behavioral1/memory/376-93-0x00007FF79BE50000-0x00007FF79C1A4000-memory.dmp	xmrig
behavioral1/memory/1228-105-0x00007FF66AB80000-0x00007FF66AED4000-memory.dmp	xmrig
behavioral1/memory/4972-112-0x00007FF7E6DC0000-0x00007FF7E7114000-memory.dmp	xmrig
behavioral1/memory/224-116-0x00007FF7F6C80000-0x00007FF7F6FD4000-memory.dmp	xmrig
behavioral1/files/0x00070000000244f1-119.dat	xmrig
behavioral1/files/0x00070000000244fb-182.dat	xmrig
behavioral1/memory/3168-308-0x00007FF69F390000-0x00007FF69F6E4000-memory.dmp	xmrig
behavioral1/memory/1112-343-0x00007FF6CDDD0000-0x00007FF6CE124000-memory.dmp	xmrig
behavioral1/memory/2588-346-0x00007FF6C9800000-0x00007FF6C9B54000-memory.dmp	xmrig
behavioral1/memory/4348-345-0x00007FF66F000000-0x00007FF66F354000-memory.dmp	xmrig
behavioral1/memory/1532-344-0x00007FF695A30000-0x00007FF695D84000-memory.dmp	xmrig
behavioral1/memory/4632-342-0x00007FF76E570000-0x00007FF76E8C4000-memory.dmp	xmrig
behavioral1/memory/624-341-0x00007FF759710000-0x00007FF759A64000-memory.dmp	xmrig
behavioral1/memory/4328-331-0x00007FF7BD270000-0x00007FF7BD5C4000-memory.dmp	xmrig
behavioral1/memory/1528-330-0x00007FF7D4DE0000-0x00007FF7D5134000-memory.dmp	xmrig
behavioral1/memory/4280-312-0x00007FF715270000-0x00007FF7155C4000-memory.dmp	xmrig
behavioral1/files/0x00070000000244fa-180.dat	xmrig
behavioral1/files/0x00070000000244f8-176.dat	xmrig
behavioral1/files/0x00070000000244f6-172.dat	xmrig
behavioral1/files/0x00070000000244f4-168.dat	xmrig

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/680-0-0x00007FF6C08E0000-0x00007FF6C0C34000-memory.dmp	upx
behavioral1/files/0x00080000000244db-6.dat	upx
behavioral1/files/0x00070000000244e1-18.dat	upx
behavioral1/memory/1084-38-0x00007FF79AA20000-0x00007FF79AD74000-memory.dmp	upx
behavioral1/files/0x00070000000244e6-42.dat	upx
behavioral1/memory/884-72-0x00007FF64B070000-0x00007FF64B3C4000-memory.dmp	upx
behavioral1/memory/376-93-0x00007FF79BE50000-0x00007FF79C1A4000-memory.dmp	upx
behavioral1/memory/1228-105-0x00007FF66AB80000-0x00007FF66AED4000-memory.dmp	upx
behavioral1/memory/4972-112-0x00007FF7E6DC0000-0x00007FF7E7114000-memory.dmp	upx
behavioral1/memory/224-116-0x00007FF7F6C80000-0x00007FF7F6FD4000-memory.dmp	upx
behavioral1/files/0x00070000000244f1-119.dat	upx
behavioral1/files/0x00070000000244fb-182.dat	upx
behavioral1/memory/3168-308-0x00007FF69F390000-0x00007FF69F6E4000-memory.dmp	upx
behavioral1/memory/1112-343-0x00007FF6CDDD0000-0x00007FF6CE124000-memory.dmp	upx
behavioral1/memory/2588-346-0x00007FF6C9800000-0x00007FF6C9B54000-memory.dmp	upx
behavioral1/memory/4348-345-0x00007FF66F000000-0x00007FF66F354000-memory.dmp	upx
behavioral1/memory/1532-344-0x00007FF695A30000-0x00007FF695D84000-memory.dmp	upx
behavioral1/memory/4632-342-0x00007FF76E570000-0x00007FF76E8C4000-memory.dmp	upx
behavioral1/memory/624-341-0x00007FF759710000-0x00007FF759A64000-memory.dmp	upx
behavioral1/memory/4328-331-0x00007FF7BD270000-0x00007FF7BD5C4000-memory.dmp	upx
behavioral1/memory/1528-330-0x00007FF7D4DE0000-0x00007FF7D5134000-memory.dmp	upx
behavioral1/memory/4280-312-0x00007FF715270000-0x00007FF7155C4000-memory.dmp	upx
behavioral1/files/0x00070000000244fa-180.dat	upx
behavioral1/files/0x00070000000244f8-176.dat	upx
behavioral1/files/0x00070000000244f6-172.dat	upx
behavioral1/files/0x00070000000244f4-168.dat	upx

C:\Users\Admin\AppData\Local\Temp\2026-10-08_3430067162f22b35e2193a4c032c709b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-08_3430067162f22b35e2193a4c032c709b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
PID:680
- C:\Windows\System\YjfgoCS.exe
  C:\Windows\System\YjfgoCS.exe
  2⤵
  PID:4284
- C:\Windows\System\GAwwTcW.exe
  C:\Windows\System\GAwwTcW.exe
  2⤵
  PID:2516
- C:\Windows\System\IKIsoyD.exe
  C:\Windows\System\IKIsoyD.exe
  2⤵
  PID:1084
- C:\Windows\System\CmQrFSK.exe
  C:\Windows\System\CmQrFSK.exe
  2⤵
  PID:540
- C:\Windows\System\POuwuiX.exe
  C:\Windows\System\POuwuiX.exe
  2⤵
  PID:1064
- C:\Windows\System\dqbDqOx.exe
  C:\Windows\System\dqbDqOx.exe
  2⤵
  PID:5100
- C:\Windows\System\btwRyHN.exe
  C:\Windows\System\btwRyHN.exe
  2⤵
  PID:1748
- C:\Windows\System\BWkcObH.exe
  C:\Windows\System\BWkcObH.exe
  2⤵
  PID:4940
- C:\Windows\System\PiLKieu.exe
  C:\Windows\System\PiLKieu.exe
  2⤵
  PID:208
- C:\Windows\System\EgNPtzP.exe
  C:\Windows\System\EgNPtzP.exe
  2⤵
  PID:4308
- C:\Windows\System\AXAQMjB.exe
  C:\Windows\System\AXAQMjB.exe
  2⤵
  PID:2212
- C:\Windows\System\fclVFDQ.exe
  C:\Windows\System\fclVFDQ.exe
  2⤵
  PID:2780
- C:\Windows\System\UfnmaqF.exe
  C:\Windows\System\UfnmaqF.exe
  2⤵
  PID:2296
- C:\Windows\System\SohxsUM.exe
  C:\Windows\System\SohxsUM.exe
  2⤵
  PID:4148
- C:\Windows\System\SlOtSaE.exe
  C:\Windows\System\SlOtSaE.exe
  2⤵
  PID:3488
- C:\Windows\System\tzGvypP.exe
  C:\Windows\System\tzGvypP.exe
  2⤵
  PID:620
- C:\Windows\System\ecARxFe.exe
  C:\Windows\System\ecARxFe.exe
  2⤵
  PID:4420
- C:\Windows\System\bGhYLAB.exe
  C:\Windows\System\bGhYLAB.exe
  2⤵
  PID:4672
- C:\Windows\System\iPdzEoC.exe
  C:\Windows\System\iPdzEoC.exe
  2⤵
  PID:4300
- C:\Windows\System\VkPYgBR.exe
  C:\Windows\System\VkPYgBR.exe
  2⤵
  PID:3304
- C:\Windows\System\JmLNLfL.exe
  C:\Windows\System\JmLNLfL.exe
  2⤵
  PID:4416
- C:\Windows\System\TJStyXu.exe
  C:\Windows\System\TJStyXu.exe
  2⤵
  PID:3540
- C:\Windows\System\aRYBOVv.exe
  C:\Windows\System\aRYBOVv.exe
  2⤵
  PID:3920
- C:\Windows\System\kuyDDdd.exe
  C:\Windows\System\kuyDDdd.exe
  2⤵
  PID:5072
- C:\Windows\System\YvmcTmY.exe
  C:\Windows\System\YvmcTmY.exe
  2⤵
  PID:5128
- C:\Windows\System\tkSXVxP.exe
  C:\Windows\System\tkSXVxP.exe
  2⤵
  PID:5144
- C:\Windows\System\UzxdHie.exe
  C:\Windows\System\UzxdHie.exe
  2⤵
  PID:5160
- C:\Windows\System\qoIExnq.exe
  C:\Windows\System\qoIExnq.exe
  2⤵
  PID:5176
- C:\Windows\System\TEZiUJR.exe
  C:\Windows\System\TEZiUJR.exe
  2⤵
  PID:5192
- C:\Windows\System\KLibAgB.exe
  C:\Windows\System\KLibAgB.exe
  2⤵
  PID:5208
- C:\Windows\System\eFjHvEA.exe
  C:\Windows\System\eFjHvEA.exe
  2⤵
  PID:5224
- C:\Windows\System\xuygRNE.exe
  C:\Windows\System\xuygRNE.exe
  2⤵
  PID:5240
- C:\Windows\System\KpdZASy.exe
  C:\Windows\System\KpdZASy.exe
  2⤵
  PID:5256
- C:\Windows\System\bBNHyus.exe
  C:\Windows\System\bBNHyus.exe
  2⤵
  PID:5272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

FdthgYu.exe

Path C:\Windows\System\FdthgYu.exe
Size 3.2MB
SHA256 b363b6a0d0b4620989187a7d7f3b3d65d7dd01156cc34e35a12bfb042d6efd18
MD5 7c531c29170aaaa00ae9079b7cc3e7f9
SHA1 c553ae7e2af18c40d2c9a605134af142a06e2d0f
SHA512 3a836e2d6f090f54737d36ee09eac663e3c08d06f51dec361de9da287dbb87cee202cca8724416b4b4b5c8e08e225116aab2c08dc2da7ca2c76604897e6436b9
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wID56uL3pgrCEdMKPFotsgEBr6GjvzWo:oemTLkNdfE0pZrD56utgpPFotBERp
TLSH
T1B6F52B90FEEB00F1DA074830D55B923FA330261A4B38D9D7D6541F87EA37AE15937A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FjcivWe.exe

Path C:\Windows\System\FjcivWe.exe
Size 3.1MB
SHA256 401f6c4a50e0a0ac6072e2508f67dd2ab6ac58b6471d643afb59cb9c49954315
MD5 4eda866adfd2015261b9192c904bec11
SHA1 bc164a484bffe10644a27628fdf7c61a5e8b635a
SHA512 a4516acd79d3120e17238bad8543d2ec3d642f60b12b88212ca06ae1d4387c2c71e2d61de3caaff0e9f71d6b65b31856e6ab072dc4e44ed44c3857263b3154ca
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wID56uL3pgrCEdMKPFotsgEBr6GL:oemTLkNdfE0pZrD56utgpPFotBEp
TLSH
T14CE53B94FFEB00F0EA074830D55B923FA330261A4738D9D7D6941F87E627AE15937A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GAwwTcW.exe

Path C:\Windows\System\GAwwTcW.exe
Size 4.0MB
SHA256 1c2cdefc270291c026ad4f4b895af509a9aada2e2d22d5d2947d7859e4458766
MD5 4750e8fefc66dc6e2a610058d94e25dd
SHA1 a12b9cc25add7b77cbfbb5d95282de1f60ee1f82
SHA512 0abe194d95193e112f39efa2c98376a9826664f894b055f1121e6511746c564dfeb6957c319b164e88eeb924471b1a49f6916ac806a613319d12905e2e81098f
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wID56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7pv:oemTLkNdfE0pZrD56utgpPFotBER/mQ4
TLSH
T1A2166C91FEEB40F1EA434530C8A7522FA330660A4735DAC7DB441F97EA277E15A33A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GWtCpqL.exe

Path C:\Windows\System\GWtCpqL.exe
Size 2.9MB
SHA256 25f662a620e2a4adbdbc731d63c8fcdc9b1c648d1407eab85a003cc265289f56
MD5 ba87bc2d796fcbd26cc6199a56dcd1af
SHA1 4204809f838a3784b733b63323f4b40ea5bba9c0
SHA512 5de89030a705113a8d726be8f268e786bd69f2a116588b32ed7da00a2351ae27ce6dabdf84fcfb0b819bb47a19b47b5fa4e466185bb8382df76027e7efab4f44
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wID56uL3pgrCEdMKPFotsgEBr64:oemTLkNdfE0pZrD56utgpPFotBEb
TLSH
T1B1D52BA4FAEF00F4EA474830D55B523FA330271A4738DDDBC6941E83E627AE15937926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TkMIPWa.exe

Path C:\Windows\System\TkMIPWa.exe
Size 3.0MB
SHA256 15ffa192721333ddac9d7cc2d19cc733580ec219a082a96001cd61ae2231b7d8
MD5 94a7d7fec57b63c2019269835a87f0c5
SHA1 fae17a32dfc5f144241ac022a2ac4438bcbfab0f
SHA512 7336dc15f8297bb60b2f0207c053f5dc3873dacaffdee52991ba7b4d29f77c1d9ebddc12529da6bd90e19fbc83a1bcfb351a901c5cf29b7d0b516bbdd28a922a
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wID56uL3pgrCEdMKPFotsgEBr6Gq:oemTLkNdfE0pZrD56utgpPFotBEA
TLSH
T1D9E53BA4FBEB00F0EA074870D55B523FA330271A4738D9D7C6941F87E627AE15937A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WUZFYah.exe

Path C:\Windows\System\WUZFYah.exe
Size 3.8MB
SHA256 4a024b035cc048c5550204172da26e1c9f2b9540f11f84a13d783ac19ccc9081
MD5 db0b870f60de8a422f410c189f2e4068
SHA1 149c65df4928274c01617694cf69e5f960ddef89
SHA512 7ea830f4c5d6ed8d0f7c317a32b047e6558ed51cbdf6fca3eaff3476cd5a0ac63dade8385a77e623acefdf1b785f705da699137956f909dcdd94e330bb113c5a
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wID56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3GdJ:oemTLkNdfE0pZrD56utgpPFotBER/K
TLSH
T1C9065B91FEEB44F1EA434530C8A7522FA33026094734DAD7DB441F97EA27BE15A33A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oaCjyTL.exe

Path C:\Windows\System\oaCjyTL.exe
Size 3.6MB
SHA256 72b888af7f0d2b2c218e0fa98c35c8ea471a1c927b35e34d36a8a999c05b3829
MD5 d0561f6a86440bc2696ef2ba4025ad76
SHA1 3cd5cc869e3a844abafbcb0793f7f8a4be12bdc9
SHA512 6a45094319fe0571498595fc6e60adc985a6e5ae5897700f82fac1da13d1e15e2d1ad1b6e9533cf7894ade81456fd9378170a4ba1a5131a83691f23b4e23338f
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wID56uL3pgrCEdMKPFotsgEBr6GjvzW+UBAN:oemTLkNdfE0pZrD56utgpPFotBER/v
TLSH
T1E4065B90FEEB44F1EA074430C8A7523FA330660A4734DAD7D6441F97EA27BE15937A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tyjWzju.exe

Path C:\Windows\System\tyjWzju.exe
Size 3.1MB
SHA256 c2be9efc3137f695ab348522fc52ca80a8d5d5f4c4ea0b7e2585122147129213
MD5 71799a415abb2c090a408aea557ec0de
SHA1 69464f37784d5ae9fc705d1df4fc162a1ecd7361
SHA512 89c57688b59e329862c5d487dc97c140a7d6cc60e67433e0d667e219ba2ff21d4c9421f07115053d5f93c31893e9f78958bb31f39057ce5a4c0df5f1218a7903
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wID56uL3pgrCEdMKPFotsgEBr6G7:oemTLkNdfE0pZrD56utgpPFotBEB
TLSH
T1A9E52B94FAEB00F0DA074830D55B923FA330361A4B38D9D7D6941F87E637AE15937A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uWwvtSW.exe

Path C:\Windows\System\uWwvtSW.exe
Size 2.9MB
SHA256 a2082ef46da4cec555bfdc82cfaaffc25657be5d03c26487de3c75d1bce56870
MD5 6f6a42b895f0948c05965fc24db8fc78
SHA1 7ce195827f75f9aa485e1743875d6e890649c0e1
SHA512 70c77819202deace9ab9d0b83b600958d1053ae62346c3908ebab22c847cdb5a754fb3a0a0adcfd6b70433892b385f4c7bb8a550e2dc4fb38ed2588eac82525b
SSDEEP 49152:oezaTF8FcNkNdfE0pZ9ozt4wID56uL3pgrCEdMKPFotsgEBr66:oemTLkNdfE0pZrD56utgpPFotBEd
TLSH
T1BCE52BA4FBEF00F4EA074870D55B523FA330271A4738D9DBC6941E83E627AE15937926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-116-0x00007FF7F6C80000-0x00007FF7F6FD4000-memory.dmp

Download

memory/376-93-0x00007FF79BE50000-0x00007FF79C1A4000-memory.dmp

Download

memory/624-341-0x00007FF759710000-0x00007FF759A64000-memory.dmp

Download

memory/680-0-0x00007FF6C08E0000-0x00007FF6C0C34000-memory.dmp

Download

memory/680-1-0x0000023E139F0000-0x0000023E13A00000-memory.dmp

Download

memory/884-72-0x00007FF64B070000-0x00007FF64B3C4000-memory.dmp

Download

memory/1084-38-0x00007FF79AA20000-0x00007FF79AD74000-memory.dmp

Download

memory/1112-343-0x00007FF6CDDD0000-0x00007FF6CE124000-memory.dmp

Download

memory/1228-105-0x00007FF66AB80000-0x00007FF66AED4000-memory.dmp

Download

memory/1528-330-0x00007FF7D4DE0000-0x00007FF7D5134000-memory.dmp

Download

memory/1532-344-0x00007FF695A30000-0x00007FF695D84000-memory.dmp

Download

memory/2588-346-0x00007FF6C9800000-0x00007FF6C9B54000-memory.dmp

Download

memory/3168-308-0x00007FF69F390000-0x00007FF69F6E4000-memory.dmp

Download

memory/4280-312-0x00007FF715270000-0x00007FF7155C4000-memory.dmp

Download

memory/4328-331-0x00007FF7BD270000-0x00007FF7BD5C4000-memory.dmp

Download

memory/4348-345-0x00007FF66F000000-0x00007FF66F354000-memory.dmp

Download

memory/4632-342-0x00007FF76E570000-0x00007FF76E8C4000-memory.dmp

Download

memory/4972-112-0x00007FF7E6DC0000-0x00007FF7E7114000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads