cobaltstrike | 028f91dbeb1dcbcdc73c8daa5a92ac0b81d0d773487a1ee6ad26f5af91caa7f8

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/10/2026, 14:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 5.9MB
Sample261015-r9742agy21
SHA256 028f91dbeb1dcbcdc73c8daa5a92ac0b81d0d773487a1ee6ad26f5af91caa7f8
MD5 43c3d9f2c1984fdfce86e1094d7653e2
SHA1 06239e51aca99011b0f645c9b0ff8574952e3d3b
SHA512 e468fcf7bfc33bf62bf7cdafe039088abe0ed328448e4940113a486e424956222dabe247896836c6f6da3c4cf3219025f48181f7a879cb5746fe86d3f8200839
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:T+856utgpPF8u/71
TLSH
T10D565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x000800000002433f-8.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024348-31.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024346-37.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002434a-55.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002434e-81.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024351-93.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024353-98.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024352-95.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024350-91.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002434f-89.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002434c-87.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002434b-83.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002434d-78.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024349-68.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024347-48.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024345-35.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024344-33.dat	cobalt_reflective_dll
behavioral1/files/0x0004000000023243-15.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024354-115.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024355-118.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000024340-122.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral1/files/0x000800000002433f-8.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024348-31.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024346-37.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002434a-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002434e-81.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024351-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024353-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024352-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024350-91.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002434f-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002434c-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002434b-83.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002434d-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024349-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024347-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024345-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024344-33.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0004000000023243-15.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024354-115.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024355-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0008000000024340-122.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral1/memory/1940-0-0x00007FF68C5B0000-0x00007FF68C904000-memory.dmp	UPX
behavioral1/files/0x000800000002433f-8.dat	UPX
behavioral1/files/0x0007000000024348-31.dat	UPX
behavioral1/files/0x0007000000024346-37.dat	UPX
behavioral1/files/0x000700000002434a-55.dat	UPX
behavioral1/files/0x000700000002434e-81.dat	UPX
behavioral1/files/0x0007000000024351-93.dat	UPX
behavioral1/memory/1288-102-0x00007FF78C3A0000-0x00007FF78C6F4000-memory.dmp	UPX
behavioral1/memory/1948-108-0x00007FF7A8BA0000-0x00007FF7A8EF4000-memory.dmp	UPX
behavioral1/memory/4868-109-0x00007FF7663B0000-0x00007FF766704000-memory.dmp	UPX
behavioral1/memory/3804-107-0x00007FF7193E0000-0x00007FF719734000-memory.dmp	UPX
behavioral1/memory/5004-106-0x00007FF61E1D0000-0x00007FF61E524000-memory.dmp	UPX
behavioral1/memory/5048-105-0x00007FF70D5B0000-0x00007FF70D904000-memory.dmp	UPX
behavioral1/memory/1652-104-0x00007FF767FA0000-0x00007FF7682F4000-memory.dmp	UPX
behavioral1/memory/3068-103-0x00007FF751AD0000-0x00007FF751E24000-memory.dmp	UPX
behavioral1/memory/3252-101-0x00007FF723070000-0x00007FF7233C4000-memory.dmp	UPX
behavioral1/memory/5060-100-0x00007FF7FC240000-0x00007FF7FC594000-memory.dmp	UPX
behavioral1/files/0x0007000000024353-98.dat	UPX
behavioral1/memory/1632-97-0x00007FF6F0000000-0x00007FF6F0354000-memory.dmp	UPX
behavioral1/files/0x0007000000024352-95.dat	UPX
behavioral1/files/0x0007000000024350-91.dat	UPX
behavioral1/files/0x000700000002434f-89.dat	UPX
behavioral1/files/0x000700000002434c-87.dat	UPX
behavioral1/memory/2820-86-0x00007FF6841E0000-0x00007FF684534000-memory.dmp	UPX
behavioral1/memory/4516-85-0x00007FF7677F0000-0x00007FF767B44000-memory.dmp	UPX
behavioral1/files/0x000700000002434b-83.dat	UPX
behavioral1/files/0x000700000002434d-78.dat	UPX
behavioral1/memory/5028-77-0x00007FF786600000-0x00007FF786954000-memory.dmp	UPX
behavioral1/files/0x0007000000024349-68.dat	UPX
behavioral1/memory/3224-64-0x00007FF607D30000-0x00007FF608084000-memory.dmp	UPX
behavioral1/files/0x0007000000024347-48.dat	UPX
behavioral1/files/0x0007000000024345-35.dat	UPX
behavioral1/files/0x0007000000024344-33.dat	UPX
behavioral1/memory/4792-41-0x00007FF6F2FF0000-0x00007FF6F3344000-memory.dmp	UPX
behavioral1/memory/1112-27-0x00007FF771EE0000-0x00007FF772234000-memory.dmp	UPX
behavioral1/files/0x0004000000023243-15.dat	UPX
behavioral1/memory/4164-11-0x00007FF6FE2B0000-0x00007FF6FE604000-memory.dmp	UPX
behavioral1/files/0x0007000000024354-115.dat	UPX
behavioral1/files/0x0007000000024355-118.dat	UPX
behavioral1/files/0x0008000000024340-122.dat	UPX
behavioral1/memory/4208-125-0x00007FF75A240000-0x00007FF75A594000-memory.dmp	UPX
behavioral1/memory/220-124-0x00007FF69F430000-0x00007FF69F784000-memory.dmp	UPX
behavioral1/memory/212-119-0x00007FF6ECC80000-0x00007FF6ECFD4000-memory.dmp	UPX
behavioral1/memory/1940-128-0x00007FF68C5B0000-0x00007FF68C904000-memory.dmp	UPX
behavioral1/memory/1112-129-0x00007FF771EE0000-0x00007FF772234000-memory.dmp	UPX
behavioral1/memory/4792-130-0x00007FF6F2FF0000-0x00007FF6F3344000-memory.dmp	UPX
behavioral1/memory/4164-131-0x00007FF6FE2B0000-0x00007FF6FE604000-memory.dmp	UPX
behavioral1/memory/212-132-0x00007FF6ECC80000-0x00007FF6ECFD4000-memory.dmp	UPX
behavioral1/memory/220-133-0x00007FF69F430000-0x00007FF69F784000-memory.dmp	UPX
behavioral1/memory/4208-134-0x00007FF75A240000-0x00007FF75A594000-memory.dmp	UPX
behavioral1/memory/4164-135-0x00007FF6FE2B0000-0x00007FF6FE604000-memory.dmp	UPX
behavioral1/memory/1112-136-0x00007FF771EE0000-0x00007FF772234000-memory.dmp	UPX
behavioral1/memory/2820-137-0x00007FF6841E0000-0x00007FF684534000-memory.dmp	UPX
behavioral1/memory/1632-145-0x00007FF6F0000000-0x00007FF6F0354000-memory.dmp	UPX
behavioral1/memory/1948-147-0x00007FF7A8BA0000-0x00007FF7A8EF4000-memory.dmp	UPX
behavioral1/memory/3068-148-0x00007FF751AD0000-0x00007FF751E24000-memory.dmp	UPX
behavioral1/memory/1652-150-0x00007FF767FA0000-0x00007FF7682F4000-memory.dmp	UPX
behavioral1/memory/5048-149-0x00007FF70D5B0000-0x00007FF70D904000-memory.dmp	UPX
behavioral1/memory/3252-146-0x00007FF723070000-0x00007FF7233C4000-memory.dmp	UPX
behavioral1/memory/5060-144-0x00007FF7FC240000-0x00007FF7FC594000-memory.dmp	UPX
behavioral1/memory/5004-143-0x00007FF61E1D0000-0x00007FF61E524000-memory.dmp	UPX
behavioral1/memory/4792-142-0x00007FF6F2FF0000-0x00007FF6F3344000-memory.dmp	UPX
behavioral1/memory/3224-141-0x00007FF607D30000-0x00007FF608084000-memory.dmp	UPX
behavioral1/memory/5028-140-0x00007FF786600000-0x00007FF786954000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/1940-0-0x00007FF68C5B0000-0x00007FF68C904000-memory.dmp	xmrig
behavioral1/files/0x000800000002433f-8.dat	xmrig
behavioral1/files/0x0007000000024348-31.dat	xmrig
behavioral1/files/0x0007000000024346-37.dat	xmrig
behavioral1/files/0x000700000002434a-55.dat	xmrig
behavioral1/files/0x000700000002434e-81.dat	xmrig
behavioral1/files/0x0007000000024351-93.dat	xmrig
behavioral1/memory/1288-102-0x00007FF78C3A0000-0x00007FF78C6F4000-memory.dmp	xmrig
behavioral1/memory/1948-108-0x00007FF7A8BA0000-0x00007FF7A8EF4000-memory.dmp	xmrig
behavioral1/memory/4868-109-0x00007FF7663B0000-0x00007FF766704000-memory.dmp	xmrig
behavioral1/memory/3804-107-0x00007FF7193E0000-0x00007FF719734000-memory.dmp	xmrig
behavioral1/memory/5004-106-0x00007FF61E1D0000-0x00007FF61E524000-memory.dmp	xmrig
behavioral1/memory/5048-105-0x00007FF70D5B0000-0x00007FF70D904000-memory.dmp	xmrig
behavioral1/memory/1652-104-0x00007FF767FA0000-0x00007FF7682F4000-memory.dmp	xmrig
behavioral1/memory/3068-103-0x00007FF751AD0000-0x00007FF751E24000-memory.dmp	xmrig
behavioral1/memory/3252-101-0x00007FF723070000-0x00007FF7233C4000-memory.dmp	xmrig
behavioral1/memory/5060-100-0x00007FF7FC240000-0x00007FF7FC594000-memory.dmp	xmrig
behavioral1/files/0x0007000000024353-98.dat	xmrig
behavioral1/memory/1632-97-0x00007FF6F0000000-0x00007FF6F0354000-memory.dmp	xmrig
behavioral1/files/0x0007000000024352-95.dat	xmrig
behavioral1/files/0x0007000000024350-91.dat	xmrig
behavioral1/files/0x000700000002434f-89.dat	xmrig
behavioral1/files/0x000700000002434c-87.dat	xmrig
behavioral1/memory/2820-86-0x00007FF6841E0000-0x00007FF684534000-memory.dmp	xmrig
behavioral1/memory/4516-85-0x00007FF7677F0000-0x00007FF767B44000-memory.dmp	xmrig
behavioral1/files/0x000700000002434b-83.dat	xmrig
behavioral1/files/0x000700000002434d-78.dat	xmrig
behavioral1/memory/5028-77-0x00007FF786600000-0x00007FF786954000-memory.dmp	xmrig
behavioral1/files/0x0007000000024349-68.dat	xmrig
behavioral1/memory/3224-64-0x00007FF607D30000-0x00007FF608084000-memory.dmp	xmrig
behavioral1/files/0x0007000000024347-48.dat	xmrig
behavioral1/files/0x0007000000024345-35.dat	xmrig
behavioral1/files/0x0007000000024344-33.dat	xmrig
behavioral1/memory/4792-41-0x00007FF6F2FF0000-0x00007FF6F3344000-memory.dmp	xmrig
behavioral1/memory/1112-27-0x00007FF771EE0000-0x00007FF772234000-memory.dmp	xmrig
behavioral1/files/0x0004000000023243-15.dat	xmrig
behavioral1/memory/4164-11-0x00007FF6FE2B0000-0x00007FF6FE604000-memory.dmp	xmrig
behavioral1/files/0x0007000000024354-115.dat	xmrig
behavioral1/files/0x0007000000024355-118.dat	xmrig
behavioral1/files/0x0008000000024340-122.dat	xmrig
behavioral1/memory/4208-125-0x00007FF75A240000-0x00007FF75A594000-memory.dmp	xmrig
behavioral1/memory/220-124-0x00007FF69F430000-0x00007FF69F784000-memory.dmp	xmrig
behavioral1/memory/212-119-0x00007FF6ECC80000-0x00007FF6ECFD4000-memory.dmp	xmrig
behavioral1/memory/1940-128-0x00007FF68C5B0000-0x00007FF68C904000-memory.dmp	xmrig
behavioral1/memory/1112-129-0x00007FF771EE0000-0x00007FF772234000-memory.dmp	xmrig
behavioral1/memory/4792-130-0x00007FF6F2FF0000-0x00007FF6F3344000-memory.dmp	xmrig
behavioral1/memory/4164-131-0x00007FF6FE2B0000-0x00007FF6FE604000-memory.dmp	xmrig
behavioral1/memory/212-132-0x00007FF6ECC80000-0x00007FF6ECFD4000-memory.dmp	xmrig
behavioral1/memory/220-133-0x00007FF69F430000-0x00007FF69F784000-memory.dmp	xmrig
behavioral1/memory/4208-134-0x00007FF75A240000-0x00007FF75A594000-memory.dmp	xmrig
behavioral1/memory/4164-135-0x00007FF6FE2B0000-0x00007FF6FE604000-memory.dmp	xmrig
behavioral1/memory/1112-136-0x00007FF771EE0000-0x00007FF772234000-memory.dmp	xmrig
behavioral1/memory/2820-137-0x00007FF6841E0000-0x00007FF684534000-memory.dmp	xmrig
behavioral1/memory/1632-145-0x00007FF6F0000000-0x00007FF6F0354000-memory.dmp	xmrig
behavioral1/memory/1948-147-0x00007FF7A8BA0000-0x00007FF7A8EF4000-memory.dmp	xmrig
behavioral1/memory/3068-148-0x00007FF751AD0000-0x00007FF751E24000-memory.dmp	xmrig
behavioral1/memory/1652-150-0x00007FF767FA0000-0x00007FF7682F4000-memory.dmp	xmrig
behavioral1/memory/5048-149-0x00007FF70D5B0000-0x00007FF70D904000-memory.dmp	xmrig
behavioral1/memory/3252-146-0x00007FF723070000-0x00007FF7233C4000-memory.dmp	xmrig
behavioral1/memory/5060-144-0x00007FF7FC240000-0x00007FF7FC594000-memory.dmp	xmrig
behavioral1/memory/5004-143-0x00007FF61E1D0000-0x00007FF61E524000-memory.dmp	xmrig
behavioral1/memory/4792-142-0x00007FF6F2FF0000-0x00007FF6F3344000-memory.dmp	xmrig
behavioral1/memory/3224-141-0x00007FF607D30000-0x00007FF608084000-memory.dmp	xmrig
behavioral1/memory/5028-140-0x00007FF786600000-0x00007FF786954000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4164	ansgYbM.exe
1112	coEpawt.exe
5004	ITGvdJG.exe
4792	WqYJGRy.exe
3224	LBYarTl.exe
3804	dUDTxFL.exe
5028	PTMEJKi.exe
4516	ZCPaIgV.exe
2820	GokdkFX.exe
1632	agiBYap.exe
1948	XUZnany.exe
5060	HTetIAu.exe
3252	MHFktXC.exe
1288	YJjvvSp.exe
3068	unQXKaE.exe
1652	gFNhxzz.exe
5048	geddLTM.exe
4868	YQsbLol.exe
212	vvUHWCQ.exe
220	NiChKOY.exe
4208	vEdHAKq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1940-0-0x00007FF68C5B0000-0x00007FF68C904000-memory.dmp	upx
behavioral1/files/0x000800000002433f-8.dat	upx
behavioral1/files/0x0007000000024348-31.dat	upx
behavioral1/files/0x0007000000024346-37.dat	upx
behavioral1/files/0x000700000002434a-55.dat	upx
behavioral1/files/0x000700000002434e-81.dat	upx
behavioral1/files/0x0007000000024351-93.dat	upx
behavioral1/memory/1288-102-0x00007FF78C3A0000-0x00007FF78C6F4000-memory.dmp	upx
behavioral1/memory/1948-108-0x00007FF7A8BA0000-0x00007FF7A8EF4000-memory.dmp	upx
behavioral1/memory/4868-109-0x00007FF7663B0000-0x00007FF766704000-memory.dmp	upx
behavioral1/memory/3804-107-0x00007FF7193E0000-0x00007FF719734000-memory.dmp	upx
behavioral1/memory/5004-106-0x00007FF61E1D0000-0x00007FF61E524000-memory.dmp	upx
behavioral1/memory/5048-105-0x00007FF70D5B0000-0x00007FF70D904000-memory.dmp	upx
behavioral1/memory/1652-104-0x00007FF767FA0000-0x00007FF7682F4000-memory.dmp	upx
behavioral1/memory/3068-103-0x00007FF751AD0000-0x00007FF751E24000-memory.dmp	upx
behavioral1/memory/3252-101-0x00007FF723070000-0x00007FF7233C4000-memory.dmp	upx
behavioral1/memory/5060-100-0x00007FF7FC240000-0x00007FF7FC594000-memory.dmp	upx
behavioral1/files/0x0007000000024353-98.dat	upx
behavioral1/memory/1632-97-0x00007FF6F0000000-0x00007FF6F0354000-memory.dmp	upx
behavioral1/files/0x0007000000024352-95.dat	upx
behavioral1/files/0x0007000000024350-91.dat	upx
behavioral1/files/0x000700000002434f-89.dat	upx
behavioral1/files/0x000700000002434c-87.dat	upx
behavioral1/memory/2820-86-0x00007FF6841E0000-0x00007FF684534000-memory.dmp	upx
behavioral1/memory/4516-85-0x00007FF7677F0000-0x00007FF767B44000-memory.dmp	upx
behavioral1/files/0x000700000002434b-83.dat	upx
behavioral1/files/0x000700000002434d-78.dat	upx
behavioral1/memory/5028-77-0x00007FF786600000-0x00007FF786954000-memory.dmp	upx
behavioral1/files/0x0007000000024349-68.dat	upx
behavioral1/memory/3224-64-0x00007FF607D30000-0x00007FF608084000-memory.dmp	upx
behavioral1/files/0x0007000000024347-48.dat	upx
behavioral1/files/0x0007000000024345-35.dat	upx
behavioral1/files/0x0007000000024344-33.dat	upx
behavioral1/memory/4792-41-0x00007FF6F2FF0000-0x00007FF6F3344000-memory.dmp	upx
behavioral1/memory/1112-27-0x00007FF771EE0000-0x00007FF772234000-memory.dmp	upx
behavioral1/files/0x0004000000023243-15.dat	upx
behavioral1/memory/4164-11-0x00007FF6FE2B0000-0x00007FF6FE604000-memory.dmp	upx
behavioral1/files/0x0007000000024354-115.dat	upx
behavioral1/files/0x0007000000024355-118.dat	upx
behavioral1/files/0x0008000000024340-122.dat	upx
behavioral1/memory/4208-125-0x00007FF75A240000-0x00007FF75A594000-memory.dmp	upx
behavioral1/memory/220-124-0x00007FF69F430000-0x00007FF69F784000-memory.dmp	upx
behavioral1/memory/212-119-0x00007FF6ECC80000-0x00007FF6ECFD4000-memory.dmp	upx
behavioral1/memory/1940-128-0x00007FF68C5B0000-0x00007FF68C904000-memory.dmp	upx
behavioral1/memory/1112-129-0x00007FF771EE0000-0x00007FF772234000-memory.dmp	upx
behavioral1/memory/4792-130-0x00007FF6F2FF0000-0x00007FF6F3344000-memory.dmp	upx
behavioral1/memory/4164-131-0x00007FF6FE2B0000-0x00007FF6FE604000-memory.dmp	upx
behavioral1/memory/212-132-0x00007FF6ECC80000-0x00007FF6ECFD4000-memory.dmp	upx
behavioral1/memory/220-133-0x00007FF69F430000-0x00007FF69F784000-memory.dmp	upx
behavioral1/memory/4208-134-0x00007FF75A240000-0x00007FF75A594000-memory.dmp	upx
behavioral1/memory/4164-135-0x00007FF6FE2B0000-0x00007FF6FE604000-memory.dmp	upx
behavioral1/memory/1112-136-0x00007FF771EE0000-0x00007FF772234000-memory.dmp	upx
behavioral1/memory/2820-137-0x00007FF6841E0000-0x00007FF684534000-memory.dmp	upx
behavioral1/memory/1632-145-0x00007FF6F0000000-0x00007FF6F0354000-memory.dmp	upx
behavioral1/memory/1948-147-0x00007FF7A8BA0000-0x00007FF7A8EF4000-memory.dmp	upx
behavioral1/memory/3068-148-0x00007FF751AD0000-0x00007FF751E24000-memory.dmp	upx
behavioral1/memory/1652-150-0x00007FF767FA0000-0x00007FF7682F4000-memory.dmp	upx
behavioral1/memory/5048-149-0x00007FF70D5B0000-0x00007FF70D904000-memory.dmp	upx
behavioral1/memory/3252-146-0x00007FF723070000-0x00007FF7233C4000-memory.dmp	upx
behavioral1/memory/5060-144-0x00007FF7FC240000-0x00007FF7FC594000-memory.dmp	upx
behavioral1/memory/5004-143-0x00007FF61E1D0000-0x00007FF61E524000-memory.dmp	upx
behavioral1/memory/4792-142-0x00007FF6F2FF0000-0x00007FF6F3344000-memory.dmp	upx
behavioral1/memory/3224-141-0x00007FF607D30000-0x00007FF608084000-memory.dmp	upx
behavioral1/memory/5028-140-0x00007FF786600000-0x00007FF786954000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\geddLTM.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\YQsbLol.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\vEdHAKq.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ITGvdJG.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\PTMEJKi.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ZCPaIgV.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\YJjvvSp.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\gFNhxzz.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ansgYbM.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\coEpawt.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\LBYarTl.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\dUDTxFL.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\GokdkFX.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\agiBYap.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\XUZnany.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\MHFktXC.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\unQXKaE.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\vvUHWCQ.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\NiChKOY.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\WqYJGRy.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\HTetIAu.exe	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 4164	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	88
PID 1940 wrote to memory of 1112	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	89
PID 1940 wrote to memory of 5004	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 1940 wrote to memory of 4792	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 1940 wrote to memory of 3224	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 1940 wrote to memory of 3804	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 1940 wrote to memory of 5028	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 1940 wrote to memory of 4516	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 1940 wrote to memory of 2820	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 1940 wrote to memory of 1632	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 1940 wrote to memory of 1948	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 1940 wrote to memory of 5060	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 1940 wrote to memory of 3252	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 1940 wrote to memory of 1288	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 1940 wrote to memory of 3068	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 1940 wrote to memory of 1652	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 1940 wrote to memory of 5048	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 1940 wrote to memory of 4868	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 1940 wrote to memory of 212	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 1940 wrote to memory of 220	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 1940 wrote to memory of 4208	1940	2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-13_43c3d9f2c1984fdfce86e1094d7653e2_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\System\ansgYbM.exe
  C:\Windows\System\ansgYbM.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\coEpawt.exe
  C:\Windows\System\coEpawt.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\ITGvdJG.exe
  C:\Windows\System\ITGvdJG.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\WqYJGRy.exe
  C:\Windows\System\WqYJGRy.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\LBYarTl.exe
  C:\Windows\System\LBYarTl.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\dUDTxFL.exe
  C:\Windows\System\dUDTxFL.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\PTMEJKi.exe
  C:\Windows\System\PTMEJKi.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\ZCPaIgV.exe
  C:\Windows\System\ZCPaIgV.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\GokdkFX.exe
  C:\Windows\System\GokdkFX.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\agiBYap.exe
  C:\Windows\System\agiBYap.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\XUZnany.exe
  C:\Windows\System\XUZnany.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\HTetIAu.exe
  C:\Windows\System\HTetIAu.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\MHFktXC.exe
  C:\Windows\System\MHFktXC.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\YJjvvSp.exe
  C:\Windows\System\YJjvvSp.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\unQXKaE.exe
  C:\Windows\System\unQXKaE.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\gFNhxzz.exe
  C:\Windows\System\gFNhxzz.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\geddLTM.exe
  C:\Windows\System\geddLTM.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\YQsbLol.exe
  C:\Windows\System\YQsbLol.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\vvUHWCQ.exe
  C:\Windows\System\vvUHWCQ.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\NiChKOY.exe
  C:\Windows\System\NiChKOY.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\vEdHAKq.exe
  C:\Windows\System\vEdHAKq.exe
  2⤵
  - Executes dropped EXE
  PID:4208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

GokdkFX.exe

Path C:\Windows\System\GokdkFX.exe
Size 5.9MB
SHA256 20bc24aa4ffafe572989bc2ba0609ecfb30713fa2d1d08c76168de27cb4cce70
MD5 3b25053e2551f1eacf74b3dbb2022a86
SHA1 22a33372dfa890ceab286529ddaf2636b4f859c1
SHA512 bdfd3f838ddb643d7c2fbc41b3ed5bac9b0cc72acc1062a4fd6b5b655f2e0db430871a87ca8037ef685e2a759747e22e8545ed82191d79d6f043460300362041
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:T+856utgpPF8u/7y
TLSH
T1AF565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HTetIAu.exe

Path C:\Windows\System\HTetIAu.exe
Size 5.9MB
SHA256 582d8dd7311f60abcc751ae97c9453ca07c2c601be7bd796e53a6b75f2c69dae
MD5 bac143784e8d8f751c8dc1d9b129f2b4
SHA1 da4ffba426d756cead2ba2cd9def131a86d957a5
SHA512 982944a4a01d0fa9c6bd04f71c4b569bab2c8c64933aaa2bac26054e8d545965ba83e469375e5bedd1a90928973be81e5a29f82a91033b2b24bb4d95534813f7
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:T+856utgpPF8u/7F
TLSH
T1B2565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ITGvdJG.exe

Path C:\Windows\System\ITGvdJG.exe
Size 5.9MB
SHA256 c8be02816987138e15e67bcc7a33b6f17b3aa0d77cce6b2283800d3c514f1faf
MD5 9b2ef830c4ebfa5acd24400e5fb0911f
SHA1 5e58abc0dcaf0c1c9c59f10e5922f9339416dedc
SHA512 f4837c6d4b0c66ffa8412b98e82049ec066e5e8ad2798dea365404fb7ac89f19d69c1a2a54731c0098b2da8b76a319171c3b10bc926e0f486b5eb2930570a4a8
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:T+856utgpPF8u/7A
TLSH
T1CD565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LBYarTl.exe

Path C:\Windows\System\LBYarTl.exe
Size 5.9MB
SHA256 a9034b64b716762e5882bb7133e3b4e5f9ad272ce37b937de6455fd3e15b271c
MD5 614291b3859337eb2736f8dbbffc8bfb
SHA1 a41dd697d51e508ce0649f61d052f7ad92c11405
SHA512 14e06995fd2288c2506b451cf5517a60b8b84672963d1214d92e4ef26d52fd25495dc37006b763b73ef2f4ea09e8ad4f8acfa819fd003a41b2157014990b53e8
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:T+856utgpPF8u/7t
TLSH
T1F9565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MHFktXC.exe

Path C:\Windows\System\MHFktXC.exe
Size 5.9MB
SHA256 b8d4b337d42c8ea7937f124dc52fe3ea9b7dfe27ac135786dbf4611365beb289
MD5 0fce1b1eb5e72c01feac9cc27664b95f
SHA1 9cda396b2986ec42d359c15cda7b54e67e352181
SHA512 23c618c7645430d1e4a402334e5bb792c5a736bb46b06e92e78d6351655f5f8b87b9aa8281bc3b7d5429c18747c4ab5c3f0fe52aa3039a54f2bf20ae2fd9cd89
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:T+856utgpPF8u/7V
TLSH
T147565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NiChKOY.exe

Path C:\Windows\System\NiChKOY.exe
Size 5.9MB
SHA256 631155dbc5755310a8828fcddf414433ac3bbddddb2af39a951fe1d088acf9f0
MD5 320524c34a48b2910c754d170eda867c
SHA1 82d0932fd91493740fa08bd0ae76aa24c9f301e0
SHA512 fbd0156827baa50c2a83a263ed6207bcbd0bd9a2b1b3631fe2d30f814ca59f3d35698538e4ea5cbb8ff7b31e5413f81baf87e72b7f713b865d86c982b5a5c923
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:T+856utgpPF8u/7J
TLSH
T139565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PTMEJKi.exe

Path C:\Windows\System\PTMEJKi.exe
Size 5.9MB
SHA256 d347d69a000d447190eba52b3ece6d285f4d8fb9a6fb99f2f44e8e08b24e21df
MD5 75ca1db17e60ab94c92d3f53ff9d9b28
SHA1 a9bc42b35f66611e756da20fda25aaabb75e6208
SHA512 ad7e87b158aed45d16ec26ff3c4621f3bb9f581fe693871b9469735605dc9a555e25ea597c2bd41039f362f037261faf8dd52fa0fa91f803d046709104fd58cd
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:T+856utgpPF8u/73
TLSH
T1D6565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WqYJGRy.exe

Path C:\Windows\System\WqYJGRy.exe
Size 5.9MB
SHA256 414595352232c20c417e379f39fc10caed6f3a6e9bd961da660270d3abed5908
MD5 4a18e7158302564e109fd706673da100
SHA1 d28ec61f90739aa0d8d525c90b15b2d63917c4d6
SHA512 57123dfe149a6857e191144dc60e6154b684fda96503e555d71b61481f26fd4f93d6274bfb862e04a33b7b1cabbe0ba8cb98f8b950666558256dfe2e5253a0b9
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:T+856utgpPF8u/7R
TLSH
T14F565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XUZnany.exe

Path C:\Windows\System\XUZnany.exe
Size 5.9MB
SHA256 f658aad53de615f471968a870c5a6802e99d8a8a630a34350be3c8aaefe01e02
MD5 61c78e2262df21149a66afa5f56ae550
SHA1 57cd0f120d19b5ac3fb038dd0a27522a5ca91fd4
SHA512 c4c1f49223d7361810c7e6c21f5e763d186986efcadfc6a1a991c084f4724c4713ebfc167405f8e835eb6d0a4e0154ac9af9b5eb05930de04d8ae53f1af9c45b
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:T+856utgpPF8u/7a
TLSH
T138565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YJjvvSp.exe

Path C:\Windows\System\YJjvvSp.exe
Size 5.9MB
SHA256 e9ee505b0fb8cd24f803a72b5ce8b0a3edb19eb00eef8b36bb3dbd32aea79730
MD5 c62531fdee89e2296ccb3b606768338c
SHA1 f8646333299cbb5d997731a03a2780d47f8961dc
SHA512 de93c8e99509eedd127b954c8ef2cdb70ee884e55fd253694d2654cccb9e6c76e7dde55f6195d67d7fb72a02302c4f9a2107787ff4bfb35fa551e1a775bd8da1
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:T+856utgpPF8u/71
TLSH
T1A7565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YQsbLol.exe

Path C:\Windows\System\YQsbLol.exe
Size 5.9MB
SHA256 e973a73a737b37e75d171c749805304e0128f50b02bf6e3e4df8effa096b17e6
MD5 72d3a0ca27a6414cde0d52a04713fb82
SHA1 87c05d9268aaf59d704425c3b87a0d85757f4363
SHA512 9fbf119d13a9be5e8cb326ccc8462ea6fe09b1831e1c42b31a08d84b51c0011b7637871e48117eb0c296f49b474f523b7d6740c2246e09144e494131c345a17c
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:T+856utgpPF8u/79
TLSH
T144565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZCPaIgV.exe

Path C:\Windows\System\ZCPaIgV.exe
Size 5.9MB
SHA256 35acae6839062aca7f00a10e918871cb0f4c6e1a450f7e4d153086984a801fbc
MD5 c3c0aff21ae4523b2e6e0591e253ab96
SHA1 ca9b68a59ed97bb88f5ae7aae958f2680dc41fa5
SHA512 3bce99bb0e0fc5a9c7133a359da21ef6b5f7afb39c693556bd60f950015e1f06c989eededd687dc6dc77f998b4946948b66bd6f9b5886f01926a31c7887206ab
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:T+856utgpPF8u/7D
TLSH
T191565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agiBYap.exe

Path C:\Windows\System\agiBYap.exe
Size 5.9MB
SHA256 2b23beb5af6ff6271337ce52154a6c42da8c5b93919660833f1a84b2209a36a4
MD5 eb92008423503edb2d80f70fb23a86f6
SHA1 382c6b7643d2371ff340a3778dba841b881ad5a8
SHA512 73084c7bd86a4c5f5eec8d46fa6d96e170e23384d55bb34be9a9fc7fb48d39496b18f13c1766fbccd9a384b4f7668e8e69f9bf8208da08692a38d3aff5407266
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:T+856utgpPF8u/7C
TLSH
T125565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ansgYbM.exe

Path C:\Windows\System\ansgYbM.exe
Size 5.9MB
SHA256 d8996349c33e924c91e05e82856b2bb6338c20dca53d4b99cfcfd7125516dc44
MD5 4497df7bc776ac4822d13e932644b947
SHA1 85af85c24a58d96192f030c3570bc76623c1d821
SHA512 92dfb39bb3f3fdc3f8a2d828ea3718e1203d40d0fd210fb20a4182380bee84e0080774845d2bf76135507e6941a4c9b211c9096e5659ff06a36437e1fb576641
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:T+856utgpPF8u/7M
TLSH
T122565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coEpawt.exe

Path C:\Windows\System\coEpawt.exe
Size 5.9MB
SHA256 d294fd492a7027d5df13118384276ec08e524f7d2092f2fb2ba01e594fc70297
MD5 c0339b7b9c6435603fe520d90c810263
SHA1 e1290ac26b4a8a5d796cef786ea05901a8df00c7
SHA512 5b93f5243ca52cc8c3a66a701c7d3462a12c76663d241dcced9e7207d86aee3caa17cdb216d6df0d3e8386389e44d2b34f1e936355be7bc9afd4d8c6bfca0e0c
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:T+856utgpPF8u/7K
TLSH
T11D565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dUDTxFL.exe

Path C:\Windows\System\dUDTxFL.exe
Size 5.9MB
SHA256 156f74b55a59c4dd3ca74619f5602abe3b40e11f5dc74193ac4b67b8ec959862
MD5 fa91f987a409fa743b580b14c8e49832
SHA1 f90bffdb8633cd4b89c0d463308f42f267d22b9d
SHA512 55e6d549420d05d7d52e28c90d52db03dc2dca1e33f8f0c90acc8d2ea36488c3eef9488e8bac6ef22e891599842a97757c7670c2ce43f014979a903093fefcd4
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:T+856utgpPF8u/7t
TLSH
T153565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gFNhxzz.exe

Path C:\Windows\System\gFNhxzz.exe
Size 5.9MB
SHA256 4766f5e77c3a36293c1bf2565e7be8fe720e791524448ebd6d8c87c7525cb168
MD5 ed9be58c1535b3756e001cd6788e9166
SHA1 c522da01a041a2d8a6ea7095fa66af99803c34d6
SHA512 e267eeee82086d822f9de255bdd7cb3f4759e765a081a6b0ed86497ce92d1821ab2a4d3b86c6a723641263ec6042e59d80305079dc6fef4f68e2355f059cf3f8
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:T+856utgpPF8u/7P
TLSH
T128565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geddLTM.exe

Path C:\Windows\System\geddLTM.exe
Size 5.9MB
SHA256 940728b7ec0cc228d566de533e38fa7d36808c4e879cff77fb07bc04bc170ac3
MD5 f973216e54b67c33220c744c89e84c63
SHA1 cd04111fcb068c8a5dafb34b6a3ed7b19b16092e
SHA512 56eea9ffca09a3ff119e25f9bde800759f5f0aef7f914ff8ea71cbf56a3f4aeeb53d05614b2370166b4327e6b1dbaa46eb7c9a2f3619b4ff8f6e9fc37eebea64
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:T+856utgpPF8u/7z
TLSH
T19F565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unQXKaE.exe

Path C:\Windows\System\unQXKaE.exe
Size 5.9MB
SHA256 283006e1ddce81d8f0d82c37d2e9289f788cc90e3754a2a6dde7e3a2293abbd0
MD5 ba25b8158a1374e62de9cd35e12c874c
SHA1 5c1565d867b64cb0ce983642c04042de3d4dc2cd
SHA512 18a50e58704462680f06c4347e4b1c55183af8c6d93cb1e4eb775963a419c6685746b5cad66032cb9218644aaa6c59fa9f2773d56a74a7f0f1bfd755971ebef6
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:T+856utgpPF8u/7x
TLSH
T1FA565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vEdHAKq.exe

Path C:\Windows\System\vEdHAKq.exe
Size 5.9MB
SHA256 f1058141e167dc371378732cad86b3d615542b2f940dadf0d86af39e104db09f
MD5 11fd2854bb5b04f8f3a5d943d512d4cc
SHA1 10559598410c23382b9e1ba928cc2a849d08722d
SHA512 abab3accad6f61172027463e926bed5dec1272878947fb4e1b02146338e95d0826dc5f93b79f11f2e64d6db7a3513872e8a956bba15e13fed3abe39c60dc0acc
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:T+856utgpPF8u/7U
TLSH
T1BF565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vvUHWCQ.exe

Path C:\Windows\System\vvUHWCQ.exe
Size 5.9MB
SHA256 55de315638747f09222cc872c3a52c83b212b78b9bede0d8b88165680c6fc47a
MD5 88e2672dec8c6fced99fe48b14441521
SHA1 b080d7e86a21ba12db2e236db1ac0c09946b765b
SHA512 e74750f8a29e929a57a189a0eae21e9b767d16f5af5643ba15bd064aca1352915e794e1ea7160095d40728de9070b4d570739fa1bac933970959546c7fa09196
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:T+856utgpPF8u/7d
TLSH
T11D565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/212-119-0x00007FF6ECC80000-0x00007FF6ECFD4000-memory.dmp

Download

memory/212-132-0x00007FF6ECC80000-0x00007FF6ECFD4000-memory.dmp

Download

memory/212-154-0x00007FF6ECC80000-0x00007FF6ECFD4000-memory.dmp

Download

memory/220-124-0x00007FF69F430000-0x00007FF69F784000-memory.dmp

Download

memory/220-133-0x00007FF69F430000-0x00007FF69F784000-memory.dmp

Download

memory/220-153-0x00007FF69F430000-0x00007FF69F784000-memory.dmp

Download

memory/1112-129-0x00007FF771EE0000-0x00007FF772234000-memory.dmp

Download

memory/1112-136-0x00007FF771EE0000-0x00007FF772234000-memory.dmp

Download

memory/1112-27-0x00007FF771EE0000-0x00007FF772234000-memory.dmp

Download

memory/1288-151-0x00007FF78C3A0000-0x00007FF78C6F4000-memory.dmp

Download

memory/1288-102-0x00007FF78C3A0000-0x00007FF78C6F4000-memory.dmp

Download

memory/1632-97-0x00007FF6F0000000-0x00007FF6F0354000-memory.dmp

Download

memory/1632-145-0x00007FF6F0000000-0x00007FF6F0354000-memory.dmp

Download

memory/1652-104-0x00007FF767FA0000-0x00007FF7682F4000-memory.dmp

Download

memory/1652-150-0x00007FF767FA0000-0x00007FF7682F4000-memory.dmp

Download

memory/1940-0-0x00007FF68C5B0000-0x00007FF68C904000-memory.dmp

Download

memory/1940-1-0x00000220BC360000-0x00000220BC370000-memory.dmp

Download

memory/1940-128-0x00007FF68C5B0000-0x00007FF68C904000-memory.dmp

Download

memory/1948-147-0x00007FF7A8BA0000-0x00007FF7A8EF4000-memory.dmp

Download

memory/1948-108-0x00007FF7A8BA0000-0x00007FF7A8EF4000-memory.dmp

Download

memory/2820-86-0x00007FF6841E0000-0x00007FF684534000-memory.dmp

Download

memory/2820-137-0x00007FF6841E0000-0x00007FF684534000-memory.dmp

Download

memory/3068-103-0x00007FF751AD0000-0x00007FF751E24000-memory.dmp

Download

memory/3068-148-0x00007FF751AD0000-0x00007FF751E24000-memory.dmp

Download

memory/3224-64-0x00007FF607D30000-0x00007FF608084000-memory.dmp

Download

memory/3224-141-0x00007FF607D30000-0x00007FF608084000-memory.dmp

Download

memory/3252-146-0x00007FF723070000-0x00007FF7233C4000-memory.dmp

Download

memory/3252-101-0x00007FF723070000-0x00007FF7233C4000-memory.dmp

Download

memory/3804-139-0x00007FF7193E0000-0x00007FF719734000-memory.dmp

Download

memory/3804-107-0x00007FF7193E0000-0x00007FF719734000-memory.dmp

Download

memory/4164-135-0x00007FF6FE2B0000-0x00007FF6FE604000-memory.dmp

Download

memory/4164-131-0x00007FF6FE2B0000-0x00007FF6FE604000-memory.dmp

Download

memory/4164-11-0x00007FF6FE2B0000-0x00007FF6FE604000-memory.dmp

Download

memory/4208-134-0x00007FF75A240000-0x00007FF75A594000-memory.dmp

Download

memory/4208-155-0x00007FF75A240000-0x00007FF75A594000-memory.dmp

Download

memory/4208-125-0x00007FF75A240000-0x00007FF75A594000-memory.dmp

Download

memory/4516-138-0x00007FF7677F0000-0x00007FF767B44000-memory.dmp

Download

memory/4516-85-0x00007FF7677F0000-0x00007FF767B44000-memory.dmp

Download

memory/4792-142-0x00007FF6F2FF0000-0x00007FF6F3344000-memory.dmp

Download

memory/4792-130-0x00007FF6F2FF0000-0x00007FF6F3344000-memory.dmp

Download

memory/4792-41-0x00007FF6F2FF0000-0x00007FF6F3344000-memory.dmp

Download

memory/4868-109-0x00007FF7663B0000-0x00007FF766704000-memory.dmp

Download

memory/4868-152-0x00007FF7663B0000-0x00007FF766704000-memory.dmp

Download

memory/5004-143-0x00007FF61E1D0000-0x00007FF61E524000-memory.dmp

Download

memory/5004-106-0x00007FF61E1D0000-0x00007FF61E524000-memory.dmp

Download

memory/5028-140-0x00007FF786600000-0x00007FF786954000-memory.dmp

Download

memory/5028-77-0x00007FF786600000-0x00007FF786954000-memory.dmp

Download

memory/5048-149-0x00007FF70D5B0000-0x00007FF70D904000-memory.dmp

Download

memory/5048-105-0x00007FF70D5B0000-0x00007FF70D904000-memory.dmp

Download

memory/5060-144-0x00007FF7FC240000-0x00007FF7FC594000-memory.dmp

Download

memory/5060-100-0x00007FF7FC240000-0x00007FF7FC594000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads