cobaltstrike | 50b5516ac6282d9e7bdafe4870b2347f6b4387780aa51754ced859873420fb66

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample261026-eekc9sby4s
SHA256 50b5516ac6282d9e7bdafe4870b2347f6b4387780aa51754ced859873420fb66
MD5 475aae82764e1d70d7e2aaf8777f8c48
SHA1 8083952a69e6f0e32fbc045253bfd0d2c7d1c74f
SHA512 ac9706d7d388fde0530c422176ec22b6588c3e8c5bc1c277e58bf3ac3295b6cfa8e05c281cb4fce031418c1e0c9c9e97dd490a79c479d3deabe9f4bd1240b578
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUu:v+D56utgpPF8u/7u
TLSH
T1F6965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x00070000000004e8-4.dat	cobalt_reflective_dll
behavioral1/files/0x001400000002423d-20.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024331-62.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024335-72.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024333-69.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024332-65.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024334-55.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024330-53.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002432f-45.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002432e-41.dat	cobalt_reflective_dll
behavioral1/files/0x0014000000024232-30.dat	cobalt_reflective_dll
behavioral1/files/0x000600000001e416-15.dat	cobalt_reflective_dll
behavioral1/files/0x001200000001e595-87.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002433b-102.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002433d-117.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002433e-119.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002433c-113.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024339-103.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002433a-100.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024338-98.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024336-84.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral1/files/0x00070000000004e8-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x001400000002423d-20.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024331-62.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024335-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024333-69.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024332-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024334-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024330-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002432f-45.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002432e-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0014000000024232-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000600000001e416-15.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x001200000001e595-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002433b-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002433d-117.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002433e-119.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002433c-113.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024339-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002433a-100.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024338-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024336-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral1/memory/1180-0-0x00007FF6FC6C0000-0x00007FF6FCA12000-memory.dmp	UPX
behavioral1/files/0x00070000000004e8-4.dat	UPX
behavioral1/files/0x001400000002423d-20.dat	UPX
behavioral1/memory/3564-32-0x00007FF7A62B0000-0x00007FF7A6602000-memory.dmp	UPX
behavioral1/memory/1436-38-0x00007FF698830000-0x00007FF698B82000-memory.dmp	UPX
behavioral1/memory/4896-52-0x00007FF6AC060000-0x00007FF6AC3B2000-memory.dmp	UPX
behavioral1/files/0x0007000000024331-62.dat	UPX
behavioral1/memory/3388-71-0x00007FF7C11E0000-0x00007FF7C1532000-memory.dmp	UPX
behavioral1/memory/4700-74-0x00007FF731AA0000-0x00007FF731DF2000-memory.dmp	UPX
behavioral1/files/0x0007000000024335-72.dat	UPX
behavioral1/files/0x0007000000024333-69.dat	UPX
behavioral1/memory/4572-68-0x00007FF77BB60000-0x00007FF77BEB2000-memory.dmp	UPX
behavioral1/memory/4008-67-0x00007FF68C890000-0x00007FF68CBE2000-memory.dmp	UPX
behavioral1/files/0x0007000000024332-65.dat	UPX
behavioral1/memory/5104-61-0x00007FF67A3A0000-0x00007FF67A6F2000-memory.dmp	UPX
behavioral1/memory/1464-60-0x00007FF65E4C0000-0x00007FF65E812000-memory.dmp	UPX
behavioral1/files/0x0007000000024334-55.dat	UPX
behavioral1/files/0x0007000000024330-53.dat	UPX
behavioral1/files/0x000700000002432f-45.dat	UPX
behavioral1/files/0x000700000002432e-41.dat	UPX
behavioral1/files/0x0014000000024232-30.dat	UPX
behavioral1/memory/4412-29-0x00007FF7ECF40000-0x00007FF7ED292000-memory.dmp	UPX
behavioral1/memory/452-19-0x00007FF6893D0000-0x00007FF689722000-memory.dmp	UPX
behavioral1/files/0x000600000001e416-15.dat	UPX
behavioral1/memory/4988-11-0x00007FF6CAED0000-0x00007FF6CB222000-memory.dmp	UPX
behavioral1/files/0x001200000001e595-87.dat	UPX
behavioral1/memory/5084-95-0x00007FF6967F0000-0x00007FF696B42000-memory.dmp	UPX
behavioral1/files/0x000700000002433b-102.dat	UPX
behavioral1/files/0x000700000002433d-117.dat	UPX
behavioral1/files/0x000700000002433e-119.dat	UPX
behavioral1/files/0x000700000002433c-113.dat	UPX
behavioral1/files/0x0007000000024339-103.dat	UPX
behavioral1/files/0x000700000002433a-100.dat	UPX
behavioral1/files/0x0007000000024338-98.dat	UPX
behavioral1/files/0x0007000000024336-84.dat	UPX
behavioral1/memory/2640-83-0x00007FF748A80000-0x00007FF748DD2000-memory.dmp	UPX
behavioral1/memory/2232-121-0x00007FF772970000-0x00007FF772CC2000-memory.dmp	UPX
behavioral1/memory/2984-122-0x00007FF794770000-0x00007FF794AC2000-memory.dmp	UPX
behavioral1/memory/220-123-0x00007FF6F36F0000-0x00007FF6F3A42000-memory.dmp	UPX
behavioral1/memory/740-124-0x00007FF6780A0000-0x00007FF6783F2000-memory.dmp	UPX
behavioral1/memory/4960-125-0x00007FF680030000-0x00007FF680382000-memory.dmp	UPX
behavioral1/memory/4824-126-0x00007FF713770000-0x00007FF713AC2000-memory.dmp	UPX
behavioral1/memory/2724-127-0x00007FF6E8A70000-0x00007FF6E8DC2000-memory.dmp	UPX
behavioral1/memory/1180-128-0x00007FF6FC6C0000-0x00007FF6FCA12000-memory.dmp	UPX
behavioral1/memory/4988-129-0x00007FF6CAED0000-0x00007FF6CB222000-memory.dmp	UPX
behavioral1/memory/452-130-0x00007FF6893D0000-0x00007FF689722000-memory.dmp	UPX
behavioral1/memory/4412-131-0x00007FF7ECF40000-0x00007FF7ED292000-memory.dmp	UPX
behavioral1/memory/3564-132-0x00007FF7A62B0000-0x00007FF7A6602000-memory.dmp	UPX
behavioral1/memory/1464-134-0x00007FF65E4C0000-0x00007FF65E812000-memory.dmp	UPX
behavioral1/memory/4896-133-0x00007FF6AC060000-0x00007FF6AC3B2000-memory.dmp	UPX
behavioral1/memory/5104-135-0x00007FF67A3A0000-0x00007FF67A6F2000-memory.dmp	UPX
behavioral1/memory/4700-136-0x00007FF731AA0000-0x00007FF731DF2000-memory.dmp	UPX
behavioral1/memory/2640-137-0x00007FF748A80000-0x00007FF748DD2000-memory.dmp	UPX
behavioral1/memory/2232-138-0x00007FF772970000-0x00007FF772CC2000-memory.dmp	UPX
behavioral1/memory/4988-139-0x00007FF6CAED0000-0x00007FF6CB222000-memory.dmp	UPX
behavioral1/memory/452-140-0x00007FF6893D0000-0x00007FF689722000-memory.dmp	UPX
behavioral1/memory/3564-141-0x00007FF7A62B0000-0x00007FF7A6602000-memory.dmp	UPX
behavioral1/memory/1436-143-0x00007FF698830000-0x00007FF698B82000-memory.dmp	UPX
behavioral1/memory/4008-145-0x00007FF68C890000-0x00007FF68CBE2000-memory.dmp	UPX
behavioral1/memory/4412-144-0x00007FF7ECF40000-0x00007FF7ED292000-memory.dmp	UPX
behavioral1/memory/4896-142-0x00007FF6AC060000-0x00007FF6AC3B2000-memory.dmp	UPX
behavioral1/memory/4700-147-0x00007FF731AA0000-0x00007FF731DF2000-memory.dmp	UPX
behavioral1/memory/4572-150-0x00007FF77BB60000-0x00007FF77BEB2000-memory.dmp	UPX
behavioral1/memory/1464-149-0x00007FF65E4C0000-0x00007FF65E812000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/1180-0-0x00007FF6FC6C0000-0x00007FF6FCA12000-memory.dmp	xmrig
behavioral1/files/0x00070000000004e8-4.dat	xmrig
behavioral1/files/0x001400000002423d-20.dat	xmrig
behavioral1/memory/3564-32-0x00007FF7A62B0000-0x00007FF7A6602000-memory.dmp	xmrig
behavioral1/memory/1436-38-0x00007FF698830000-0x00007FF698B82000-memory.dmp	xmrig
behavioral1/memory/4896-52-0x00007FF6AC060000-0x00007FF6AC3B2000-memory.dmp	xmrig
behavioral1/files/0x0007000000024331-62.dat	xmrig
behavioral1/memory/3388-71-0x00007FF7C11E0000-0x00007FF7C1532000-memory.dmp	xmrig
behavioral1/memory/4700-74-0x00007FF731AA0000-0x00007FF731DF2000-memory.dmp	xmrig
behavioral1/files/0x0007000000024335-72.dat	xmrig
behavioral1/files/0x0007000000024333-69.dat	xmrig
behavioral1/memory/4572-68-0x00007FF77BB60000-0x00007FF77BEB2000-memory.dmp	xmrig
behavioral1/memory/4008-67-0x00007FF68C890000-0x00007FF68CBE2000-memory.dmp	xmrig
behavioral1/files/0x0007000000024332-65.dat	xmrig
behavioral1/memory/5104-61-0x00007FF67A3A0000-0x00007FF67A6F2000-memory.dmp	xmrig
behavioral1/memory/1464-60-0x00007FF65E4C0000-0x00007FF65E812000-memory.dmp	xmrig
behavioral1/files/0x0007000000024334-55.dat	xmrig
behavioral1/files/0x0007000000024330-53.dat	xmrig
behavioral1/files/0x000700000002432f-45.dat	xmrig
behavioral1/files/0x000700000002432e-41.dat	xmrig
behavioral1/files/0x0014000000024232-30.dat	xmrig
behavioral1/memory/4412-29-0x00007FF7ECF40000-0x00007FF7ED292000-memory.dmp	xmrig
behavioral1/memory/452-19-0x00007FF6893D0000-0x00007FF689722000-memory.dmp	xmrig
behavioral1/files/0x000600000001e416-15.dat	xmrig
behavioral1/memory/4988-11-0x00007FF6CAED0000-0x00007FF6CB222000-memory.dmp	xmrig
behavioral1/files/0x001200000001e595-87.dat	xmrig
behavioral1/memory/5084-95-0x00007FF6967F0000-0x00007FF696B42000-memory.dmp	xmrig
behavioral1/files/0x000700000002433b-102.dat	xmrig
behavioral1/files/0x000700000002433d-117.dat	xmrig
behavioral1/files/0x000700000002433e-119.dat	xmrig
behavioral1/files/0x000700000002433c-113.dat	xmrig
behavioral1/files/0x0007000000024339-103.dat	xmrig
behavioral1/files/0x000700000002433a-100.dat	xmrig
behavioral1/files/0x0007000000024338-98.dat	xmrig
behavioral1/files/0x0007000000024336-84.dat	xmrig
behavioral1/memory/2640-83-0x00007FF748A80000-0x00007FF748DD2000-memory.dmp	xmrig
behavioral1/memory/2232-121-0x00007FF772970000-0x00007FF772CC2000-memory.dmp	xmrig
behavioral1/memory/2984-122-0x00007FF794770000-0x00007FF794AC2000-memory.dmp	xmrig
behavioral1/memory/220-123-0x00007FF6F36F0000-0x00007FF6F3A42000-memory.dmp	xmrig
behavioral1/memory/740-124-0x00007FF6780A0000-0x00007FF6783F2000-memory.dmp	xmrig
behavioral1/memory/4960-125-0x00007FF680030000-0x00007FF680382000-memory.dmp	xmrig
behavioral1/memory/4824-126-0x00007FF713770000-0x00007FF713AC2000-memory.dmp	xmrig
behavioral1/memory/2724-127-0x00007FF6E8A70000-0x00007FF6E8DC2000-memory.dmp	xmrig
behavioral1/memory/1180-128-0x00007FF6FC6C0000-0x00007FF6FCA12000-memory.dmp	xmrig
behavioral1/memory/4988-129-0x00007FF6CAED0000-0x00007FF6CB222000-memory.dmp	xmrig
behavioral1/memory/452-130-0x00007FF6893D0000-0x00007FF689722000-memory.dmp	xmrig
behavioral1/memory/4412-131-0x00007FF7ECF40000-0x00007FF7ED292000-memory.dmp	xmrig
behavioral1/memory/3564-132-0x00007FF7A62B0000-0x00007FF7A6602000-memory.dmp	xmrig
behavioral1/memory/1464-134-0x00007FF65E4C0000-0x00007FF65E812000-memory.dmp	xmrig
behavioral1/memory/4896-133-0x00007FF6AC060000-0x00007FF6AC3B2000-memory.dmp	xmrig
behavioral1/memory/5104-135-0x00007FF67A3A0000-0x00007FF67A6F2000-memory.dmp	xmrig
behavioral1/memory/4700-136-0x00007FF731AA0000-0x00007FF731DF2000-memory.dmp	xmrig
behavioral1/memory/2640-137-0x00007FF748A80000-0x00007FF748DD2000-memory.dmp	xmrig
behavioral1/memory/2232-138-0x00007FF772970000-0x00007FF772CC2000-memory.dmp	xmrig
behavioral1/memory/4988-139-0x00007FF6CAED0000-0x00007FF6CB222000-memory.dmp	xmrig
behavioral1/memory/452-140-0x00007FF6893D0000-0x00007FF689722000-memory.dmp	xmrig
behavioral1/memory/3564-141-0x00007FF7A62B0000-0x00007FF7A6602000-memory.dmp	xmrig
behavioral1/memory/1436-143-0x00007FF698830000-0x00007FF698B82000-memory.dmp	xmrig
behavioral1/memory/4008-145-0x00007FF68C890000-0x00007FF68CBE2000-memory.dmp	xmrig
behavioral1/memory/4412-144-0x00007FF7ECF40000-0x00007FF7ED292000-memory.dmp	xmrig
behavioral1/memory/4896-142-0x00007FF6AC060000-0x00007FF6AC3B2000-memory.dmp	xmrig
behavioral1/memory/4700-147-0x00007FF731AA0000-0x00007FF731DF2000-memory.dmp	xmrig
behavioral1/memory/4572-150-0x00007FF77BB60000-0x00007FF77BEB2000-memory.dmp	xmrig
behavioral1/memory/1464-149-0x00007FF65E4C0000-0x00007FF65E812000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4988	OPFahVd.exe
452	pMAWGXq.exe
1436	TjcJeJt.exe
4412	OvPgFzd.exe
4896	LytJMrx.exe
3564	NLKrCvs.exe
4008	ZQZvvjE.exe
4572	rsKKdRQ.exe
1464	PMcXIoh.exe
5104	WMKbkad.exe
3388	VTIzZvI.exe
4700	vZujQte.exe
2640	vuzqpwQ.exe
5084	XLEfvUp.exe
4824	Lqvqxom.exe
2232	KDpAdhr.exe
2984	YGUhVhH.exe
2724	FGVlEeO.exe
220	PzpBzks.exe
740	RWhsMVW.exe
4960	lrZRpJH.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1180-0-0x00007FF6FC6C0000-0x00007FF6FCA12000-memory.dmp	upx
behavioral1/files/0x00070000000004e8-4.dat	upx
behavioral1/files/0x001400000002423d-20.dat	upx
behavioral1/memory/3564-32-0x00007FF7A62B0000-0x00007FF7A6602000-memory.dmp	upx
behavioral1/memory/1436-38-0x00007FF698830000-0x00007FF698B82000-memory.dmp	upx
behavioral1/memory/4896-52-0x00007FF6AC060000-0x00007FF6AC3B2000-memory.dmp	upx
behavioral1/files/0x0007000000024331-62.dat	upx
behavioral1/memory/3388-71-0x00007FF7C11E0000-0x00007FF7C1532000-memory.dmp	upx
behavioral1/memory/4700-74-0x00007FF731AA0000-0x00007FF731DF2000-memory.dmp	upx
behavioral1/files/0x0007000000024335-72.dat	upx
behavioral1/files/0x0007000000024333-69.dat	upx
behavioral1/memory/4572-68-0x00007FF77BB60000-0x00007FF77BEB2000-memory.dmp	upx
behavioral1/memory/4008-67-0x00007FF68C890000-0x00007FF68CBE2000-memory.dmp	upx
behavioral1/files/0x0007000000024332-65.dat	upx
behavioral1/memory/5104-61-0x00007FF67A3A0000-0x00007FF67A6F2000-memory.dmp	upx
behavioral1/memory/1464-60-0x00007FF65E4C0000-0x00007FF65E812000-memory.dmp	upx
behavioral1/files/0x0007000000024334-55.dat	upx
behavioral1/files/0x0007000000024330-53.dat	upx
behavioral1/files/0x000700000002432f-45.dat	upx
behavioral1/files/0x000700000002432e-41.dat	upx
behavioral1/files/0x0014000000024232-30.dat	upx
behavioral1/memory/4412-29-0x00007FF7ECF40000-0x00007FF7ED292000-memory.dmp	upx
behavioral1/memory/452-19-0x00007FF6893D0000-0x00007FF689722000-memory.dmp	upx
behavioral1/files/0x000600000001e416-15.dat	upx
behavioral1/memory/4988-11-0x00007FF6CAED0000-0x00007FF6CB222000-memory.dmp	upx
behavioral1/files/0x001200000001e595-87.dat	upx
behavioral1/memory/5084-95-0x00007FF6967F0000-0x00007FF696B42000-memory.dmp	upx
behavioral1/files/0x000700000002433b-102.dat	upx
behavioral1/files/0x000700000002433d-117.dat	upx
behavioral1/files/0x000700000002433e-119.dat	upx
behavioral1/files/0x000700000002433c-113.dat	upx
behavioral1/files/0x0007000000024339-103.dat	upx
behavioral1/files/0x000700000002433a-100.dat	upx
behavioral1/files/0x0007000000024338-98.dat	upx
behavioral1/files/0x0007000000024336-84.dat	upx
behavioral1/memory/2640-83-0x00007FF748A80000-0x00007FF748DD2000-memory.dmp	upx
behavioral1/memory/2232-121-0x00007FF772970000-0x00007FF772CC2000-memory.dmp	upx
behavioral1/memory/2984-122-0x00007FF794770000-0x00007FF794AC2000-memory.dmp	upx
behavioral1/memory/220-123-0x00007FF6F36F0000-0x00007FF6F3A42000-memory.dmp	upx
behavioral1/memory/740-124-0x00007FF6780A0000-0x00007FF6783F2000-memory.dmp	upx
behavioral1/memory/4960-125-0x00007FF680030000-0x00007FF680382000-memory.dmp	upx
behavioral1/memory/4824-126-0x00007FF713770000-0x00007FF713AC2000-memory.dmp	upx
behavioral1/memory/2724-127-0x00007FF6E8A70000-0x00007FF6E8DC2000-memory.dmp	upx
behavioral1/memory/1180-128-0x00007FF6FC6C0000-0x00007FF6FCA12000-memory.dmp	upx
behavioral1/memory/4988-129-0x00007FF6CAED0000-0x00007FF6CB222000-memory.dmp	upx
behavioral1/memory/452-130-0x00007FF6893D0000-0x00007FF689722000-memory.dmp	upx
behavioral1/memory/4412-131-0x00007FF7ECF40000-0x00007FF7ED292000-memory.dmp	upx
behavioral1/memory/3564-132-0x00007FF7A62B0000-0x00007FF7A6602000-memory.dmp	upx
behavioral1/memory/1464-134-0x00007FF65E4C0000-0x00007FF65E812000-memory.dmp	upx
behavioral1/memory/4896-133-0x00007FF6AC060000-0x00007FF6AC3B2000-memory.dmp	upx
behavioral1/memory/5104-135-0x00007FF67A3A0000-0x00007FF67A6F2000-memory.dmp	upx
behavioral1/memory/4700-136-0x00007FF731AA0000-0x00007FF731DF2000-memory.dmp	upx
behavioral1/memory/2640-137-0x00007FF748A80000-0x00007FF748DD2000-memory.dmp	upx
behavioral1/memory/2232-138-0x00007FF772970000-0x00007FF772CC2000-memory.dmp	upx
behavioral1/memory/4988-139-0x00007FF6CAED0000-0x00007FF6CB222000-memory.dmp	upx
behavioral1/memory/452-140-0x00007FF6893D0000-0x00007FF689722000-memory.dmp	upx
behavioral1/memory/3564-141-0x00007FF7A62B0000-0x00007FF7A6602000-memory.dmp	upx
behavioral1/memory/1436-143-0x00007FF698830000-0x00007FF698B82000-memory.dmp	upx
behavioral1/memory/4008-145-0x00007FF68C890000-0x00007FF68CBE2000-memory.dmp	upx
behavioral1/memory/4412-144-0x00007FF7ECF40000-0x00007FF7ED292000-memory.dmp	upx
behavioral1/memory/4896-142-0x00007FF6AC060000-0x00007FF6AC3B2000-memory.dmp	upx
behavioral1/memory/4700-147-0x00007FF731AA0000-0x00007FF731DF2000-memory.dmp	upx
behavioral1/memory/4572-150-0x00007FF77BB60000-0x00007FF77BEB2000-memory.dmp	upx
behavioral1/memory/1464-149-0x00007FF65E4C0000-0x00007FF65E812000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\ZQZvvjE.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\vZujQte.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\YGUhVhH.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\FGVlEeO.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\PzpBzks.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\OPFahVd.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\TjcJeJt.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\NLKrCvs.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\rsKKdRQ.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\PMcXIoh.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\WMKbkad.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\XLEfvUp.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\lrZRpJH.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\OvPgFzd.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\LytJMrx.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\vuzqpwQ.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\KDpAdhr.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\pMAWGXq.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\VTIzZvI.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\Lqvqxom.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\RWhsMVW.exe	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 4988	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	86
PID 1180 wrote to memory of 452	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	87
PID 1180 wrote to memory of 1436	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	88
PID 1180 wrote to memory of 4412	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	89
PID 1180 wrote to memory of 4896	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 1180 wrote to memory of 3564	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 1180 wrote to memory of 4008	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 1180 wrote to memory of 4572	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 1180 wrote to memory of 1464	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 1180 wrote to memory of 5104	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 1180 wrote to memory of 3388	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 1180 wrote to memory of 4700	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 1180 wrote to memory of 2640	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 1180 wrote to memory of 5084	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 1180 wrote to memory of 4824	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 1180 wrote to memory of 2232	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 1180 wrote to memory of 2984	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 1180 wrote to memory of 2724	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 1180 wrote to memory of 220	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 1180 wrote to memory of 740	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 1180 wrote to memory of 4960	1180	2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_475aae82764e1d70d7e2aaf8777f8c48_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\System\OPFahVd.exe
  C:\Windows\System\OPFahVd.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\pMAWGXq.exe
  C:\Windows\System\pMAWGXq.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\TjcJeJt.exe
  C:\Windows\System\TjcJeJt.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\OvPgFzd.exe
  C:\Windows\System\OvPgFzd.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\LytJMrx.exe
  C:\Windows\System\LytJMrx.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\NLKrCvs.exe
  C:\Windows\System\NLKrCvs.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\ZQZvvjE.exe
  C:\Windows\System\ZQZvvjE.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\rsKKdRQ.exe
  C:\Windows\System\rsKKdRQ.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\PMcXIoh.exe
  C:\Windows\System\PMcXIoh.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\WMKbkad.exe
  C:\Windows\System\WMKbkad.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\VTIzZvI.exe
  C:\Windows\System\VTIzZvI.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\vZujQte.exe
  C:\Windows\System\vZujQte.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\vuzqpwQ.exe
  C:\Windows\System\vuzqpwQ.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\XLEfvUp.exe
  C:\Windows\System\XLEfvUp.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\Lqvqxom.exe
  C:\Windows\System\Lqvqxom.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\KDpAdhr.exe
  C:\Windows\System\KDpAdhr.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\YGUhVhH.exe
  C:\Windows\System\YGUhVhH.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\FGVlEeO.exe
  C:\Windows\System\FGVlEeO.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\PzpBzks.exe
  C:\Windows\System\PzpBzks.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\RWhsMVW.exe
  C:\Windows\System\RWhsMVW.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\lrZRpJH.exe
  C:\Windows\System\lrZRpJH.exe
  2⤵
  - Executes dropped EXE
  PID:4960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

FGVlEeO.exe

Path C:\Windows\System\FGVlEeO.exe
Size 8.3MB
SHA256 50143386d68fa85ed54b33b83948c68b0b1a645b24badffef5ab5b9d30254b7f
MD5 8d85af5960936c972a7636a6caf63ca5
SHA1 0dbcd6abb1f2c9559c150c84ce9d357c7ba9e39a
SHA512 57a807b38a9a1efad087df26b1e814ff779e10eb08c71abdc27adf93ab23d603e3cded819567594fc30ca0a606613fb09b6fbaad00650285382e7caf37a8b86f
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUG:v+D56utgpPF8u/7G
TLSH
T104965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KDpAdhr.exe

Path C:\Windows\System\KDpAdhr.exe
Size 8.3MB
SHA256 c6a8a33c46ca186334fa6fafc12a4995a9768b7e2ff13b2e24c1e017fc7afb84
MD5 2807978ce9108907978264fb77fb1c03
SHA1 fcbfd446fee5e171b5d8b4fbe699ccd638586c32
SHA512 6359770bffab97df15a1282c17a76c901dc1284ec51f92119ac15c6a19588784432dc4b7613d6216a03b9dd8c95fcc145acac601a4837529320eb36739ad61d0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUR:v+D56utgpPF8u/7R
TLSH
T175965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lqvqxom.exe

Path C:\Windows\System\Lqvqxom.exe
Size 8.3MB
SHA256 9565cdaf5e7a07eb5b5a6638d2a7d9a3a2c333c818498986692e99e4ce39e04c
MD5 6160534a14579fbd4651f23e3a21f157
SHA1 f0d68f65bd45d82b380e59793fada1a8a657e434
SHA512 7e3a984bdaa07cb524bf1a73117bb086dfbbad7095aa6774e11764666e691a28b39213942e5ae41c12242c3d0069568dd1564df7814b93e2086cdb34d0230dc0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUT:v+D56utgpPF8u/7T
TLSH
T13C965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LytJMrx.exe

Path C:\Windows\System\LytJMrx.exe
Size 8.3MB
SHA256 12e3605636b34850de4a048cbbab599bb1b3279cbe6268b19c70ecb837dc7dc3
MD5 0b4a7a041d19feed5aec2c17270051df
SHA1 c008973549ab9a979289289c84cb1f5ed5e94bf4
SHA512 82c7d5f16b49fc0992111ddc3acd92a5636815e95039d9a46545cb448c9998b523ee903e574cc2f0df63247504d7e5c98df4861ee2130d176915b1d653ae4213
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUH:v+D56utgpPF8u/7H
TLSH
T1C1965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NLKrCvs.exe

Path C:\Windows\System\NLKrCvs.exe
Size 8.3MB
SHA256 05d4af8b21271c6b535485b10e923173e58afc3b115366904a4d2fa0e96cc259
MD5 68a1d78d2cee4d2ee2d88cba13c0db2d
SHA1 2ec3ac7d6542885128b74c88d9b8b78d8159dd27
SHA512 d695443f01b55b8a0f1415a333b8edd6714a866f53b3f7fa549191de58bf885525b16c56d2819d9cf9ce778755de35e0ce22c4b0a17ac44f6ea7e215d9c0db28
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUT:v+D56utgpPF8u/7T
TLSH
T18F965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OPFahVd.exe

Path C:\Windows\System\OPFahVd.exe
Size 8.3MB
SHA256 168dae5007ca918ca6b6a36d4c2fc9de4a405f726f8c8ad82fc9711dd932c608
MD5 54282ab4a796f5b91295bf1c54518c5f
SHA1 88e65304262269ae06df5f087f3d5a0802802a26
SHA512 542b7791042415747d119fe49c9b83ecd76d9336395cd53b00712c819e5531ea01220dfe622b65c860f4f2daa8f348a31eabada6d2c9e1b3428a03bc90c617a7
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUc:v+D56utgpPF8u/7c
TLSH
T12B965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OvPgFzd.exe

Path C:\Windows\System\OvPgFzd.exe
Size 8.3MB
SHA256 c27ca2180c1c9594abf585822fe35058862ead8f214e7ad36efa02edbf2329e5
MD5 847a63b77a2be941031256950e068156
SHA1 16f0ddcc77c337beda98150a4c8792e36f9eae2f
SHA512 d33275379da4135a743bac51a1e2cf2301b4db1fbc477836d22c0bb1841e1c256af9b88ffa2c51490721434e7b4aa5d185aee09956f9bdef0d9367b47c3e37e5
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUe:v+D56utgpPF8u/7e
TLSH
T146965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PMcXIoh.exe

Path C:\Windows\System\PMcXIoh.exe
Size 8.3MB
SHA256 75ce3963b3a73b16d3901475d1a69883eecd84afe380827eeebde64f3b9bbdbd
MD5 b1213ad71ca2c322fc6c660a67348ee5
SHA1 1e8c46496a6afa31e90dced3cdc3f72389fd5215
SHA512 ee246b312b756ee104ead07c6abc0d0b86fc6a5358fba97750afe46720c15f7598032efdb0df5c86094990c9b1aba4f8847e4e1dc11e59be92de0b795a0a7f43
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU9:v+D56utgpPF8u/79
TLSH
T111965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PzpBzks.exe

Path C:\Windows\System\PzpBzks.exe
Size 8.3MB
SHA256 8b9cebc712104f5a5650a24a61a97f06e2bef97dc37177be9bb428827e883b58
MD5 61c4e2904e9fdd7c60859bdb77f2c915
SHA1 bb995bb8f74312ce29fd7d2deac93148870a578c
SHA512 7d50ab47c805d039e4cd4484d80826307ac63a46c2d23ba3656a854122e484787d700b1bcda97c9ff56c8d35ae333da5983f1d27b334d744faf5b8d6a2627c4b
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUv:v+D56utgpPF8u/7v
TLSH
T178965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RWhsMVW.exe

Path C:\Windows\System\RWhsMVW.exe
Size 8.3MB
SHA256 faa773fd3dfcb404a62d4fa1c7ac15f45902fd6e134e9a610cd29dde760c1971
MD5 754cb5d8d8ed7fdfa4b98a1f2c04f13e
SHA1 2aec538f73e4aa4cacf9a236fa883d8add18f4f0
SHA512 6de58120915acfe1caf8d0b021b4e97058fd26e3522374a4b36ac4ece172bd296f97cd2500ada889aad433f59b2d7d64af1350dd5272cb27f30d4f1331d3ceec
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUR:v+D56utgpPF8u/7R
TLSH
T155965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TjcJeJt.exe

Path C:\Windows\System\TjcJeJt.exe
Size 8.3MB
SHA256 f901ad107002992223bfe6baaafb20b30822a354be65c2d37d3ed3956e594ccf
MD5 63a207f40a97281e32728bb746d69ec1
SHA1 9912fa43a80d6e326fd85e44ba6afc75fe99831a
SHA512 9fb02e9672db3c40cafaca5be3c26d55a72c76593918baa49c7115c5b2c8fa50d75e79f7b5db3d6cb337e021d213ae0ec046126c93b7575a647ecb36dea68177
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUZ:v+D56utgpPF8u/7Z
TLSH
T1E0965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VTIzZvI.exe

Path C:\Windows\System\VTIzZvI.exe
Size 8.3MB
SHA256 a72242db05e7074b5d25beb3699c71c420acf85c4959d9e1d594cf7ff12f8977
MD5 254ab6364c9d6f1c3c2b905ef704095e
SHA1 871c226f58dfe5e901eb2c1a66d00262de74cb2f
SHA512 9c7b05a5d72964262d65a80a710a7e338375c44beeab2f220873addf3e7199c91e202c9f6320ef39274dc5c0e8aacd2bb744f89623d92dc3b027dbdc54f7cdcb
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUU:v+D56utgpPF8u/7U
TLSH
T143965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMKbkad.exe

Path C:\Windows\System\WMKbkad.exe
Size 8.3MB
SHA256 249bd757af0864fc1c5e29ad216b1cb9bb87beafb1f6f6fa28734b1c70aa41a8
MD5 b2c31642c12a4ca1f2c62f172a51d21b
SHA1 000a1e62bfcd79e5dc744b281a08c90f4844cc31
SHA512 29baa130faa9e511943afb360e94f2b2449aaa43cb8c7909841c0d90a1594792de6b92e241c6c1af57618b07d91e8a2f3b00925bc6dea973c64f931e4f57982f
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUL:v+D56utgpPF8u/7L
TLSH
T188965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XLEfvUp.exe

Path C:\Windows\System\XLEfvUp.exe
Size 8.3MB
SHA256 aa2946a8869746e214131d16916b0b96a9405cbd4dfe76cdbbbf9b595e5cdd58
MD5 395958c38174c929b1dc39d50577e92c
SHA1 0179928ec2113ee852a8e699746f1f3a8de2bea5
SHA512 70240876a684ee5e2d65b0f6bd6a03d3a68b545d43cef30a24e271061cb5ba0801257cd066789da7fe873810c33c6c99963c2c1fd000936d844ecb8569e6622e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUl:v+D56utgpPF8u/7l
TLSH
T172965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YGUhVhH.exe

Path C:\Windows\System\YGUhVhH.exe
Size 8.3MB
SHA256 9c51b3d4a4337a227c387241a8ec6da0df7a377ae2ed02c296ec960e2756a5d6
MD5 b93ba2101fb6079b0e768073783f3449
SHA1 7a8e669f32fb6c41c5ea884a3b7288d06ab99cd3
SHA512 9cee29b584e082b313345e2e409fea84e1c31027383c6ae12aee84c5f355de804b5844dcad81ae1a77e6becc394d86ffcc0841795a8474264ab5a6b4f67ae630
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUm:v+D56utgpPF8u/7m
TLSH
T1F5965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZQZvvjE.exe

Path C:\Windows\System\ZQZvvjE.exe
Size 8.3MB
SHA256 ccb9725fdd2e1680ed6a7d967e6d894667dba8c22560d61993eef655e05d19a6
MD5 c9081c83962140d3cafca89173fac539
SHA1 80392dedaaa74002c98be3738ce3a5ee8aff32eb
SHA512 96a7f95ce258e038188ad21d59a0fb9996fd4d2cd75ee78848d74d399c36e243eeb1ecdbccc8581724208156a220369e8f21c4608b8a434798c180e4a6f5207e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUz:v+D56utgpPF8u/7z
TLSH
T1A1965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lrZRpJH.exe

Path C:\Windows\System\lrZRpJH.exe
Size 8.3MB
SHA256 aee25edfb9b63e86393af7eacab08df3517d4923977ecccf5d86bcc6a6d0e1e5
MD5 2582e630908a6db55e8012f0ae8ee3ae
SHA1 f840a8868ef1e6284e04a3c4890265d7f89cffcc
SHA512 c9c6b76246cb189e4a4a850540c0596555864e8e6d60395e1867b4fe4c48ce437f730c02fe37a05d80b7eb3ecd133fa37d61d23c39d0de088b383e2ba645b945
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUu:v+D56utgpPF8u/7u
TLSH
T11D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pMAWGXq.exe

Path C:\Windows\System\pMAWGXq.exe
Size 8.3MB
SHA256 903a52b0e374e3dccac8c302df707b455d2cd68d8108153d1089572024e490d2
MD5 bdeb7f2745d5c6cdf2719d79131d4515
SHA1 4f49d9ab3048ec384fda9c9ef5652a6765d56b39
SHA512 9ebfb2a8287fd25dec40257f734ea355ee9293e894bd8e5a60cc4ee8b4db204272f6c9c38308937b462ff36577089ddfed58171fd59d84cafa08bd8f86fdf49d
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUy:v+D56utgpPF8u/7y
TLSH
T15E965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rsKKdRQ.exe

Path C:\Windows\System\rsKKdRQ.exe
Size 8.3MB
SHA256 6f90d982006cc5b4a5bbc1c151e0d51cf34c3fc8a93b3f905d7332c540d5bdae
MD5 f7148c51937e57c3990c9d60d40a5308
SHA1 ca127f2b073927a36489bde9b01d9ad343fab3a9
SHA512 9547e0f8f2aaf8cbeeebe688e67b05a2757176a378b644140928c13ca675e2d440da17fd5384af6fd999041381c7ba1b0a3763bc580df61895da8362c05e1c5c
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU7:v+D56utgpPF8u/77
TLSH
T133965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vZujQte.exe

Path C:\Windows\System\vZujQte.exe
Size 8.3MB
SHA256 6d6ce1b1d0e6299b995ac5b398a611e00b794dc5ef2aca61c370b8935b411a30
MD5 d2ac13eabd0c8dd4d9f1621ac6b62bb3
SHA1 7069492397ee015f8a77a7cb949245ae2d743409
SHA512 cd8332be802bb0647a2de41d6457250286f2af8d0c5534e989045a9552f622f7c72c41fc8265d67875f738143c83cb6f429349618dc1f91019d6f7996b630484
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU/:v+D56utgpPF8u/7/
TLSH
T18D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vuzqpwQ.exe

Path C:\Windows\System\vuzqpwQ.exe
Size 8.3MB
SHA256 7b4e09bd8b8ff527c0da2c7c337172b4d2f917d79b7f7a2ca6b027d5f3a5235a
MD5 7935c385a25ecad2bb28d6dfffc7dfd7
SHA1 28a0ab16049bf3590e942c72aa018a6fa1fb5ed9
SHA512 f3d6ca47df34acd9e39087c9e827df500988a7f76a8b79f33e01559462d24f4ade867ef1a90cfc23be432499b3fcf2f27ed98fb7c6dc772369db25d9eaeb2cc3
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUO:v+D56utgpPF8u/7O
TLSH
T10B965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-123-0x00007FF6F36F0000-0x00007FF6F3A42000-memory.dmp

Download

memory/220-158-0x00007FF6F36F0000-0x00007FF6F3A42000-memory.dmp

Download

memory/452-130-0x00007FF6893D0000-0x00007FF689722000-memory.dmp

Download

memory/452-140-0x00007FF6893D0000-0x00007FF689722000-memory.dmp

Download

memory/452-19-0x00007FF6893D0000-0x00007FF689722000-memory.dmp

Download

memory/740-124-0x00007FF6780A0000-0x00007FF6783F2000-memory.dmp

Download

memory/740-157-0x00007FF6780A0000-0x00007FF6783F2000-memory.dmp

Download

memory/1180-0-0x00007FF6FC6C0000-0x00007FF6FCA12000-memory.dmp

Download

memory/1180-1-0x0000020716750000-0x0000020716760000-memory.dmp

Download

memory/1180-128-0x00007FF6FC6C0000-0x00007FF6FCA12000-memory.dmp

Download

memory/1436-143-0x00007FF698830000-0x00007FF698B82000-memory.dmp

Download

memory/1436-38-0x00007FF698830000-0x00007FF698B82000-memory.dmp

Download

memory/1464-134-0x00007FF65E4C0000-0x00007FF65E812000-memory.dmp

Download

memory/1464-60-0x00007FF65E4C0000-0x00007FF65E812000-memory.dmp

Download

memory/1464-149-0x00007FF65E4C0000-0x00007FF65E812000-memory.dmp

Download

memory/2232-155-0x00007FF772970000-0x00007FF772CC2000-memory.dmp

Download

memory/2232-121-0x00007FF772970000-0x00007FF772CC2000-memory.dmp

Download

memory/2232-138-0x00007FF772970000-0x00007FF772CC2000-memory.dmp

Download

memory/2640-83-0x00007FF748A80000-0x00007FF748DD2000-memory.dmp

Download

memory/2640-151-0x00007FF748A80000-0x00007FF748DD2000-memory.dmp

Download

memory/2640-137-0x00007FF748A80000-0x00007FF748DD2000-memory.dmp

Download

memory/2724-127-0x00007FF6E8A70000-0x00007FF6E8DC2000-memory.dmp

Download

memory/2724-159-0x00007FF6E8A70000-0x00007FF6E8DC2000-memory.dmp

Download

memory/2984-154-0x00007FF794770000-0x00007FF794AC2000-memory.dmp

Download

memory/2984-122-0x00007FF794770000-0x00007FF794AC2000-memory.dmp

Download

memory/3388-71-0x00007FF7C11E0000-0x00007FF7C1532000-memory.dmp

Download

memory/3388-146-0x00007FF7C11E0000-0x00007FF7C1532000-memory.dmp

Download

memory/3564-32-0x00007FF7A62B0000-0x00007FF7A6602000-memory.dmp

Download

memory/3564-132-0x00007FF7A62B0000-0x00007FF7A6602000-memory.dmp

Download

memory/3564-141-0x00007FF7A62B0000-0x00007FF7A6602000-memory.dmp

Download

memory/4008-145-0x00007FF68C890000-0x00007FF68CBE2000-memory.dmp

Download

memory/4008-67-0x00007FF68C890000-0x00007FF68CBE2000-memory.dmp

Download

memory/4412-29-0x00007FF7ECF40000-0x00007FF7ED292000-memory.dmp

Download

memory/4412-131-0x00007FF7ECF40000-0x00007FF7ED292000-memory.dmp

Download

memory/4412-144-0x00007FF7ECF40000-0x00007FF7ED292000-memory.dmp

Download

memory/4572-150-0x00007FF77BB60000-0x00007FF77BEB2000-memory.dmp

Download

memory/4572-68-0x00007FF77BB60000-0x00007FF77BEB2000-memory.dmp

Download

memory/4700-74-0x00007FF731AA0000-0x00007FF731DF2000-memory.dmp

Download

memory/4700-136-0x00007FF731AA0000-0x00007FF731DF2000-memory.dmp

Download

memory/4700-147-0x00007FF731AA0000-0x00007FF731DF2000-memory.dmp

Download

memory/4824-153-0x00007FF713770000-0x00007FF713AC2000-memory.dmp

Download

memory/4824-126-0x00007FF713770000-0x00007FF713AC2000-memory.dmp

Download

memory/4896-52-0x00007FF6AC060000-0x00007FF6AC3B2000-memory.dmp

Download

memory/4896-142-0x00007FF6AC060000-0x00007FF6AC3B2000-memory.dmp

Download

memory/4896-133-0x00007FF6AC060000-0x00007FF6AC3B2000-memory.dmp

Download

memory/4960-125-0x00007FF680030000-0x00007FF680382000-memory.dmp

Download

memory/4960-156-0x00007FF680030000-0x00007FF680382000-memory.dmp

Download

memory/4988-139-0x00007FF6CAED0000-0x00007FF6CB222000-memory.dmp

Download

memory/4988-11-0x00007FF6CAED0000-0x00007FF6CB222000-memory.dmp

Download

memory/4988-129-0x00007FF6CAED0000-0x00007FF6CB222000-memory.dmp

Download

memory/5084-95-0x00007FF6967F0000-0x00007FF696B42000-memory.dmp

Download

memory/5084-152-0x00007FF6967F0000-0x00007FF696B42000-memory.dmp

Download

memory/5104-61-0x00007FF67A3A0000-0x00007FF67A6F2000-memory.dmp

Download

memory/5104-148-0x00007FF67A3A0000-0x00007FF67A6F2000-memory.dmp

Download

memory/5104-135-0x00007FF67A3A0000-0x00007FF67A6F2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads