cobaltstrike | 72d3a00984078d89cfbfc48cdf500aa603365de73c83273f4ce4c611afdf69a6

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample261026-erlf4ads9l
SHA256 72d3a00984078d89cfbfc48cdf500aa603365de73c83273f4ce4c611afdf69a6
MD5 228d75cebb5468cfe5e4936728b30003
SHA1 526021c5cc055c4a5da1886f02ca4277c6376e7a
SHA512 d96b6bd00953a76e4943a22ce123eb7467998f48b8bfa36d22781ee3f954014b67a634b24ac88b28228e6801e8d12e0be35d6de5209cd30f9afec55475aa39fa
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUh:v+D56utgpPF8u/7h
TLSH
T1F4965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000b00000001b2c5-5.dat	cobalt_reflective_dll
behavioral2/files/0x000e00000001c54a-10.dat	cobalt_reflective_dll
behavioral2/files/0x000e00000001c54b-17.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c54f-23.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c550-29.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c551-36.dat	cobalt_reflective_dll
behavioral2/files/0x0004000000000433-41.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c553-47.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c554-55.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c556-68.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c557-75.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c559-86.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c55b-101.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c55c-110.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c55f-127.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c56b-134.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c55e-123.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c55d-117.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c55a-97.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c558-82.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c555-61.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001b2c5-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000e00000001c54a-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000e00000001c54b-17.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c54f-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c550-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c551-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0004000000000433-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c553-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c554-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c556-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c557-75.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c559-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c55b-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c55c-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c55f-127.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c56b-134.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c55e-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c55d-117.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c55a-97.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c558-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c555-61.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1904-0-0x00007FF6EB320000-0x00007FF6EB672000-memory.dmp	UPX
behavioral2/files/0x000b00000001b2c5-5.dat	UPX
behavioral2/memory/1036-7-0x00007FF7F15D0000-0x00007FF7F1922000-memory.dmp	UPX
behavioral2/files/0x000e00000001c54a-10.dat	UPX
behavioral2/memory/3132-12-0x00007FF7890B0000-0x00007FF789402000-memory.dmp	UPX
behavioral2/files/0x000e00000001c54b-17.dat	UPX
behavioral2/memory/2492-20-0x00007FF681350000-0x00007FF6816A2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c54f-23.dat	UPX
behavioral2/memory/5008-24-0x00007FF6BAF20000-0x00007FF6BB272000-memory.dmp	UPX
behavioral2/files/0x000d00000001c550-29.dat	UPX
behavioral2/memory/2328-30-0x00007FF600240000-0x00007FF600592000-memory.dmp	UPX
behavioral2/files/0x000d00000001c551-36.dat	UPX
behavioral2/memory/4628-37-0x00007FF7605B0000-0x00007FF760902000-memory.dmp	UPX
behavioral2/files/0x0004000000000433-41.dat	UPX
behavioral2/memory/1600-42-0x00007FF6FA530000-0x00007FF6FA882000-memory.dmp	UPX
behavioral2/memory/1904-45-0x00007FF6EB320000-0x00007FF6EB672000-memory.dmp	UPX
behavioral2/files/0x000d00000001c553-47.dat	UPX
behavioral2/memory/1036-50-0x00007FF7F15D0000-0x00007FF7F1922000-memory.dmp	UPX
behavioral2/files/0x000d00000001c554-55.dat	UPX
behavioral2/memory/3236-52-0x00007FF794D80000-0x00007FF7950D2000-memory.dmp	UPX
behavioral2/memory/260-56-0x00007FF7C9F70000-0x00007FF7CA2C2000-memory.dmp	UPX
behavioral2/memory/3132-62-0x00007FF7890B0000-0x00007FF789402000-memory.dmp	UPX
behavioral2/memory/3764-65-0x00007FF7A9750000-0x00007FF7A9AA2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c556-68.dat	UPX
behavioral2/files/0x000d00000001c557-75.dat	UPX
behavioral2/files/0x000d00000001c559-86.dat	UPX
behavioral2/memory/5764-92-0x00007FF61BC20000-0x00007FF61BF72000-memory.dmp	UPX
behavioral2/files/0x000d00000001c55b-101.dat	UPX
behavioral2/files/0x000d00000001c55c-110.dat	UPX
behavioral2/memory/1600-115-0x00007FF6FA530000-0x00007FF6FA882000-memory.dmp	UPX
behavioral2/files/0x000d00000001c55f-127.dat	UPX
behavioral2/memory/5152-136-0x00007FF62D0E0000-0x00007FF62D432000-memory.dmp	UPX
behavioral2/memory/260-135-0x00007FF7C9F70000-0x00007FF7CA2C2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c56b-134.dat	UPX
behavioral2/memory/1756-129-0x00007FF790100000-0x00007FF790452000-memory.dmp	UPX
behavioral2/memory/3236-128-0x00007FF794D80000-0x00007FF7950D2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c55e-123.dat	UPX
behavioral2/memory/4264-122-0x00007FF7D47F0000-0x00007FF7D4B42000-memory.dmp	UPX
behavioral2/files/0x000d00000001c55d-117.dat	UPX
behavioral2/memory/5036-116-0x00007FF778160000-0x00007FF7784B2000-memory.dmp	UPX
behavioral2/memory/3004-109-0x00007FF771730000-0x00007FF771A82000-memory.dmp	UPX
behavioral2/memory/4628-108-0x00007FF7605B0000-0x00007FF760902000-memory.dmp	UPX
behavioral2/memory/948-102-0x00007FF7C3C10000-0x00007FF7C3F62000-memory.dmp	UPX
behavioral2/files/0x000d00000001c55a-97.dat	UPX
behavioral2/memory/4188-96-0x00007FF649DA0000-0x00007FF64A0F2000-memory.dmp	UPX
behavioral2/memory/2328-95-0x00007FF600240000-0x00007FF600592000-memory.dmp	UPX
behavioral2/memory/1768-94-0x00007FF67F680000-0x00007FF67F9D2000-memory.dmp	UPX
behavioral2/memory/1092-93-0x00007FF694F80000-0x00007FF6952D2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c558-82.dat	UPX
behavioral2/memory/5008-76-0x00007FF6BAF20000-0x00007FF6BB272000-memory.dmp	UPX
behavioral2/memory/416-70-0x00007FF710CF0000-0x00007FF711042000-memory.dmp	UPX
behavioral2/memory/2492-69-0x00007FF681350000-0x00007FF6816A2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c555-61.dat	UPX
behavioral2/memory/3764-138-0x00007FF7A9750000-0x00007FF7A9AA2000-memory.dmp	UPX
behavioral2/memory/5764-140-0x00007FF61BC20000-0x00007FF61BF72000-memory.dmp	UPX
behavioral2/memory/416-139-0x00007FF710CF0000-0x00007FF711042000-memory.dmp	UPX
behavioral2/memory/1768-141-0x00007FF67F680000-0x00007FF67F9D2000-memory.dmp	UPX
behavioral2/memory/948-142-0x00007FF7C3C10000-0x00007FF7C3F62000-memory.dmp	UPX
behavioral2/memory/3004-143-0x00007FF771730000-0x00007FF771A82000-memory.dmp	UPX
behavioral2/memory/5036-144-0x00007FF778160000-0x00007FF7784B2000-memory.dmp	UPX
behavioral2/memory/4264-145-0x00007FF7D47F0000-0x00007FF7D4B42000-memory.dmp	UPX
behavioral2/memory/1756-146-0x00007FF790100000-0x00007FF790452000-memory.dmp	UPX
behavioral2/memory/5152-147-0x00007FF62D0E0000-0x00007FF62D432000-memory.dmp	UPX
behavioral2/memory/1036-148-0x00007FF7F15D0000-0x00007FF7F1922000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1904-0-0x00007FF6EB320000-0x00007FF6EB672000-memory.dmp	xmrig
behavioral2/files/0x000b00000001b2c5-5.dat	xmrig
behavioral2/memory/1036-7-0x00007FF7F15D0000-0x00007FF7F1922000-memory.dmp	xmrig
behavioral2/files/0x000e00000001c54a-10.dat	xmrig
behavioral2/memory/3132-12-0x00007FF7890B0000-0x00007FF789402000-memory.dmp	xmrig
behavioral2/files/0x000e00000001c54b-17.dat	xmrig
behavioral2/memory/2492-20-0x00007FF681350000-0x00007FF6816A2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c54f-23.dat	xmrig
behavioral2/memory/5008-24-0x00007FF6BAF20000-0x00007FF6BB272000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c550-29.dat	xmrig
behavioral2/memory/2328-30-0x00007FF600240000-0x00007FF600592000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c551-36.dat	xmrig
behavioral2/memory/4628-37-0x00007FF7605B0000-0x00007FF760902000-memory.dmp	xmrig
behavioral2/files/0x0004000000000433-41.dat	xmrig
behavioral2/memory/1600-42-0x00007FF6FA530000-0x00007FF6FA882000-memory.dmp	xmrig
behavioral2/memory/1904-45-0x00007FF6EB320000-0x00007FF6EB672000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c553-47.dat	xmrig
behavioral2/memory/1036-50-0x00007FF7F15D0000-0x00007FF7F1922000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c554-55.dat	xmrig
behavioral2/memory/3236-52-0x00007FF794D80000-0x00007FF7950D2000-memory.dmp	xmrig
behavioral2/memory/260-56-0x00007FF7C9F70000-0x00007FF7CA2C2000-memory.dmp	xmrig
behavioral2/memory/3132-62-0x00007FF7890B0000-0x00007FF789402000-memory.dmp	xmrig
behavioral2/memory/3764-65-0x00007FF7A9750000-0x00007FF7A9AA2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c556-68.dat	xmrig
behavioral2/files/0x000d00000001c557-75.dat	xmrig
behavioral2/files/0x000d00000001c559-86.dat	xmrig
behavioral2/memory/5764-92-0x00007FF61BC20000-0x00007FF61BF72000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c55b-101.dat	xmrig
behavioral2/files/0x000d00000001c55c-110.dat	xmrig
behavioral2/memory/1600-115-0x00007FF6FA530000-0x00007FF6FA882000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c55f-127.dat	xmrig
behavioral2/memory/5152-136-0x00007FF62D0E0000-0x00007FF62D432000-memory.dmp	xmrig
behavioral2/memory/260-135-0x00007FF7C9F70000-0x00007FF7CA2C2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c56b-134.dat	xmrig
behavioral2/memory/1756-129-0x00007FF790100000-0x00007FF790452000-memory.dmp	xmrig
behavioral2/memory/3236-128-0x00007FF794D80000-0x00007FF7950D2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c55e-123.dat	xmrig
behavioral2/memory/4264-122-0x00007FF7D47F0000-0x00007FF7D4B42000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c55d-117.dat	xmrig
behavioral2/memory/5036-116-0x00007FF778160000-0x00007FF7784B2000-memory.dmp	xmrig
behavioral2/memory/3004-109-0x00007FF771730000-0x00007FF771A82000-memory.dmp	xmrig
behavioral2/memory/4628-108-0x00007FF7605B0000-0x00007FF760902000-memory.dmp	xmrig
behavioral2/memory/948-102-0x00007FF7C3C10000-0x00007FF7C3F62000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c55a-97.dat	xmrig
behavioral2/memory/4188-96-0x00007FF649DA0000-0x00007FF64A0F2000-memory.dmp	xmrig
behavioral2/memory/2328-95-0x00007FF600240000-0x00007FF600592000-memory.dmp	xmrig
behavioral2/memory/1768-94-0x00007FF67F680000-0x00007FF67F9D2000-memory.dmp	xmrig
behavioral2/memory/1092-93-0x00007FF694F80000-0x00007FF6952D2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c558-82.dat	xmrig
behavioral2/memory/5008-76-0x00007FF6BAF20000-0x00007FF6BB272000-memory.dmp	xmrig
behavioral2/memory/416-70-0x00007FF710CF0000-0x00007FF711042000-memory.dmp	xmrig
behavioral2/memory/2492-69-0x00007FF681350000-0x00007FF6816A2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c555-61.dat	xmrig
behavioral2/memory/3764-138-0x00007FF7A9750000-0x00007FF7A9AA2000-memory.dmp	xmrig
behavioral2/memory/5764-140-0x00007FF61BC20000-0x00007FF61BF72000-memory.dmp	xmrig
behavioral2/memory/416-139-0x00007FF710CF0000-0x00007FF711042000-memory.dmp	xmrig
behavioral2/memory/1768-141-0x00007FF67F680000-0x00007FF67F9D2000-memory.dmp	xmrig
behavioral2/memory/948-142-0x00007FF7C3C10000-0x00007FF7C3F62000-memory.dmp	xmrig
behavioral2/memory/3004-143-0x00007FF771730000-0x00007FF771A82000-memory.dmp	xmrig
behavioral2/memory/5036-144-0x00007FF778160000-0x00007FF7784B2000-memory.dmp	xmrig
behavioral2/memory/4264-145-0x00007FF7D47F0000-0x00007FF7D4B42000-memory.dmp	xmrig
behavioral2/memory/1756-146-0x00007FF790100000-0x00007FF790452000-memory.dmp	xmrig
behavioral2/memory/5152-147-0x00007FF62D0E0000-0x00007FF62D432000-memory.dmp	xmrig
behavioral2/memory/1036-148-0x00007FF7F15D0000-0x00007FF7F1922000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1036	zeMLOPb.exe
3132	kCIjFAw.exe
2492	ARuVqqA.exe
5008	kmPgAeS.exe
2328	UHQTaQz.exe
4628	YImidBG.exe
1600	kGYyMFW.exe
3236	bRzryId.exe
260	MgZHZEx.exe
3764	BdozICo.exe
416	fuUIsbq.exe
5764	elRkpWe.exe
4188	sKxRkZs.exe
1092	jtAOOFn.exe
1768	ESwIMPr.exe
948	tGYIVKA.exe
3004	pcQsjkD.exe
5036	PBInJkb.exe
4264	BYCplHV.exe
1756	uzRUMKC.exe
5152	neGUvyM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1904-0-0x00007FF6EB320000-0x00007FF6EB672000-memory.dmp	upx
behavioral2/files/0x000b00000001b2c5-5.dat	upx
behavioral2/memory/1036-7-0x00007FF7F15D0000-0x00007FF7F1922000-memory.dmp	upx
behavioral2/files/0x000e00000001c54a-10.dat	upx
behavioral2/memory/3132-12-0x00007FF7890B0000-0x00007FF789402000-memory.dmp	upx
behavioral2/files/0x000e00000001c54b-17.dat	upx
behavioral2/memory/2492-20-0x00007FF681350000-0x00007FF6816A2000-memory.dmp	upx
behavioral2/files/0x000d00000001c54f-23.dat	upx
behavioral2/memory/5008-24-0x00007FF6BAF20000-0x00007FF6BB272000-memory.dmp	upx
behavioral2/files/0x000d00000001c550-29.dat	upx
behavioral2/memory/2328-30-0x00007FF600240000-0x00007FF600592000-memory.dmp	upx
behavioral2/files/0x000d00000001c551-36.dat	upx
behavioral2/memory/4628-37-0x00007FF7605B0000-0x00007FF760902000-memory.dmp	upx
behavioral2/files/0x0004000000000433-41.dat	upx
behavioral2/memory/1600-42-0x00007FF6FA530000-0x00007FF6FA882000-memory.dmp	upx
behavioral2/memory/1904-45-0x00007FF6EB320000-0x00007FF6EB672000-memory.dmp	upx
behavioral2/files/0x000d00000001c553-47.dat	upx
behavioral2/memory/1036-50-0x00007FF7F15D0000-0x00007FF7F1922000-memory.dmp	upx
behavioral2/files/0x000d00000001c554-55.dat	upx
behavioral2/memory/3236-52-0x00007FF794D80000-0x00007FF7950D2000-memory.dmp	upx
behavioral2/memory/260-56-0x00007FF7C9F70000-0x00007FF7CA2C2000-memory.dmp	upx
behavioral2/memory/3132-62-0x00007FF7890B0000-0x00007FF789402000-memory.dmp	upx
behavioral2/memory/3764-65-0x00007FF7A9750000-0x00007FF7A9AA2000-memory.dmp	upx
behavioral2/files/0x000d00000001c556-68.dat	upx
behavioral2/files/0x000d00000001c557-75.dat	upx
behavioral2/files/0x000d00000001c559-86.dat	upx
behavioral2/memory/5764-92-0x00007FF61BC20000-0x00007FF61BF72000-memory.dmp	upx
behavioral2/files/0x000d00000001c55b-101.dat	upx
behavioral2/files/0x000d00000001c55c-110.dat	upx
behavioral2/memory/1600-115-0x00007FF6FA530000-0x00007FF6FA882000-memory.dmp	upx
behavioral2/files/0x000d00000001c55f-127.dat	upx
behavioral2/memory/5152-136-0x00007FF62D0E0000-0x00007FF62D432000-memory.dmp	upx
behavioral2/memory/260-135-0x00007FF7C9F70000-0x00007FF7CA2C2000-memory.dmp	upx
behavioral2/files/0x000d00000001c56b-134.dat	upx
behavioral2/memory/1756-129-0x00007FF790100000-0x00007FF790452000-memory.dmp	upx
behavioral2/memory/3236-128-0x00007FF794D80000-0x00007FF7950D2000-memory.dmp	upx
behavioral2/files/0x000d00000001c55e-123.dat	upx
behavioral2/memory/4264-122-0x00007FF7D47F0000-0x00007FF7D4B42000-memory.dmp	upx
behavioral2/files/0x000d00000001c55d-117.dat	upx
behavioral2/memory/5036-116-0x00007FF778160000-0x00007FF7784B2000-memory.dmp	upx
behavioral2/memory/3004-109-0x00007FF771730000-0x00007FF771A82000-memory.dmp	upx
behavioral2/memory/4628-108-0x00007FF7605B0000-0x00007FF760902000-memory.dmp	upx
behavioral2/memory/948-102-0x00007FF7C3C10000-0x00007FF7C3F62000-memory.dmp	upx
behavioral2/files/0x000d00000001c55a-97.dat	upx
behavioral2/memory/4188-96-0x00007FF649DA0000-0x00007FF64A0F2000-memory.dmp	upx
behavioral2/memory/2328-95-0x00007FF600240000-0x00007FF600592000-memory.dmp	upx
behavioral2/memory/1768-94-0x00007FF67F680000-0x00007FF67F9D2000-memory.dmp	upx
behavioral2/memory/1092-93-0x00007FF694F80000-0x00007FF6952D2000-memory.dmp	upx
behavioral2/files/0x000d00000001c558-82.dat	upx
behavioral2/memory/5008-76-0x00007FF6BAF20000-0x00007FF6BB272000-memory.dmp	upx
behavioral2/memory/416-70-0x00007FF710CF0000-0x00007FF711042000-memory.dmp	upx
behavioral2/memory/2492-69-0x00007FF681350000-0x00007FF6816A2000-memory.dmp	upx
behavioral2/files/0x000d00000001c555-61.dat	upx
behavioral2/memory/3764-138-0x00007FF7A9750000-0x00007FF7A9AA2000-memory.dmp	upx
behavioral2/memory/5764-140-0x00007FF61BC20000-0x00007FF61BF72000-memory.dmp	upx
behavioral2/memory/416-139-0x00007FF710CF0000-0x00007FF711042000-memory.dmp	upx
behavioral2/memory/1768-141-0x00007FF67F680000-0x00007FF67F9D2000-memory.dmp	upx
behavioral2/memory/948-142-0x00007FF7C3C10000-0x00007FF7C3F62000-memory.dmp	upx
behavioral2/memory/3004-143-0x00007FF771730000-0x00007FF771A82000-memory.dmp	upx
behavioral2/memory/5036-144-0x00007FF778160000-0x00007FF7784B2000-memory.dmp	upx
behavioral2/memory/4264-145-0x00007FF7D47F0000-0x00007FF7D4B42000-memory.dmp	upx
behavioral2/memory/1756-146-0x00007FF790100000-0x00007FF790452000-memory.dmp	upx
behavioral2/memory/5152-147-0x00007FF62D0E0000-0x00007FF62D432000-memory.dmp	upx
behavioral2/memory/1036-148-0x00007FF7F15D0000-0x00007FF7F1922000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\kGYyMFW.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\BdozICo.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fuUIsbq.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\BYCplHV.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\neGUvyM.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\kCIjFAw.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\UHQTaQz.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\elRkpWe.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\jtAOOFn.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ESwIMPr.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\tGYIVKA.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\pcQsjkD.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\uzRUMKC.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\MgZHZEx.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\sKxRkZs.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\PBInJkb.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\zeMLOPb.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ARuVqqA.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\kmPgAeS.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\YImidBG.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\bRzryId.exe	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1036	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	89
PID 1904 wrote to memory of 3132	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 1904 wrote to memory of 2492	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 1904 wrote to memory of 5008	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 1904 wrote to memory of 2328	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 1904 wrote to memory of 4628	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 1904 wrote to memory of 1600	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 1904 wrote to memory of 3236	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 1904 wrote to memory of 260	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 1904 wrote to memory of 3764	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 1904 wrote to memory of 416	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 1904 wrote to memory of 5764	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 1904 wrote to memory of 4188	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 1904 wrote to memory of 1092	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 1904 wrote to memory of 1768	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 1904 wrote to memory of 948	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 1904 wrote to memory of 3004	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 1904 wrote to memory of 5036	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 1904 wrote to memory of 4264	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 1904 wrote to memory of 1756	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 1904 wrote to memory of 5152	1904	2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_228d75cebb5468cfe5e4936728b30003_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\System\zeMLOPb.exe
  C:\Windows\System\zeMLOPb.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\kCIjFAw.exe
  C:\Windows\System\kCIjFAw.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\ARuVqqA.exe
  C:\Windows\System\ARuVqqA.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\kmPgAeS.exe
  C:\Windows\System\kmPgAeS.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\UHQTaQz.exe
  C:\Windows\System\UHQTaQz.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\YImidBG.exe
  C:\Windows\System\YImidBG.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\kGYyMFW.exe
  C:\Windows\System\kGYyMFW.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\bRzryId.exe
  C:\Windows\System\bRzryId.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\MgZHZEx.exe
  C:\Windows\System\MgZHZEx.exe
  2⤵
  - Executes dropped EXE
  PID:260
- C:\Windows\System\BdozICo.exe
  C:\Windows\System\BdozICo.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\fuUIsbq.exe
  C:\Windows\System\fuUIsbq.exe
  2⤵
  - Executes dropped EXE
  PID:416
- C:\Windows\System\elRkpWe.exe
  C:\Windows\System\elRkpWe.exe
  2⤵
  - Executes dropped EXE
  PID:5764
- C:\Windows\System\sKxRkZs.exe
  C:\Windows\System\sKxRkZs.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\jtAOOFn.exe
  C:\Windows\System\jtAOOFn.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\ESwIMPr.exe
  C:\Windows\System\ESwIMPr.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\tGYIVKA.exe
  C:\Windows\System\tGYIVKA.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\pcQsjkD.exe
  C:\Windows\System\pcQsjkD.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\PBInJkb.exe
  C:\Windows\System\PBInJkb.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\BYCplHV.exe
  C:\Windows\System\BYCplHV.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\uzRUMKC.exe
  C:\Windows\System\uzRUMKC.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\neGUvyM.exe
  C:\Windows\System\neGUvyM.exe
  2⤵
  - Executes dropped EXE
  PID:5152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ARuVqqA.exe

Path C:\Windows\System\ARuVqqA.exe
Size 8.3MB
SHA256 fa877353f8d9144d7c1aa4c33f179714ca159afa401d313ffda8e15803bb5593
MD5 444ded9f1e5295d738d25d578a40c9f9
SHA1 48599ad22d2dea90aa36b5b1f996b116965ff729
SHA512 f912b509f5f3ea402f5767bdc3c80d50150730848633dd447081a76854df2b5ba452a33ca6247daab258dad32ee48d1bbeaceff01a46ee4b536531ca355e8fbc
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUm:v+D56utgpPF8u/7m
TLSH
T1C3965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BYCplHV.exe

Path C:\Windows\System\BYCplHV.exe
Size 8.3MB
SHA256 5e56f92a72f0c35d4af11fe65d089787f7f9cf383fdd6c1fbe02459177ca7057
MD5 4db4c441f98cd1e32a7b7857b8fa1088
SHA1 f2e964d92f35875369730789f39c5060c8ed30de
SHA512 adb2d7a6c416fcd8039563081dc75657803f22681b203b7909c728e17a8e90c998a9f2869dd57ff2c57b7a5338b0969c43ed0d84a96fcb3af7bc054948b7992a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUu:v+D56utgpPF8u/7u
TLSH
T1BF965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BdozICo.exe

Path C:\Windows\System\BdozICo.exe
Size 8.3MB
SHA256 ca82d7d3034afa08fd15507cea413a86d4179f6818113866e2aa42266f3b5a55
MD5 9d9977b4c9b7e336785d37b57d6b68d0
SHA1 9333d6452d852a5bba0eee5230ab04f66cdefb36
SHA512 0a34e6cb5838447d72adf6fdbbb8be0d43e4c075e4c23e376de7f418264a04117485bd2ddf1e5d213ba119fd4e45affba550731cac6b17ad5bfaf38b0b85c04c
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUh:v+D56utgpPF8u/7h
TLSH
T1D1965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ESwIMPr.exe

Path C:\Windows\System\ESwIMPr.exe
Size 8.3MB
SHA256 e75bc2b593cc0b65c5a608bc5f13006760e8d80522bac191afceafb42f942cb4
MD5 1c759a2fbcc25bd48b2a81549d004cce
SHA1 3336782a9dd0939c81b6f0edb0606e8c8f28332b
SHA512 d2c540072268c1ac4f141d507f5cc551718c4e71a3f19eb9a3db43f016c180a8dc645d59ee844e012cf3f48fab88a00dbbf3b3d9381e93fefa04a73702fd686e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUb:v+D56utgpPF8u/7b
TLSH
T17D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MgZHZEx.exe

Path C:\Windows\System\MgZHZEx.exe
Size 8.3MB
SHA256 2e1f57a6447901a09c30275c1dcd235f5e1f23dabe5f777639c3891be9f12d8e
MD5 518c1f4b7aac35c07b55a7789617ed5c
SHA1 b8b3d24260e990dc9a05317e6140d43ad16b168d
SHA512 c382de25d9b0758f442e6aa536f24b6f3f801217ac8f480735a5d91e46ffbeb50015b1d8197855800f3fe3c04deef2f8c31f5ac4583130c8f8e60a83df55a8fb
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUq:v+D56utgpPF8u/7q
TLSH
T1F1965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PBInJkb.exe

Path C:\Windows\System\PBInJkb.exe
Size 8.3MB
SHA256 c2d5a9473825862899450369c438936f68b797ceea0ce76fb0bfba75876ad4f8
MD5 2f68c0af43d444c98dac0a04749b80c9
SHA1 d14276dd783313527cc07f06684972fdfd988c55
SHA512 74648c928ece6132f8b32c4cbd6e3a2e94fc90325b64a8662a34723a396483049f923dbdfe7db89be170b2d1fefbf1e6cd6f15becf93cb374a904f9d1546d3d3
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUk:v+D56utgpPF8u/7k
TLSH
T19A965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UHQTaQz.exe

Path C:\Windows\System\UHQTaQz.exe
Size 8.3MB
SHA256 915c7824175dc38ca555a9d4e20ed65d6cbae7e813877868c4a4dd0c42f5affd
MD5 0f4efec158330b4e23943752c3212ba3
SHA1 038aad4f6a6bc64f5a6da87a1e53d724160fe012
SHA512 011ba2743ab3ebc211f6b8f9cf501c15082820162e92e9e485d4fe1e008d5b7ad8334223bddc042085fa8dfaec4f729115d89b4129d0ed61cc3e6ad96ac6b28f
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUb:v+D56utgpPF8u/7b
TLSH
T197965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YImidBG.exe

Path C:\Windows\System\YImidBG.exe
Size 8.3MB
SHA256 84f91395dcbbab55085bae39189192d955d1ee0695e7b1d7f943dd7d0cf2774b
MD5 32744d3f9b3dda6960134a52f3dcd51b
SHA1 b16636aedeabc478515d4a131d5697e2e0f2b073
SHA512 b5d7accf384a1952d460a611f78ac477b7593fe76fea66465c80d9c8e64dc0c0245d0dec6c2fb343d2b3e07ea5ae364f5c9f6cd2056a156ecded537740040913
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUc:v+D56utgpPF8u/7c
TLSH
T184965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bRzryId.exe

Path C:\Windows\System\bRzryId.exe
Size 8.3MB
SHA256 f6e65c29417ad1a91ac339c44aba489edcd660267262776c2bda8e54d0701be1
MD5 0b4f7552d397e3d069ec080dc4efb87b
SHA1 3a94520be1d9108a8d12939680619d54493d0623
SHA512 ab17b81461ed94e75b1723b7e365d4a49baf41b383fb9a40d65b696aaf6415514b4c65fe1e4f010de6184718b181b7a822d75b38e6db6ab6be8d55d1898ee486
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUQ:v+D56utgpPF8u/7Q
TLSH
T196965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elRkpWe.exe

Path C:\Windows\System\elRkpWe.exe
Size 8.3MB
SHA256 103ce389960fa56b483d9bffb2f55eb41141f30c66018df43c999c8587e5640a
MD5 439d31adda8c303940268c2d8a240781
SHA1 5cb01ef060968b6b6b28572c9f03bda8e842b481
SHA512 309697c6e16e40ad630368cfd752ee48d3f08c454f92f877bc889cdc38dea991ddbcd57ab8ff2c59a0e89e70a3e2d06e3a0ab8045838a08b1d80ba32c382e027
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUA:v+D56utgpPF8u/7A
TLSH
T1BE965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fuUIsbq.exe

Path C:\Windows\System\fuUIsbq.exe
Size 8.3MB
SHA256 8dc60b31e42d3d47a3da7873d00baff9efa3ae8b9e27ffd21c92b6a53a41fec4
MD5 efe48d598b66dcbbde226c1232955971
SHA1 e34aa4ec2b1019bfad51f8dd73eeea055f8b18c0
SHA512 93413bd1e161ac21e4151c966f29a90f4c3f0d916cb295b3d8dbe075433e636eb715de03a56e386a3bba86ae71a8b07536fc3a0179ff08063cdeef6d3c61c837
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUH:v+D56utgpPF8u/7H
TLSH
T1E9965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jtAOOFn.exe

Path C:\Windows\System\jtAOOFn.exe
Size 8.3MB
SHA256 1fbec8b9f00f719e729f8b4978d3858b0abe23e3106cfd9c1e6022f4c2a70fef
MD5 76e163ef1bcb4d75822e8f089652003b
SHA1 dc5746d933d9dc33e5dd63642202813a2b40ca00
SHA512 8126b9d02783142c9f23e22987af5239c397f8330aa9e04963549dd63000ab374ed1b3d9b34b79b3ef79bb35afd34201253fac079bbaf8dbdade69ae41152221
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU2:v+D56utgpPF8u/72
TLSH
T1BA965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kCIjFAw.exe

Path C:\Windows\System\kCIjFAw.exe
Size 8.3MB
SHA256 5474d6493b9ddf3da807c9483d79d15d8d56c56e87800c5439fe651af1b4bc5f
MD5 e27d7953b4af05b1405e615442b686b2
SHA1 c8a224a9066482b6b81e01780738aee986819f49
SHA512 31dc9a410f36d13f705078be6bfa520a2b5c7c121e807ae99165cd53d0d2340cd6623ae4698577f0dd2953ee89e74e20c3995748ee2c870b5e3112d15298d16d
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUQ:v+D56utgpPF8u/7Q
TLSH
T16E965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kGYyMFW.exe

Path C:\Windows\System\kGYyMFW.exe
Size 8.3MB
SHA256 ba075049650fbdd5990eca2229e2e6dd06e3c7d2d7232d160ed766c69bcb670d
MD5 24fed464ee4fc54efee5f5f07b8eb059
SHA1 c0582e30d7862adcb2ac44f664e75f0873914277
SHA512 ffba49d0b2e775cf05c29653674bbdc6b433a03baf5571720d391a840033e9e6b892bdefa6b92686eddffbaf9ba9eb6b22a00ab4f1fa760559d010da4cb36118
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU8:v+D56utgpPF8u/78
TLSH
T165965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kmPgAeS.exe

Path C:\Windows\System\kmPgAeS.exe
Size 8.3MB
SHA256 e0c48d79d9aad31c024df7933cfc4b44ee28b5490d0e80ae2dbe6e0f58a82059
MD5 3dfaeac13e50ab9a8faccdd53c71c5ea
SHA1 8b9979fb0f27eca71257fa6afd13839332a2402b
SHA512 2d4184abb5384ca17559f3df9e545affb334c2942a121ef96b3423cea4b5b4968682248d112fefbe2399abf37eaf2495d795385642c1643d846eb0461a9fe0a0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUf:v+D56utgpPF8u/7f
TLSH
T196965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

neGUvyM.exe

Path C:\Windows\System\neGUvyM.exe
Size 8.3MB
SHA256 64faa9a5bf07c3feef396dae7e8e142140901567a3fa92f7e1be7b0ebc9b3a51
MD5 439f8ad519caae1e45698c38271e9968
SHA1 9c20abced7d67568e2d73c232575907e1d492f57
SHA512 4d9a37e362a767d01759ed45908a9d75cc122ae09ebaa9ff366d0768401de1d6023a1c209f927f609f0eeb75b6dcdbe1650ba77e0aa9928b947ce705a9e58c73
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUD:v+D56utgpPF8u/7D
TLSH
T111965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcQsjkD.exe

Path C:\Windows\System\pcQsjkD.exe
Size 8.3MB
SHA256 e97b56d1bc99845842503722b9563843b3b1c04f7eaa1c879e3a25de37eaf1b2
MD5 433115d95142209ccd7e3f5556975c94
SHA1 60c229b287fd9281385c8870c3a4d131d9c19c8d
SHA512 f0cbc2dda10fd28ac865ddb9ef328a0682af561387d96e862ff21d1125d955a7a342bea32fd2118ce99cef653bf3d9af4807c8a1c3dc407d2828ec979f221561
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUW:v+D56utgpPF8u/7W
TLSH
T175965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sKxRkZs.exe

Path C:\Windows\System\sKxRkZs.exe
Size 8.3MB
SHA256 f7318db36da42b730e16128222b14c4c82590a2c2ce102cf26678c33281e8487
MD5 dbec833b9f872bfe77c320a369974b04
SHA1 0e8f17223b8205a6643fddd1ef4d9c10faa47103
SHA512 c34f06e0603e0b571f5dfc67b67df04fe17e2249d5a253d6e38d6b3cc80b650ceba469f2c9518724f3c7b240b9efdc1bd39d66ac0cb2e1f6a23c208f84275679
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUN:v+D56utgpPF8u/7N
TLSH
T198965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tGYIVKA.exe

Path C:\Windows\System\tGYIVKA.exe
Size 8.3MB
SHA256 59cf93e6c054294325d5ea5b92c675d2c120dfbe305ad4e0f7a7b8361dbd4e0c
MD5 de4e122c42b261e75bc26d41d968af84
SHA1 6e2482a3e67af0f5262c0968706e579e89e36948
SHA512 c38798470efb4b40dc29a08aa141bd5856e0414f6633306ef3596f80a1986c692b1caa0c299e65e26904c8ea033e7516fbe39298333696bec0a2f4d2a7251b2b
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUs:v+D56utgpPF8u/7s
TLSH
T1B2965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uzRUMKC.exe

Path C:\Windows\System\uzRUMKC.exe
Size 8.3MB
SHA256 41311c495346610b79f84192ed67b303ceeb0f806b921a7e85f03865dc8fbb78
MD5 01bb6ec50f3d660ac0e83e9fe05f9cbb
SHA1 4ae0d6ab59c90625a2248ca7f5c92437fee298f4
SHA512 b7f82adf6114763504392fd7ada193146914a062cbec6c1594dd4317d59bf5be1d76742bd5024efea40148a8ddc625b3285ee672bafec4840954bf4f83e0f776
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUq:v+D56utgpPF8u/7q
TLSH
T138965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zeMLOPb.exe

Path C:\Windows\System\zeMLOPb.exe
Size 8.3MB
SHA256 4c9cb891f7cffa7c98686b178784613e75521d97c724a7af687aa870dacc6662
MD5 c97fc4b07d1ade6b633c8be4e736faf6
SHA1 3a2b24e14bb2c14a6a9d6b5c045cac7d467bd592
SHA512 4a3adc2753c221abb97ad81f275fa4a5bb463c9d5e1f0ca3a2a01b3f3e3081b2570771c3b1c7b55cef84681d72eddfce09cee166c45a89ed2144f5ffd93e37b6
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUy:v+D56utgpPF8u/7y
TLSH
T1FF965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-56-0x00007FF7C9F70000-0x00007FF7CA2C2000-memory.dmp

Download

memory/260-135-0x00007FF7C9F70000-0x00007FF7CA2C2000-memory.dmp

Download

memory/260-156-0x00007FF7C9F70000-0x00007FF7CA2C2000-memory.dmp

Download

memory/416-70-0x00007FF710CF0000-0x00007FF711042000-memory.dmp

Download

memory/416-139-0x00007FF710CF0000-0x00007FF711042000-memory.dmp

Download

memory/416-158-0x00007FF710CF0000-0x00007FF711042000-memory.dmp

Download

memory/948-102-0x00007FF7C3C10000-0x00007FF7C3F62000-memory.dmp

Download

memory/948-142-0x00007FF7C3C10000-0x00007FF7C3F62000-memory.dmp

Download

memory/948-164-0x00007FF7C3C10000-0x00007FF7C3F62000-memory.dmp

Download

memory/1036-148-0x00007FF7F15D0000-0x00007FF7F1922000-memory.dmp

Download

memory/1036-7-0x00007FF7F15D0000-0x00007FF7F1922000-memory.dmp

Download

memory/1036-50-0x00007FF7F15D0000-0x00007FF7F1922000-memory.dmp

Download

memory/1092-93-0x00007FF694F80000-0x00007FF6952D2000-memory.dmp

Download

memory/1092-159-0x00007FF694F80000-0x00007FF6952D2000-memory.dmp

Download

memory/1600-115-0x00007FF6FA530000-0x00007FF6FA882000-memory.dmp

Download

memory/1600-154-0x00007FF6FA530000-0x00007FF6FA882000-memory.dmp

Download

memory/1600-42-0x00007FF6FA530000-0x00007FF6FA882000-memory.dmp

Download

memory/1756-129-0x00007FF790100000-0x00007FF790452000-memory.dmp

Download

memory/1756-146-0x00007FF790100000-0x00007FF790452000-memory.dmp

Download

memory/1756-167-0x00007FF790100000-0x00007FF790452000-memory.dmp

Download

memory/1768-94-0x00007FF67F680000-0x00007FF67F9D2000-memory.dmp

Download

memory/1768-166-0x00007FF67F680000-0x00007FF67F9D2000-memory.dmp

Download

memory/1768-141-0x00007FF67F680000-0x00007FF67F9D2000-memory.dmp

Download

memory/1904-0-0x00007FF6EB320000-0x00007FF6EB672000-memory.dmp

Download

memory/1904-1-0x00000136D0D60000-0x00000136D0D70000-memory.dmp

Download

memory/1904-45-0x00007FF6EB320000-0x00007FF6EB672000-memory.dmp

Download

memory/2328-95-0x00007FF600240000-0x00007FF600592000-memory.dmp

Download

memory/2328-152-0x00007FF600240000-0x00007FF600592000-memory.dmp

Download

memory/2328-30-0x00007FF600240000-0x00007FF600592000-memory.dmp

Download

memory/2492-150-0x00007FF681350000-0x00007FF6816A2000-memory.dmp

Download

memory/2492-20-0x00007FF681350000-0x00007FF6816A2000-memory.dmp

Download

memory/2492-69-0x00007FF681350000-0x00007FF6816A2000-memory.dmp

Download

memory/3004-109-0x00007FF771730000-0x00007FF771A82000-memory.dmp

Download

memory/3004-163-0x00007FF771730000-0x00007FF771A82000-memory.dmp

Download

memory/3004-143-0x00007FF771730000-0x00007FF771A82000-memory.dmp

Download

memory/3132-149-0x00007FF7890B0000-0x00007FF789402000-memory.dmp

Download

memory/3132-12-0x00007FF7890B0000-0x00007FF789402000-memory.dmp

Download

memory/3132-62-0x00007FF7890B0000-0x00007FF789402000-memory.dmp

Download

memory/3236-52-0x00007FF794D80000-0x00007FF7950D2000-memory.dmp

Download

memory/3236-155-0x00007FF794D80000-0x00007FF7950D2000-memory.dmp

Download

memory/3236-128-0x00007FF794D80000-0x00007FF7950D2000-memory.dmp

Download

memory/3764-65-0x00007FF7A9750000-0x00007FF7A9AA2000-memory.dmp

Download

memory/3764-157-0x00007FF7A9750000-0x00007FF7A9AA2000-memory.dmp

Download

memory/3764-138-0x00007FF7A9750000-0x00007FF7A9AA2000-memory.dmp

Download

memory/4188-161-0x00007FF649DA0000-0x00007FF64A0F2000-memory.dmp

Download

memory/4188-96-0x00007FF649DA0000-0x00007FF64A0F2000-memory.dmp

Download

memory/4264-122-0x00007FF7D47F0000-0x00007FF7D4B42000-memory.dmp

Download

memory/4264-165-0x00007FF7D47F0000-0x00007FF7D4B42000-memory.dmp

Download

memory/4264-145-0x00007FF7D47F0000-0x00007FF7D4B42000-memory.dmp

Download

memory/4628-153-0x00007FF7605B0000-0x00007FF760902000-memory.dmp

Download

memory/4628-108-0x00007FF7605B0000-0x00007FF760902000-memory.dmp

Download

memory/4628-37-0x00007FF7605B0000-0x00007FF760902000-memory.dmp

Download

memory/5008-151-0x00007FF6BAF20000-0x00007FF6BB272000-memory.dmp

Download

memory/5008-24-0x00007FF6BAF20000-0x00007FF6BB272000-memory.dmp

Download

memory/5008-76-0x00007FF6BAF20000-0x00007FF6BB272000-memory.dmp

Download

memory/5036-144-0x00007FF778160000-0x00007FF7784B2000-memory.dmp

Download

memory/5036-162-0x00007FF778160000-0x00007FF7784B2000-memory.dmp

Download

memory/5036-116-0x00007FF778160000-0x00007FF7784B2000-memory.dmp

Download

memory/5152-136-0x00007FF62D0E0000-0x00007FF62D432000-memory.dmp

Download

memory/5152-147-0x00007FF62D0E0000-0x00007FF62D432000-memory.dmp

Download

memory/5152-168-0x00007FF62D0E0000-0x00007FF62D432000-memory.dmp

Download

memory/5764-160-0x00007FF61BC20000-0x00007FF61BF72000-memory.dmp

Download

memory/5764-92-0x00007FF61BC20000-0x00007FF61BF72000-memory.dmp

Download

memory/5764-140-0x00007FF61BC20000-0x00007FF61BF72000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads