cobaltstrike | b5f6f686ff875f00a611a3f46e9fd42447a46aa989a2e65a1cdf96150fbb8372

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample261026-vcvdfsbe47
SHA256 b5f6f686ff875f00a611a3f46e9fd42447a46aa989a2e65a1cdf96150fbb8372
MD5 a8c112db752417347d4095ef33dc6bba
SHA1 b35898f97bd5394247f436038316f28431ce7c2f
SHA512 6f7097346990b893ed8441caee1516f2066d9f98aecb805280ead73c066d72d4cf75e1581bf423e37ec3018104649c8a6be1ce63eba816968c85e045fb6af880
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU1:v+D56utgpPF8u/71
TLSH
T137965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0009000000019cb3-5.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c656-11.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c657-17.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c652-23.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c658-29.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c659-34.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c65a-39.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c65b-45.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c65c-50.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c65d-55.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c65f-64.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c664-89.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c665-94.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c667-105.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c669-109.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c666-100.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c663-85.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c662-80.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c661-75.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c660-70.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c65e-60.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0009000000019cb3-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c656-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c657-17.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c652-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c658-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c659-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c65a-39.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c65b-45.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c65c-50.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c65d-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c65f-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c664-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c665-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c667-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c669-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c666-100.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c663-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c662-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c661-75.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c660-70.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c65e-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3352-0-0x00007FF702AC0000-0x00007FF702E12000-memory.dmp	UPX
behavioral2/files/0x0009000000019cb3-5.dat	UPX
behavioral2/memory/4236-8-0x00007FF661100000-0x00007FF661452000-memory.dmp	UPX
behavioral2/files/0x000c00000001c656-11.dat	UPX
behavioral2/memory/3388-12-0x00007FF784990000-0x00007FF784CE2000-memory.dmp	UPX
behavioral2/files/0x000c00000001c657-17.dat	UPX
behavioral2/files/0x000d00000001c652-23.dat	UPX
behavioral2/memory/5644-24-0x00007FF60D8D0000-0x00007FF60DC22000-memory.dmp	UPX
behavioral2/files/0x000c00000001c658-29.dat	UPX
behavioral2/files/0x000c00000001c659-34.dat	UPX
behavioral2/files/0x000c00000001c65a-39.dat	UPX
behavioral2/files/0x000c00000001c65b-45.dat	UPX
behavioral2/files/0x000c00000001c65c-50.dat	UPX
behavioral2/files/0x000c00000001c65d-55.dat	UPX
behavioral2/files/0x000c00000001c65f-64.dat	UPX
behavioral2/files/0x000c00000001c664-89.dat	UPX
behavioral2/files/0x000c00000001c665-94.dat	UPX
behavioral2/files/0x000c00000001c667-105.dat	UPX
behavioral2/files/0x000c00000001c669-109.dat	UPX
behavioral2/files/0x000c00000001c666-100.dat	UPX
behavioral2/files/0x000c00000001c663-85.dat	UPX
behavioral2/files/0x000c00000001c662-80.dat	UPX
behavioral2/files/0x000c00000001c661-75.dat	UPX
behavioral2/files/0x000c00000001c660-70.dat	UPX
behavioral2/files/0x000c00000001c65e-60.dat	UPX
behavioral2/memory/2052-18-0x00007FF77B970000-0x00007FF77BCC2000-memory.dmp	UPX
behavioral2/memory/2132-111-0x00007FF7AA580000-0x00007FF7AA8D2000-memory.dmp	UPX
behavioral2/memory/4348-112-0x00007FF602B90000-0x00007FF602EE2000-memory.dmp	UPX
behavioral2/memory/5012-113-0x00007FF649140000-0x00007FF649492000-memory.dmp	UPX
behavioral2/memory/2804-114-0x00007FF628580000-0x00007FF6288D2000-memory.dmp	UPX
behavioral2/memory/3468-115-0x00007FF67D7A0000-0x00007FF67DAF2000-memory.dmp	UPX
behavioral2/memory/5776-117-0x00007FF72AE10000-0x00007FF72B162000-memory.dmp	UPX
behavioral2/memory/3892-118-0x00007FF714BB0000-0x00007FF714F02000-memory.dmp	UPX
behavioral2/memory/5164-116-0x00007FF66DA80000-0x00007FF66DDD2000-memory.dmp	UPX
behavioral2/memory/5028-119-0x00007FF7F3AF0000-0x00007FF7F3E42000-memory.dmp	UPX
behavioral2/memory/4612-121-0x00007FF7B88C0000-0x00007FF7B8C12000-memory.dmp	UPX
behavioral2/memory/5680-122-0x00007FF72E930000-0x00007FF72EC82000-memory.dmp	UPX
behavioral2/memory/4920-123-0x00007FF618FF0000-0x00007FF619342000-memory.dmp	UPX
behavioral2/memory/2956-125-0x00007FF70B770000-0x00007FF70BAC2000-memory.dmp	UPX
behavioral2/memory/2564-127-0x00007FF76B850000-0x00007FF76BBA2000-memory.dmp	UPX
behavioral2/memory/5456-126-0x00007FF72A010000-0x00007FF72A362000-memory.dmp	UPX
behavioral2/memory/4792-124-0x00007FF7AC370000-0x00007FF7AC6C2000-memory.dmp	UPX
behavioral2/memory/5292-120-0x00007FF605CD0000-0x00007FF606022000-memory.dmp	UPX
behavioral2/memory/3352-128-0x00007FF702AC0000-0x00007FF702E12000-memory.dmp	UPX
behavioral2/memory/3388-129-0x00007FF784990000-0x00007FF784CE2000-memory.dmp	UPX
behavioral2/memory/2052-130-0x00007FF77B970000-0x00007FF77BCC2000-memory.dmp	UPX
behavioral2/memory/5644-131-0x00007FF60D8D0000-0x00007FF60DC22000-memory.dmp	UPX
behavioral2/memory/2132-132-0x00007FF7AA580000-0x00007FF7AA8D2000-memory.dmp	UPX
behavioral2/memory/4236-133-0x00007FF661100000-0x00007FF661452000-memory.dmp	UPX
behavioral2/memory/3388-134-0x00007FF784990000-0x00007FF784CE2000-memory.dmp	UPX
behavioral2/memory/2052-135-0x00007FF77B970000-0x00007FF77BCC2000-memory.dmp	UPX
behavioral2/memory/5644-136-0x00007FF60D8D0000-0x00007FF60DC22000-memory.dmp	UPX
behavioral2/memory/2132-137-0x00007FF7AA580000-0x00007FF7AA8D2000-memory.dmp	UPX
behavioral2/memory/2564-138-0x00007FF76B850000-0x00007FF76BBA2000-memory.dmp	UPX
behavioral2/memory/5012-140-0x00007FF649140000-0x00007FF649492000-memory.dmp	UPX
behavioral2/memory/4348-141-0x00007FF602B90000-0x00007FF602EE2000-memory.dmp	UPX
behavioral2/memory/5164-143-0x00007FF66DA80000-0x00007FF66DDD2000-memory.dmp	UPX
behavioral2/memory/2804-142-0x00007FF628580000-0x00007FF6288D2000-memory.dmp	UPX
behavioral2/memory/3468-139-0x00007FF67D7A0000-0x00007FF67DAF2000-memory.dmp	UPX
behavioral2/memory/5680-150-0x00007FF72E930000-0x00007FF72EC82000-memory.dmp	UPX
behavioral2/memory/2956-151-0x00007FF70B770000-0x00007FF70BAC2000-memory.dmp	UPX
behavioral2/memory/5292-152-0x00007FF605CD0000-0x00007FF606022000-memory.dmp	UPX
behavioral2/memory/4920-149-0x00007FF618FF0000-0x00007FF619342000-memory.dmp	UPX
behavioral2/memory/4792-148-0x00007FF7AC370000-0x00007FF7AC6C2000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3352-0-0x00007FF702AC0000-0x00007FF702E12000-memory.dmp	xmrig
behavioral2/files/0x0009000000019cb3-5.dat	xmrig
behavioral2/memory/4236-8-0x00007FF661100000-0x00007FF661452000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c656-11.dat	xmrig
behavioral2/memory/3388-12-0x00007FF784990000-0x00007FF784CE2000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c657-17.dat	xmrig
behavioral2/files/0x000d00000001c652-23.dat	xmrig
behavioral2/memory/5644-24-0x00007FF60D8D0000-0x00007FF60DC22000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c658-29.dat	xmrig
behavioral2/files/0x000c00000001c659-34.dat	xmrig
behavioral2/files/0x000c00000001c65a-39.dat	xmrig
behavioral2/files/0x000c00000001c65b-45.dat	xmrig
behavioral2/files/0x000c00000001c65c-50.dat	xmrig
behavioral2/files/0x000c00000001c65d-55.dat	xmrig
behavioral2/files/0x000c00000001c65f-64.dat	xmrig
behavioral2/files/0x000c00000001c664-89.dat	xmrig
behavioral2/files/0x000c00000001c665-94.dat	xmrig
behavioral2/files/0x000c00000001c667-105.dat	xmrig
behavioral2/files/0x000c00000001c669-109.dat	xmrig
behavioral2/files/0x000c00000001c666-100.dat	xmrig
behavioral2/files/0x000c00000001c663-85.dat	xmrig
behavioral2/files/0x000c00000001c662-80.dat	xmrig
behavioral2/files/0x000c00000001c661-75.dat	xmrig
behavioral2/files/0x000c00000001c660-70.dat	xmrig
behavioral2/files/0x000c00000001c65e-60.dat	xmrig
behavioral2/memory/2052-18-0x00007FF77B970000-0x00007FF77BCC2000-memory.dmp	xmrig
behavioral2/memory/2132-111-0x00007FF7AA580000-0x00007FF7AA8D2000-memory.dmp	xmrig
behavioral2/memory/4348-112-0x00007FF602B90000-0x00007FF602EE2000-memory.dmp	xmrig
behavioral2/memory/5012-113-0x00007FF649140000-0x00007FF649492000-memory.dmp	xmrig
behavioral2/memory/2804-114-0x00007FF628580000-0x00007FF6288D2000-memory.dmp	xmrig
behavioral2/memory/3468-115-0x00007FF67D7A0000-0x00007FF67DAF2000-memory.dmp	xmrig
behavioral2/memory/5776-117-0x00007FF72AE10000-0x00007FF72B162000-memory.dmp	xmrig
behavioral2/memory/3892-118-0x00007FF714BB0000-0x00007FF714F02000-memory.dmp	xmrig
behavioral2/memory/5164-116-0x00007FF66DA80000-0x00007FF66DDD2000-memory.dmp	xmrig
behavioral2/memory/5028-119-0x00007FF7F3AF0000-0x00007FF7F3E42000-memory.dmp	xmrig
behavioral2/memory/4612-121-0x00007FF7B88C0000-0x00007FF7B8C12000-memory.dmp	xmrig
behavioral2/memory/5680-122-0x00007FF72E930000-0x00007FF72EC82000-memory.dmp	xmrig
behavioral2/memory/4920-123-0x00007FF618FF0000-0x00007FF619342000-memory.dmp	xmrig
behavioral2/memory/2956-125-0x00007FF70B770000-0x00007FF70BAC2000-memory.dmp	xmrig
behavioral2/memory/2564-127-0x00007FF76B850000-0x00007FF76BBA2000-memory.dmp	xmrig
behavioral2/memory/5456-126-0x00007FF72A010000-0x00007FF72A362000-memory.dmp	xmrig
behavioral2/memory/4792-124-0x00007FF7AC370000-0x00007FF7AC6C2000-memory.dmp	xmrig
behavioral2/memory/5292-120-0x00007FF605CD0000-0x00007FF606022000-memory.dmp	xmrig
behavioral2/memory/3352-128-0x00007FF702AC0000-0x00007FF702E12000-memory.dmp	xmrig
behavioral2/memory/3388-129-0x00007FF784990000-0x00007FF784CE2000-memory.dmp	xmrig
behavioral2/memory/2052-130-0x00007FF77B970000-0x00007FF77BCC2000-memory.dmp	xmrig
behavioral2/memory/5644-131-0x00007FF60D8D0000-0x00007FF60DC22000-memory.dmp	xmrig
behavioral2/memory/2132-132-0x00007FF7AA580000-0x00007FF7AA8D2000-memory.dmp	xmrig
behavioral2/memory/4236-133-0x00007FF661100000-0x00007FF661452000-memory.dmp	xmrig
behavioral2/memory/3388-134-0x00007FF784990000-0x00007FF784CE2000-memory.dmp	xmrig
behavioral2/memory/2052-135-0x00007FF77B970000-0x00007FF77BCC2000-memory.dmp	xmrig
behavioral2/memory/5644-136-0x00007FF60D8D0000-0x00007FF60DC22000-memory.dmp	xmrig
behavioral2/memory/2132-137-0x00007FF7AA580000-0x00007FF7AA8D2000-memory.dmp	xmrig
behavioral2/memory/2564-138-0x00007FF76B850000-0x00007FF76BBA2000-memory.dmp	xmrig
behavioral2/memory/5012-140-0x00007FF649140000-0x00007FF649492000-memory.dmp	xmrig
behavioral2/memory/4348-141-0x00007FF602B90000-0x00007FF602EE2000-memory.dmp	xmrig
behavioral2/memory/5164-143-0x00007FF66DA80000-0x00007FF66DDD2000-memory.dmp	xmrig
behavioral2/memory/2804-142-0x00007FF628580000-0x00007FF6288D2000-memory.dmp	xmrig
behavioral2/memory/3468-139-0x00007FF67D7A0000-0x00007FF67DAF2000-memory.dmp	xmrig
behavioral2/memory/5680-150-0x00007FF72E930000-0x00007FF72EC82000-memory.dmp	xmrig
behavioral2/memory/2956-151-0x00007FF70B770000-0x00007FF70BAC2000-memory.dmp	xmrig
behavioral2/memory/5292-152-0x00007FF605CD0000-0x00007FF606022000-memory.dmp	xmrig
behavioral2/memory/4920-149-0x00007FF618FF0000-0x00007FF619342000-memory.dmp	xmrig
behavioral2/memory/4792-148-0x00007FF7AC370000-0x00007FF7AC6C2000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4236	Xihuxtn.exe
3388	qBgkqyj.exe
2052	KuIffPJ.exe
5644	AnVVOeG.exe
2132	zVwQCtk.exe
2564	hEzvcyp.exe
4348	UeLLBws.exe
5012	KvnFAKD.exe
2804	OOkOjjm.exe
3468	ARnftwj.exe
5164	jQrdDaq.exe
5776	BNCeNSz.exe
3892	oVQtEUW.exe
5028	sbdkuCE.exe
5292	ZLDctRr.exe
4612	uJWeBpi.exe
5680	aryOKCF.exe
4920	wxscpkS.exe
4792	xvSDkpg.exe
2956	OOUXbia.exe
5456	yNgwZNU.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3352-0-0x00007FF702AC0000-0x00007FF702E12000-memory.dmp	upx
behavioral2/files/0x0009000000019cb3-5.dat	upx
behavioral2/memory/4236-8-0x00007FF661100000-0x00007FF661452000-memory.dmp	upx
behavioral2/files/0x000c00000001c656-11.dat	upx
behavioral2/memory/3388-12-0x00007FF784990000-0x00007FF784CE2000-memory.dmp	upx
behavioral2/files/0x000c00000001c657-17.dat	upx
behavioral2/files/0x000d00000001c652-23.dat	upx
behavioral2/memory/5644-24-0x00007FF60D8D0000-0x00007FF60DC22000-memory.dmp	upx
behavioral2/files/0x000c00000001c658-29.dat	upx
behavioral2/files/0x000c00000001c659-34.dat	upx
behavioral2/files/0x000c00000001c65a-39.dat	upx
behavioral2/files/0x000c00000001c65b-45.dat	upx
behavioral2/files/0x000c00000001c65c-50.dat	upx
behavioral2/files/0x000c00000001c65d-55.dat	upx
behavioral2/files/0x000c00000001c65f-64.dat	upx
behavioral2/files/0x000c00000001c664-89.dat	upx
behavioral2/files/0x000c00000001c665-94.dat	upx
behavioral2/files/0x000c00000001c667-105.dat	upx
behavioral2/files/0x000c00000001c669-109.dat	upx
behavioral2/files/0x000c00000001c666-100.dat	upx
behavioral2/files/0x000c00000001c663-85.dat	upx
behavioral2/files/0x000c00000001c662-80.dat	upx
behavioral2/files/0x000c00000001c661-75.dat	upx
behavioral2/files/0x000c00000001c660-70.dat	upx
behavioral2/files/0x000c00000001c65e-60.dat	upx
behavioral2/memory/2052-18-0x00007FF77B970000-0x00007FF77BCC2000-memory.dmp	upx
behavioral2/memory/2132-111-0x00007FF7AA580000-0x00007FF7AA8D2000-memory.dmp	upx
behavioral2/memory/4348-112-0x00007FF602B90000-0x00007FF602EE2000-memory.dmp	upx
behavioral2/memory/5012-113-0x00007FF649140000-0x00007FF649492000-memory.dmp	upx
behavioral2/memory/2804-114-0x00007FF628580000-0x00007FF6288D2000-memory.dmp	upx
behavioral2/memory/3468-115-0x00007FF67D7A0000-0x00007FF67DAF2000-memory.dmp	upx
behavioral2/memory/5776-117-0x00007FF72AE10000-0x00007FF72B162000-memory.dmp	upx
behavioral2/memory/3892-118-0x00007FF714BB0000-0x00007FF714F02000-memory.dmp	upx
behavioral2/memory/5164-116-0x00007FF66DA80000-0x00007FF66DDD2000-memory.dmp	upx
behavioral2/memory/5028-119-0x00007FF7F3AF0000-0x00007FF7F3E42000-memory.dmp	upx
behavioral2/memory/4612-121-0x00007FF7B88C0000-0x00007FF7B8C12000-memory.dmp	upx
behavioral2/memory/5680-122-0x00007FF72E930000-0x00007FF72EC82000-memory.dmp	upx
behavioral2/memory/4920-123-0x00007FF618FF0000-0x00007FF619342000-memory.dmp	upx
behavioral2/memory/2956-125-0x00007FF70B770000-0x00007FF70BAC2000-memory.dmp	upx
behavioral2/memory/2564-127-0x00007FF76B850000-0x00007FF76BBA2000-memory.dmp	upx
behavioral2/memory/5456-126-0x00007FF72A010000-0x00007FF72A362000-memory.dmp	upx
behavioral2/memory/4792-124-0x00007FF7AC370000-0x00007FF7AC6C2000-memory.dmp	upx
behavioral2/memory/5292-120-0x00007FF605CD0000-0x00007FF606022000-memory.dmp	upx
behavioral2/memory/3352-128-0x00007FF702AC0000-0x00007FF702E12000-memory.dmp	upx
behavioral2/memory/3388-129-0x00007FF784990000-0x00007FF784CE2000-memory.dmp	upx
behavioral2/memory/2052-130-0x00007FF77B970000-0x00007FF77BCC2000-memory.dmp	upx
behavioral2/memory/5644-131-0x00007FF60D8D0000-0x00007FF60DC22000-memory.dmp	upx
behavioral2/memory/2132-132-0x00007FF7AA580000-0x00007FF7AA8D2000-memory.dmp	upx
behavioral2/memory/4236-133-0x00007FF661100000-0x00007FF661452000-memory.dmp	upx
behavioral2/memory/3388-134-0x00007FF784990000-0x00007FF784CE2000-memory.dmp	upx
behavioral2/memory/2052-135-0x00007FF77B970000-0x00007FF77BCC2000-memory.dmp	upx
behavioral2/memory/5644-136-0x00007FF60D8D0000-0x00007FF60DC22000-memory.dmp	upx
behavioral2/memory/2132-137-0x00007FF7AA580000-0x00007FF7AA8D2000-memory.dmp	upx
behavioral2/memory/2564-138-0x00007FF76B850000-0x00007FF76BBA2000-memory.dmp	upx
behavioral2/memory/5012-140-0x00007FF649140000-0x00007FF649492000-memory.dmp	upx
behavioral2/memory/4348-141-0x00007FF602B90000-0x00007FF602EE2000-memory.dmp	upx
behavioral2/memory/5164-143-0x00007FF66DA80000-0x00007FF66DDD2000-memory.dmp	upx
behavioral2/memory/2804-142-0x00007FF628580000-0x00007FF6288D2000-memory.dmp	upx
behavioral2/memory/3468-139-0x00007FF67D7A0000-0x00007FF67DAF2000-memory.dmp	upx
behavioral2/memory/5680-150-0x00007FF72E930000-0x00007FF72EC82000-memory.dmp	upx
behavioral2/memory/2956-151-0x00007FF70B770000-0x00007FF70BAC2000-memory.dmp	upx
behavioral2/memory/5292-152-0x00007FF605CD0000-0x00007FF606022000-memory.dmp	upx
behavioral2/memory/4920-149-0x00007FF618FF0000-0x00007FF619342000-memory.dmp	upx
behavioral2/memory/4792-148-0x00007FF7AC370000-0x00007FF7AC6C2000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\aryOKCF.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\yNgwZNU.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\Xihuxtn.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\UeLLBws.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\OOkOjjm.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\oVQtEUW.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\uJWeBpi.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\OOUXbia.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\KuIffPJ.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ARnftwj.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\BNCeNSz.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\wxscpkS.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\qBgkqyj.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\zVwQCtk.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\hEzvcyp.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\KvnFAKD.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\jQrdDaq.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\xvSDkpg.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\AnVVOeG.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\sbdkuCE.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ZLDctRr.exe	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 4236	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 3352 wrote to memory of 3388	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 3352 wrote to memory of 2052	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 3352 wrote to memory of 5644	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 3352 wrote to memory of 2132	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 3352 wrote to memory of 2564	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 3352 wrote to memory of 4348	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 3352 wrote to memory of 5012	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 3352 wrote to memory of 2804	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 3352 wrote to memory of 3468	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 3352 wrote to memory of 5164	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 3352 wrote to memory of 5776	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 3352 wrote to memory of 3892	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 3352 wrote to memory of 5028	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 3352 wrote to memory of 5292	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 3352 wrote to memory of 4612	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 3352 wrote to memory of 5680	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 3352 wrote to memory of 4920	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 3352 wrote to memory of 4792	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 3352 wrote to memory of 2956	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109
PID 3352 wrote to memory of 5456	3352	2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_a8c112db752417347d4095ef33dc6bba_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\System\Xihuxtn.exe
  C:\Windows\System\Xihuxtn.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\qBgkqyj.exe
  C:\Windows\System\qBgkqyj.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\KuIffPJ.exe
  C:\Windows\System\KuIffPJ.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\AnVVOeG.exe
  C:\Windows\System\AnVVOeG.exe
  2⤵
  - Executes dropped EXE
  PID:5644
- C:\Windows\System\zVwQCtk.exe
  C:\Windows\System\zVwQCtk.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\hEzvcyp.exe
  C:\Windows\System\hEzvcyp.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\UeLLBws.exe
  C:\Windows\System\UeLLBws.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\KvnFAKD.exe
  C:\Windows\System\KvnFAKD.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\OOkOjjm.exe
  C:\Windows\System\OOkOjjm.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\ARnftwj.exe
  C:\Windows\System\ARnftwj.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\jQrdDaq.exe
  C:\Windows\System\jQrdDaq.exe
  2⤵
  - Executes dropped EXE
  PID:5164
- C:\Windows\System\BNCeNSz.exe
  C:\Windows\System\BNCeNSz.exe
  2⤵
  - Executes dropped EXE
  PID:5776
- C:\Windows\System\oVQtEUW.exe
  C:\Windows\System\oVQtEUW.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\sbdkuCE.exe
  C:\Windows\System\sbdkuCE.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\ZLDctRr.exe
  C:\Windows\System\ZLDctRr.exe
  2⤵
  - Executes dropped EXE
  PID:5292
- C:\Windows\System\uJWeBpi.exe
  C:\Windows\System\uJWeBpi.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\aryOKCF.exe
  C:\Windows\System\aryOKCF.exe
  2⤵
  - Executes dropped EXE
  PID:5680
- C:\Windows\System\wxscpkS.exe
  C:\Windows\System\wxscpkS.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\xvSDkpg.exe
  C:\Windows\System\xvSDkpg.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\OOUXbia.exe
  C:\Windows\System\OOUXbia.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\yNgwZNU.exe
  C:\Windows\System\yNgwZNU.exe
  2⤵
  - Executes dropped EXE
  PID:5456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ARnftwj.exe

Path C:\Windows\System\ARnftwj.exe
Size 8.3MB
SHA256 b815780037b1da2e7d7e4392c6d56ea4d0a5dad133ddaaeaa3f91f1f0bd08763
MD5 b0ae0c093067a8735a93a74166fb152b
SHA1 a6aa56f1f1015c3c66249ad0c2fc333049c251fd
SHA512 7d1ebe54aa6b4c026db35bacd9e3514571b8a969db8e314d2daac2c5e93eea57aa693833d91ac7efd78ec05c12ec4693797b6e1bb9ca5de2adc088af47047d55
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUt:v+D56utgpPF8u/7t
TLSH
T182965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnVVOeG.exe

Path C:\Windows\System\AnVVOeG.exe
Size 8.3MB
SHA256 6dea80afb32b2465137c037425927185be1a9d07c86871ef8e33a4e10f0cb6a4
MD5 539d10f6512a155599ed655430f9a02a
SHA1 745c53394506a7beb9803705dc6b986c4c935408
SHA512 f8c00332e0f0059a95c1e1272f8fb01b8841cb6076394dbe40db0656a510754bd4ad99bc9419dd7d03069201c737652988f46fb62631df74899a88cc1ab9becd
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUA:v+D56utgpPF8u/7A
TLSH
T137965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BNCeNSz.exe

Path C:\Windows\System\BNCeNSz.exe
Size 8.3MB
SHA256 5f80c5a84e3c61be32529a551fd18555860e9d4da0c8aab8aefd5e789cd1da66
MD5 c3235beede5739f05a02013ce6d8544e
SHA1 f7299e1a4cd40a52bd20ea7193f05cfa3a8681d6
SHA512 db12154e0928c06db4e9fc475ea659b09b1e2d889c148d27ad6df18718a03d971a612f9313c866ba41f7b7a9a23223ab1210cabde577beeb3bb0604b702b1dae
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUz:v+D56utgpPF8u/7z
TLSH
T125965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KuIffPJ.exe

Path C:\Windows\System\KuIffPJ.exe
Size 8.3MB
SHA256 bdf3445a3db2186782b2fdb2ff52aab770c1da3a926c0d91626e22cfc6da8650
MD5 a971c88cbf1f4d8a2b158ee10b84a718
SHA1 80208f18048489ace6d942a858293c41d9999494
SHA512 69bb07135aaba4eaa6eee5a52a1d42fed0a83a71d40e45ce9b2788ab17191c385619fd233a6e7e9d52d2c448a27b3dceadbfec5de5ce53abf0fa1e7b969dd8ab
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUq:v+D56utgpPF8u/7q
TLSH
T108965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KvnFAKD.exe

Path C:\Windows\System\KvnFAKD.exe
Size 8.3MB
SHA256 033e58af28ce578571711053ecd17df86b15e26db61dd99a9740b081f0757f49
MD5 4fe66bda8c7743b5c8cbe495dcedff2c
SHA1 deb7d4a5fdea0ecea8740911a57ba713a3b0a9e5
SHA512 c03a7c02d15a18287da34507a51c3695efda29416a0e655d77e73e9aeae7d8aee2013604e2829537032466eb01c5862c51046d7a8a8c9dc557507fa2b2c341f9
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUz:v+D56utgpPF8u/7z
TLSH
T1E3965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OOUXbia.exe

Path C:\Windows\System\OOUXbia.exe
Size 8.3MB
SHA256 f527bb6f6fbcb3c87f8ff0d1f952e3e0b9fc4ce35e5de749ea249f1dee8f6eb1
MD5 8208d414f2ac1f76ea1cc612c3c3897b
SHA1 e42d0d5aead8e44fc3266d9c8a50656920216253
SHA512 5e462009cd5604577365ec17c34918649cf9a4fd159fcfa227c092bd594a6ef1c8a03ad84d1369a2a470152e9c6a891a764e90376230db0a0d4c706ba999a34d
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUj:v+D56utgpPF8u/7j
TLSH
T19B965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OOkOjjm.exe

Path C:\Windows\System\OOkOjjm.exe
Size 8.3MB
SHA256 d96cdee7667c1dcea445385a4184cfabb67fbf862386268f29922e1a181a7a92
MD5 25d36a13a9afce63655c0bb77c1606ff
SHA1 8800f09b3fe6a118134f7db75410a16a39f9b798
SHA512 5140cbb07f9a4488f5db80f6e03f64b4df26e03f667c73fca30574d9bb8396f6b3df9f3fa2a8052e05ab25b7d1e3ff59e8418d9a4cd3e990e1a1535a7639fe8c
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUZ:v+D56utgpPF8u/7Z
TLSH
T17A965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UeLLBws.exe

Path C:\Windows\System\UeLLBws.exe
Size 8.3MB
SHA256 cdd9725c6bef5af8882af4488c69deb09eee7dc6ee1a176b34162b6f512313d4
MD5 208572d8b4a4aabf91673745a3990803
SHA1 fc2620b4d7a6e992420dad6f8bd4afd912083255
SHA512 6a9baf7875f7ed8565f29d33aa98f6ca9c79842b9a19c3c7cbc699ad38426a0538af86618e625f757a859a8fa28ad0abdb935cd02e482fac80902f63d54478a5
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUc:v+D56utgpPF8u/7c
TLSH
T1FC965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xihuxtn.exe

Path C:\Windows\System\Xihuxtn.exe
Size 8.3MB
SHA256 0640da42657f2409747c5191034fb6cc8936bf7d995ed29fb2e18bb034ba200d
MD5 e640fcd34f8c8cd72aa66ff393b38c20
SHA1 7b4756f004c2c20e48b3d1f5b57baf8351269961
SHA512 c1381e1e22b07e10050d66de5f26880e8e1be59bbae15c846ac9117ed4b6309a73fe36cd7f0295a35cfb7cc412c7889a34f427d3f00cfc798bf4d785ec377bc0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU7:v+D56utgpPF8u/77
TLSH
T108965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZLDctRr.exe

Path C:\Windows\System\ZLDctRr.exe
Size 8.3MB
SHA256 47e2f17f73447dffc23f39968f1f71514a4dc35084b7490ac96045b2bcb8eef8
MD5 8de8a5a5e82e4753ca1a7e8590848be0
SHA1 b83fc313ea380d4d56ae42a59273479b1a7d7561
SHA512 9bd387ec0a479ee51ede6b7bdbfc0953f6b1ad101b68bdb6c1a1bc9b515632380f9dea913eb4764087603abbadf10edd44db46a5fa7006dcf3e1b995c7b54d0b
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUG:v+D56utgpPF8u/7G
TLSH
T1C0965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aryOKCF.exe

Path C:\Windows\System\aryOKCF.exe
Size 8.3MB
SHA256 3d172361fad58a37856557b792aa49cb1dd1b4ea8eb5b51cba821d0fa4020e8a
MD5 bfcade463f3aa97e071db65f13533429
SHA1 9d501451b75b6142ede4c5fecc84f465bd89a137
SHA512 01c2531462b2e696432fc007e437f33a7d5aef48acb1130dc080b5e811626e280fb049700267e90447d53990221eeebee983f10481f25aef0d8b6c1955a3e089
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUD:v+D56utgpPF8u/7D
TLSH
T143965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hEzvcyp.exe

Path C:\Windows\System\hEzvcyp.exe
Size 8.3MB
SHA256 30540633192b5ab51bc0ac365a41a3766929d252e6b91b15487748819f5b9f51
MD5 7ee07c020198b619994b48d105f915a1
SHA1 23d7e05afc64d58d2d2eabcaa26e8d3c52485866
SHA512 93c5144c71f345e2205185bd5f478484cfa64f607002a3e077059760e380783871fafa52f6007942caf574373fb89e090a7824ecad15fa2dae2eac4485a2130f
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUW:v+D56utgpPF8u/7W
TLSH
T174965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jQrdDaq.exe

Path C:\Windows\System\jQrdDaq.exe
Size 8.3MB
SHA256 92fe14bae403173b15d55f4b14e3007182ec8b9db958f3e910e462def0403f67
MD5 df24cf61110aaf189e65e04eed1efe12
SHA1 65cef76a1a206f12e5c6f0955ed3ab71241cfd26
SHA512 4580742e8699f0a455dd1b43000f0695f9f4f9627351bf37e50e5d3061f1469ef432a3a6ce7150b2296a39d60e70a594eac31b50a97bdc1f238a242e33e60975
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU1:v+D56utgpPF8u/71
TLSH
T18A965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oVQtEUW.exe

Path C:\Windows\System\oVQtEUW.exe
Size 8.3MB
SHA256 cd0e893df07b719f83af7eaaa275d1cd224aee94a2450e491106536760cdf17b
MD5 35fc56fb04355db5b4c6021950523ace
SHA1 5c7dd00c578834e97ecdd5c98715271c852c23ad
SHA512 aa2b05fb2828d76a9fc1f2261156224859ffd2da2b9ff587da7f312dc5b921ed352cadffb4fa0e46856bcdd1fd296ce68fc07bac89f2f8fb19f952f5d0c5f1e8
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUX:v+D56utgpPF8u/7X
TLSH
T141965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qBgkqyj.exe

Path C:\Windows\System\qBgkqyj.exe
Size 8.3MB
SHA256 0ddbd401cefab6dc9b08e006e1108462eb3ca48e8ae061b74d7afdc6bab5d0d4
MD5 d9f576314b9f3fd10b9a398f295cf126
SHA1 9a44049799a307201b99d5142e850ace5fb2cd5d
SHA512 8fb91cb2fc5d221ff180d92d7629a7cf0f36fd27944baf04de34c462840f65c7fa6d296ef01213cd5fb2606e12b288d8fdfc7702b9dfcec7cd6a92d37541b442
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUz:v+D56utgpPF8u/7z
TLSH
T1FC965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sbdkuCE.exe

Path C:\Windows\System\sbdkuCE.exe
Size 8.3MB
SHA256 cc24e99c7f456ab3f394c6ae361f983103260c3631ce9eacb960eeb5ed13acfc
MD5 31dbd8d6cb176da7543167cc26015981
SHA1 2c1dca5963225ef16daa939e1f19fb188bbe159b
SHA512 94518dcd0c78c4c5f93c08a8f2c5904525fc29729fc108c001600a81912b9d15b05caacf645bec74808a96a26314ef8680a90c70c4ff692bb91e1b988f6e9a4c
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU0:v+D56utgpPF8u/70
TLSH
T1B9965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uJWeBpi.exe

Path C:\Windows\System\uJWeBpi.exe
Size 8.3MB
SHA256 6c6a716ca74598982b80de65751ea880999eee724c3eeaf7db7b2f9d2f71f414
MD5 ed62e6df831317f587f8a6c144eab1d3
SHA1 c19caa333f9e12cc88ae1b4a88c6c925805656ec
SHA512 35bcdac95e95912ee71204ff5e752ac39711b4891a1476657aa8455c5d306a7becbefcd2abbbebeb5f5b1540d8fd08e408bbb3eb22167a70534af506d8265e92
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUF:v+D56utgpPF8u/7F
TLSH
T183965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wxscpkS.exe

Path C:\Windows\System\wxscpkS.exe
Size 8.3MB
SHA256 14af35800708e2bbcdfaa73e004edf7037de2634e2e3781ca870a522d74f8d5e
MD5 933e6207b4319ff2df965643ddd67c6e
SHA1 ca2067480b01b529ee8821f482ee366cea582ffd
SHA512 2a15f258feb1ec636dc0290039eab0f13fe27a78f53a4ae2dc80725ff922f2dab96a6d007d570fb68b1df1c7479221ef013599c9e549c7fec6f7ee7b78e24f68
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU2:v+D56utgpPF8u/72
TLSH
T133965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvSDkpg.exe

Path C:\Windows\System\xvSDkpg.exe
Size 8.3MB
SHA256 231930dc68b615d0dd3cc8f6a78fe804c3813cd607dc3e6692499584cd8d5fd9
MD5 ebb062c12d225d45399593f700217e11
SHA1 ccdf543333c407d20f50b8562a5ad894f0b4b35f
SHA512 0b9394837545a33cf02f9f938d4095ca2b007e2e55c5a957811a01ba010233a9abb1c927a3c2bedfda8ac099dab497689f005b4a138ec32a521a5e3590744ad4
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUr:v+D56utgpPF8u/7r
TLSH
T1B5965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yNgwZNU.exe

Path C:\Windows\System\yNgwZNU.exe
Size 8.3MB
SHA256 8fbc2e2d7deec2358e840508651f6093a098208443683c8a47da6fe5f2a59d0c
MD5 2dfe9f8046ec3e9116bda24ec137b486
SHA1 3b48fbff897bce800fba7f10610d624e6ea3aa2f
SHA512 e4e0430f80f738a1b628acf633ed75281e28a108c08772ba36a8e6d31a70e5cd0c39def8cd2339a4ed1f6b575fc235132b8a3f8005ad887777d5fee1dc028ad9
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU5:v+D56utgpPF8u/75
TLSH
T1C6965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zVwQCtk.exe

Path C:\Windows\System\zVwQCtk.exe
Size 8.3MB
SHA256 e2c3800363277bd68ef3e5c0988f3b32ea09f4eb487a0561d4574392f150ce29
MD5 a016e706da8d60466369e37e9f444cef
SHA1 da6782e95def1f14176f545925b9d0c1ef875d6c
SHA512 d742e22be50085d493ff295ba3fea5424f32d35022a190686390e236901ff07c0de7dbd12df651078da2b42566b4ac5a4d216c506f8d0de2f828c3152665310b
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUt:v+D56utgpPF8u/7t
TLSH
T147965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2052-135-0x00007FF77B970000-0x00007FF77BCC2000-memory.dmp

Download

memory/2052-130-0x00007FF77B970000-0x00007FF77BCC2000-memory.dmp

Download

memory/2052-18-0x00007FF77B970000-0x00007FF77BCC2000-memory.dmp

Download

memory/2132-132-0x00007FF7AA580000-0x00007FF7AA8D2000-memory.dmp

Download

memory/2132-111-0x00007FF7AA580000-0x00007FF7AA8D2000-memory.dmp

Download

memory/2132-137-0x00007FF7AA580000-0x00007FF7AA8D2000-memory.dmp

Download

memory/2564-138-0x00007FF76B850000-0x00007FF76BBA2000-memory.dmp

Download

memory/2564-127-0x00007FF76B850000-0x00007FF76BBA2000-memory.dmp

Download

memory/2804-114-0x00007FF628580000-0x00007FF6288D2000-memory.dmp

Download

memory/2804-142-0x00007FF628580000-0x00007FF6288D2000-memory.dmp

Download

memory/2956-125-0x00007FF70B770000-0x00007FF70BAC2000-memory.dmp

Download

memory/2956-151-0x00007FF70B770000-0x00007FF70BAC2000-memory.dmp

Download

memory/3352-0-0x00007FF702AC0000-0x00007FF702E12000-memory.dmp

Download

memory/3352-1-0x0000018D0EFE0000-0x0000018D0EFF0000-memory.dmp

Download

memory/3352-128-0x00007FF702AC0000-0x00007FF702E12000-memory.dmp

Download

memory/3388-134-0x00007FF784990000-0x00007FF784CE2000-memory.dmp

Download

memory/3388-129-0x00007FF784990000-0x00007FF784CE2000-memory.dmp

Download

memory/3388-12-0x00007FF784990000-0x00007FF784CE2000-memory.dmp

Download

memory/3468-139-0x00007FF67D7A0000-0x00007FF67DAF2000-memory.dmp

Download

memory/3468-115-0x00007FF67D7A0000-0x00007FF67DAF2000-memory.dmp

Download

memory/3892-146-0x00007FF714BB0000-0x00007FF714F02000-memory.dmp

Download

memory/3892-118-0x00007FF714BB0000-0x00007FF714F02000-memory.dmp

Download

memory/4236-8-0x00007FF661100000-0x00007FF661452000-memory.dmp

Download

memory/4236-133-0x00007FF661100000-0x00007FF661452000-memory.dmp

Download

memory/4348-141-0x00007FF602B90000-0x00007FF602EE2000-memory.dmp

Download

memory/4348-112-0x00007FF602B90000-0x00007FF602EE2000-memory.dmp

Download

memory/4612-144-0x00007FF7B88C0000-0x00007FF7B8C12000-memory.dmp

Download

memory/4612-121-0x00007FF7B88C0000-0x00007FF7B8C12000-memory.dmp

Download

memory/4792-148-0x00007FF7AC370000-0x00007FF7AC6C2000-memory.dmp

Download

memory/4792-124-0x00007FF7AC370000-0x00007FF7AC6C2000-memory.dmp

Download

memory/4920-123-0x00007FF618FF0000-0x00007FF619342000-memory.dmp

Download

memory/4920-149-0x00007FF618FF0000-0x00007FF619342000-memory.dmp

Download

memory/5012-113-0x00007FF649140000-0x00007FF649492000-memory.dmp

Download

memory/5012-140-0x00007FF649140000-0x00007FF649492000-memory.dmp

Download

memory/5028-145-0x00007FF7F3AF0000-0x00007FF7F3E42000-memory.dmp

Download

memory/5028-119-0x00007FF7F3AF0000-0x00007FF7F3E42000-memory.dmp

Download

memory/5164-116-0x00007FF66DA80000-0x00007FF66DDD2000-memory.dmp

Download

memory/5164-143-0x00007FF66DA80000-0x00007FF66DDD2000-memory.dmp

Download

memory/5292-152-0x00007FF605CD0000-0x00007FF606022000-memory.dmp

Download

memory/5292-120-0x00007FF605CD0000-0x00007FF606022000-memory.dmp

Download

memory/5456-126-0x00007FF72A010000-0x00007FF72A362000-memory.dmp

Download

memory/5456-153-0x00007FF72A010000-0x00007FF72A362000-memory.dmp

Download

memory/5644-24-0x00007FF60D8D0000-0x00007FF60DC22000-memory.dmp

Download

memory/5644-136-0x00007FF60D8D0000-0x00007FF60DC22000-memory.dmp

Download

memory/5644-131-0x00007FF60D8D0000-0x00007FF60DC22000-memory.dmp

Download

memory/5680-150-0x00007FF72E930000-0x00007FF72EC82000-memory.dmp

Download

memory/5680-122-0x00007FF72E930000-0x00007FF72EC82000-memory.dmp

Download

memory/5776-147-0x00007FF72AE10000-0x00007FF72B162000-memory.dmp

Download

memory/5776-117-0x00007FF72AE10000-0x00007FF72B162000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads