cobaltstrike | c8e483dbb4c263249d6940ecba53bf9a5687c5a9612586e7a3b9fdfc7b6c7345

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample261027-blmkeshx3w
SHA256 c8e483dbb4c263249d6940ecba53bf9a5687c5a9612586e7a3b9fdfc7b6c7345
MD5 fc28d42c6be36988881fed9c10efad6b
SHA1 89cc922773e0310ee7dad500aaf2e38a9f1098fb
SHA512 677c265bf0f3d4c17489fe7b18cb3b42fe63aeaaeee96cca6b12783dd72590163ff46dc86ec899600deb733f2d87bd05bf8dff5e82b3db860e00218f068d0aa4
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUu:v+D56utgpPF8u/7u
TLSH
T11E965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000d00000001b89d-5.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5a7-9.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5a8-17.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5a9-22.dat	cobalt_reflective_dll
behavioral2/files/0x000e00000001c5a4-28.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5aa-35.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5ab-43.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5ac-47.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5ad-53.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5af-66.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5b2-86.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5b3-93.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5b4-99.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5b5-106.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5b9-137.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5b8-131.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5b7-124.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5b6-117.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5b1-82.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5b0-75.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5ae-62.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001b89d-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5a7-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5a8-17.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5a9-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000e00000001c5a4-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5aa-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5ab-43.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5ac-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5ad-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5af-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5b2-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5b3-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5b4-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5b5-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5b9-137.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5b8-131.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5b7-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5b6-117.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5b1-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5b0-75.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5ae-62.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2416-0-0x00007FF681590000-0x00007FF6818E2000-memory.dmp	UPX
behavioral2/files/0x000d00000001b89d-5.dat	UPX
behavioral2/memory/3284-8-0x00007FF6C6EE0000-0x00007FF6C7232000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5a7-9.dat	UPX
behavioral2/memory/3644-12-0x00007FF64AEA0000-0x00007FF64B1F2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5a8-17.dat	UPX
behavioral2/memory/6052-18-0x00007FF782AE0000-0x00007FF782E32000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5a9-22.dat	UPX
behavioral2/memory/3248-24-0x00007FF651640000-0x00007FF651992000-memory.dmp	UPX
behavioral2/files/0x000e00000001c5a4-28.dat	UPX
behavioral2/files/0x000d00000001c5aa-35.dat	UPX
behavioral2/files/0x000d00000001c5ab-43.dat	UPX
behavioral2/files/0x000d00000001c5ac-47.dat	UPX
behavioral2/files/0x000d00000001c5ad-53.dat	UPX
behavioral2/memory/2416-60-0x00007FF681590000-0x00007FF6818E2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5af-66.dat	UPX
behavioral2/memory/5244-74-0x00007FF62EC60000-0x00007FF62EFB2000-memory.dmp	UPX
behavioral2/memory/6052-80-0x00007FF782AE0000-0x00007FF782E32000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5b2-86.dat	UPX
behavioral2/files/0x000d00000001c5b3-93.dat	UPX
behavioral2/files/0x000d00000001c5b4-99.dat	UPX
behavioral2/files/0x000d00000001c5b5-106.dat	UPX
behavioral2/memory/4148-116-0x00007FF7B92F0000-0x00007FF7B9642000-memory.dmp	UPX
behavioral2/memory/5372-135-0x00007FF645580000-0x00007FF6458D2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5b9-137.dat	UPX
behavioral2/memory/2792-136-0x00007FF6E7130000-0x00007FF6E7482000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5b8-131.dat	UPX
behavioral2/memory/5384-130-0x00007FF7EA190000-0x00007FF7EA4E2000-memory.dmp	UPX
behavioral2/memory/5764-129-0x00007FF6AEC40000-0x00007FF6AEF92000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5b7-124.dat	UPX
behavioral2/memory/2684-123-0x00007FF6F7ED0000-0x00007FF6F8222000-memory.dmp	UPX
behavioral2/memory/3928-122-0x00007FF7717A0000-0x00007FF771AF2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5b6-117.dat	UPX
behavioral2/memory/4888-115-0x00007FF7EC8C0000-0x00007FF7ECC12000-memory.dmp	UPX
behavioral2/memory/3080-109-0x00007FF749E00000-0x00007FF74A152000-memory.dmp	UPX
behavioral2/memory/4576-108-0x00007FF630AF0000-0x00007FF630E42000-memory.dmp	UPX
behavioral2/memory/5220-102-0x00007FF7FDA50000-0x00007FF7FDDA2000-memory.dmp	UPX
behavioral2/memory/3492-101-0x00007FF7D1930000-0x00007FF7D1C82000-memory.dmp	UPX
behavioral2/memory/5160-95-0x00007FF76DCF0000-0x00007FF76E042000-memory.dmp	UPX
behavioral2/memory/5064-94-0x00007FF6DCF00000-0x00007FF6DD252000-memory.dmp	UPX
behavioral2/memory/4180-88-0x00007FF798CE0000-0x00007FF799032000-memory.dmp	UPX
behavioral2/memory/3248-87-0x00007FF651640000-0x00007FF651992000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5b1-82.dat	UPX
behavioral2/memory/5856-81-0x00007FF6F3BF0000-0x00007FF6F3F42000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5b0-75.dat	UPX
behavioral2/memory/3644-73-0x00007FF64AEA0000-0x00007FF64B1F2000-memory.dmp	UPX
behavioral2/memory/5372-67-0x00007FF645580000-0x00007FF6458D2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5ae-62.dat	UPX
behavioral2/memory/5764-61-0x00007FF6AEC40000-0x00007FF6AEF92000-memory.dmp	UPX
behavioral2/memory/3928-54-0x00007FF7717A0000-0x00007FF771AF2000-memory.dmp	UPX
behavioral2/memory/4888-48-0x00007FF7EC8C0000-0x00007FF7ECC12000-memory.dmp	UPX
behavioral2/memory/4576-42-0x00007FF630AF0000-0x00007FF630E42000-memory.dmp	UPX
behavioral2/memory/3492-36-0x00007FF7D1930000-0x00007FF7D1C82000-memory.dmp	UPX
behavioral2/memory/5064-30-0x00007FF6DCF00000-0x00007FF6DD252000-memory.dmp	UPX
behavioral2/memory/5244-139-0x00007FF62EC60000-0x00007FF62EFB2000-memory.dmp	UPX
behavioral2/memory/5856-140-0x00007FF6F3BF0000-0x00007FF6F3F42000-memory.dmp	UPX
behavioral2/memory/4180-141-0x00007FF798CE0000-0x00007FF799032000-memory.dmp	UPX
behavioral2/memory/5160-142-0x00007FF76DCF0000-0x00007FF76E042000-memory.dmp	UPX
behavioral2/memory/5220-143-0x00007FF7FDA50000-0x00007FF7FDDA2000-memory.dmp	UPX
behavioral2/memory/3080-144-0x00007FF749E00000-0x00007FF74A152000-memory.dmp	UPX
behavioral2/memory/4148-145-0x00007FF7B92F0000-0x00007FF7B9642000-memory.dmp	UPX
behavioral2/memory/2684-146-0x00007FF6F7ED0000-0x00007FF6F8222000-memory.dmp	UPX
behavioral2/memory/5384-147-0x00007FF7EA190000-0x00007FF7EA4E2000-memory.dmp	UPX
behavioral2/memory/2792-148-0x00007FF6E7130000-0x00007FF6E7482000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2416-0-0x00007FF681590000-0x00007FF6818E2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001b89d-5.dat	xmrig
behavioral2/memory/3284-8-0x00007FF6C6EE0000-0x00007FF6C7232000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5a7-9.dat	xmrig
behavioral2/memory/3644-12-0x00007FF64AEA0000-0x00007FF64B1F2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5a8-17.dat	xmrig
behavioral2/memory/6052-18-0x00007FF782AE0000-0x00007FF782E32000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5a9-22.dat	xmrig
behavioral2/memory/3248-24-0x00007FF651640000-0x00007FF651992000-memory.dmp	xmrig
behavioral2/files/0x000e00000001c5a4-28.dat	xmrig
behavioral2/files/0x000d00000001c5aa-35.dat	xmrig
behavioral2/files/0x000d00000001c5ab-43.dat	xmrig
behavioral2/files/0x000d00000001c5ac-47.dat	xmrig
behavioral2/files/0x000d00000001c5ad-53.dat	xmrig
behavioral2/memory/2416-60-0x00007FF681590000-0x00007FF6818E2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5af-66.dat	xmrig
behavioral2/memory/5244-74-0x00007FF62EC60000-0x00007FF62EFB2000-memory.dmp	xmrig
behavioral2/memory/6052-80-0x00007FF782AE0000-0x00007FF782E32000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5b2-86.dat	xmrig
behavioral2/files/0x000d00000001c5b3-93.dat	xmrig
behavioral2/files/0x000d00000001c5b4-99.dat	xmrig
behavioral2/files/0x000d00000001c5b5-106.dat	xmrig
behavioral2/memory/4148-116-0x00007FF7B92F0000-0x00007FF7B9642000-memory.dmp	xmrig
behavioral2/memory/5372-135-0x00007FF645580000-0x00007FF6458D2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5b9-137.dat	xmrig
behavioral2/memory/2792-136-0x00007FF6E7130000-0x00007FF6E7482000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5b8-131.dat	xmrig
behavioral2/memory/5384-130-0x00007FF7EA190000-0x00007FF7EA4E2000-memory.dmp	xmrig
behavioral2/memory/5764-129-0x00007FF6AEC40000-0x00007FF6AEF92000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5b7-124.dat	xmrig
behavioral2/memory/2684-123-0x00007FF6F7ED0000-0x00007FF6F8222000-memory.dmp	xmrig
behavioral2/memory/3928-122-0x00007FF7717A0000-0x00007FF771AF2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5b6-117.dat	xmrig
behavioral2/memory/4888-115-0x00007FF7EC8C0000-0x00007FF7ECC12000-memory.dmp	xmrig
behavioral2/memory/3080-109-0x00007FF749E00000-0x00007FF74A152000-memory.dmp	xmrig
behavioral2/memory/4576-108-0x00007FF630AF0000-0x00007FF630E42000-memory.dmp	xmrig
behavioral2/memory/5220-102-0x00007FF7FDA50000-0x00007FF7FDDA2000-memory.dmp	xmrig
behavioral2/memory/3492-101-0x00007FF7D1930000-0x00007FF7D1C82000-memory.dmp	xmrig
behavioral2/memory/5160-95-0x00007FF76DCF0000-0x00007FF76E042000-memory.dmp	xmrig
behavioral2/memory/5064-94-0x00007FF6DCF00000-0x00007FF6DD252000-memory.dmp	xmrig
behavioral2/memory/4180-88-0x00007FF798CE0000-0x00007FF799032000-memory.dmp	xmrig
behavioral2/memory/3248-87-0x00007FF651640000-0x00007FF651992000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5b1-82.dat	xmrig
behavioral2/memory/5856-81-0x00007FF6F3BF0000-0x00007FF6F3F42000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5b0-75.dat	xmrig
behavioral2/memory/3644-73-0x00007FF64AEA0000-0x00007FF64B1F2000-memory.dmp	xmrig
behavioral2/memory/5372-67-0x00007FF645580000-0x00007FF6458D2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5ae-62.dat	xmrig
behavioral2/memory/5764-61-0x00007FF6AEC40000-0x00007FF6AEF92000-memory.dmp	xmrig
behavioral2/memory/3928-54-0x00007FF7717A0000-0x00007FF771AF2000-memory.dmp	xmrig
behavioral2/memory/4888-48-0x00007FF7EC8C0000-0x00007FF7ECC12000-memory.dmp	xmrig
behavioral2/memory/4576-42-0x00007FF630AF0000-0x00007FF630E42000-memory.dmp	xmrig
behavioral2/memory/3492-36-0x00007FF7D1930000-0x00007FF7D1C82000-memory.dmp	xmrig
behavioral2/memory/5064-30-0x00007FF6DCF00000-0x00007FF6DD252000-memory.dmp	xmrig
behavioral2/memory/5244-139-0x00007FF62EC60000-0x00007FF62EFB2000-memory.dmp	xmrig
behavioral2/memory/5856-140-0x00007FF6F3BF0000-0x00007FF6F3F42000-memory.dmp	xmrig
behavioral2/memory/4180-141-0x00007FF798CE0000-0x00007FF799032000-memory.dmp	xmrig
behavioral2/memory/5160-142-0x00007FF76DCF0000-0x00007FF76E042000-memory.dmp	xmrig
behavioral2/memory/5220-143-0x00007FF7FDA50000-0x00007FF7FDDA2000-memory.dmp	xmrig
behavioral2/memory/3080-144-0x00007FF749E00000-0x00007FF74A152000-memory.dmp	xmrig
behavioral2/memory/4148-145-0x00007FF7B92F0000-0x00007FF7B9642000-memory.dmp	xmrig
behavioral2/memory/2684-146-0x00007FF6F7ED0000-0x00007FF6F8222000-memory.dmp	xmrig
behavioral2/memory/5384-147-0x00007FF7EA190000-0x00007FF7EA4E2000-memory.dmp	xmrig
behavioral2/memory/2792-148-0x00007FF6E7130000-0x00007FF6E7482000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3284	lffcykq.exe
3644	wUfqJmg.exe
6052	vXdEbuN.exe
3248	BQEhMWR.exe
5064	AwKSdtH.exe
3492	AuGIaZC.exe
4576	zYdTJwF.exe
4888	QbzSrcm.exe
3928	BfzHQyd.exe
5764	rLCOoyd.exe
5372	WZPoplK.exe
5244	iAhBJug.exe
5856	tUWvJuI.exe
4180	WULMfTf.exe
5160	iMqfYaD.exe
5220	WqQNPaO.exe
3080	fNBtjid.exe
4148	gFODrHO.exe
2684	cpPqXii.exe
5384	GJjTtPs.exe
2792	PYjWMPQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2416-0-0x00007FF681590000-0x00007FF6818E2000-memory.dmp	upx
behavioral2/files/0x000d00000001b89d-5.dat	upx
behavioral2/memory/3284-8-0x00007FF6C6EE0000-0x00007FF6C7232000-memory.dmp	upx
behavioral2/files/0x000d00000001c5a7-9.dat	upx
behavioral2/memory/3644-12-0x00007FF64AEA0000-0x00007FF64B1F2000-memory.dmp	upx
behavioral2/files/0x000d00000001c5a8-17.dat	upx
behavioral2/memory/6052-18-0x00007FF782AE0000-0x00007FF782E32000-memory.dmp	upx
behavioral2/files/0x000d00000001c5a9-22.dat	upx
behavioral2/memory/3248-24-0x00007FF651640000-0x00007FF651992000-memory.dmp	upx
behavioral2/files/0x000e00000001c5a4-28.dat	upx
behavioral2/files/0x000d00000001c5aa-35.dat	upx
behavioral2/files/0x000d00000001c5ab-43.dat	upx
behavioral2/files/0x000d00000001c5ac-47.dat	upx
behavioral2/files/0x000d00000001c5ad-53.dat	upx
behavioral2/memory/2416-60-0x00007FF681590000-0x00007FF6818E2000-memory.dmp	upx
behavioral2/files/0x000d00000001c5af-66.dat	upx
behavioral2/memory/5244-74-0x00007FF62EC60000-0x00007FF62EFB2000-memory.dmp	upx
behavioral2/memory/6052-80-0x00007FF782AE0000-0x00007FF782E32000-memory.dmp	upx
behavioral2/files/0x000d00000001c5b2-86.dat	upx
behavioral2/files/0x000d00000001c5b3-93.dat	upx
behavioral2/files/0x000d00000001c5b4-99.dat	upx
behavioral2/files/0x000d00000001c5b5-106.dat	upx
behavioral2/memory/4148-116-0x00007FF7B92F0000-0x00007FF7B9642000-memory.dmp	upx
behavioral2/memory/5372-135-0x00007FF645580000-0x00007FF6458D2000-memory.dmp	upx
behavioral2/files/0x000d00000001c5b9-137.dat	upx
behavioral2/memory/2792-136-0x00007FF6E7130000-0x00007FF6E7482000-memory.dmp	upx
behavioral2/files/0x000d00000001c5b8-131.dat	upx
behavioral2/memory/5384-130-0x00007FF7EA190000-0x00007FF7EA4E2000-memory.dmp	upx
behavioral2/memory/5764-129-0x00007FF6AEC40000-0x00007FF6AEF92000-memory.dmp	upx
behavioral2/files/0x000d00000001c5b7-124.dat	upx
behavioral2/memory/2684-123-0x00007FF6F7ED0000-0x00007FF6F8222000-memory.dmp	upx
behavioral2/memory/3928-122-0x00007FF7717A0000-0x00007FF771AF2000-memory.dmp	upx
behavioral2/files/0x000d00000001c5b6-117.dat	upx
behavioral2/memory/4888-115-0x00007FF7EC8C0000-0x00007FF7ECC12000-memory.dmp	upx
behavioral2/memory/3080-109-0x00007FF749E00000-0x00007FF74A152000-memory.dmp	upx
behavioral2/memory/4576-108-0x00007FF630AF0000-0x00007FF630E42000-memory.dmp	upx
behavioral2/memory/5220-102-0x00007FF7FDA50000-0x00007FF7FDDA2000-memory.dmp	upx
behavioral2/memory/3492-101-0x00007FF7D1930000-0x00007FF7D1C82000-memory.dmp	upx
behavioral2/memory/5160-95-0x00007FF76DCF0000-0x00007FF76E042000-memory.dmp	upx
behavioral2/memory/5064-94-0x00007FF6DCF00000-0x00007FF6DD252000-memory.dmp	upx
behavioral2/memory/4180-88-0x00007FF798CE0000-0x00007FF799032000-memory.dmp	upx
behavioral2/memory/3248-87-0x00007FF651640000-0x00007FF651992000-memory.dmp	upx
behavioral2/files/0x000d00000001c5b1-82.dat	upx
behavioral2/memory/5856-81-0x00007FF6F3BF0000-0x00007FF6F3F42000-memory.dmp	upx
behavioral2/files/0x000d00000001c5b0-75.dat	upx
behavioral2/memory/3644-73-0x00007FF64AEA0000-0x00007FF64B1F2000-memory.dmp	upx
behavioral2/memory/5372-67-0x00007FF645580000-0x00007FF6458D2000-memory.dmp	upx
behavioral2/files/0x000d00000001c5ae-62.dat	upx
behavioral2/memory/5764-61-0x00007FF6AEC40000-0x00007FF6AEF92000-memory.dmp	upx
behavioral2/memory/3928-54-0x00007FF7717A0000-0x00007FF771AF2000-memory.dmp	upx
behavioral2/memory/4888-48-0x00007FF7EC8C0000-0x00007FF7ECC12000-memory.dmp	upx
behavioral2/memory/4576-42-0x00007FF630AF0000-0x00007FF630E42000-memory.dmp	upx
behavioral2/memory/3492-36-0x00007FF7D1930000-0x00007FF7D1C82000-memory.dmp	upx
behavioral2/memory/5064-30-0x00007FF6DCF00000-0x00007FF6DD252000-memory.dmp	upx
behavioral2/memory/5244-139-0x00007FF62EC60000-0x00007FF62EFB2000-memory.dmp	upx
behavioral2/memory/5856-140-0x00007FF6F3BF0000-0x00007FF6F3F42000-memory.dmp	upx
behavioral2/memory/4180-141-0x00007FF798CE0000-0x00007FF799032000-memory.dmp	upx
behavioral2/memory/5160-142-0x00007FF76DCF0000-0x00007FF76E042000-memory.dmp	upx
behavioral2/memory/5220-143-0x00007FF7FDA50000-0x00007FF7FDDA2000-memory.dmp	upx
behavioral2/memory/3080-144-0x00007FF749E00000-0x00007FF74A152000-memory.dmp	upx
behavioral2/memory/4148-145-0x00007FF7B92F0000-0x00007FF7B9642000-memory.dmp	upx
behavioral2/memory/2684-146-0x00007FF6F7ED0000-0x00007FF6F8222000-memory.dmp	upx
behavioral2/memory/5384-147-0x00007FF7EA190000-0x00007FF7EA4E2000-memory.dmp	upx
behavioral2/memory/2792-148-0x00007FF6E7130000-0x00007FF6E7482000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\gFODrHO.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\WZPoplK.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\WULMfTf.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\GJjTtPs.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\PYjWMPQ.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\wUfqJmg.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\BQEhMWR.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\zYdTJwF.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\iAhBJug.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\WqQNPaO.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\cpPqXii.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\lffcykq.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\AwKSdtH.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\tUWvJuI.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\vXdEbuN.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\AuGIaZC.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\QbzSrcm.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\BfzHQyd.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\rLCOoyd.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\iMqfYaD.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fNBtjid.exe	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 3284	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 2416 wrote to memory of 3644	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 2416 wrote to memory of 6052	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 2416 wrote to memory of 3248	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 2416 wrote to memory of 5064	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 2416 wrote to memory of 3492	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 2416 wrote to memory of 4576	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 2416 wrote to memory of 4888	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 2416 wrote to memory of 3928	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 2416 wrote to memory of 5764	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 2416 wrote to memory of 5372	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 2416 wrote to memory of 5244	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 2416 wrote to memory of 5856	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 2416 wrote to memory of 4180	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 2416 wrote to memory of 5160	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 2416 wrote to memory of 5220	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 2416 wrote to memory of 3080	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 2416 wrote to memory of 4148	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109
PID 2416 wrote to memory of 2684	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	110
PID 2416 wrote to memory of 5384	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	111
PID 2416 wrote to memory of 2792	2416	2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_fc28d42c6be36988881fed9c10efad6b_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\System\lffcykq.exe
  C:\Windows\System\lffcykq.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\wUfqJmg.exe
  C:\Windows\System\wUfqJmg.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\vXdEbuN.exe
  C:\Windows\System\vXdEbuN.exe
  2⤵
  - Executes dropped EXE
  PID:6052
- C:\Windows\System\BQEhMWR.exe
  C:\Windows\System\BQEhMWR.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\AwKSdtH.exe
  C:\Windows\System\AwKSdtH.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\AuGIaZC.exe
  C:\Windows\System\AuGIaZC.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\zYdTJwF.exe
  C:\Windows\System\zYdTJwF.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\QbzSrcm.exe
  C:\Windows\System\QbzSrcm.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\BfzHQyd.exe
  C:\Windows\System\BfzHQyd.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\rLCOoyd.exe
  C:\Windows\System\rLCOoyd.exe
  2⤵
  - Executes dropped EXE
  PID:5764
- C:\Windows\System\WZPoplK.exe
  C:\Windows\System\WZPoplK.exe
  2⤵
  - Executes dropped EXE
  PID:5372
- C:\Windows\System\iAhBJug.exe
  C:\Windows\System\iAhBJug.exe
  2⤵
  - Executes dropped EXE
  PID:5244
- C:\Windows\System\tUWvJuI.exe
  C:\Windows\System\tUWvJuI.exe
  2⤵
  - Executes dropped EXE
  PID:5856
- C:\Windows\System\WULMfTf.exe
  C:\Windows\System\WULMfTf.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\iMqfYaD.exe
  C:\Windows\System\iMqfYaD.exe
  2⤵
  - Executes dropped EXE
  PID:5160
- C:\Windows\System\WqQNPaO.exe
  C:\Windows\System\WqQNPaO.exe
  2⤵
  - Executes dropped EXE
  PID:5220
- C:\Windows\System\fNBtjid.exe
  C:\Windows\System\fNBtjid.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\gFODrHO.exe
  C:\Windows\System\gFODrHO.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\cpPqXii.exe
  C:\Windows\System\cpPqXii.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\GJjTtPs.exe
  C:\Windows\System\GJjTtPs.exe
  2⤵
  - Executes dropped EXE
  PID:5384
- C:\Windows\System\PYjWMPQ.exe
  C:\Windows\System\PYjWMPQ.exe
  2⤵
  - Executes dropped EXE
  PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AuGIaZC.exe

Path C:\Windows\System\AuGIaZC.exe
Size 8.3MB
SHA256 a9c96b30e4c589321f1e27164205ba19b9b65c2bbf836cfe763105c18c11867b
MD5 b43662fdd1d164a224e6313c2c305589
SHA1 aa2b73db8dde0e5b8d2d694961e0b960c6c2dc3f
SHA512 031af68592c5de7d5b8dba0034c0dd6d2c4e98b9dcb8b411431e96c3004182ef1a6d9cdc9cc427483429a4afdfb0f3becef8ee84c4432b62f03121720bd62674
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUc:v+D56utgpPF8u/7c
TLSH
T16C965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AwKSdtH.exe

Path C:\Windows\System\AwKSdtH.exe
Size 8.3MB
SHA256 b6f1fdaeec0c9a9a657dbe3009bbe49b471b61669461ab9393f56d3d7283b0a0
MD5 b7c78fb1859958a9f636df6b1b88d1ef
SHA1 1cfbe1d2f0bf235e2d63700139e60673eaa4ba9e
SHA512 8a0768f214954b1610901bf16ca7761b4d9aa1361e7fd55ec4bed6727028cb3cacfaf006e0d9d3fc3e835d0749a5ae500121d0b229a3c9b5b01308616553977a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUq:v+D56utgpPF8u/7q
TLSH
T17E965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BQEhMWR.exe

Path C:\Windows\System\BQEhMWR.exe
Size 8.3MB
SHA256 8d219e3c1c23921372c6707b5c56b78824e35cbea805a0eec86ca1c70850232c
MD5 96f925f0ed68268570cb2831aec13c9e
SHA1 17a0c212de853f2ac839b0dc0d64c9433c232f18
SHA512 a6479702040a7b1391c8424913c65b5f391fc0afad167576cdbe9e10c6227062773c75fdf64002ca532f787a4a891d0319f63c54a5bf6ea4001f622e3bf8d7b7
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUm:v+D56utgpPF8u/7m
TLSH
T106965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BfzHQyd.exe

Path C:\Windows\System\BfzHQyd.exe
Size 8.3MB
SHA256 7feafc0a822582b91b0807d4f0b65d7a0d4ba6fbcbe73a8a4557bd9afda8c3a2
MD5 abc3129be5d044d84a73b9571cfa6da2
SHA1 d1c85ba90f0400fa0463577361aee3620d75c942
SHA512 541f7a752ed903b163806aed9ed06045d772f9328bcdc374ed80fe2fe10a0be524873eb3ace0bdce1d08326c7fbbf2f7d752463b37901955742dbb051669c387
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUG:v+D56utgpPF8u/7G
TLSH
T157965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GJjTtPs.exe

Path C:\Windows\System\GJjTtPs.exe
Size 8.3MB
SHA256 88985d705ce92e8fe6618b6ad3465fe606fdd9889e3bea427963c0dea2689afd
MD5 3bfeca8c4d466c5d362854ef98493627
SHA1 06d1b25dfc56c60ad28907a326873884385f6550
SHA512 0243d7d3f7fd7cc8ff517dab9ecd922f204dc50fdb84de91a38da8f3b8183f652a66e6443a85dd2c521a60a011deda848b99e474bd1130a91f5babb5332340e0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUs:v+D56utgpPF8u/7s
TLSH
T1F6965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PYjWMPQ.exe

Path C:\Windows\System\PYjWMPQ.exe
Size 8.3MB
SHA256 fdc6789980bddfc6eb1591b966e4200e7273b02ca2a3cf2bd71067588ebbcd4a
MD5 0d8a0a5b072dcef1b6ceb367ff131af9
SHA1 42670304514320ce15b56cf9f1409bd221c07793
SHA512 83e36fca354502f27dffb625cc18ebce9260b2a7fd3e883a968fedc91fdc2312b51722e5bdc09e19a668d2ec1061cacc3d428e719e52c7345a62b9768b74bd4a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU+:v+D56utgpPF8u/7+
TLSH
T134965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QbzSrcm.exe

Path C:\Windows\System\QbzSrcm.exe
Size 8.3MB
SHA256 2a4b596a923fc7d08e3a82e85f51cfcaf3e583eef45ab26223beb86aa96f5e50
MD5 9e676284e80adeabcf98c197f5a60cca
SHA1 1c013a22fd55c2cb4b7d4638767745d41b33243b
SHA512 b2e91c0335190c77085d01cb32e059c7f297c17935a62606b3542c4c6a2f5a4a4e3202317f954ffb659958e0ca23f79363bd06377b460bdca4df75c218fb2bd6
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUT:v+D56utgpPF8u/7T
TLSH
T143965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WULMfTf.exe

Path C:\Windows\System\WULMfTf.exe
Size 8.3MB
SHA256 a083738120e27bea45fd2067e41c6e736469ab6b89f10b583f110488c33c3545
MD5 914590fc0078977bbc9994d03c9fc225
SHA1 9d871ce9b7071dbecdf4a5ce1e3add6748fe2905
SHA512 76b2701586beddd604e91fee00f51b708e9b9590889d928b2c954afb6f9754a6d58d64b1b03a1f34b1c8ec318b6b1be06086c202a94aade5a5a9cee7e1a4fb5a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU3:v+D56utgpPF8u/73
TLSH
T1C7965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WZPoplK.exe

Path C:\Windows\System\WZPoplK.exe
Size 8.3MB
SHA256 120f82ec933ee55793f49bd7e756a42945c6d20c61feb8ad13ce701d8c13f88b
MD5 7c678f03aa478b33772f4429a0a2624f
SHA1 68e5af482b06c42a367dba369123aed71f45a38c
SHA512 d08d38814679cb07b0f9dae25905f17bd040e52554aa45645d6aab6421b1960e7948a704056be20f2b831d2b8d7d7d9c9d32ee0fdf506bd10fb7979645d8cdba
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUq:v+D56utgpPF8u/7q
TLSH
T1FF965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WqQNPaO.exe

Path C:\Windows\System\WqQNPaO.exe
Size 8.3MB
SHA256 4a033ecc8c3fc5903222fa8edd1d02b7deee48c7e4635746f38ced4b3b637bea
MD5 77344796b75ce7802ae9b6f27eddad44
SHA1 dedc80c34d47de6b1cb93676391041adb18b564c
SHA512 a72d660da5e14829e575af92de1521507641970d5c56b7d01bdfbad1f3a39ce75c896544e13b5a37c379b079d74c133d9418f67056b10a6132e35466f3df22d0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU/:v+D56utgpPF8u/7/
TLSH
T196965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cpPqXii.exe

Path C:\Windows\System\cpPqXii.exe
Size 8.3MB
SHA256 603597a24f5e873249d66e351e60db1f5d4c4d9c4749cb153ffa07863e28f4e9
MD5 d4a81bf755ac81d3ff39cc3874aef7a2
SHA1 391c31fa60cc1709ebaed58392a81ea9f19495a8
SHA512 7e4f123ccd38a073654784da9896274074ce49fd8f440838855710f50c7f20b46bdd8e655bdcd1028365be8b3218c05dde8bb0ddc1df3597fe0ad525cedcbc7b
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUf:v+D56utgpPF8u/7f
TLSH
T10C965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fNBtjid.exe

Path C:\Windows\System\fNBtjid.exe
Size 8.3MB
SHA256 51254d5a7c58901d6d6a68c56c1d60d4451b2dc9011d5e6743fcd9f5c9f85826
MD5 06093f7357b7fb0c785c2246900a422e
SHA1 2fe454e248fb3de5be4cba7e5530a3b8b7e6bb34
SHA512 e4ed6927740ed3ecef6c9ff66063547d71b464c89e3968e67d1c2fc19a93d3afa79d0b1575adf63db141173926d24b93734153f3477fdd42982e1f00505dd8f3
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUx:v+D56utgpPF8u/7x
TLSH
T15A965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gFODrHO.exe

Path C:\Windows\System\gFODrHO.exe
Size 8.3MB
SHA256 4f95f8e9feae7d759aa27342a457cb1225233c4f86a4dbf0bde48eaa0e357a87
MD5 44545f34af4870420227dc6d8fcced01
SHA1 bcb32ea76113b48f50d6f148f537e869b1bd7cb5
SHA512 63395119592d84ad23ad1e11360d788d95454250b586668b3d423b8943ad3550109e791e65de1fa292a9baaae830c3bf2db310289366d4db8f1792ecef9890e2
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU4:v+D56utgpPF8u/74
TLSH
T1F5965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iAhBJug.exe

Path C:\Windows\System\iAhBJug.exe
Size 8.3MB
SHA256 e9b9856621f8aa087f27b72a7d99a740f7cacecf5483fc535322669f8b7de1af
MD5 06fc411d4c49962e08adecb270f0ef56
SHA1 de415a6372223864160acd278f66f147b85ac0ea
SHA512 01800030f34c6265de59095bc9448c89d96226cf5e1245ff177ab7ff937e4265c8075cb0e882535db6992c36dc38941ba84994fe51c7c294b110ce7f57ef0aa4
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUc:v+D56utgpPF8u/7c
TLSH
T135965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iMqfYaD.exe

Path C:\Windows\System\iMqfYaD.exe
Size 8.3MB
SHA256 6d213be8adad3c1161c62ca267170ffbf537bd8835c5d186cdc28d372d267fb3
MD5 804ac26d3ee9ecee5b88b89b2f9bf475
SHA1 efa0054acd3da83332d954e4b0a53878b87711b1
SHA512 51bc76da24d409e32ae7b1bccae2c47f4eee2cd41d1797d438e9e84f8a8f844b5ff3e0a2c4f4f37e3b38e293174acc1aab24386918f3a2eeca5cb15e5e674c44
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUa:v+D56utgpPF8u/7a
TLSH
T13C965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lffcykq.exe

Path C:\Windows\System\lffcykq.exe
Size 8.3MB
SHA256 339f512ee6741100d9e5b924940a9d842323cf242b9fd5af541856d2a1264c97
MD5 15f3675d0914d6dd7b6b45e48a574efb
SHA1 67f617103a676f985c4aa2d2e9068dffc2556132
SHA512 91e8ca7d24024f83ce93067b902c1b48534e5d4d7b4bdd7b8afb3b190c652dc02691ee883962a29fc5082d2c007077717a9f40da68ecff321771e0620ab5e41b
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUe:v+D56utgpPF8u/7e
TLSH
T161965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rLCOoyd.exe

Path C:\Windows\System\rLCOoyd.exe
Size 8.3MB
SHA256 071b7c8e2f51192d1cf61dddfbcd9b020ce1953b6d59843798a842b12c018358
MD5 4dcdbbbf333cbf19a6c4035c8a52ec73
SHA1 a2e4ce11d79f9d089a2d9cbdc1a18827d29d8c89
SHA512 14b31f43942148f765ad8a2536269123143eb10b7bca1f3d0df21d00456bb2075c89c36d8a6ae42f883d7fd40dbc22a4fde2c9ebd602aeb64bd79e56875b8ca6
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUh:v+D56utgpPF8u/7h
TLSH
T161965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tUWvJuI.exe

Path C:\Windows\System\tUWvJuI.exe
Size 8.3MB
SHA256 d84d11f1826fbbbedf50bd2a858d8f1c9caa1432ca6fa7dbcf4e6fe59b25ec68
MD5 64fb7e559c3b993b92387c9db1617f30
SHA1 817e167004da0fd873bc40ed0ea8d0331677ce28
SHA512 81bed55c1d45b89ec1e82a41c4d22de5e03bb2f8c9ee838ae29ea095b4389ac6cdffd4fb9173ddd86c80e9c32d55dd1c1ae31ef0a84199d81a05e669b7d86a77
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUm:v+D56utgpPF8u/7m
TLSH
T1B3965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vXdEbuN.exe

Path C:\Windows\System\vXdEbuN.exe
Size 8.3MB
SHA256 6639f8cdef265eeff8bf7e187e0666d0db006b5ecf40c677c9b71b710d5dfc90
MD5 a9b92110a7c149b9ca63451730ef6310
SHA1 445161cda5944e85991aa0033891ed3438fd3d73
SHA512 ebcb4ee4455f6758f85e793afce2dbee5db68e730f7d30fb94df9e7b89b45972e37ed81754e25aa3612e046889b4ec6c241c445ae68ba1c2bd4db0d8fb896b81
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUm:v+D56utgpPF8u/7m
TLSH
T18B965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wUfqJmg.exe

Path C:\Windows\System\wUfqJmg.exe
Size 8.3MB
SHA256 b90accf4e6bd1c78bc2e317bd8459fb56d084733a43ffe27eb1ad86a6784d7a5
MD5 0ddf358836bc426abddfa2db3ca16ed6
SHA1 f9f0e0e8dace7cf2edf265f37a698526a1897004
SHA512 0a136799033452ddd0085801288f099273418589d6a305bfd85ff3d45741c226dbe51e3672164bdc84901a271cbd9aa45935432633e214c368ccad1931080fff
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUM:v+D56utgpPF8u/7M
TLSH
T16D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zYdTJwF.exe

Path C:\Windows\System\zYdTJwF.exe
Size 8.3MB
SHA256 e6067ea7bf308eeb9f611a7e54ee85804c9c047c94b8941111628fb9bef53021
MD5 ba6a356854975702232a383f1a5c57e9
SHA1 de839683c56cdc27779a00fedead70e15817bfcd
SHA512 4226999c0661e7de05ec28bac94292d72817cb070ab6277aab389d42d4d65e84c1ab8faa7547891af3d2283c0ea58707dd7e7a248ce2b42005da4f3d1a687f2a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUZ:v+D56utgpPF8u/7Z
TLSH
T13E965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2416-60-0x00007FF681590000-0x00007FF6818E2000-memory.dmp

Download

memory/2416-0-0x00007FF681590000-0x00007FF6818E2000-memory.dmp

Download

memory/2416-1-0x000001B8196F0000-0x000001B819700000-memory.dmp

Download

memory/2684-146-0x00007FF6F7ED0000-0x00007FF6F8222000-memory.dmp

Download

memory/2684-123-0x00007FF6F7ED0000-0x00007FF6F8222000-memory.dmp

Download

memory/2684-166-0x00007FF6F7ED0000-0x00007FF6F8222000-memory.dmp

Download

memory/2792-148-0x00007FF6E7130000-0x00007FF6E7482000-memory.dmp

Download

memory/2792-136-0x00007FF6E7130000-0x00007FF6E7482000-memory.dmp

Download

memory/2792-169-0x00007FF6E7130000-0x00007FF6E7482000-memory.dmp

Download

memory/3080-144-0x00007FF749E00000-0x00007FF74A152000-memory.dmp

Download

memory/3080-168-0x00007FF749E00000-0x00007FF74A152000-memory.dmp

Download

memory/3080-109-0x00007FF749E00000-0x00007FF74A152000-memory.dmp

Download

memory/3248-87-0x00007FF651640000-0x00007FF651992000-memory.dmp

Download

memory/3248-24-0x00007FF651640000-0x00007FF651992000-memory.dmp

Download

memory/3248-152-0x00007FF651640000-0x00007FF651992000-memory.dmp

Download

memory/3284-8-0x00007FF6C6EE0000-0x00007FF6C7232000-memory.dmp

Download

memory/3284-149-0x00007FF6C6EE0000-0x00007FF6C7232000-memory.dmp

Download

memory/3492-154-0x00007FF7D1930000-0x00007FF7D1C82000-memory.dmp

Download

memory/3492-36-0x00007FF7D1930000-0x00007FF7D1C82000-memory.dmp

Download

memory/3492-101-0x00007FF7D1930000-0x00007FF7D1C82000-memory.dmp

Download

memory/3644-12-0x00007FF64AEA0000-0x00007FF64B1F2000-memory.dmp

Download

memory/3644-150-0x00007FF64AEA0000-0x00007FF64B1F2000-memory.dmp

Download

memory/3644-73-0x00007FF64AEA0000-0x00007FF64B1F2000-memory.dmp

Download

memory/3928-122-0x00007FF7717A0000-0x00007FF771AF2000-memory.dmp

Download

memory/3928-54-0x00007FF7717A0000-0x00007FF771AF2000-memory.dmp

Download

memory/3928-157-0x00007FF7717A0000-0x00007FF771AF2000-memory.dmp

Download

memory/4148-165-0x00007FF7B92F0000-0x00007FF7B9642000-memory.dmp

Download

memory/4148-116-0x00007FF7B92F0000-0x00007FF7B9642000-memory.dmp

Download

memory/4148-145-0x00007FF7B92F0000-0x00007FF7B9642000-memory.dmp

Download

memory/4180-164-0x00007FF798CE0000-0x00007FF799032000-memory.dmp

Download

memory/4180-88-0x00007FF798CE0000-0x00007FF799032000-memory.dmp

Download

memory/4180-141-0x00007FF798CE0000-0x00007FF799032000-memory.dmp

Download

memory/4576-155-0x00007FF630AF0000-0x00007FF630E42000-memory.dmp

Download

memory/4576-108-0x00007FF630AF0000-0x00007FF630E42000-memory.dmp

Download

memory/4576-42-0x00007FF630AF0000-0x00007FF630E42000-memory.dmp

Download

memory/4888-115-0x00007FF7EC8C0000-0x00007FF7ECC12000-memory.dmp

Download

memory/4888-48-0x00007FF7EC8C0000-0x00007FF7ECC12000-memory.dmp

Download

memory/4888-156-0x00007FF7EC8C0000-0x00007FF7ECC12000-memory.dmp

Download

memory/5064-153-0x00007FF6DCF00000-0x00007FF6DD252000-memory.dmp

Download

memory/5064-30-0x00007FF6DCF00000-0x00007FF6DD252000-memory.dmp

Download

memory/5064-94-0x00007FF6DCF00000-0x00007FF6DD252000-memory.dmp

Download

memory/5160-142-0x00007FF76DCF0000-0x00007FF76E042000-memory.dmp

Download

memory/5160-163-0x00007FF76DCF0000-0x00007FF76E042000-memory.dmp

Download

memory/5160-95-0x00007FF76DCF0000-0x00007FF76E042000-memory.dmp

Download

memory/5220-102-0x00007FF7FDA50000-0x00007FF7FDDA2000-memory.dmp

Download

memory/5220-162-0x00007FF7FDA50000-0x00007FF7FDDA2000-memory.dmp

Download

memory/5220-143-0x00007FF7FDA50000-0x00007FF7FDDA2000-memory.dmp

Download

memory/5244-139-0x00007FF62EC60000-0x00007FF62EFB2000-memory.dmp

Download

memory/5244-74-0x00007FF62EC60000-0x00007FF62EFB2000-memory.dmp

Download

memory/5244-160-0x00007FF62EC60000-0x00007FF62EFB2000-memory.dmp

Download

memory/5372-159-0x00007FF645580000-0x00007FF6458D2000-memory.dmp

Download

memory/5372-135-0x00007FF645580000-0x00007FF6458D2000-memory.dmp

Download

memory/5372-67-0x00007FF645580000-0x00007FF6458D2000-memory.dmp

Download

memory/5384-130-0x00007FF7EA190000-0x00007FF7EA4E2000-memory.dmp

Download

memory/5384-147-0x00007FF7EA190000-0x00007FF7EA4E2000-memory.dmp

Download

memory/5384-167-0x00007FF7EA190000-0x00007FF7EA4E2000-memory.dmp

Download

memory/5764-158-0x00007FF6AEC40000-0x00007FF6AEF92000-memory.dmp

Download

memory/5764-61-0x00007FF6AEC40000-0x00007FF6AEF92000-memory.dmp

Download

memory/5764-129-0x00007FF6AEC40000-0x00007FF6AEF92000-memory.dmp

Download

memory/5856-161-0x00007FF6F3BF0000-0x00007FF6F3F42000-memory.dmp

Download

memory/5856-81-0x00007FF6F3BF0000-0x00007FF6F3F42000-memory.dmp

Download

memory/5856-140-0x00007FF6F3BF0000-0x00007FF6F3F42000-memory.dmp

Download

memory/6052-18-0x00007FF782AE0000-0x00007FF782E32000-memory.dmp

Download

memory/6052-80-0x00007FF782AE0000-0x00007FF782E32000-memory.dmp

Download

memory/6052-151-0x00007FF782AE0000-0x00007FF782E32000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads