cobaltstrike | f96984529e3789b029d8c3b4f3adc158cdec0ef5d0bbac1130e383a070c4935c

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 05:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample261027-gbf8jscg55
SHA256 f96984529e3789b029d8c3b4f3adc158cdec0ef5d0bbac1130e383a070c4935c
MD5 d723d7c594443fc9b8dcf10eca0e2f82
SHA1 8f1492855c314e87d36981d55f202d897b5e1b83
SHA512 efcc16e6790d712bc2a2bd98272bb2f3c52482049aca14e190f8420ed200c554241fb048c53801b03e30fe0da5edf8b1a878d8e546e365bec482793c05288dd2
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUL:v+D56utgpPF8u/7L
TLSH
T100965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000d00000001c5d9-5.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5de-9.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5da-17.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5df-23.dat	cobalt_reflective_dll
behavioral2/files/0x0003000000000439-27.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e1-33.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e2-38.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e3-42.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e4-48.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e5-54.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e6-58.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e7-64.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e8-69.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e9-74.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5eb-83.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ec-88.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ed-93.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5f0-103.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5f1-108.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ee-99.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ea-79.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c5d9-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5de-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5da-17.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5df-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0003000000000439-27.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e1-33.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e2-38.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e3-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e4-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e5-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e6-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e7-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e8-69.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e9-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5eb-83.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ec-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ed-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5f0-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5f1-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ee-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ea-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4868-0-0x00007FF622380000-0x00007FF6226D2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5d9-5.dat	UPX
behavioral2/memory/5972-6-0x00007FF7E8F60000-0x00007FF7E92B2000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5de-9.dat	UPX
behavioral2/memory/3132-12-0x00007FF74F120000-0x00007FF74F472000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5da-17.dat	UPX
behavioral2/memory/2944-18-0x00007FF6637E0000-0x00007FF663B32000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5df-23.dat	UPX
behavioral2/files/0x0003000000000439-27.dat	UPX
behavioral2/files/0x000c00000001c5e1-33.dat	UPX
behavioral2/files/0x000c00000001c5e2-38.dat	UPX
behavioral2/files/0x000c00000001c5e3-42.dat	UPX
behavioral2/files/0x000c00000001c5e4-48.dat	UPX
behavioral2/files/0x000c00000001c5e5-54.dat	UPX
behavioral2/files/0x000c00000001c5e6-58.dat	UPX
behavioral2/files/0x000c00000001c5e7-64.dat	UPX
behavioral2/files/0x000c00000001c5e8-69.dat	UPX
behavioral2/files/0x000c00000001c5e9-74.dat	UPX
behavioral2/files/0x000c00000001c5eb-83.dat	UPX
behavioral2/files/0x000c00000001c5ec-88.dat	UPX
behavioral2/files/0x000c00000001c5ed-93.dat	UPX
behavioral2/files/0x000c00000001c5f0-103.dat	UPX
behavioral2/files/0x000c00000001c5f1-108.dat	UPX
behavioral2/files/0x000c00000001c5ee-99.dat	UPX
behavioral2/files/0x000c00000001c5ea-79.dat	UPX
behavioral2/memory/1232-110-0x00007FF726E20000-0x00007FF727172000-memory.dmp	UPX
behavioral2/memory/5804-111-0x00007FF69CEB0000-0x00007FF69D202000-memory.dmp	UPX
behavioral2/memory/4520-112-0x00007FF7A2AD0000-0x00007FF7A2E22000-memory.dmp	UPX
behavioral2/memory/720-113-0x00007FF6C7EB0000-0x00007FF6C8202000-memory.dmp	UPX
behavioral2/memory/5288-114-0x00007FF69B480000-0x00007FF69B7D2000-memory.dmp	UPX
behavioral2/memory/4672-115-0x00007FF7E0CA0000-0x00007FF7E0FF2000-memory.dmp	UPX
behavioral2/memory/4724-116-0x00007FF7E0DF0000-0x00007FF7E1142000-memory.dmp	UPX
behavioral2/memory/4296-117-0x00007FF71E370000-0x00007FF71E6C2000-memory.dmp	UPX
behavioral2/memory/1140-119-0x00007FF74F840000-0x00007FF74FB92000-memory.dmp	UPX
behavioral2/memory/1280-120-0x00007FF6FA490000-0x00007FF6FA7E2000-memory.dmp	UPX
behavioral2/memory/2160-121-0x00007FF634BC0000-0x00007FF634F12000-memory.dmp	UPX
behavioral2/memory/944-118-0x00007FF6F3500000-0x00007FF6F3852000-memory.dmp	UPX
behavioral2/memory/1872-122-0x00007FF6C09D0000-0x00007FF6C0D22000-memory.dmp	UPX
behavioral2/memory/5960-123-0x00007FF76D2F0000-0x00007FF76D642000-memory.dmp	UPX
behavioral2/memory/5312-124-0x00007FF63CAA0000-0x00007FF63CDF2000-memory.dmp	UPX
behavioral2/memory/3912-125-0x00007FF778A20000-0x00007FF778D72000-memory.dmp	UPX
behavioral2/memory/4844-127-0x00007FF7C4EA0000-0x00007FF7C51F2000-memory.dmp	UPX
behavioral2/memory/6084-126-0x00007FF7908F0000-0x00007FF790C42000-memory.dmp	UPX
behavioral2/memory/4868-128-0x00007FF622380000-0x00007FF6226D2000-memory.dmp	UPX
behavioral2/memory/5972-129-0x00007FF7E8F60000-0x00007FF7E92B2000-memory.dmp	UPX
behavioral2/memory/3132-130-0x00007FF74F120000-0x00007FF74F472000-memory.dmp	UPX
behavioral2/memory/2944-131-0x00007FF6637E0000-0x00007FF663B32000-memory.dmp	UPX
behavioral2/memory/1232-132-0x00007FF726E20000-0x00007FF727172000-memory.dmp	UPX
behavioral2/memory/5972-133-0x00007FF7E8F60000-0x00007FF7E92B2000-memory.dmp	UPX
behavioral2/memory/3132-134-0x00007FF74F120000-0x00007FF74F472000-memory.dmp	UPX
behavioral2/memory/2944-135-0x00007FF6637E0000-0x00007FF663B32000-memory.dmp	UPX
behavioral2/memory/1232-136-0x00007FF726E20000-0x00007FF727172000-memory.dmp	UPX
behavioral2/memory/4844-137-0x00007FF7C4EA0000-0x00007FF7C51F2000-memory.dmp	UPX
behavioral2/memory/4520-138-0x00007FF7A2AD0000-0x00007FF7A2E22000-memory.dmp	UPX
behavioral2/memory/720-140-0x00007FF6C7EB0000-0x00007FF6C8202000-memory.dmp	UPX
behavioral2/memory/5288-141-0x00007FF69B480000-0x00007FF69B7D2000-memory.dmp	UPX
behavioral2/memory/5804-139-0x00007FF69CEB0000-0x00007FF69D202000-memory.dmp	UPX
behavioral2/memory/4296-142-0x00007FF71E370000-0x00007FF71E6C2000-memory.dmp	UPX
behavioral2/memory/4672-145-0x00007FF7E0CA0000-0x00007FF7E0FF2000-memory.dmp	UPX
behavioral2/memory/4724-144-0x00007FF7E0DF0000-0x00007FF7E1142000-memory.dmp	UPX
behavioral2/memory/944-143-0x00007FF6F3500000-0x00007FF6F3852000-memory.dmp	UPX
behavioral2/memory/1140-146-0x00007FF74F840000-0x00007FF74FB92000-memory.dmp	UPX
behavioral2/memory/6084-150-0x00007FF7908F0000-0x00007FF790C42000-memory.dmp	UPX
behavioral2/memory/5960-152-0x00007FF76D2F0000-0x00007FF76D642000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4868-0-0x00007FF622380000-0x00007FF6226D2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5d9-5.dat	xmrig
behavioral2/memory/5972-6-0x00007FF7E8F60000-0x00007FF7E92B2000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5de-9.dat	xmrig
behavioral2/memory/3132-12-0x00007FF74F120000-0x00007FF74F472000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5da-17.dat	xmrig
behavioral2/memory/2944-18-0x00007FF6637E0000-0x00007FF663B32000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5df-23.dat	xmrig
behavioral2/files/0x0003000000000439-27.dat	xmrig
behavioral2/files/0x000c00000001c5e1-33.dat	xmrig
behavioral2/files/0x000c00000001c5e2-38.dat	xmrig
behavioral2/files/0x000c00000001c5e3-42.dat	xmrig
behavioral2/files/0x000c00000001c5e4-48.dat	xmrig
behavioral2/files/0x000c00000001c5e5-54.dat	xmrig
behavioral2/files/0x000c00000001c5e6-58.dat	xmrig
behavioral2/files/0x000c00000001c5e7-64.dat	xmrig
behavioral2/files/0x000c00000001c5e8-69.dat	xmrig
behavioral2/files/0x000c00000001c5e9-74.dat	xmrig
behavioral2/files/0x000c00000001c5eb-83.dat	xmrig
behavioral2/files/0x000c00000001c5ec-88.dat	xmrig
behavioral2/files/0x000c00000001c5ed-93.dat	xmrig
behavioral2/files/0x000c00000001c5f0-103.dat	xmrig
behavioral2/files/0x000c00000001c5f1-108.dat	xmrig
behavioral2/files/0x000c00000001c5ee-99.dat	xmrig
behavioral2/files/0x000c00000001c5ea-79.dat	xmrig
behavioral2/memory/1232-110-0x00007FF726E20000-0x00007FF727172000-memory.dmp	xmrig
behavioral2/memory/5804-111-0x00007FF69CEB0000-0x00007FF69D202000-memory.dmp	xmrig
behavioral2/memory/4520-112-0x00007FF7A2AD0000-0x00007FF7A2E22000-memory.dmp	xmrig
behavioral2/memory/720-113-0x00007FF6C7EB0000-0x00007FF6C8202000-memory.dmp	xmrig
behavioral2/memory/5288-114-0x00007FF69B480000-0x00007FF69B7D2000-memory.dmp	xmrig
behavioral2/memory/4672-115-0x00007FF7E0CA0000-0x00007FF7E0FF2000-memory.dmp	xmrig
behavioral2/memory/4724-116-0x00007FF7E0DF0000-0x00007FF7E1142000-memory.dmp	xmrig
behavioral2/memory/4296-117-0x00007FF71E370000-0x00007FF71E6C2000-memory.dmp	xmrig
behavioral2/memory/1140-119-0x00007FF74F840000-0x00007FF74FB92000-memory.dmp	xmrig
behavioral2/memory/1280-120-0x00007FF6FA490000-0x00007FF6FA7E2000-memory.dmp	xmrig
behavioral2/memory/2160-121-0x00007FF634BC0000-0x00007FF634F12000-memory.dmp	xmrig
behavioral2/memory/944-118-0x00007FF6F3500000-0x00007FF6F3852000-memory.dmp	xmrig
behavioral2/memory/1872-122-0x00007FF6C09D0000-0x00007FF6C0D22000-memory.dmp	xmrig
behavioral2/memory/5960-123-0x00007FF76D2F0000-0x00007FF76D642000-memory.dmp	xmrig
behavioral2/memory/5312-124-0x00007FF63CAA0000-0x00007FF63CDF2000-memory.dmp	xmrig
behavioral2/memory/3912-125-0x00007FF778A20000-0x00007FF778D72000-memory.dmp	xmrig
behavioral2/memory/4844-127-0x00007FF7C4EA0000-0x00007FF7C51F2000-memory.dmp	xmrig
behavioral2/memory/6084-126-0x00007FF7908F0000-0x00007FF790C42000-memory.dmp	xmrig
behavioral2/memory/4868-128-0x00007FF622380000-0x00007FF6226D2000-memory.dmp	xmrig
behavioral2/memory/5972-129-0x00007FF7E8F60000-0x00007FF7E92B2000-memory.dmp	xmrig
behavioral2/memory/3132-130-0x00007FF74F120000-0x00007FF74F472000-memory.dmp	xmrig
behavioral2/memory/2944-131-0x00007FF6637E0000-0x00007FF663B32000-memory.dmp	xmrig
behavioral2/memory/1232-132-0x00007FF726E20000-0x00007FF727172000-memory.dmp	xmrig
behavioral2/memory/5972-133-0x00007FF7E8F60000-0x00007FF7E92B2000-memory.dmp	xmrig
behavioral2/memory/3132-134-0x00007FF74F120000-0x00007FF74F472000-memory.dmp	xmrig
behavioral2/memory/2944-135-0x00007FF6637E0000-0x00007FF663B32000-memory.dmp	xmrig
behavioral2/memory/1232-136-0x00007FF726E20000-0x00007FF727172000-memory.dmp	xmrig
behavioral2/memory/4844-137-0x00007FF7C4EA0000-0x00007FF7C51F2000-memory.dmp	xmrig
behavioral2/memory/4520-138-0x00007FF7A2AD0000-0x00007FF7A2E22000-memory.dmp	xmrig
behavioral2/memory/720-140-0x00007FF6C7EB0000-0x00007FF6C8202000-memory.dmp	xmrig
behavioral2/memory/5288-141-0x00007FF69B480000-0x00007FF69B7D2000-memory.dmp	xmrig
behavioral2/memory/5804-139-0x00007FF69CEB0000-0x00007FF69D202000-memory.dmp	xmrig
behavioral2/memory/4296-142-0x00007FF71E370000-0x00007FF71E6C2000-memory.dmp	xmrig
behavioral2/memory/4672-145-0x00007FF7E0CA0000-0x00007FF7E0FF2000-memory.dmp	xmrig
behavioral2/memory/4724-144-0x00007FF7E0DF0000-0x00007FF7E1142000-memory.dmp	xmrig
behavioral2/memory/944-143-0x00007FF6F3500000-0x00007FF6F3852000-memory.dmp	xmrig
behavioral2/memory/1140-146-0x00007FF74F840000-0x00007FF74FB92000-memory.dmp	xmrig
behavioral2/memory/6084-150-0x00007FF7908F0000-0x00007FF790C42000-memory.dmp	xmrig
behavioral2/memory/5960-152-0x00007FF76D2F0000-0x00007FF76D642000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
5972	wrTVIBU.exe
3132	oFHOZVi.exe
2944	UycgJPP.exe
1232	yhWAEuA.exe
4844	AoHGHye.exe
5804	jjCkNUu.exe
4520	jnHigrM.exe
720	xseupBZ.exe
5288	CUvvuOu.exe
4672	riAPgLp.exe
4724	xMXLwRn.exe
4296	hGzuhNS.exe
944	jhjvCMK.exe
1140	QoErvRr.exe
1280	ozcABNN.exe
2160	vZetvWz.exe
1872	mOlneOh.exe
5960	EeZrDEM.exe
5312	gnTwVld.exe
3912	ZQERfcx.exe
6084	jnJGSwk.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4868-0-0x00007FF622380000-0x00007FF6226D2000-memory.dmp	upx
behavioral2/files/0x000d00000001c5d9-5.dat	upx
behavioral2/memory/5972-6-0x00007FF7E8F60000-0x00007FF7E92B2000-memory.dmp	upx
behavioral2/files/0x000c00000001c5de-9.dat	upx
behavioral2/memory/3132-12-0x00007FF74F120000-0x00007FF74F472000-memory.dmp	upx
behavioral2/files/0x000d00000001c5da-17.dat	upx
behavioral2/memory/2944-18-0x00007FF6637E0000-0x00007FF663B32000-memory.dmp	upx
behavioral2/files/0x000c00000001c5df-23.dat	upx
behavioral2/files/0x0003000000000439-27.dat	upx
behavioral2/files/0x000c00000001c5e1-33.dat	upx
behavioral2/files/0x000c00000001c5e2-38.dat	upx
behavioral2/files/0x000c00000001c5e3-42.dat	upx
behavioral2/files/0x000c00000001c5e4-48.dat	upx
behavioral2/files/0x000c00000001c5e5-54.dat	upx
behavioral2/files/0x000c00000001c5e6-58.dat	upx
behavioral2/files/0x000c00000001c5e7-64.dat	upx
behavioral2/files/0x000c00000001c5e8-69.dat	upx
behavioral2/files/0x000c00000001c5e9-74.dat	upx
behavioral2/files/0x000c00000001c5eb-83.dat	upx
behavioral2/files/0x000c00000001c5ec-88.dat	upx
behavioral2/files/0x000c00000001c5ed-93.dat	upx
behavioral2/files/0x000c00000001c5f0-103.dat	upx
behavioral2/files/0x000c00000001c5f1-108.dat	upx
behavioral2/files/0x000c00000001c5ee-99.dat	upx
behavioral2/files/0x000c00000001c5ea-79.dat	upx
behavioral2/memory/1232-110-0x00007FF726E20000-0x00007FF727172000-memory.dmp	upx
behavioral2/memory/5804-111-0x00007FF69CEB0000-0x00007FF69D202000-memory.dmp	upx
behavioral2/memory/4520-112-0x00007FF7A2AD0000-0x00007FF7A2E22000-memory.dmp	upx
behavioral2/memory/720-113-0x00007FF6C7EB0000-0x00007FF6C8202000-memory.dmp	upx
behavioral2/memory/5288-114-0x00007FF69B480000-0x00007FF69B7D2000-memory.dmp	upx
behavioral2/memory/4672-115-0x00007FF7E0CA0000-0x00007FF7E0FF2000-memory.dmp	upx
behavioral2/memory/4724-116-0x00007FF7E0DF0000-0x00007FF7E1142000-memory.dmp	upx
behavioral2/memory/4296-117-0x00007FF71E370000-0x00007FF71E6C2000-memory.dmp	upx
behavioral2/memory/1140-119-0x00007FF74F840000-0x00007FF74FB92000-memory.dmp	upx
behavioral2/memory/1280-120-0x00007FF6FA490000-0x00007FF6FA7E2000-memory.dmp	upx
behavioral2/memory/2160-121-0x00007FF634BC0000-0x00007FF634F12000-memory.dmp	upx
behavioral2/memory/944-118-0x00007FF6F3500000-0x00007FF6F3852000-memory.dmp	upx
behavioral2/memory/1872-122-0x00007FF6C09D0000-0x00007FF6C0D22000-memory.dmp	upx
behavioral2/memory/5960-123-0x00007FF76D2F0000-0x00007FF76D642000-memory.dmp	upx
behavioral2/memory/5312-124-0x00007FF63CAA0000-0x00007FF63CDF2000-memory.dmp	upx
behavioral2/memory/3912-125-0x00007FF778A20000-0x00007FF778D72000-memory.dmp	upx
behavioral2/memory/4844-127-0x00007FF7C4EA0000-0x00007FF7C51F2000-memory.dmp	upx
behavioral2/memory/6084-126-0x00007FF7908F0000-0x00007FF790C42000-memory.dmp	upx
behavioral2/memory/4868-128-0x00007FF622380000-0x00007FF6226D2000-memory.dmp	upx
behavioral2/memory/5972-129-0x00007FF7E8F60000-0x00007FF7E92B2000-memory.dmp	upx
behavioral2/memory/3132-130-0x00007FF74F120000-0x00007FF74F472000-memory.dmp	upx
behavioral2/memory/2944-131-0x00007FF6637E0000-0x00007FF663B32000-memory.dmp	upx
behavioral2/memory/1232-132-0x00007FF726E20000-0x00007FF727172000-memory.dmp	upx
behavioral2/memory/5972-133-0x00007FF7E8F60000-0x00007FF7E92B2000-memory.dmp	upx
behavioral2/memory/3132-134-0x00007FF74F120000-0x00007FF74F472000-memory.dmp	upx
behavioral2/memory/2944-135-0x00007FF6637E0000-0x00007FF663B32000-memory.dmp	upx
behavioral2/memory/1232-136-0x00007FF726E20000-0x00007FF727172000-memory.dmp	upx
behavioral2/memory/4844-137-0x00007FF7C4EA0000-0x00007FF7C51F2000-memory.dmp	upx
behavioral2/memory/4520-138-0x00007FF7A2AD0000-0x00007FF7A2E22000-memory.dmp	upx
behavioral2/memory/720-140-0x00007FF6C7EB0000-0x00007FF6C8202000-memory.dmp	upx
behavioral2/memory/5288-141-0x00007FF69B480000-0x00007FF69B7D2000-memory.dmp	upx
behavioral2/memory/5804-139-0x00007FF69CEB0000-0x00007FF69D202000-memory.dmp	upx
behavioral2/memory/4296-142-0x00007FF71E370000-0x00007FF71E6C2000-memory.dmp	upx
behavioral2/memory/4672-145-0x00007FF7E0CA0000-0x00007FF7E0FF2000-memory.dmp	upx
behavioral2/memory/4724-144-0x00007FF7E0DF0000-0x00007FF7E1142000-memory.dmp	upx
behavioral2/memory/944-143-0x00007FF6F3500000-0x00007FF6F3852000-memory.dmp	upx
behavioral2/memory/1140-146-0x00007FF74F840000-0x00007FF74FB92000-memory.dmp	upx
behavioral2/memory/6084-150-0x00007FF7908F0000-0x00007FF790C42000-memory.dmp	upx
behavioral2/memory/5960-152-0x00007FF76D2F0000-0x00007FF76D642000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\wrTVIBU.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\yhWAEuA.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\AoHGHye.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\CUvvuOu.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\xMXLwRn.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\mOlneOh.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\oFHOZVi.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\jjCkNUu.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\jnHigrM.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\riAPgLp.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\hGzuhNS.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ozcABNN.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\UycgJPP.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\EeZrDEM.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\gnTwVld.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\xseupBZ.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\jhjvCMK.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\QoErvRr.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\vZetvWz.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ZQERfcx.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\jnJGSwk.exe	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 5972	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 4868 wrote to memory of 3132	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 4868 wrote to memory of 2944	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 4868 wrote to memory of 1232	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 4868 wrote to memory of 4844	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 4868 wrote to memory of 5804	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 4868 wrote to memory of 4520	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 4868 wrote to memory of 720	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 4868 wrote to memory of 5288	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 4868 wrote to memory of 4672	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 4868 wrote to memory of 4724	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 4868 wrote to memory of 4296	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 4868 wrote to memory of 944	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 4868 wrote to memory of 1140	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 4868 wrote to memory of 1280	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 4868 wrote to memory of 2160	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 4868 wrote to memory of 1872	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 4868 wrote to memory of 5960	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 4868 wrote to memory of 5312	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 4868 wrote to memory of 3912	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109
PID 4868 wrote to memory of 6084	4868	2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_d723d7c594443fc9b8dcf10eca0e2f82_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\System\wrTVIBU.exe
  C:\Windows\System\wrTVIBU.exe
  2⤵
  - Executes dropped EXE
  PID:5972
- C:\Windows\System\oFHOZVi.exe
  C:\Windows\System\oFHOZVi.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\UycgJPP.exe
  C:\Windows\System\UycgJPP.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\yhWAEuA.exe
  C:\Windows\System\yhWAEuA.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\AoHGHye.exe
  C:\Windows\System\AoHGHye.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\jjCkNUu.exe
  C:\Windows\System\jjCkNUu.exe
  2⤵
  - Executes dropped EXE
  PID:5804
- C:\Windows\System\jnHigrM.exe
  C:\Windows\System\jnHigrM.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\xseupBZ.exe
  C:\Windows\System\xseupBZ.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\CUvvuOu.exe
  C:\Windows\System\CUvvuOu.exe
  2⤵
  - Executes dropped EXE
  PID:5288
- C:\Windows\System\riAPgLp.exe
  C:\Windows\System\riAPgLp.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\xMXLwRn.exe
  C:\Windows\System\xMXLwRn.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\hGzuhNS.exe
  C:\Windows\System\hGzuhNS.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\jhjvCMK.exe
  C:\Windows\System\jhjvCMK.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\QoErvRr.exe
  C:\Windows\System\QoErvRr.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\ozcABNN.exe
  C:\Windows\System\ozcABNN.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\vZetvWz.exe
  C:\Windows\System\vZetvWz.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\mOlneOh.exe
  C:\Windows\System\mOlneOh.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\EeZrDEM.exe
  C:\Windows\System\EeZrDEM.exe
  2⤵
  - Executes dropped EXE
  PID:5960
- C:\Windows\System\gnTwVld.exe
  C:\Windows\System\gnTwVld.exe
  2⤵
  - Executes dropped EXE
  PID:5312
- C:\Windows\System\ZQERfcx.exe
  C:\Windows\System\ZQERfcx.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\jnJGSwk.exe
  C:\Windows\System\jnJGSwk.exe
  2⤵
  - Executes dropped EXE
  PID:6084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AoHGHye.exe

Path C:\Windows\System\AoHGHye.exe
Size 8.3MB
SHA256 27dfe270bff992335cab56996162907cd372319aa3ca9aa164ea092278f24c79
MD5 110a9cc4f8f58b6087f0ddbc41928d16
SHA1 a2f39b84a68bd3b98037b238ea1cad032e02b22c
SHA512 41d7172765a1bc148274e76e7bed923735418f031ae226e9c5e99676be262e852e12f0a9accf108f9e7012b89718b62e8ed7647cc1342e7fec152a28d3f88f9a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUd:v+D56utgpPF8u/7d
TLSH
T122965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CUvvuOu.exe

Path C:\Windows\System\CUvvuOu.exe
Size 8.3MB
SHA256 258d05624431ecad02b3e7969ca013e7e8f23a5462c0a2a49808636e43d364d6
MD5 149d4b1964964633fd28b27aad7bd4ce
SHA1 0d5f215405f766a87fdc19b5cab96da6d0f1feb5
SHA512 d3de94e721289cf6a8299b219d6688d9ac540eae44829c92ef2d9306bab8a97ecae72696721b6ee70f25ca800c8fa0a8c433caaac8a63bb5da19ec2ff885429e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUb:v+D56utgpPF8u/7b
TLSH
T17E965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EeZrDEM.exe

Path C:\Windows\System\EeZrDEM.exe
Size 8.3MB
SHA256 dd463447a373fc5dec3016cb96cd519655ba4d4b8249368d90c86b69728c957e
MD5 e1ba51d33d4257e84f7237bc945fcdea
SHA1 cb3b581d8ab32b87170eb1d7c86ba489a55a635c
SHA512 4e0fe09f976397b4b8639c729a7bfd792c98b7f731529f0cfd83c40c3102d01882175d0686cf614183f750e63519d46db49a1ac88d6662e41b4b2980798711c7
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUR:v+D56utgpPF8u/7R
TLSH
T11D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QoErvRr.exe

Path C:\Windows\System\QoErvRr.exe
Size 8.3MB
SHA256 3d397377f96b68415f5357f11842b66029f167685135dc31290d27513f2e1da0
MD5 dd666e21f60eba9d4c6b0b49acfc4853
SHA1 6d543a40f89f75735c13c08f8db3d84eab7fe073
SHA512 25d5d8826d310a21b8174cdd9cb9e5026aea3406627841a1e3839a992715899b4782ca8b7b76858692f7101a02736d1f59fb32edcf934b3da159812a098fd7c5
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU3:v+D56utgpPF8u/73
TLSH
T126965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UycgJPP.exe

Path C:\Windows\System\UycgJPP.exe
Size 8.3MB
SHA256 c6ce333249a6681d310afe0db0421181634b834a81a3531d0e01173f89fcf9eb
MD5 1e4ec733a5f0a6b44303abc2525686df
SHA1 ee1f013d3f4b7f51a48385f0e9544243c4457c89
SHA512 10113c913b8b39a810b68147af8439b1df19639c9a576081a1d069d7d9b3deb2f5b0535a650131434591e82d6f144956ea35c5ea5bea5862a538d771e423dd6e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUU:v+D56utgpPF8u/7U
TLSH
T1A4965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZQERfcx.exe

Path C:\Windows\System\ZQERfcx.exe
Size 8.3MB
SHA256 fcf40076a8df2e028697fb16645de2acf369b466bfb9d48d7be4b78cd251b528
MD5 3c7fc626843677a434937a253dd85798
SHA1 fe451d039017831008b868df1674c5c1816722f7
SHA512 d5668a8d54c2696782ab592a412b9e83b2d1d718e56a5997dfa10fa04639d12165674388baedddea3da1b36b81d636a9ab5856e20caf6abab2dcedd56fade409
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUo:v+D56utgpPF8u/7o
TLSH
T105965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gnTwVld.exe

Path C:\Windows\System\gnTwVld.exe
Size 8.3MB
SHA256 bae15d383b48be31913095b61f7ff2d7c2f29fe5ea865c9cc0fe393607930ab6
MD5 21407da1c32a17ceb95f9309539d4d5a
SHA1 d275343266893e44f903c9bee46c7467c980d9b6
SHA512 9ec990f314abd98fae2da9e57dac25a3bf55cc979201a53b52d4593fd2773f778f6dd97f7e933da0b7036674bdabfcc240309b2a20f4bd0df77d15799a08b2c2
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUr:v+D56utgpPF8u/7r
TLSH
T1F5965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hGzuhNS.exe

Path C:\Windows\System\hGzuhNS.exe
Size 8.3MB
SHA256 27cdee849c6c3ebe3d94d8eaa7757c2f1ec29b2be9232d7e52314b30a2bc029a
MD5 734601450fa80b6dcbd294459d63cdd6
SHA1 1d1aad4e3ca1db1b4f75d0f931923ba79f4fcad9
SHA512 7aa6cd9eca59a9b1697b0c376e8f940b8bd1af184c492d863ee19e5bcf2ced79ef187f64eb3f5f3edef4b6c9014d43b4576d7b1679b974fb9113d7857dca6fe6
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUz:v+D56utgpPF8u/7z
TLSH
T1D0965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhjvCMK.exe

Path C:\Windows\System\jhjvCMK.exe
Size 8.3MB
SHA256 145908b8a35d6ce3e9ef517e6d7ffe4f2e6b1f5d6f55a3713ed4f442ee83040c
MD5 df8d004d0f73480adc12fe5b4d955841
SHA1 4d9074a31cd37732babd06511786ceff7003ea8e
SHA512 f55a3cbe8bc1c7588de32c7442cb2d2b58aa23497feab8ae60a1b12493175d743dd067437d9b01bcbe94c8f2f0ec29e130c933adc648317cf89dc9dd3c535867
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUk:v+D56utgpPF8u/7k
TLSH
T164965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjCkNUu.exe

Path C:\Windows\System\jjCkNUu.exe
Size 8.3MB
SHA256 4d93384e31fd7bde8712c5ec38e193ca55586e2c5aa31c91e37a6940cf315973
MD5 2c6a88a055d9943af561161ca33bb6d8
SHA1 35099c5923bbc92b923a2174330a64e3c1b42121
SHA512 a38f395cf64a857e4887bec20197e665e6bca1a38025da2cf1a0a0ca9ae05611ddcf75f46fe481e3c3aedcee65d121169879ae4a254a2a3371f8c66c0f228043
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU/:v+D56utgpPF8u/7/
TLSH
T16A965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jnHigrM.exe

Path C:\Windows\System\jnHigrM.exe
Size 8.3MB
SHA256 86bc618d7f7df0267b8e6b1a206eaac1502b2d6fef228fd5ed10dafa26a23ded
MD5 6c33ec35fa7314de5c34732b32c95e0a
SHA1 9c2949c8a505b86b2a70bd47e12053dac9d55cbb
SHA512 f1ec34453ede0b54a66649943f78aefd6771c71c3e2da4244addab726e85fcccaee2aa6d4311aa2165957bf1885a8e34acf8abc73f6129323c93d1a5553cb7d0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUY:v+D56utgpPF8u/7Y
TLSH
T1DB965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jnJGSwk.exe

Path C:\Windows\System\jnJGSwk.exe
Size 8.3MB
SHA256 6f0816fd8e91c56caf633819b5658aabccc80f775c77ff4968f65a50d148409e
MD5 855da814d9057f545ac0bb2e7edde166
SHA1 537226de61a3e706e63e1b04f5f86bc991136f29
SHA512 7118c2c86fd40307ae37b2d8a42a39e59ed645d7b4c6a999356f499673b69b6bd201de6069cf1701a6fe973913e2d39addb9f82bad3ba858c13bfb7b112d7f77
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUR:v+D56utgpPF8u/7R
TLSH
T1FC965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mOlneOh.exe

Path C:\Windows\System\mOlneOh.exe
Size 8.3MB
SHA256 dda51fa14078778651c8cd902a3f0854094be5bad26b0ed88aefde670361038e
MD5 403b3c2661ec3afdbfbb9bfc57d38df6
SHA1 e37406e562157f78b412a89d2aa10d363bdaa75a
SHA512 1d46e1b339b757e465e7af293649eaf0543c47b25413930d5a22b4c0b7cbdb8a5cb348b1a193de3a919f31b05d45a272a0d8e9331495ba8045434320752fea7f
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU5:v+D56utgpPF8u/75
TLSH
T17F965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oFHOZVi.exe

Path C:\Windows\System\oFHOZVi.exe
Size 8.3MB
SHA256 9bf1e0f934991c49f2145569f617b05538ae59c6919ad4bb0d31e66e84a33376
MD5 c724ff450d668c1429917e6b1f0ba34d
SHA1 a20707c0b4dd08e3a9c00b21b21c35d425932728
SHA512 0907f059a2bfcc766ea74b68ebd21099f6fd52282b738c37d4aa596c4605ed76d74542ba5af4feb04337f6a8d3792880dfe2922f211f4b6534c622beb47fad5a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUf:v+D56utgpPF8u/7f
TLSH
T104965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ozcABNN.exe

Path C:\Windows\System\ozcABNN.exe
Size 8.3MB
SHA256 c9c18f163514ef318b4e97e7199fd03f8725d489a90fa085a2140659dc80ad02
MD5 f856117345f4722ce08d964f7aa033ff
SHA1 594de52dc780de12f14116c3fe2710384b10be30
SHA512 3e72991c481a69cae330d43370cc8e4e9b14f144563ffb6f4ccd221e83a338e59f3baa1e926d39152da8131546997e89a010680e8e6f4136d1aabec485be3f36
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUj:v+D56utgpPF8u/7j
TLSH
T1BE965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

riAPgLp.exe

Path C:\Windows\System\riAPgLp.exe
Size 8.3MB
SHA256 bf1239a432dbde50ad5bb4363239eb72b5927320fb003696dc7db503ee1fb24d
MD5 b06fc2a8497569382138f4653204f26a
SHA1 a562f92f9cc5cd215ab8f8ff380976fa28db121e
SHA512 2b7dac7a5403c1a7cb53980e1579dd8cf3dd4d0910df81c343f1bdf5915a1256baa5589b21958eb0646e09c014dcc69791c17c2b617bae3242fe8be344ceb05f
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUE:v+D56utgpPF8u/7E
TLSH
T191965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vZetvWz.exe

Path C:\Windows\System\vZetvWz.exe
Size 8.3MB
SHA256 e29900ee56f55026d7e2d20744d9ac6fb7d5c5755e0cb263b8d735bbabbae330
MD5 eb7de7c6b240981217658b34e870a014
SHA1 8f60b0569af4bf6f74bc26b10d989b2dc0ddfd48
SHA512 78766f5a26976d287965c4096ab43527950ea95fa6e7e7a13580168314e687ac69fa489fc7a2a473b4798f247ebd0d4aed024601b7ef278fe65b3b1e196f8136
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUc:v+D56utgpPF8u/7c
TLSH
T141965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrTVIBU.exe

Path C:\Windows\System\wrTVIBU.exe
Size 8.3MB
SHA256 81aab8ff693150e7cdb92e6fb7c43300cca7ffea61aa64deddced1b5c1632fd4
MD5 85437a1cbc3da46b0051c57d580f2d3e
SHA1 81457c6a38cb8d1e69672c424c680beea6a94423
SHA512 e6b9f83f32aefdf911843bb6ce85e2191fca3da984b07e4b3abd0610662409d0a3eb16788297e120cbddbeef3bc6743b9fe91423c4d5cdd7005a2137d482b9cc
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUJ:v+D56utgpPF8u/7J
TLSH
T1AA965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xMXLwRn.exe

Path C:\Windows\System\xMXLwRn.exe
Size 8.3MB
SHA256 e85e64667c323aa214e7757c4488fefdb8cb0f099537788de0fd9b54cc380a09
MD5 9b3cb941b83eca2b9db827210bdfe9ef
SHA1 b781f3fce18b178ee262f423c0ed922da61d7f02
SHA512 b8cc9484a487216c50b1398881218938ef05b1bb91ee09eaa32d874ad232030c6482cc4cfd85746ff498e312d0c52c858ebb13c11ac730c1eee7e433642b097b
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU1:v+D56utgpPF8u/71
TLSH
T131965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xseupBZ.exe

Path C:\Windows\System\xseupBZ.exe
Size 8.3MB
SHA256 9efe17549afb919f055e5ca69191f47ec319fb72a28ab8971da5217580828d9b
MD5 b7aee6492b64161eced81d46ef6e8b71
SHA1 1a456144c1e15e14173a2e6f15e34d5cacb9caf3
SHA512 1aaece667ade80127b89cbe0d91b7b6613e2b0fd57b5154f83b6afc298036ed58ade560c08f8e13e437275f97c5a9a72ac0ba834818f32427d7759f73ebc06f0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUn:v+D56utgpPF8u/7n
TLSH
T1A6965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yhWAEuA.exe

Path C:\Windows\System\yhWAEuA.exe
Size 8.3MB
SHA256 1c3ffed70fd7c8046b5dbddddc285b5c8037f11e7344c8f89673000b4ad75242
MD5 db43ee592b478f7d17d5de2651a18754
SHA1 66e644cdca173f5e20519ecc24b53726d3ace6b6
SHA512 aa8da4ad5021d9db1bad114721a2a63d1a34555d5bef1f4791bd7cb3c67093a9fdd51a8dcfa12a816f58c00fd6d2d5ba1b9311fab0306f73f949aaaada20e6cf
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUE:v+D56utgpPF8u/7E
TLSH
T1A4965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/720-140-0x00007FF6C7EB0000-0x00007FF6C8202000-memory.dmp

Download

memory/720-113-0x00007FF6C7EB0000-0x00007FF6C8202000-memory.dmp

Download

memory/944-143-0x00007FF6F3500000-0x00007FF6F3852000-memory.dmp

Download

memory/944-118-0x00007FF6F3500000-0x00007FF6F3852000-memory.dmp

Download

memory/1140-119-0x00007FF74F840000-0x00007FF74FB92000-memory.dmp

Download

memory/1140-146-0x00007FF74F840000-0x00007FF74FB92000-memory.dmp

Download

memory/1232-136-0x00007FF726E20000-0x00007FF727172000-memory.dmp

Download

memory/1232-110-0x00007FF726E20000-0x00007FF727172000-memory.dmp

Download

memory/1232-132-0x00007FF726E20000-0x00007FF727172000-memory.dmp

Download

memory/1280-120-0x00007FF6FA490000-0x00007FF6FA7E2000-memory.dmp

Download

memory/1280-149-0x00007FF6FA490000-0x00007FF6FA7E2000-memory.dmp

Download

memory/1872-122-0x00007FF6C09D0000-0x00007FF6C0D22000-memory.dmp

Download

memory/1872-148-0x00007FF6C09D0000-0x00007FF6C0D22000-memory.dmp

Download

memory/2160-121-0x00007FF634BC0000-0x00007FF634F12000-memory.dmp

Download

memory/2160-153-0x00007FF634BC0000-0x00007FF634F12000-memory.dmp

Download

memory/2944-135-0x00007FF6637E0000-0x00007FF663B32000-memory.dmp

Download

memory/2944-18-0x00007FF6637E0000-0x00007FF663B32000-memory.dmp

Download

memory/2944-131-0x00007FF6637E0000-0x00007FF663B32000-memory.dmp

Download

memory/3132-12-0x00007FF74F120000-0x00007FF74F472000-memory.dmp

Download

memory/3132-130-0x00007FF74F120000-0x00007FF74F472000-memory.dmp

Download

memory/3132-134-0x00007FF74F120000-0x00007FF74F472000-memory.dmp

Download

memory/3912-151-0x00007FF778A20000-0x00007FF778D72000-memory.dmp

Download

memory/3912-125-0x00007FF778A20000-0x00007FF778D72000-memory.dmp

Download

memory/4296-142-0x00007FF71E370000-0x00007FF71E6C2000-memory.dmp

Download

memory/4296-117-0x00007FF71E370000-0x00007FF71E6C2000-memory.dmp

Download

memory/4520-138-0x00007FF7A2AD0000-0x00007FF7A2E22000-memory.dmp

Download

memory/4520-112-0x00007FF7A2AD0000-0x00007FF7A2E22000-memory.dmp

Download

memory/4672-145-0x00007FF7E0CA0000-0x00007FF7E0FF2000-memory.dmp

Download

memory/4672-115-0x00007FF7E0CA0000-0x00007FF7E0FF2000-memory.dmp

Download

memory/4724-116-0x00007FF7E0DF0000-0x00007FF7E1142000-memory.dmp

Download

memory/4724-144-0x00007FF7E0DF0000-0x00007FF7E1142000-memory.dmp

Download

memory/4844-137-0x00007FF7C4EA0000-0x00007FF7C51F2000-memory.dmp

Download

memory/4844-127-0x00007FF7C4EA0000-0x00007FF7C51F2000-memory.dmp

Download

memory/4868-1-0x000001D2AD980000-0x000001D2AD990000-memory.dmp

Download

memory/4868-128-0x00007FF622380000-0x00007FF6226D2000-memory.dmp

Download

memory/4868-0-0x00007FF622380000-0x00007FF6226D2000-memory.dmp

Download

memory/5288-114-0x00007FF69B480000-0x00007FF69B7D2000-memory.dmp

Download

memory/5288-141-0x00007FF69B480000-0x00007FF69B7D2000-memory.dmp

Download

memory/5312-124-0x00007FF63CAA0000-0x00007FF63CDF2000-memory.dmp

Download

memory/5312-147-0x00007FF63CAA0000-0x00007FF63CDF2000-memory.dmp

Download

memory/5804-139-0x00007FF69CEB0000-0x00007FF69D202000-memory.dmp

Download

memory/5804-111-0x00007FF69CEB0000-0x00007FF69D202000-memory.dmp

Download

memory/5960-152-0x00007FF76D2F0000-0x00007FF76D642000-memory.dmp

Download

memory/5960-123-0x00007FF76D2F0000-0x00007FF76D642000-memory.dmp

Download

memory/5972-6-0x00007FF7E8F60000-0x00007FF7E92B2000-memory.dmp

Download

memory/5972-133-0x00007FF7E8F60000-0x00007FF7E92B2000-memory.dmp

Download

memory/5972-129-0x00007FF7E8F60000-0x00007FF7E92B2000-memory.dmp

Download

memory/6084-150-0x00007FF7908F0000-0x00007FF790C42000-memory.dmp

Download

memory/6084-126-0x00007FF7908F0000-0x00007FF790C42000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads