cobaltstrike | 83ab3e97827f49467e6f6b7c6da80047ba66762f5f62e6be020713589348c35f

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample261027-hlb71sch55
SHA256 83ab3e97827f49467e6f6b7c6da80047ba66762f5f62e6be020713589348c35f
MD5 ca16a66997f917238de947442a67c297
SHA1 56150ff8751bc58bbebfad60205fb9745313ac09
SHA512 ab98df7b31f4a46829f3ad591efe3655f2d5487b45ef010eaf0158220ee767345543544b039f154651ff0ed9f29e712dc25988af10d02ef8030adde1eea6defe
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUZ:v+D56utgpPF8u/7Z
TLSH
T1EF965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x000a000000024290-6.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000024379-5.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024382-37.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024381-44.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024384-56.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024385-58.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024383-53.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024380-42.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002437f-35.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002437e-26.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024386-70.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002438b-88.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002438d-104.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002438f-111.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024390-115.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002438e-112.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002438c-94.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002438a-90.dat	cobalt_reflective_dll
behavioral1/files/0x000800000002437a-84.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024389-102.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024388-77.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral1/files/0x000a000000024290-6.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0008000000024379-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024382-37.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024381-44.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024384-56.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024385-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024383-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024380-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002437f-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002437e-26.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024386-70.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002438b-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002438d-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002438f-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024390-115.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002438e-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002438c-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002438a-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000800000002437a-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024389-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024388-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral1/memory/2216-0-0x00007FF709EB0000-0x00007FF70A202000-memory.dmp	UPX
behavioral1/files/0x000a000000024290-6.dat	UPX
behavioral1/files/0x0008000000024379-5.dat	UPX
behavioral1/memory/2412-11-0x00007FF7A0AC0000-0x00007FF7A0E12000-memory.dmp	UPX
behavioral1/files/0x0007000000024382-37.dat	UPX
behavioral1/memory/2972-39-0x00007FF7CF000000-0x00007FF7CF352000-memory.dmp	UPX
behavioral1/files/0x0007000000024381-44.dat	UPX
behavioral1/files/0x0007000000024384-56.dat	UPX
behavioral1/memory/4540-62-0x00007FF66DEA0000-0x00007FF66E1F2000-memory.dmp	UPX
behavioral1/memory/1644-61-0x00007FF79A6C0000-0x00007FF79AA12000-memory.dmp	UPX
behavioral1/memory/3052-60-0x00007FF601110000-0x00007FF601462000-memory.dmp	UPX
behavioral1/files/0x0007000000024385-58.dat	UPX
behavioral1/memory/1740-55-0x00007FF782150000-0x00007FF7824A2000-memory.dmp	UPX
behavioral1/files/0x0007000000024383-53.dat	UPX
behavioral1/memory/1944-48-0x00007FF736F10000-0x00007FF737262000-memory.dmp	UPX
behavioral1/files/0x0007000000024380-42.dat	UPX
behavioral1/files/0x000700000002437f-35.dat	UPX
behavioral1/memory/2844-33-0x00007FF663A60000-0x00007FF663DB2000-memory.dmp	UPX
behavioral1/memory/640-29-0x00007FF7B3060000-0x00007FF7B33B2000-memory.dmp	UPX
behavioral1/files/0x000700000002437e-26.dat	UPX
behavioral1/memory/1412-17-0x00007FF72B560000-0x00007FF72B8B2000-memory.dmp	UPX
behavioral1/files/0x0007000000024386-70.dat	UPX
behavioral1/files/0x000700000002438b-88.dat	UPX
behavioral1/files/0x000700000002438d-104.dat	UPX
behavioral1/files/0x000700000002438f-111.dat	UPX
behavioral1/files/0x0007000000024390-115.dat	UPX
behavioral1/files/0x000700000002438e-112.dat	UPX
behavioral1/memory/3788-100-0x00007FF6FC8D0000-0x00007FF6FCC22000-memory.dmp	UPX
behavioral1/memory/4728-97-0x00007FF7F52B0000-0x00007FF7F5602000-memory.dmp	UPX
behavioral1/files/0x000700000002438c-94.dat	UPX
behavioral1/files/0x000700000002438a-90.dat	UPX
behavioral1/files/0x000800000002437a-84.dat	UPX
behavioral1/files/0x0007000000024389-102.dat	UPX
behavioral1/files/0x0007000000024388-77.dat	UPX
behavioral1/memory/2696-119-0x00007FF66A0D0000-0x00007FF66A422000-memory.dmp	UPX
behavioral1/memory/2436-120-0x00007FF727010000-0x00007FF727362000-memory.dmp	UPX
behavioral1/memory/524-121-0x00007FF7ADF80000-0x00007FF7AE2D2000-memory.dmp	UPX
behavioral1/memory/4340-122-0x00007FF6E8A60000-0x00007FF6E8DB2000-memory.dmp	UPX
behavioral1/memory/3564-123-0x00007FF77A670000-0x00007FF77A9C2000-memory.dmp	UPX
behavioral1/memory/556-124-0x00007FF6AD020000-0x00007FF6AD372000-memory.dmp	UPX
behavioral1/memory/4344-125-0x00007FF7B33E0000-0x00007FF7B3732000-memory.dmp	UPX
behavioral1/memory/4608-126-0x00007FF77EA70000-0x00007FF77EDC2000-memory.dmp	UPX
behavioral1/memory/5000-127-0x00007FF64A3A0000-0x00007FF64A6F2000-memory.dmp	UPX
behavioral1/memory/2844-128-0x00007FF663A60000-0x00007FF663DB2000-memory.dmp	UPX
behavioral1/memory/2216-129-0x00007FF709EB0000-0x00007FF70A202000-memory.dmp	UPX
behavioral1/memory/640-131-0x00007FF7B3060000-0x00007FF7B33B2000-memory.dmp	UPX
behavioral1/memory/1412-130-0x00007FF72B560000-0x00007FF72B8B2000-memory.dmp	UPX
behavioral1/memory/2972-132-0x00007FF7CF000000-0x00007FF7CF352000-memory.dmp	UPX
behavioral1/memory/2412-133-0x00007FF7A0AC0000-0x00007FF7A0E12000-memory.dmp	UPX
behavioral1/memory/1412-134-0x00007FF72B560000-0x00007FF72B8B2000-memory.dmp	UPX
behavioral1/memory/1944-135-0x00007FF736F10000-0x00007FF737262000-memory.dmp	UPX
behavioral1/memory/640-136-0x00007FF7B3060000-0x00007FF7B33B2000-memory.dmp	UPX
behavioral1/memory/1740-137-0x00007FF782150000-0x00007FF7824A2000-memory.dmp	UPX
behavioral1/memory/2844-138-0x00007FF663A60000-0x00007FF663DB2000-memory.dmp	UPX
behavioral1/memory/3052-142-0x00007FF601110000-0x00007FF601462000-memory.dmp	UPX
behavioral1/memory/2972-141-0x00007FF7CF000000-0x00007FF7CF352000-memory.dmp	UPX
behavioral1/memory/1644-140-0x00007FF79A6C0000-0x00007FF79AA12000-memory.dmp	UPX
behavioral1/memory/4540-139-0x00007FF66DEA0000-0x00007FF66E1F2000-memory.dmp	UPX
behavioral1/memory/4728-143-0x00007FF7F52B0000-0x00007FF7F5602000-memory.dmp	UPX
behavioral1/memory/4344-144-0x00007FF7B33E0000-0x00007FF7B3732000-memory.dmp	UPX
behavioral1/memory/3788-145-0x00007FF6FC8D0000-0x00007FF6FCC22000-memory.dmp	UPX
behavioral1/memory/2696-149-0x00007FF66A0D0000-0x00007FF66A422000-memory.dmp	UPX
behavioral1/memory/4608-150-0x00007FF77EA70000-0x00007FF77EDC2000-memory.dmp	UPX
behavioral1/memory/2436-148-0x00007FF727010000-0x00007FF727362000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2216-0-0x00007FF709EB0000-0x00007FF70A202000-memory.dmp	xmrig
behavioral1/files/0x000a000000024290-6.dat	xmrig
behavioral1/files/0x0008000000024379-5.dat	xmrig
behavioral1/memory/2412-11-0x00007FF7A0AC0000-0x00007FF7A0E12000-memory.dmp	xmrig
behavioral1/files/0x0007000000024382-37.dat	xmrig
behavioral1/memory/2972-39-0x00007FF7CF000000-0x00007FF7CF352000-memory.dmp	xmrig
behavioral1/files/0x0007000000024381-44.dat	xmrig
behavioral1/files/0x0007000000024384-56.dat	xmrig
behavioral1/memory/4540-62-0x00007FF66DEA0000-0x00007FF66E1F2000-memory.dmp	xmrig
behavioral1/memory/1644-61-0x00007FF79A6C0000-0x00007FF79AA12000-memory.dmp	xmrig
behavioral1/memory/3052-60-0x00007FF601110000-0x00007FF601462000-memory.dmp	xmrig
behavioral1/files/0x0007000000024385-58.dat	xmrig
behavioral1/memory/1740-55-0x00007FF782150000-0x00007FF7824A2000-memory.dmp	xmrig
behavioral1/files/0x0007000000024383-53.dat	xmrig
behavioral1/memory/1944-48-0x00007FF736F10000-0x00007FF737262000-memory.dmp	xmrig
behavioral1/files/0x0007000000024380-42.dat	xmrig
behavioral1/files/0x000700000002437f-35.dat	xmrig
behavioral1/memory/2844-33-0x00007FF663A60000-0x00007FF663DB2000-memory.dmp	xmrig
behavioral1/memory/640-29-0x00007FF7B3060000-0x00007FF7B33B2000-memory.dmp	xmrig
behavioral1/files/0x000700000002437e-26.dat	xmrig
behavioral1/memory/1412-17-0x00007FF72B560000-0x00007FF72B8B2000-memory.dmp	xmrig
behavioral1/files/0x0007000000024386-70.dat	xmrig
behavioral1/files/0x000700000002438b-88.dat	xmrig
behavioral1/files/0x000700000002438d-104.dat	xmrig
behavioral1/files/0x000700000002438f-111.dat	xmrig
behavioral1/files/0x0007000000024390-115.dat	xmrig
behavioral1/files/0x000700000002438e-112.dat	xmrig
behavioral1/memory/3788-100-0x00007FF6FC8D0000-0x00007FF6FCC22000-memory.dmp	xmrig
behavioral1/memory/4728-97-0x00007FF7F52B0000-0x00007FF7F5602000-memory.dmp	xmrig
behavioral1/files/0x000700000002438c-94.dat	xmrig
behavioral1/files/0x000700000002438a-90.dat	xmrig
behavioral1/files/0x000800000002437a-84.dat	xmrig
behavioral1/files/0x0007000000024389-102.dat	xmrig
behavioral1/files/0x0007000000024388-77.dat	xmrig
behavioral1/memory/2696-119-0x00007FF66A0D0000-0x00007FF66A422000-memory.dmp	xmrig
behavioral1/memory/2436-120-0x00007FF727010000-0x00007FF727362000-memory.dmp	xmrig
behavioral1/memory/524-121-0x00007FF7ADF80000-0x00007FF7AE2D2000-memory.dmp	xmrig
behavioral1/memory/4340-122-0x00007FF6E8A60000-0x00007FF6E8DB2000-memory.dmp	xmrig
behavioral1/memory/3564-123-0x00007FF77A670000-0x00007FF77A9C2000-memory.dmp	xmrig
behavioral1/memory/556-124-0x00007FF6AD020000-0x00007FF6AD372000-memory.dmp	xmrig
behavioral1/memory/4344-125-0x00007FF7B33E0000-0x00007FF7B3732000-memory.dmp	xmrig
behavioral1/memory/4608-126-0x00007FF77EA70000-0x00007FF77EDC2000-memory.dmp	xmrig
behavioral1/memory/5000-127-0x00007FF64A3A0000-0x00007FF64A6F2000-memory.dmp	xmrig
behavioral1/memory/2844-128-0x00007FF663A60000-0x00007FF663DB2000-memory.dmp	xmrig
behavioral1/memory/2216-129-0x00007FF709EB0000-0x00007FF70A202000-memory.dmp	xmrig
behavioral1/memory/640-131-0x00007FF7B3060000-0x00007FF7B33B2000-memory.dmp	xmrig
behavioral1/memory/1412-130-0x00007FF72B560000-0x00007FF72B8B2000-memory.dmp	xmrig
behavioral1/memory/2972-132-0x00007FF7CF000000-0x00007FF7CF352000-memory.dmp	xmrig
behavioral1/memory/2412-133-0x00007FF7A0AC0000-0x00007FF7A0E12000-memory.dmp	xmrig
behavioral1/memory/1412-134-0x00007FF72B560000-0x00007FF72B8B2000-memory.dmp	xmrig
behavioral1/memory/1944-135-0x00007FF736F10000-0x00007FF737262000-memory.dmp	xmrig
behavioral1/memory/640-136-0x00007FF7B3060000-0x00007FF7B33B2000-memory.dmp	xmrig
behavioral1/memory/1740-137-0x00007FF782150000-0x00007FF7824A2000-memory.dmp	xmrig
behavioral1/memory/2844-138-0x00007FF663A60000-0x00007FF663DB2000-memory.dmp	xmrig
behavioral1/memory/3052-142-0x00007FF601110000-0x00007FF601462000-memory.dmp	xmrig
behavioral1/memory/2972-141-0x00007FF7CF000000-0x00007FF7CF352000-memory.dmp	xmrig
behavioral1/memory/1644-140-0x00007FF79A6C0000-0x00007FF79AA12000-memory.dmp	xmrig
behavioral1/memory/4540-139-0x00007FF66DEA0000-0x00007FF66E1F2000-memory.dmp	xmrig
behavioral1/memory/4728-143-0x00007FF7F52B0000-0x00007FF7F5602000-memory.dmp	xmrig
behavioral1/memory/4344-144-0x00007FF7B33E0000-0x00007FF7B3732000-memory.dmp	xmrig
behavioral1/memory/3788-145-0x00007FF6FC8D0000-0x00007FF6FCC22000-memory.dmp	xmrig
behavioral1/memory/2696-149-0x00007FF66A0D0000-0x00007FF66A422000-memory.dmp	xmrig
behavioral1/memory/4608-150-0x00007FF77EA70000-0x00007FF77EDC2000-memory.dmp	xmrig
behavioral1/memory/2436-148-0x00007FF727010000-0x00007FF727362000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2412	qABNtMt.exe
1412	anmfcaL.exe
1944	TLGbHhl.exe
640	vyMVZzC.exe
1740	QcnkJuU.exe
2844	pwNqYks.exe
3052	wcvkGfh.exe
2972	oDbuils.exe
1644	GgahZYs.exe
4540	XHAlKjT.exe
4728	OhlIYox.exe
4344	YkTPppc.exe
3788	gAiPngJ.exe
2696	xrxgziH.exe
2436	hErRoRR.exe
524	WgiwtPj.exe
4340	NypmnEA.exe
4608	KXqRFZe.exe
3564	hyPWEmJ.exe
5000	JhVlqWE.exe
556	pCRsRtn.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2216-0-0x00007FF709EB0000-0x00007FF70A202000-memory.dmp	upx
behavioral1/files/0x000a000000024290-6.dat	upx
behavioral1/files/0x0008000000024379-5.dat	upx
behavioral1/memory/2412-11-0x00007FF7A0AC0000-0x00007FF7A0E12000-memory.dmp	upx
behavioral1/files/0x0007000000024382-37.dat	upx
behavioral1/memory/2972-39-0x00007FF7CF000000-0x00007FF7CF352000-memory.dmp	upx
behavioral1/files/0x0007000000024381-44.dat	upx
behavioral1/files/0x0007000000024384-56.dat	upx
behavioral1/memory/4540-62-0x00007FF66DEA0000-0x00007FF66E1F2000-memory.dmp	upx
behavioral1/memory/1644-61-0x00007FF79A6C0000-0x00007FF79AA12000-memory.dmp	upx
behavioral1/memory/3052-60-0x00007FF601110000-0x00007FF601462000-memory.dmp	upx
behavioral1/files/0x0007000000024385-58.dat	upx
behavioral1/memory/1740-55-0x00007FF782150000-0x00007FF7824A2000-memory.dmp	upx
behavioral1/files/0x0007000000024383-53.dat	upx
behavioral1/memory/1944-48-0x00007FF736F10000-0x00007FF737262000-memory.dmp	upx
behavioral1/files/0x0007000000024380-42.dat	upx
behavioral1/files/0x000700000002437f-35.dat	upx
behavioral1/memory/2844-33-0x00007FF663A60000-0x00007FF663DB2000-memory.dmp	upx
behavioral1/memory/640-29-0x00007FF7B3060000-0x00007FF7B33B2000-memory.dmp	upx
behavioral1/files/0x000700000002437e-26.dat	upx
behavioral1/memory/1412-17-0x00007FF72B560000-0x00007FF72B8B2000-memory.dmp	upx
behavioral1/files/0x0007000000024386-70.dat	upx
behavioral1/files/0x000700000002438b-88.dat	upx
behavioral1/files/0x000700000002438d-104.dat	upx
behavioral1/files/0x000700000002438f-111.dat	upx
behavioral1/files/0x0007000000024390-115.dat	upx
behavioral1/files/0x000700000002438e-112.dat	upx
behavioral1/memory/3788-100-0x00007FF6FC8D0000-0x00007FF6FCC22000-memory.dmp	upx
behavioral1/memory/4728-97-0x00007FF7F52B0000-0x00007FF7F5602000-memory.dmp	upx
behavioral1/files/0x000700000002438c-94.dat	upx
behavioral1/files/0x000700000002438a-90.dat	upx
behavioral1/files/0x000800000002437a-84.dat	upx
behavioral1/files/0x0007000000024389-102.dat	upx
behavioral1/files/0x0007000000024388-77.dat	upx
behavioral1/memory/2696-119-0x00007FF66A0D0000-0x00007FF66A422000-memory.dmp	upx
behavioral1/memory/2436-120-0x00007FF727010000-0x00007FF727362000-memory.dmp	upx
behavioral1/memory/524-121-0x00007FF7ADF80000-0x00007FF7AE2D2000-memory.dmp	upx
behavioral1/memory/4340-122-0x00007FF6E8A60000-0x00007FF6E8DB2000-memory.dmp	upx
behavioral1/memory/3564-123-0x00007FF77A670000-0x00007FF77A9C2000-memory.dmp	upx
behavioral1/memory/556-124-0x00007FF6AD020000-0x00007FF6AD372000-memory.dmp	upx
behavioral1/memory/4344-125-0x00007FF7B33E0000-0x00007FF7B3732000-memory.dmp	upx
behavioral1/memory/4608-126-0x00007FF77EA70000-0x00007FF77EDC2000-memory.dmp	upx
behavioral1/memory/5000-127-0x00007FF64A3A0000-0x00007FF64A6F2000-memory.dmp	upx
behavioral1/memory/2844-128-0x00007FF663A60000-0x00007FF663DB2000-memory.dmp	upx
behavioral1/memory/2216-129-0x00007FF709EB0000-0x00007FF70A202000-memory.dmp	upx
behavioral1/memory/640-131-0x00007FF7B3060000-0x00007FF7B33B2000-memory.dmp	upx
behavioral1/memory/1412-130-0x00007FF72B560000-0x00007FF72B8B2000-memory.dmp	upx
behavioral1/memory/2972-132-0x00007FF7CF000000-0x00007FF7CF352000-memory.dmp	upx
behavioral1/memory/2412-133-0x00007FF7A0AC0000-0x00007FF7A0E12000-memory.dmp	upx
behavioral1/memory/1412-134-0x00007FF72B560000-0x00007FF72B8B2000-memory.dmp	upx
behavioral1/memory/1944-135-0x00007FF736F10000-0x00007FF737262000-memory.dmp	upx
behavioral1/memory/640-136-0x00007FF7B3060000-0x00007FF7B33B2000-memory.dmp	upx
behavioral1/memory/1740-137-0x00007FF782150000-0x00007FF7824A2000-memory.dmp	upx
behavioral1/memory/2844-138-0x00007FF663A60000-0x00007FF663DB2000-memory.dmp	upx
behavioral1/memory/3052-142-0x00007FF601110000-0x00007FF601462000-memory.dmp	upx
behavioral1/memory/2972-141-0x00007FF7CF000000-0x00007FF7CF352000-memory.dmp	upx
behavioral1/memory/1644-140-0x00007FF79A6C0000-0x00007FF79AA12000-memory.dmp	upx
behavioral1/memory/4540-139-0x00007FF66DEA0000-0x00007FF66E1F2000-memory.dmp	upx
behavioral1/memory/4728-143-0x00007FF7F52B0000-0x00007FF7F5602000-memory.dmp	upx
behavioral1/memory/4344-144-0x00007FF7B33E0000-0x00007FF7B3732000-memory.dmp	upx
behavioral1/memory/3788-145-0x00007FF6FC8D0000-0x00007FF6FCC22000-memory.dmp	upx
behavioral1/memory/2696-149-0x00007FF66A0D0000-0x00007FF66A422000-memory.dmp	upx
behavioral1/memory/4608-150-0x00007FF77EA70000-0x00007FF77EDC2000-memory.dmp	upx
behavioral1/memory/2436-148-0x00007FF727010000-0x00007FF727362000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\QcnkJuU.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\wcvkGfh.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\XHAlKjT.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\OhlIYox.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\YkTPppc.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\gAiPngJ.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\KXqRFZe.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\pwNqYks.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\xrxgziH.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\NypmnEA.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\hyPWEmJ.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\qABNtMt.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\TLGbHhl.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\oDbuils.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\WgiwtPj.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\JhVlqWE.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\anmfcaL.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\vyMVZzC.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\GgahZYs.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\hErRoRR.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\pCRsRtn.exe	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2412	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	85
PID 2216 wrote to memory of 1412	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	86
PID 2216 wrote to memory of 1944	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	87
PID 2216 wrote to memory of 640	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	88
PID 2216 wrote to memory of 1740	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	89
PID 2216 wrote to memory of 2844	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 2216 wrote to memory of 3052	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 2216 wrote to memory of 2972	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 2216 wrote to memory of 1644	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 2216 wrote to memory of 4540	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 2216 wrote to memory of 4728	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 2216 wrote to memory of 4344	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 2216 wrote to memory of 3788	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 2216 wrote to memory of 2696	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 2216 wrote to memory of 2436	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 2216 wrote to memory of 524	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 2216 wrote to memory of 4340	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 2216 wrote to memory of 4608	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 2216 wrote to memory of 3564	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 2216 wrote to memory of 5000	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 2216 wrote to memory of 556	2216	2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_ca16a66997f917238de947442a67c297_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\System\qABNtMt.exe
  C:\Windows\System\qABNtMt.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\anmfcaL.exe
  C:\Windows\System\anmfcaL.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\TLGbHhl.exe
  C:\Windows\System\TLGbHhl.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\vyMVZzC.exe
  C:\Windows\System\vyMVZzC.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\QcnkJuU.exe
  C:\Windows\System\QcnkJuU.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\pwNqYks.exe
  C:\Windows\System\pwNqYks.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\wcvkGfh.exe
  C:\Windows\System\wcvkGfh.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\oDbuils.exe
  C:\Windows\System\oDbuils.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\GgahZYs.exe
  C:\Windows\System\GgahZYs.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\XHAlKjT.exe
  C:\Windows\System\XHAlKjT.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\OhlIYox.exe
  C:\Windows\System\OhlIYox.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\YkTPppc.exe
  C:\Windows\System\YkTPppc.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\gAiPngJ.exe
  C:\Windows\System\gAiPngJ.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\xrxgziH.exe
  C:\Windows\System\xrxgziH.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\hErRoRR.exe
  C:\Windows\System\hErRoRR.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\WgiwtPj.exe
  C:\Windows\System\WgiwtPj.exe
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Windows\System\NypmnEA.exe
  C:\Windows\System\NypmnEA.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\KXqRFZe.exe
  C:\Windows\System\KXqRFZe.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\hyPWEmJ.exe
  C:\Windows\System\hyPWEmJ.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\JhVlqWE.exe
  C:\Windows\System\JhVlqWE.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\pCRsRtn.exe
  C:\Windows\System\pCRsRtn.exe
  2⤵
  - Executes dropped EXE
  PID:556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

GgahZYs.exe

Path C:\Windows\System\GgahZYs.exe
Size 8.3MB
SHA256 1322282f7f6128eb72da15043d580a56dfb630f078d313dd24e539ebaae9423c
MD5 ae3a4bac5235fbdd824fdf2d5cf939ef
SHA1 ad98df476d530af7c5df57a442135d027d772e26
SHA512 800288e3ecf560250ec56cfab4617de80d05576e523319e1deb8f8a6824be3a68f2488c3d1ef0b52883e88fe85d8c6db1d657b9689a228eb5320df490ff5df54
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU5:v+D56utgpPF8u/75
TLSH
T1C2965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JhVlqWE.exe

Path C:\Windows\System\JhVlqWE.exe
Size 8.3MB
SHA256 d0b254b14125efdae7ea447299b37eea9610914a4834030a762ac89cd5f75a24
MD5 85cbe7e2314b969761da56b365515b17
SHA1 26132339901b06bb376d536c4263a3cbee340055
SHA512 1eb31fe9611e8942ccdc23dae859c3c52ed6bf2d914eb26398ef8cb0fc5342df28e5380b83143a2b8637f2bee1eb41cc174cb9aad384993e60703d923d3802c3
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUi:v+D56utgpPF8u/7i
TLSH
T144965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KXqRFZe.exe

Path C:\Windows\System\KXqRFZe.exe
Size 8.3MB
SHA256 ffc34200e584b6e9aaca08618aade94b532181262defbcbe2065c1979f12d7eb
MD5 21a31ea91493d1dbfe9d9393473e8d2e
SHA1 aa49d0603ced1ea44fe62fdec47b407cdc950bf2
SHA512 b3a0d40d3b2229d45c9dec08c04659ce3073ee9fa52347674fc38c05ebad8cbbef9b4f60b4ee9b52e36705d88bf865f8ab739162c59267c39cfae38b2e66652d
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU4:v+D56utgpPF8u/74
TLSH
T1CA965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NypmnEA.exe

Path C:\Windows\System\NypmnEA.exe
Size 8.3MB
SHA256 eb041e1b16c1f0bdb2f72287399a9c711d535d0d27eeefb5b1b5e9e0a2d50a76
MD5 adb3c189b93e40407aac12200c2ca9d2
SHA1 e99a9a506dcb1af0d4025e2a920385020e70dac9
SHA512 2eb9f020477a9157fdd5b63e28ec049a1a3590233312c5478fb00040a2263dbef275d676d7aaf19eb106af41dcc4c4e39b5911d2d3c812900290aa178589dc62
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUT:v+D56utgpPF8u/7T
TLSH
T1DA965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OhlIYox.exe

Path C:\Windows\System\OhlIYox.exe
Size 8.3MB
SHA256 16befcf95f0b5906d948c8392ebc5894aaf7fbf0dec4ef0bd2ddf1b2dc0e1baa
MD5 9c464a9f75ba52bcb3b114bb6a3ee109
SHA1 c80ed1dfc83b447e4ba27020b812e22f1c44632b
SHA512 1ac0d28ff373e8ed7f8d80436381c82e53f435d80711a0c807ebb3d3c5e8e30c9f6197c7f316ec50bc45603f324116d242b7139f73570db664cce77cce382fd6
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU5:v+D56utgpPF8u/75
TLSH
T13B965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QcnkJuU.exe

Path C:\Windows\System\QcnkJuU.exe
Size 8.3MB
SHA256 5e7417bbd5a5303931368c5aae39f2eed421bcb92e344bc16845a365e8bc9f7e
MD5 aeb3687420c425e653bbad18a94966bc
SHA1 c8ee43f9c4e86c06753e850fbd1d0d1271f04435
SHA512 3f0f3a3a04a0119d135ed901ddda83d44323a44aa057acfac81f8e3e397ea2fb96b2bc9ef38ee5fb86eaabe8c44aa513ad8f66fb0c58c37643b523b4a87f2f4d
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUi:v+D56utgpPF8u/7i
TLSH
T120965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TLGbHhl.exe

Path C:\Windows\System\TLGbHhl.exe
Size 8.3MB
SHA256 538f0ec0c213056d541f15e89b4382a712bb55c3cada658599ce84c7a2029da9
MD5 cc9923f04e62d47c562cd5087ab6c19b
SHA1 aaf70d7125861b927eccddd92e7023ed5c1333d1
SHA512 591d64fffb38a26b689a07ccd4a02353b754e287f1622bac4283e6e8187fc7c16e231011d1cf2d870e2e001c1f401c12dccbfbc726dbe38322add71d58108b70
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUX:v+D56utgpPF8u/7X
TLSH
T131965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WgiwtPj.exe

Path C:\Windows\System\WgiwtPj.exe
Size 8.3MB
SHA256 0328e0748cfc1e65ff7f39096114d3c23fb3bef2b4e6219144a08357d278965e
MD5 350082319626a7c6726730e8bb4a42be
SHA1 3403c1552dd99dde48b611c714798e8b9ad350ed
SHA512 d7efad5bca2098646ff935ad961f6c8c00e350615e001f6ce4e379b606b41dfa66d879f1857ccc5be21e28e793c9c631858213e1742ef0418f2afccc27822f5f
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU/:v+D56utgpPF8u/7/
TLSH
T1A3965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XHAlKjT.exe

Path C:\Windows\System\XHAlKjT.exe
Size 8.3MB
SHA256 87c73133bf02015434255eddb7541cc0a9a34ad4fc1f317870398959054f138f
MD5 827619f045f19904b281caf4571e8757
SHA1 778446fbb78d9af87818e73ab4e2ec93428b0e46
SHA512 ce6e4889cfaff7efb48eca7dcb68f8427fc8f6af565ddd3025170def8e7334dcd795fb27d2b5e1fc3ebf9fff5298690e0e82d8a58db6857d5ab324f12be95c1a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUq:v+D56utgpPF8u/7q
TLSH
T10A965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YkTPppc.exe

Path C:\Windows\System\YkTPppc.exe
Size 8.3MB
SHA256 0bc10d806e61706c98c6507b32f40935b68c4510036851785663dd1f0c3472be
MD5 932b433e1aea1fbc85fce2b2ec55de17
SHA1 4c7a1f6cb9c19c45398408726907c5095b407cf7
SHA512 adbae2394384c0fd703dace4ca5b375bf062bd31684995eec0b918b2dce7410e5bd17b920cc7f1d45748cc24ed341b3ee01ddb04452f559334ea983938683e48
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUt:v+D56utgpPF8u/7t
TLSH
T1A8965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

anmfcaL.exe

Path C:\Windows\System\anmfcaL.exe
Size 8.3MB
SHA256 b0d950f61e7b519e203c7a4b08c204130477a8cd079087ec77d35d42a3399723
MD5 8c1e334349740e48f541368c40d56ad3
SHA1 f387883faffa45f9adffecf421b182f0af473227
SHA512 728c65fe355e70f9756165d58029dddc2e9b618f8ac64ea7ed9306214a9d93031130eb06fbc46c19cb7b7359ed44463d65aaf9b4267d1cef336117ed36c64fc7
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUq:v+D56utgpPF8u/7q
TLSH
T1BB965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gAiPngJ.exe

Path C:\Windows\System\gAiPngJ.exe
Size 8.3MB
SHA256 6f91383dfba82ff43f62dacc57770afe597b667393cf3629a9c9ec7a3b6bb940
MD5 b4c4a5af77e4fa676882bf8d8a03c5f8
SHA1 fa26380f3a3d8ee488deca4eb2a1125302281c22
SHA512 1805e0fa7dcfa3da3072e001496215aded238e4ac69ddb901d90b216be21f6c614de5aa4a0e3bc42fe04ef7f2309ee0f552018ccc80b5183a7a1d8e400df95ed
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU2:v+D56utgpPF8u/72
TLSH
T13E965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hErRoRR.exe

Path C:\Windows\System\hErRoRR.exe
Size 8.3MB
SHA256 58a7dceeae7709d9f03b23ff4797ac1e92e01c27d3dba9abf31304bead11b7ca
MD5 fd618a15f5987021fb62a8fd64b8540f
SHA1 6129f8b50f9391fde93d1de75a7325818417762c
SHA512 b1b1c4fe272dea059a5ac0f457ff46995bbdac0fd6a60280e83074321fea5f48b4cc7850969d2df9febda918ee643821ff15838c94f289b40a44c155630e2763
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUE:v+D56utgpPF8u/7E
TLSH
T1C5965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyPWEmJ.exe

Path C:\Windows\System\hyPWEmJ.exe
Size 8.3MB
SHA256 a5119dc947d279989d7c92e932225e3abc77404ffbedc0ae2dc7e04eb09432d7
MD5 7bbad208fb06412f17cc1206c21d5f04
SHA1 821703746c74a1f4a1376a2c143f63928082ee8d
SHA512 0d59c455514533ac0c481fcdf52a926ed8e6d75de15a8b0da51f79f3f432d30c00f9e8373cd967137fb3989c7d94a6ecd8ac81d3ea3a9a1e858c64d932227f16
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUE:v+D56utgpPF8u/7E
TLSH
T1A9965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oDbuils.exe

Path C:\Windows\System\oDbuils.exe
Size 8.3MB
SHA256 08b3a406d9cb24f482e8c99057dd83f3bfa3fc0045f4493dbc074d66a5e6c3ca
MD5 8da61bbe6bdb1d93834b3d74c9b592e5
SHA1 eef74f03b6797ecfdf258bcfa3575c777a158554
SHA512 245e904042016ad3fb3416ebdce17116dd82d276be6a86dc02c8532bcf64d1f267bc378824d6fad8464625a00e74922ced08321dbc419a0e35a5680c78f2a425
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUR:v+D56utgpPF8u/7R
TLSH
T109965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pCRsRtn.exe

Path C:\Windows\System\pCRsRtn.exe
Size 8.3MB
SHA256 111017b6eed74603e8f9c1bd97b414fe0287db831f46819110c6575e5a0461ad
MD5 afff03dcc2d5014b1eb890c86f2dce1a
SHA1 a18c1db6ee7730eaaf0ae3873ac2c81f902f4992
SHA512 5ef08d3ad54ab8d176457c087842182061363bf2069866c583c5f04f97df125812d7deea75f0756c7f6b3823ed71ef5fb9b6c1fb3fca3ea3c8b20eb1f70f136d
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU7:v+D56utgpPF8u/77
TLSH
T10B965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwNqYks.exe

Path C:\Windows\System\pwNqYks.exe
Size 8.3MB
SHA256 1ac52e0a0ca0af147b945e4888ff7365614e6c374f5e91d4c12e5fbcd6393357
MD5 7dd9aa1bff83de6ec96aec53e713e7d2
SHA1 23018de29eaad0b4b697b06f96b0f58907ba00c4
SHA512 340f7ff7d4c1ad1c04eaa9269e695a04084fc8bd04434748f6e7f99c3d948843ba0d8aa3e791dacb6552c577d82ae7657918309146aa2b15ffef4dff6eef3f87
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU0:v+D56utgpPF8u/70
TLSH
T1FF965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qABNtMt.exe

Path C:\Windows\System\qABNtMt.exe
Size 8.3MB
SHA256 b25cc4e2a7fdd53046c2de673c67da8c7681e0cf92808f988b14e89a6fad3ce4
MD5 5fcd5818b70bf32903874560197dd729
SHA1 6e6d6a705ddd881be5ad7275c335d6197b6bf03b
SHA512 696881b3cad77fb4ded14065306344d00372b026e6c5cadb75927761762e8e7f083ab5416280911eac494d92e09940411f8ade833c8c295ee4a80ed8211ac526
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUd:v+D56utgpPF8u/7d
TLSH
T127965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vyMVZzC.exe

Path C:\Windows\System\vyMVZzC.exe
Size 8.3MB
SHA256 cc43e5b254a2013c836fd14e2910526630700cfaa33d99abf6dc1adadc0d93f4
MD5 d239ca44b68619d5ab81d2329fb0ebad
SHA1 85907d8e8de73581bc82e923e8481ec326031319
SHA512 9493200e37bc48c1029611949ceea67b98292910e41416990799326e92b0d4c191ccb325d9e8b4a6b3b6fb57246e7bac8dfeff5a5971b18c67c9e182cec3ef98
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUd:v+D56utgpPF8u/7d
TLSH
T158965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wcvkGfh.exe

Path C:\Windows\System\wcvkGfh.exe
Size 8.3MB
SHA256 1b2351fa83881f5621cfe3576dad6575618aa77980887ae457b490f9f5a4f2b8
MD5 77d2b4f796d773a61f7f8b09708f2ed9
SHA1 fdcbfc7bec58d82d68f9d9e2d55a9d477cc3ce39
SHA512 cea00ec1b696237b16190cab63ff4eff2c9af23aaba137ee6534d026a90b6f4b5fd68dfa6dd4f092a068d299bc4f036933332ff2e46329ddf4d270e0fceb5eab
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUe:v+D56utgpPF8u/7e
TLSH
T15C965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrxgziH.exe

Path C:\Windows\System\xrxgziH.exe
Size 8.3MB
SHA256 4c1fed77d01a4cb856b06ceeb9d0fbd57d76cd05da1e964a6366a57ef6d31aee
MD5 aa4d7647036bc669a313515884117df7
SHA1 a9f2a2f89a239b887826169d891d2a900e8bd83b
SHA512 1c673d0c3052f1a5b16a03355926437a52894fe54151746a26ed367e318cec36d010e3a7a3779048fa713efc7b612696f52852eebe517c4eb7555b1c1c53aba4
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUA:v+D56utgpPF8u/7A
TLSH
T1C4965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/524-121-0x00007FF7ADF80000-0x00007FF7AE2D2000-memory.dmp

Download

memory/524-146-0x00007FF7ADF80000-0x00007FF7AE2D2000-memory.dmp

Download

memory/556-152-0x00007FF6AD020000-0x00007FF6AD372000-memory.dmp

Download

memory/556-124-0x00007FF6AD020000-0x00007FF6AD372000-memory.dmp

Download

memory/640-29-0x00007FF7B3060000-0x00007FF7B33B2000-memory.dmp

Download

memory/640-131-0x00007FF7B3060000-0x00007FF7B33B2000-memory.dmp

Download

memory/640-136-0x00007FF7B3060000-0x00007FF7B33B2000-memory.dmp

Download

memory/1412-17-0x00007FF72B560000-0x00007FF72B8B2000-memory.dmp

Download

memory/1412-130-0x00007FF72B560000-0x00007FF72B8B2000-memory.dmp

Download

memory/1412-134-0x00007FF72B560000-0x00007FF72B8B2000-memory.dmp

Download

memory/1644-61-0x00007FF79A6C0000-0x00007FF79AA12000-memory.dmp

Download

memory/1644-140-0x00007FF79A6C0000-0x00007FF79AA12000-memory.dmp

Download

memory/1740-55-0x00007FF782150000-0x00007FF7824A2000-memory.dmp

Download

memory/1740-137-0x00007FF782150000-0x00007FF7824A2000-memory.dmp

Download

memory/1944-135-0x00007FF736F10000-0x00007FF737262000-memory.dmp

Download

memory/1944-48-0x00007FF736F10000-0x00007FF737262000-memory.dmp

Download

memory/2216-0-0x00007FF709EB0000-0x00007FF70A202000-memory.dmp

Download

memory/2216-129-0x00007FF709EB0000-0x00007FF70A202000-memory.dmp

Download

memory/2216-1-0x0000022179110000-0x0000022179120000-memory.dmp

Download

memory/2412-11-0x00007FF7A0AC0000-0x00007FF7A0E12000-memory.dmp

Download

memory/2412-133-0x00007FF7A0AC0000-0x00007FF7A0E12000-memory.dmp

Download

memory/2436-148-0x00007FF727010000-0x00007FF727362000-memory.dmp

Download

memory/2436-120-0x00007FF727010000-0x00007FF727362000-memory.dmp

Download

memory/2696-149-0x00007FF66A0D0000-0x00007FF66A422000-memory.dmp

Download

memory/2696-119-0x00007FF66A0D0000-0x00007FF66A422000-memory.dmp

Download

memory/2844-33-0x00007FF663A60000-0x00007FF663DB2000-memory.dmp

Download

memory/2844-128-0x00007FF663A60000-0x00007FF663DB2000-memory.dmp

Download

memory/2844-138-0x00007FF663A60000-0x00007FF663DB2000-memory.dmp

Download

memory/2972-141-0x00007FF7CF000000-0x00007FF7CF352000-memory.dmp

Download

memory/2972-132-0x00007FF7CF000000-0x00007FF7CF352000-memory.dmp

Download

memory/2972-39-0x00007FF7CF000000-0x00007FF7CF352000-memory.dmp

Download

memory/3052-60-0x00007FF601110000-0x00007FF601462000-memory.dmp

Download

memory/3052-142-0x00007FF601110000-0x00007FF601462000-memory.dmp

Download

memory/3564-151-0x00007FF77A670000-0x00007FF77A9C2000-memory.dmp

Download

memory/3564-123-0x00007FF77A670000-0x00007FF77A9C2000-memory.dmp

Download

memory/3788-100-0x00007FF6FC8D0000-0x00007FF6FCC22000-memory.dmp

Download

memory/3788-145-0x00007FF6FC8D0000-0x00007FF6FCC22000-memory.dmp

Download

memory/4340-147-0x00007FF6E8A60000-0x00007FF6E8DB2000-memory.dmp

Download

memory/4340-122-0x00007FF6E8A60000-0x00007FF6E8DB2000-memory.dmp

Download

memory/4344-125-0x00007FF7B33E0000-0x00007FF7B3732000-memory.dmp

Download

memory/4344-144-0x00007FF7B33E0000-0x00007FF7B3732000-memory.dmp

Download

memory/4540-62-0x00007FF66DEA0000-0x00007FF66E1F2000-memory.dmp

Download

memory/4540-139-0x00007FF66DEA0000-0x00007FF66E1F2000-memory.dmp

Download

memory/4608-150-0x00007FF77EA70000-0x00007FF77EDC2000-memory.dmp

Download

memory/4608-126-0x00007FF77EA70000-0x00007FF77EDC2000-memory.dmp

Download

memory/4728-143-0x00007FF7F52B0000-0x00007FF7F5602000-memory.dmp

Download

memory/4728-97-0x00007FF7F52B0000-0x00007FF7F5602000-memory.dmp

Download

memory/5000-127-0x00007FF64A3A0000-0x00007FF64A6F2000-memory.dmp

Download

memory/5000-153-0x00007FF64A3A0000-0x00007FF64A6F2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads