cobaltstrike | 11c259ff1fb0c9e0462cf672591395d1033ae187cc8b132ddb1166787290236c

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample261027-lf87cadb64
SHA256 11c259ff1fb0c9e0462cf672591395d1033ae187cc8b132ddb1166787290236c
MD5 ac494091b58f44345061686639c5da14
SHA1 c0e101666801e17be17bcd203cd4572f6ea37e49
SHA512 cc1600cccc06a6ca9442173009a02066aee82f7dbe90ab9ad9d1c45be282df016cec33449652d84ccd93f4c92d734b1951ff0412eaaf6169512a20e3e9668748
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUy:v+D56utgpPF8u/7y
TLSH
T1AC965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000b000000016d03-5.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4c9-11.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4ca-17.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4cb-23.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4cc-28.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4cd-36.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4ce-42.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4d0-54.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4d2-68.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4d4-82.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4d8-109.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4db-127.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4dc-136.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4da-123.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4d9-116.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4d7-102.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4d6-95.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4d5-88.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4d3-74.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4d1-60.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4cf-48.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000b000000016d03-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4c9-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4ca-17.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4cb-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4cc-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4cd-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4ce-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4d0-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4d2-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4d4-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4d8-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4db-127.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4dc-136.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4da-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4d9-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4d7-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4d6-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4d5-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4d3-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4d1-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4cf-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2804-0-0x00007FF6A1FF0000-0x00007FF6A2342000-memory.dmp	UPX
behavioral2/files/0x000b000000016d03-5.dat	UPX
behavioral2/memory/4996-6-0x00007FF7E8060000-0x00007FF7E83B2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4c9-11.dat	UPX
behavioral2/memory/3260-12-0x00007FF7BB6D0000-0x00007FF7BBA22000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4ca-17.dat	UPX
behavioral2/files/0x000d00000001c4cb-23.dat	UPX
behavioral2/files/0x000d00000001c4cc-28.dat	UPX
behavioral2/files/0x000d00000001c4cd-36.dat	UPX
behavioral2/memory/6044-41-0x00007FF6BA4F0000-0x00007FF6BA842000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4ce-42.dat	UPX
behavioral2/memory/5268-47-0x00007FF60D820000-0x00007FF60DB72000-memory.dmp	UPX
behavioral2/memory/2328-53-0x00007FF66EB90000-0x00007FF66EEE2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4d0-54.dat	UPX
behavioral2/memory/3212-62-0x00007FF7D5C00000-0x00007FF7D5F52000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4d2-68.dat	UPX
behavioral2/memory/2548-76-0x00007FF682300000-0x00007FF682652000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4d4-82.dat	UPX
behavioral2/memory/1996-87-0x00007FF6871D0000-0x00007FF687522000-memory.dmp	UPX
behavioral2/memory/1976-93-0x00007FF67EB00000-0x00007FF67EE52000-memory.dmp	UPX
behavioral2/memory/2928-101-0x00007FF688180000-0x00007FF6884D2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4d8-109.dat	UPX
behavioral2/files/0x000d00000001c4db-127.dat	UPX
behavioral2/files/0x000d00000001c4dc-136.dat	UPX
behavioral2/memory/2668-135-0x00007FF605180000-0x00007FF6054D2000-memory.dmp	UPX
behavioral2/memory/2820-134-0x00007FF6F6610000-0x00007FF6F6962000-memory.dmp	UPX
behavioral2/memory/3368-129-0x00007FF618F70000-0x00007FF6192C2000-memory.dmp	UPX
behavioral2/memory/3212-128-0x00007FF7D5C00000-0x00007FF7D5F52000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4da-123.dat	UPX
behavioral2/memory/2640-122-0x00007FF61BED0000-0x00007FF61C222000-memory.dmp	UPX
behavioral2/memory/2328-121-0x00007FF66EB90000-0x00007FF66EEE2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4d9-116.dat	UPX
behavioral2/memory/4056-115-0x00007FF7BAD90000-0x00007FF7BB0E2000-memory.dmp	UPX
behavioral2/memory/5268-114-0x00007FF60D820000-0x00007FF60DB72000-memory.dmp	UPX
behavioral2/memory/108-108-0x00007FF6B2BF0000-0x00007FF6B2F42000-memory.dmp	UPX
behavioral2/memory/6044-107-0x00007FF6BA4F0000-0x00007FF6BA842000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4d7-102.dat	UPX
behavioral2/memory/5428-100-0x00007FF6ECF20000-0x00007FF6ED272000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4d6-95.dat	UPX
behavioral2/memory/5784-94-0x00007FF769B30000-0x00007FF769E82000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4d5-88.dat	UPX
behavioral2/memory/2028-81-0x00007FF73E580000-0x00007FF73E8D2000-memory.dmp	UPX
behavioral2/memory/5068-80-0x00007FF77BEE0000-0x00007FF77C232000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4d3-74.dat	UPX
behavioral2/memory/3260-73-0x00007FF7BB6D0000-0x00007FF7BBA22000-memory.dmp	UPX
behavioral2/memory/2820-67-0x00007FF6F6610000-0x00007FF6F6962000-memory.dmp	UPX
behavioral2/memory/4996-66-0x00007FF7E8060000-0x00007FF7E83B2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4d1-60.dat	UPX
behavioral2/memory/2804-59-0x00007FF6A1FF0000-0x00007FF6A2342000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4cf-48.dat	UPX
behavioral2/memory/5428-35-0x00007FF6ECF20000-0x00007FF6ED272000-memory.dmp	UPX
behavioral2/memory/1976-29-0x00007FF67EB00000-0x00007FF67EE52000-memory.dmp	UPX
behavioral2/memory/2788-24-0x00007FF6E74F0000-0x00007FF6E7842000-memory.dmp	UPX
behavioral2/memory/5068-18-0x00007FF77BEE0000-0x00007FF77C232000-memory.dmp	UPX
behavioral2/memory/2548-139-0x00007FF682300000-0x00007FF682652000-memory.dmp	UPX
behavioral2/memory/2028-140-0x00007FF73E580000-0x00007FF73E8D2000-memory.dmp	UPX
behavioral2/memory/1996-141-0x00007FF6871D0000-0x00007FF687522000-memory.dmp	UPX
behavioral2/memory/5784-142-0x00007FF769B30000-0x00007FF769E82000-memory.dmp	UPX
behavioral2/memory/2928-143-0x00007FF688180000-0x00007FF6884D2000-memory.dmp	UPX
behavioral2/memory/108-144-0x00007FF6B2BF0000-0x00007FF6B2F42000-memory.dmp	UPX
behavioral2/memory/4056-145-0x00007FF7BAD90000-0x00007FF7BB0E2000-memory.dmp	UPX
behavioral2/memory/2640-146-0x00007FF61BED0000-0x00007FF61C222000-memory.dmp	UPX
behavioral2/memory/3368-147-0x00007FF618F70000-0x00007FF6192C2000-memory.dmp	UPX
behavioral2/memory/2668-148-0x00007FF605180000-0x00007FF6054D2000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2804-0-0x00007FF6A1FF0000-0x00007FF6A2342000-memory.dmp	xmrig
behavioral2/files/0x000b000000016d03-5.dat	xmrig
behavioral2/memory/4996-6-0x00007FF7E8060000-0x00007FF7E83B2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4c9-11.dat	xmrig
behavioral2/memory/3260-12-0x00007FF7BB6D0000-0x00007FF7BBA22000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4ca-17.dat	xmrig
behavioral2/files/0x000d00000001c4cb-23.dat	xmrig
behavioral2/files/0x000d00000001c4cc-28.dat	xmrig
behavioral2/files/0x000d00000001c4cd-36.dat	xmrig
behavioral2/memory/6044-41-0x00007FF6BA4F0000-0x00007FF6BA842000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4ce-42.dat	xmrig
behavioral2/memory/5268-47-0x00007FF60D820000-0x00007FF60DB72000-memory.dmp	xmrig
behavioral2/memory/2328-53-0x00007FF66EB90000-0x00007FF66EEE2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4d0-54.dat	xmrig
behavioral2/memory/3212-62-0x00007FF7D5C00000-0x00007FF7D5F52000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4d2-68.dat	xmrig
behavioral2/memory/2548-76-0x00007FF682300000-0x00007FF682652000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4d4-82.dat	xmrig
behavioral2/memory/1996-87-0x00007FF6871D0000-0x00007FF687522000-memory.dmp	xmrig
behavioral2/memory/1976-93-0x00007FF67EB00000-0x00007FF67EE52000-memory.dmp	xmrig
behavioral2/memory/2928-101-0x00007FF688180000-0x00007FF6884D2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4d8-109.dat	xmrig
behavioral2/files/0x000d00000001c4db-127.dat	xmrig
behavioral2/files/0x000d00000001c4dc-136.dat	xmrig
behavioral2/memory/2668-135-0x00007FF605180000-0x00007FF6054D2000-memory.dmp	xmrig
behavioral2/memory/2820-134-0x00007FF6F6610000-0x00007FF6F6962000-memory.dmp	xmrig
behavioral2/memory/3368-129-0x00007FF618F70000-0x00007FF6192C2000-memory.dmp	xmrig
behavioral2/memory/3212-128-0x00007FF7D5C00000-0x00007FF7D5F52000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4da-123.dat	xmrig
behavioral2/memory/2640-122-0x00007FF61BED0000-0x00007FF61C222000-memory.dmp	xmrig
behavioral2/memory/2328-121-0x00007FF66EB90000-0x00007FF66EEE2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4d9-116.dat	xmrig
behavioral2/memory/4056-115-0x00007FF7BAD90000-0x00007FF7BB0E2000-memory.dmp	xmrig
behavioral2/memory/5268-114-0x00007FF60D820000-0x00007FF60DB72000-memory.dmp	xmrig
behavioral2/memory/108-108-0x00007FF6B2BF0000-0x00007FF6B2F42000-memory.dmp	xmrig
behavioral2/memory/6044-107-0x00007FF6BA4F0000-0x00007FF6BA842000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4d7-102.dat	xmrig
behavioral2/memory/5428-100-0x00007FF6ECF20000-0x00007FF6ED272000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4d6-95.dat	xmrig
behavioral2/memory/5784-94-0x00007FF769B30000-0x00007FF769E82000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4d5-88.dat	xmrig
behavioral2/memory/2028-81-0x00007FF73E580000-0x00007FF73E8D2000-memory.dmp	xmrig
behavioral2/memory/5068-80-0x00007FF77BEE0000-0x00007FF77C232000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4d3-74.dat	xmrig
behavioral2/memory/3260-73-0x00007FF7BB6D0000-0x00007FF7BBA22000-memory.dmp	xmrig
behavioral2/memory/2820-67-0x00007FF6F6610000-0x00007FF6F6962000-memory.dmp	xmrig
behavioral2/memory/4996-66-0x00007FF7E8060000-0x00007FF7E83B2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4d1-60.dat	xmrig
behavioral2/memory/2804-59-0x00007FF6A1FF0000-0x00007FF6A2342000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4cf-48.dat	xmrig
behavioral2/memory/5428-35-0x00007FF6ECF20000-0x00007FF6ED272000-memory.dmp	xmrig
behavioral2/memory/1976-29-0x00007FF67EB00000-0x00007FF67EE52000-memory.dmp	xmrig
behavioral2/memory/2788-24-0x00007FF6E74F0000-0x00007FF6E7842000-memory.dmp	xmrig
behavioral2/memory/5068-18-0x00007FF77BEE0000-0x00007FF77C232000-memory.dmp	xmrig
behavioral2/memory/2548-139-0x00007FF682300000-0x00007FF682652000-memory.dmp	xmrig
behavioral2/memory/2028-140-0x00007FF73E580000-0x00007FF73E8D2000-memory.dmp	xmrig
behavioral2/memory/1996-141-0x00007FF6871D0000-0x00007FF687522000-memory.dmp	xmrig
behavioral2/memory/5784-142-0x00007FF769B30000-0x00007FF769E82000-memory.dmp	xmrig
behavioral2/memory/2928-143-0x00007FF688180000-0x00007FF6884D2000-memory.dmp	xmrig
behavioral2/memory/108-144-0x00007FF6B2BF0000-0x00007FF6B2F42000-memory.dmp	xmrig
behavioral2/memory/4056-145-0x00007FF7BAD90000-0x00007FF7BB0E2000-memory.dmp	xmrig
behavioral2/memory/2640-146-0x00007FF61BED0000-0x00007FF61C222000-memory.dmp	xmrig
behavioral2/memory/3368-147-0x00007FF618F70000-0x00007FF6192C2000-memory.dmp	xmrig
behavioral2/memory/2668-148-0x00007FF605180000-0x00007FF6054D2000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4996	vZCzpqn.exe
3260	DkiNqhF.exe
5068	IucxvJp.exe
2788	YbBNSDC.exe
1976	ucidbZf.exe
5428	RjrBAcP.exe
6044	PpgEPMO.exe
5268	KtNaUiS.exe
2328	UYoMHSy.exe
3212	tpVGxvV.exe
2820	FvqdDmz.exe
2548	TQPYaWk.exe
2028	nbVfvol.exe
1996	ginKjht.exe
5784	gXMjFEQ.exe
2928	ykJQGtQ.exe
108	RJRMaGY.exe
4056	XEsrUoD.exe
2640	KCuJamw.exe
3368	rdtITXt.exe
2668	FqVkjDC.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2804-0-0x00007FF6A1FF0000-0x00007FF6A2342000-memory.dmp	upx
behavioral2/files/0x000b000000016d03-5.dat	upx
behavioral2/memory/4996-6-0x00007FF7E8060000-0x00007FF7E83B2000-memory.dmp	upx
behavioral2/files/0x000d00000001c4c9-11.dat	upx
behavioral2/memory/3260-12-0x00007FF7BB6D0000-0x00007FF7BBA22000-memory.dmp	upx
behavioral2/files/0x000d00000001c4ca-17.dat	upx
behavioral2/files/0x000d00000001c4cb-23.dat	upx
behavioral2/files/0x000d00000001c4cc-28.dat	upx
behavioral2/files/0x000d00000001c4cd-36.dat	upx
behavioral2/memory/6044-41-0x00007FF6BA4F0000-0x00007FF6BA842000-memory.dmp	upx
behavioral2/files/0x000d00000001c4ce-42.dat	upx
behavioral2/memory/5268-47-0x00007FF60D820000-0x00007FF60DB72000-memory.dmp	upx
behavioral2/memory/2328-53-0x00007FF66EB90000-0x00007FF66EEE2000-memory.dmp	upx
behavioral2/files/0x000d00000001c4d0-54.dat	upx
behavioral2/memory/3212-62-0x00007FF7D5C00000-0x00007FF7D5F52000-memory.dmp	upx
behavioral2/files/0x000d00000001c4d2-68.dat	upx
behavioral2/memory/2548-76-0x00007FF682300000-0x00007FF682652000-memory.dmp	upx
behavioral2/files/0x000d00000001c4d4-82.dat	upx
behavioral2/memory/1996-87-0x00007FF6871D0000-0x00007FF687522000-memory.dmp	upx
behavioral2/memory/1976-93-0x00007FF67EB00000-0x00007FF67EE52000-memory.dmp	upx
behavioral2/memory/2928-101-0x00007FF688180000-0x00007FF6884D2000-memory.dmp	upx
behavioral2/files/0x000d00000001c4d8-109.dat	upx
behavioral2/files/0x000d00000001c4db-127.dat	upx
behavioral2/files/0x000d00000001c4dc-136.dat	upx
behavioral2/memory/2668-135-0x00007FF605180000-0x00007FF6054D2000-memory.dmp	upx
behavioral2/memory/2820-134-0x00007FF6F6610000-0x00007FF6F6962000-memory.dmp	upx
behavioral2/memory/3368-129-0x00007FF618F70000-0x00007FF6192C2000-memory.dmp	upx
behavioral2/memory/3212-128-0x00007FF7D5C00000-0x00007FF7D5F52000-memory.dmp	upx
behavioral2/files/0x000d00000001c4da-123.dat	upx
behavioral2/memory/2640-122-0x00007FF61BED0000-0x00007FF61C222000-memory.dmp	upx
behavioral2/memory/2328-121-0x00007FF66EB90000-0x00007FF66EEE2000-memory.dmp	upx
behavioral2/files/0x000d00000001c4d9-116.dat	upx
behavioral2/memory/4056-115-0x00007FF7BAD90000-0x00007FF7BB0E2000-memory.dmp	upx
behavioral2/memory/5268-114-0x00007FF60D820000-0x00007FF60DB72000-memory.dmp	upx
behavioral2/memory/108-108-0x00007FF6B2BF0000-0x00007FF6B2F42000-memory.dmp	upx
behavioral2/memory/6044-107-0x00007FF6BA4F0000-0x00007FF6BA842000-memory.dmp	upx
behavioral2/files/0x000d00000001c4d7-102.dat	upx
behavioral2/memory/5428-100-0x00007FF6ECF20000-0x00007FF6ED272000-memory.dmp	upx
behavioral2/files/0x000d00000001c4d6-95.dat	upx
behavioral2/memory/5784-94-0x00007FF769B30000-0x00007FF769E82000-memory.dmp	upx
behavioral2/files/0x000d00000001c4d5-88.dat	upx
behavioral2/memory/2028-81-0x00007FF73E580000-0x00007FF73E8D2000-memory.dmp	upx
behavioral2/memory/5068-80-0x00007FF77BEE0000-0x00007FF77C232000-memory.dmp	upx
behavioral2/files/0x000d00000001c4d3-74.dat	upx
behavioral2/memory/3260-73-0x00007FF7BB6D0000-0x00007FF7BBA22000-memory.dmp	upx
behavioral2/memory/2820-67-0x00007FF6F6610000-0x00007FF6F6962000-memory.dmp	upx
behavioral2/memory/4996-66-0x00007FF7E8060000-0x00007FF7E83B2000-memory.dmp	upx
behavioral2/files/0x000d00000001c4d1-60.dat	upx
behavioral2/memory/2804-59-0x00007FF6A1FF0000-0x00007FF6A2342000-memory.dmp	upx
behavioral2/files/0x000d00000001c4cf-48.dat	upx
behavioral2/memory/5428-35-0x00007FF6ECF20000-0x00007FF6ED272000-memory.dmp	upx
behavioral2/memory/1976-29-0x00007FF67EB00000-0x00007FF67EE52000-memory.dmp	upx
behavioral2/memory/2788-24-0x00007FF6E74F0000-0x00007FF6E7842000-memory.dmp	upx
behavioral2/memory/5068-18-0x00007FF77BEE0000-0x00007FF77C232000-memory.dmp	upx
behavioral2/memory/2548-139-0x00007FF682300000-0x00007FF682652000-memory.dmp	upx
behavioral2/memory/2028-140-0x00007FF73E580000-0x00007FF73E8D2000-memory.dmp	upx
behavioral2/memory/1996-141-0x00007FF6871D0000-0x00007FF687522000-memory.dmp	upx
behavioral2/memory/5784-142-0x00007FF769B30000-0x00007FF769E82000-memory.dmp	upx
behavioral2/memory/2928-143-0x00007FF688180000-0x00007FF6884D2000-memory.dmp	upx
behavioral2/memory/108-144-0x00007FF6B2BF0000-0x00007FF6B2F42000-memory.dmp	upx
behavioral2/memory/4056-145-0x00007FF7BAD90000-0x00007FF7BB0E2000-memory.dmp	upx
behavioral2/memory/2640-146-0x00007FF61BED0000-0x00007FF61C222000-memory.dmp	upx
behavioral2/memory/3368-147-0x00007FF618F70000-0x00007FF6192C2000-memory.dmp	upx
behavioral2/memory/2668-148-0x00007FF605180000-0x00007FF6054D2000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\ykJQGtQ.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\RJRMaGY.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\FqVkjDC.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\IucxvJp.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\YbBNSDC.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ucidbZf.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\FvqdDmz.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\XEsrUoD.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\DkiNqhF.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\PpgEPMO.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\KtNaUiS.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\tpVGxvV.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\TQPYaWk.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\nbVfvol.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\vZCzpqn.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\RjrBAcP.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\UYoMHSy.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\KCuJamw.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\rdtITXt.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ginKjht.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\gXMjFEQ.exe	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 4996	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 2804 wrote to memory of 3260	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 2804 wrote to memory of 5068	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 2804 wrote to memory of 2788	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 2804 wrote to memory of 1976	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 2804 wrote to memory of 5428	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 2804 wrote to memory of 6044	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 2804 wrote to memory of 5268	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 2804 wrote to memory of 2328	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 2804 wrote to memory of 3212	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 2804 wrote to memory of 2820	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 2804 wrote to memory of 2548	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 2804 wrote to memory of 2028	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 2804 wrote to memory of 1996	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 2804 wrote to memory of 5784	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 2804 wrote to memory of 2928	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 2804 wrote to memory of 108	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 2804 wrote to memory of 4056	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 2804 wrote to memory of 2640	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 2804 wrote to memory of 3368	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109
PID 2804 wrote to memory of 2668	2804	2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_ac494091b58f44345061686639c5da14_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\System\vZCzpqn.exe
  C:\Windows\System\vZCzpqn.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\DkiNqhF.exe
  C:\Windows\System\DkiNqhF.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\IucxvJp.exe
  C:\Windows\System\IucxvJp.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\YbBNSDC.exe
  C:\Windows\System\YbBNSDC.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\ucidbZf.exe
  C:\Windows\System\ucidbZf.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\RjrBAcP.exe
  C:\Windows\System\RjrBAcP.exe
  2⤵
  - Executes dropped EXE
  PID:5428
- C:\Windows\System\PpgEPMO.exe
  C:\Windows\System\PpgEPMO.exe
  2⤵
  - Executes dropped EXE
  PID:6044
- C:\Windows\System\KtNaUiS.exe
  C:\Windows\System\KtNaUiS.exe
  2⤵
  - Executes dropped EXE
  PID:5268
- C:\Windows\System\UYoMHSy.exe
  C:\Windows\System\UYoMHSy.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\tpVGxvV.exe
  C:\Windows\System\tpVGxvV.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\FvqdDmz.exe
  C:\Windows\System\FvqdDmz.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\TQPYaWk.exe
  C:\Windows\System\TQPYaWk.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\nbVfvol.exe
  C:\Windows\System\nbVfvol.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\ginKjht.exe
  C:\Windows\System\ginKjht.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\gXMjFEQ.exe
  C:\Windows\System\gXMjFEQ.exe
  2⤵
  - Executes dropped EXE
  PID:5784
- C:\Windows\System\ykJQGtQ.exe
  C:\Windows\System\ykJQGtQ.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\RJRMaGY.exe
  C:\Windows\System\RJRMaGY.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\XEsrUoD.exe
  C:\Windows\System\XEsrUoD.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\KCuJamw.exe
  C:\Windows\System\KCuJamw.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\rdtITXt.exe
  C:\Windows\System\rdtITXt.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\FqVkjDC.exe
  C:\Windows\System\FqVkjDC.exe
  2⤵
  - Executes dropped EXE
  PID:2668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DkiNqhF.exe

Path C:\Windows\System\DkiNqhF.exe
Size 8.3MB
SHA256 012949984797723a0e88d7569aba9ed1062e8453772505d297ab30e9ef9f9f7d
MD5 956bc280e3bf9b04fd29770a09f86cd1
SHA1 d2db4dbac5e12345f48d1cba596a81b3db3e984a
SHA512 ea0dba38868ea0db29e39614f918b4e60c176a34e6bc3316f19b589f80232acf12c40d69889eb0166d906248365782eb3f98770962187115a2190cf4c51ffaba
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUg:v+D56utgpPF8u/7g
TLSH
T19B965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FqVkjDC.exe

Path C:\Windows\System\FqVkjDC.exe
Size 8.3MB
SHA256 48d5b9cff65f8e8d98e3d20c3a69a8f84d505d3173a6ae54364d962a435ca20f
MD5 15ea7aa60c67d2161fffa17a0b9cb7c3
SHA1 fe0080d2e962f90b9599aeb422c3ef336c2fde5b
SHA512 3206cf9719069b7698e32db10cbc55de7ee9c392380f1029e6ad4210dc176dca0b8d86bc239c5250bb6cf14eeadf81f224386f7be142df591311bd12cbf1e60f
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUL:v+D56utgpPF8u/7L
TLSH
T1FE965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FvqdDmz.exe

Path C:\Windows\System\FvqdDmz.exe
Size 8.3MB
SHA256 9581c5fb643140b962775de55465b4c40ce3aaa24907a5d3ca209ec9ae770ceb
MD5 b895ba044c5be203ab5a5aa479cf8f51
SHA1 ce0aa5d9ad55d5aba7e5219615762df5ba598621
SHA512 19554dda33aa694329e70e52462c14029b0d890ca6c096b9d33496a7cd7505845b5b99865d4a2465fca8bf3818d688a1e9d2f6c4199ce0f009eeeb1dd953ebe5
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUk:v+D56utgpPF8u/7k
TLSH
T1A5965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IucxvJp.exe

Path C:\Windows\System\IucxvJp.exe
Size 8.3MB
SHA256 976446051b3ac1fb52ea9b19986f26e6c591782e2e9321105b1b4e9d35008632
MD5 9ba56e1ef276f184a73292bbe19a480d
SHA1 614a887e8936b3515cc7ec30c41c12de06d4ece0
SHA512 d9103140be9485c5e32e2f279d4b3c5257af3ec36f1a5965665fc1d13dfe59da5cb41783b87edfa74eca94730469b076749dd1979834a8aa5b45b9b368fa608d
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUY:v+D56utgpPF8u/7Y
TLSH
T197965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KCuJamw.exe

Path C:\Windows\System\KCuJamw.exe
Size 8.3MB
SHA256 947f9332f225bcdf44b6291e8282c13b186ac7764c614ce0b76ad6a4da753163
MD5 f7d9292ad1936ea8a6d573da4d5b95e3
SHA1 7490f40e23818607208469d5be3e1e477a648187
SHA512 41415aedce70f2e38a30f0a138651e8beb8946a28ea9e055c17457a2e2bc90924e5adb4d1c8f08e2da183676c5573570b714ba548e50ceccd92b6bf5577c1ab7
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUu:v+D56utgpPF8u/7u
TLSH
T17B965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KtNaUiS.exe

Path C:\Windows\System\KtNaUiS.exe
Size 8.3MB
SHA256 0345b0cd313412a13639c8bb18e58b28ceb3693a5f1da9834511a2ae5ee2ecb5
MD5 4a0dfb2ea48032d4b00f79847e579fd9
SHA1 247d845e57d08613a4f611ac7ee57c2b1c7969c1
SHA512 9a4f74c1670e3c27bb422a1b414af2c6ebbb2f633d18614226077ea5143d3492171604ffaeee2214172d96f9315626d524c15d8c55fa6e884dcb58a5732c2405
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUO:v+D56utgpPF8u/7O
TLSH
T169965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PpgEPMO.exe

Path C:\Windows\System\PpgEPMO.exe
Size 8.3MB
SHA256 d8668072a8e0fd8eab68b8ed8ba1279e33ae4a40e784ff12d7ff523030180672
MD5 2069799e88f9eb53b3de47386ceae7a3
SHA1 dd21122771eb2c61e3fd21d43a737844fbf4c044
SHA512 c8efbc4cbdb2127b5a0815d03bc51eb41d5f125c604acd99d6201c6fd589a0056605992f1464be856497c6c9528e0d96261536b0a66da7906c6db50609216778
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUf:v+D56utgpPF8u/7f
TLSH
T184965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RJRMaGY.exe

Path C:\Windows\System\RJRMaGY.exe
Size 8.3MB
SHA256 871d12bc73301f3e2c8b374944746326d94a6c84aff1add9e86050b3d70bf9e8
MD5 d484632de049e901704b60522b73e35b
SHA1 150d297167ad9cff8d2c9aba7d7f73e09b58d4ec
SHA512 851aad33df1b02a5c5e9d38452b751d73f199ebac6bfb524f4f92dbcf84d9671eb52cc0a7046f2ccf33b5d3c93022c8f81af1daddd4a2e301866ce7e4be73eb8
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUb:v+D56utgpPF8u/7b
TLSH
T166965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RjrBAcP.exe

Path C:\Windows\System\RjrBAcP.exe
Size 8.3MB
SHA256 c989ae8b8f2994e22ed0d80a560ad074a589452e2ad97be3010263e096241d60
MD5 41d5a6f4d70b384b6582dcae3136247b
SHA1 98a22bd6bb1d6040df135221528b1f7463df19c1
SHA512 9ced927c57fdccbc21d13e2a238fb846fad4c3985a7dd84aa266f88b682b907b99f3b2de5155e4c48e62ca5a2c430a7f0d0c82e42166e99595bbd50cd318ae68
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUu:v+D56utgpPF8u/7u
TLSH
T1FF965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TQPYaWk.exe

Path C:\Windows\System\TQPYaWk.exe
Size 8.3MB
SHA256 59eccc81eae4da3ab406ba923d5fb3d236ecfcadaaa67faaffefb520ed5013b0
MD5 dd40846bac7a8e87148c23b19ceb6401
SHA1 7016a665d7c1829734d49ea0ef4d1d02a7f5c4be
SHA512 84ddbb6aaa0972bc3747d76b645f9bf21191eb68baffae5d3cb54cec10cfa5ff002228f49eda7630546614217583d40a0f51e6a38c6ff28c85ba99fca2aad3e1
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUq:v+D56utgpPF8u/7q
TLSH
T10D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UYoMHSy.exe

Path C:\Windows\System\UYoMHSy.exe
Size 8.3MB
SHA256 e87d08ab2c8ba839ae3d7554203f5fe6f0deeba7e00d0be25330296ac976eaee
MD5 406ac052717617dd4a40774ee2dd2173
SHA1 69b6ab6215ffe7e0101fa8120385af2efe163e90
SHA512 2f7903795e5ed1b3e0d2155d3e81f51b098245c6cf5e4043435c18e670056647db1f12c17b2a62447b23587d24242b715054d6641ce8f672830746e252ea3b0a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU+:v+D56utgpPF8u/7+
TLSH
T15C965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XEsrUoD.exe

Path C:\Windows\System\XEsrUoD.exe
Size 8.3MB
SHA256 6822165539f7abe4bae4b2052f0537117cf25685c24198048add07518addfa9d
MD5 178a632308696f9120a2c0dbb747dd04
SHA1 726c08f1e06fb38015464d569f90fa04e66d9a29
SHA512 026b38b594b38fa78d9e0dfda5a98fcb8b752d4d1357e52ba428181bed4493a34c66e2b8aecca52aa3338f6b21faf667e0640d0a195cf5c2077ae0e51b2511e4
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUr:v+D56utgpPF8u/7r
TLSH
T18A965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YbBNSDC.exe

Path C:\Windows\System\YbBNSDC.exe
Size 8.3MB
SHA256 46c92fd1b34b6c8bd3c496ce441d2b3e761ba83497ec2c4979e99388fead8320
MD5 efcb7df5abe6ff667baa7d1e700c02a1
SHA1 d92960f016341dc4f43e3dc786c74b0c1e0b815c
SHA512 5b84ecee24eedf964e2e40f4a9f665b582f1f972060d1c0e1c67dcc244157d85b95951722b3291174016d3c7370ef06b63fd56dec707722fe629e2d8df42ca0d
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUw:v+D56utgpPF8u/7w
TLSH
T15A965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gXMjFEQ.exe

Path C:\Windows\System\gXMjFEQ.exe
Size 8.3MB
SHA256 b4f2f72ffc7759d74086a9f1e67078c16fccc843e64e81798bf456784a008e45
MD5 045220afe77f68928a23f544e4539f11
SHA1 4756de04b0bbff48eef3407204e7e4bf77699696
SHA512 f17ec2d61b28bede29305bd10a8fa609329b951836398aa29a78995b4d5965b192ac796750aef73725be9b1bab5695557e5ba446f4b428ed3236b26fdee68423
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU+:v+D56utgpPF8u/7+
TLSH
T130965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ginKjht.exe

Path C:\Windows\System\ginKjht.exe
Size 8.3MB
SHA256 fd36264fe337a8b943195933aae98c12e4a2cfeec7162702178bbdf42490dbad
MD5 490d1477bd0dfd1d99a51e06240af7ca
SHA1 3eb3ec0ba8aec3576021e03ef03b70fbbf8bc576
SHA512 0c25fb57447e8eb0550856192ee45c3da50f38cbd90cf386998c6573b88ae4fb9fdedb637800929614df180649bc84807cacde92756e7071e35ecd3c6344034d
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUS:v+D56utgpPF8u/7S
TLSH
T17A965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nbVfvol.exe

Path C:\Windows\System\nbVfvol.exe
Size 8.3MB
SHA256 74569656b789990f428e6df53b6c61f7af77321dca4ccc56bfd55e443f82238d
MD5 7abca7261d9e1fb9607660c8c8698e76
SHA1 10a43d2eb0eba7035501432b3acec1841c45c2aa
SHA512 8d9d7e30f272785f1c4ea1863bc90fba6cc1cce75ccd4affe20baf6acf46fc57cb5c178534b0b194ca5234d9cc5b4525495ac91ca932658b4cf49beb2fc7d1c6
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUI:v+D56utgpPF8u/7I
TLSH
T132965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rdtITXt.exe

Path C:\Windows\System\rdtITXt.exe
Size 8.3MB
SHA256 082b61598124e80f5a0a0f02fdad3e9c238aae3ccc897bb59a2ce7f9611ffd2a
MD5 1dce01a1e9ca42d0f26c56a6ee520cc1
SHA1 dfa08bfbfd23db224ad495508f0462c4a1313f8d
SHA512 d96740f64aa57941f5ab889006e32be3baeeb80eafd879c9ebd065410c47fb2700b975bd7a3d1802707d786cdf29c3ce96974bf7829d3b54eec683375b61c2f8
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUm:v+D56utgpPF8u/7m
TLSH
T178965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tpVGxvV.exe

Path C:\Windows\System\tpVGxvV.exe
Size 8.3MB
SHA256 eef998e587118c86b2103aa9fd2c0f439850e42b39beb6b5141e6f4859f2e556
MD5 332447cc0eadd623bbf3f4d83453094b
SHA1 2a3957229902445351e23ccdc59d6373fbd28409
SHA512 9293550d0658daa64be0658b5514a25b29ff4202daa40eefdcef2e8e0905d25aefd8dbe8cac58b0e7e9f68634831e367c6ae5df19d6048ca6f5c2c76feb0dadc
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU8:v+D56utgpPF8u/78
TLSH
T17A965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucidbZf.exe

Path C:\Windows\System\ucidbZf.exe
Size 8.3MB
SHA256 ebf10259082f5e622c185c2b5c9e8d29ebea89c1fa95bc433ac4fa7d3a24dd22
MD5 cde64053222abb4332c8c55e4429679a
SHA1 16c062ebc0bfb13c47fe141a3e29e4d52c2a97e7
SHA512 bdb6ce95c898342484be5bedab912ca2408f1d9482b882a6fbaf344406b5f1ccd40c92fdb4ad4724d27bd38fb2f6c14106ae361fd6e409a0a33f3219c7897304
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUp:v+D56utgpPF8u/7p
TLSH
T151965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vZCzpqn.exe

Path C:\Windows\System\vZCzpqn.exe
Size 8.3MB
SHA256 cc7325c7b2610455343d053e948fd852527b0bcc33fa1022c57c97e7a7eec44b
MD5 39b60f214f9e8071d78c227198d05a09
SHA1 7812586ba9db308b1f5e88311c7ce897a22dc1d2
SHA512 013e600395c09be1a0283142930a9092960347c1c7dbc147fc3cd72597077fc37daf07c9bde554a413448c7582a6eb99e4b2d847d62efd21d07389c7287a425d
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUf:v+D56utgpPF8u/7f
TLSH
T175965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ykJQGtQ.exe

Path C:\Windows\System\ykJQGtQ.exe
Size 8.3MB
SHA256 86ead98251fa477b21c51e36420679d22fd71782ecab30f725c1f6d4fb36ea49
MD5 248dbcae9571ff50e577a31292c97574
SHA1 18b614c1cf60186e9a7f179d645ecb0937d79e0d
SHA512 a85c023ef41d7cfde6ca8f547f8c6cd34221feb126715631c1731a902c384c395204b11ace026bbd8cc07312016415475278993eeb95550e63cd41b54e84acb1
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUU:v+D56utgpPF8u/7U
TLSH
T114965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-144-0x00007FF6B2BF0000-0x00007FF6B2F42000-memory.dmp

Download

memory/108-108-0x00007FF6B2BF0000-0x00007FF6B2F42000-memory.dmp

Download

memory/108-166-0x00007FF6B2BF0000-0x00007FF6B2F42000-memory.dmp

Download

memory/1976-93-0x00007FF67EB00000-0x00007FF67EE52000-memory.dmp

Download

memory/1976-152-0x00007FF67EB00000-0x00007FF67EE52000-memory.dmp

Download

memory/1976-29-0x00007FF67EB00000-0x00007FF67EE52000-memory.dmp

Download

memory/1996-87-0x00007FF6871D0000-0x00007FF687522000-memory.dmp

Download

memory/1996-161-0x00007FF6871D0000-0x00007FF687522000-memory.dmp

Download

memory/1996-141-0x00007FF6871D0000-0x00007FF687522000-memory.dmp

Download

memory/2028-81-0x00007FF73E580000-0x00007FF73E8D2000-memory.dmp

Download

memory/2028-159-0x00007FF73E580000-0x00007FF73E8D2000-memory.dmp

Download

memory/2028-140-0x00007FF73E580000-0x00007FF73E8D2000-memory.dmp

Download

memory/2328-156-0x00007FF66EB90000-0x00007FF66EEE2000-memory.dmp

Download

memory/2328-121-0x00007FF66EB90000-0x00007FF66EEE2000-memory.dmp

Download

memory/2328-53-0x00007FF66EB90000-0x00007FF66EEE2000-memory.dmp

Download

memory/2548-76-0x00007FF682300000-0x00007FF682652000-memory.dmp

Download

memory/2548-160-0x00007FF682300000-0x00007FF682652000-memory.dmp

Download

memory/2548-139-0x00007FF682300000-0x00007FF682652000-memory.dmp

Download

memory/2640-122-0x00007FF61BED0000-0x00007FF61C222000-memory.dmp

Download

memory/2640-146-0x00007FF61BED0000-0x00007FF61C222000-memory.dmp

Download

memory/2640-167-0x00007FF61BED0000-0x00007FF61C222000-memory.dmp

Download

memory/2668-168-0x00007FF605180000-0x00007FF6054D2000-memory.dmp

Download

memory/2668-148-0x00007FF605180000-0x00007FF6054D2000-memory.dmp

Download

memory/2668-135-0x00007FF605180000-0x00007FF6054D2000-memory.dmp

Download

memory/2788-24-0x00007FF6E74F0000-0x00007FF6E7842000-memory.dmp

Download

memory/2788-169-0x00007FF6E74F0000-0x00007FF6E7842000-memory.dmp

Download

memory/2804-59-0x00007FF6A1FF0000-0x00007FF6A2342000-memory.dmp

Download

memory/2804-0-0x00007FF6A1FF0000-0x00007FF6A2342000-memory.dmp

Download

memory/2804-1-0x0000017400000000-0x0000017400010000-memory.dmp

Download

memory/2820-134-0x00007FF6F6610000-0x00007FF6F6962000-memory.dmp

Download

memory/2820-157-0x00007FF6F6610000-0x00007FF6F6962000-memory.dmp

Download

memory/2820-67-0x00007FF6F6610000-0x00007FF6F6962000-memory.dmp

Download

memory/2928-163-0x00007FF688180000-0x00007FF6884D2000-memory.dmp

Download

memory/2928-101-0x00007FF688180000-0x00007FF6884D2000-memory.dmp

Download

memory/2928-143-0x00007FF688180000-0x00007FF6884D2000-memory.dmp

Download

memory/3212-62-0x00007FF7D5C00000-0x00007FF7D5F52000-memory.dmp

Download

memory/3212-158-0x00007FF7D5C00000-0x00007FF7D5F52000-memory.dmp

Download

memory/3212-128-0x00007FF7D5C00000-0x00007FF7D5F52000-memory.dmp

Download

memory/3260-12-0x00007FF7BB6D0000-0x00007FF7BBA22000-memory.dmp

Download

memory/3260-73-0x00007FF7BB6D0000-0x00007FF7BBA22000-memory.dmp

Download

memory/3260-150-0x00007FF7BB6D0000-0x00007FF7BBA22000-memory.dmp

Download

memory/3368-129-0x00007FF618F70000-0x00007FF6192C2000-memory.dmp

Download

memory/3368-147-0x00007FF618F70000-0x00007FF6192C2000-memory.dmp

Download

memory/3368-165-0x00007FF618F70000-0x00007FF6192C2000-memory.dmp

Download

memory/4056-115-0x00007FF7BAD90000-0x00007FF7BB0E2000-memory.dmp

Download

memory/4056-145-0x00007FF7BAD90000-0x00007FF7BB0E2000-memory.dmp

Download

memory/4056-164-0x00007FF7BAD90000-0x00007FF7BB0E2000-memory.dmp

Download

memory/4996-149-0x00007FF7E8060000-0x00007FF7E83B2000-memory.dmp

Download

memory/4996-66-0x00007FF7E8060000-0x00007FF7E83B2000-memory.dmp

Download

memory/4996-6-0x00007FF7E8060000-0x00007FF7E83B2000-memory.dmp

Download

memory/5068-151-0x00007FF77BEE0000-0x00007FF77C232000-memory.dmp

Download

memory/5068-80-0x00007FF77BEE0000-0x00007FF77C232000-memory.dmp

Download

memory/5068-18-0x00007FF77BEE0000-0x00007FF77C232000-memory.dmp

Download

memory/5268-47-0x00007FF60D820000-0x00007FF60DB72000-memory.dmp

Download

memory/5268-155-0x00007FF60D820000-0x00007FF60DB72000-memory.dmp

Download

memory/5268-114-0x00007FF60D820000-0x00007FF60DB72000-memory.dmp

Download

memory/5428-153-0x00007FF6ECF20000-0x00007FF6ED272000-memory.dmp

Download

memory/5428-35-0x00007FF6ECF20000-0x00007FF6ED272000-memory.dmp

Download

memory/5428-100-0x00007FF6ECF20000-0x00007FF6ED272000-memory.dmp

Download

memory/5784-162-0x00007FF769B30000-0x00007FF769E82000-memory.dmp

Download

memory/5784-142-0x00007FF769B30000-0x00007FF769E82000-memory.dmp

Download

memory/5784-94-0x00007FF769B30000-0x00007FF769E82000-memory.dmp

Download

memory/6044-154-0x00007FF6BA4F0000-0x00007FF6BA842000-memory.dmp

Download

memory/6044-41-0x00007FF6BA4F0000-0x00007FF6BA842000-memory.dmp

Download

memory/6044-107-0x00007FF6BA4F0000-0x00007FF6BA842000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads