cobaltstrike | 8361a5b1e0ffbe6ccbf713364b18060b8798eecd9456caecd997d049875a070d

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample261027-mbl2pas1ht
SHA256 8361a5b1e0ffbe6ccbf713364b18060b8798eecd9456caecd997d049875a070d
MD5 a39b6e01b90c820ed6dda8f05c79d33a
SHA1 db6b8ba7fa8ebe6ce69f227e19bf409d00546015
SHA512 6a3555f325be0474222e96482b779619da6162d8c84b6844484d2d2e2d6373610f683e5289def88fefa1a727f30fe2874c9abc49c008189932c2f84dfeefc55e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUg:v+D56utgpPF8u/7g
TLSH
T10D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x0008000000024617-5.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002461e-30.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024622-45.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024626-60.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024628-81.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024627-95.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002462c-107.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002462b-105.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002462a-101.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024629-99.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024620-89.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024623-82.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024621-69.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002461f-67.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024625-55.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024624-52.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002461d-49.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002461c-35.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002461b-28.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002462d-120.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002462e-121.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024617-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002461e-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024622-45.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024626-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024628-81.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024627-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002462c-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002462b-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002462a-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024629-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024620-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024623-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024621-69.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002461f-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024625-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024624-52.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002461d-49.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002461c-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002461b-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002462d-120.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002462e-121.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral1/memory/4940-0-0x00007FF7EACA0000-0x00007FF7EAFF2000-memory.dmp	UPX
behavioral1/files/0x0008000000024617-5.dat	UPX
behavioral1/files/0x000700000002461e-30.dat	UPX
behavioral1/files/0x0007000000024622-45.dat	UPX
behavioral1/files/0x0007000000024626-60.dat	UPX
behavioral1/memory/1472-58-0x00007FF642B60000-0x00007FF642EB2000-memory.dmp	UPX
behavioral1/files/0x0007000000024628-81.dat	UPX
behavioral1/files/0x0007000000024627-95.dat	UPX
behavioral1/files/0x000700000002462c-107.dat	UPX
behavioral1/memory/3852-113-0x00007FF7E4CB0000-0x00007FF7E5002000-memory.dmp	UPX
behavioral1/memory/3688-115-0x00007FF739AF0000-0x00007FF739E42000-memory.dmp	UPX
behavioral1/memory/1140-114-0x00007FF758B00000-0x00007FF758E52000-memory.dmp	UPX
behavioral1/memory/768-112-0x00007FF70A1F0000-0x00007FF70A542000-memory.dmp	UPX
behavioral1/memory/5112-111-0x00007FF687F20000-0x00007FF688272000-memory.dmp	UPX
behavioral1/memory/3360-110-0x00007FF792670000-0x00007FF7929C2000-memory.dmp	UPX
behavioral1/memory/4888-109-0x00007FF7E5030000-0x00007FF7E5382000-memory.dmp	UPX
behavioral1/files/0x000700000002462b-105.dat	UPX
behavioral1/memory/3048-104-0x00007FF6A2880000-0x00007FF6A2BD2000-memory.dmp	UPX
behavioral1/memory/5312-103-0x00007FF673610000-0x00007FF673962000-memory.dmp	UPX
behavioral1/files/0x000700000002462a-101.dat	UPX
behavioral1/files/0x0007000000024629-99.dat	UPX
behavioral1/memory/5364-98-0x00007FF6FDB30000-0x00007FF6FDE82000-memory.dmp	UPX
behavioral1/memory/2324-97-0x00007FF65A6C0000-0x00007FF65AA12000-memory.dmp	UPX
behavioral1/files/0x0007000000024620-89.dat	UPX
behavioral1/memory/4272-88-0x00007FF7E4FE0000-0x00007FF7E5332000-memory.dmp	UPX
behavioral1/memory/5420-87-0x00007FF7B3A80000-0x00007FF7B3DD2000-memory.dmp	UPX
behavioral1/files/0x0007000000024623-82.dat	UPX
behavioral1/memory/4908-72-0x00007FF7EE790000-0x00007FF7EEAE2000-memory.dmp	UPX
behavioral1/files/0x0007000000024621-69.dat	UPX
behavioral1/files/0x000700000002461f-67.dat	UPX
behavioral1/files/0x0007000000024625-55.dat	UPX
behavioral1/files/0x0007000000024624-52.dat	UPX
behavioral1/files/0x000700000002461d-49.dat	UPX
behavioral1/memory/4644-44-0x00007FF798020000-0x00007FF798372000-memory.dmp	UPX
behavioral1/files/0x000700000002461c-35.dat	UPX
behavioral1/files/0x000700000002461b-28.dat	UPX
behavioral1/memory/4704-27-0x00007FF7609C0000-0x00007FF760D12000-memory.dmp	UPX
behavioral1/memory/4628-22-0x00007FF7F6870000-0x00007FF7F6BC2000-memory.dmp	UPX
behavioral1/memory/4496-7-0x00007FF73F9E0000-0x00007FF73FD32000-memory.dmp	UPX
behavioral1/files/0x000700000002462d-120.dat	UPX
behavioral1/files/0x000700000002462e-121.dat	UPX
behavioral1/memory/2648-126-0x00007FF7E7EC0000-0x00007FF7E8212000-memory.dmp	UPX
behavioral1/memory/5008-127-0x00007FF6C7850000-0x00007FF6C7BA2000-memory.dmp	UPX
behavioral1/memory/4940-128-0x00007FF7EACA0000-0x00007FF7EAFF2000-memory.dmp	UPX
behavioral1/memory/4496-129-0x00007FF73F9E0000-0x00007FF73FD32000-memory.dmp	UPX
behavioral1/memory/4628-130-0x00007FF7F6870000-0x00007FF7F6BC2000-memory.dmp	UPX
behavioral1/memory/4704-131-0x00007FF7609C0000-0x00007FF760D12000-memory.dmp	UPX
behavioral1/memory/4644-132-0x00007FF798020000-0x00007FF798372000-memory.dmp	UPX
behavioral1/memory/4908-134-0x00007FF7EE790000-0x00007FF7EEAE2000-memory.dmp	UPX
behavioral1/memory/1472-133-0x00007FF642B60000-0x00007FF642EB2000-memory.dmp	UPX
behavioral1/memory/4496-135-0x00007FF73F9E0000-0x00007FF73FD32000-memory.dmp	UPX
behavioral1/memory/4628-136-0x00007FF7F6870000-0x00007FF7F6BC2000-memory.dmp	UPX
behavioral1/memory/4272-137-0x00007FF7E4FE0000-0x00007FF7E5332000-memory.dmp	UPX
behavioral1/memory/2324-145-0x00007FF65A6C0000-0x00007FF65AA12000-memory.dmp	UPX
behavioral1/memory/4644-146-0x00007FF798020000-0x00007FF798372000-memory.dmp	UPX
behavioral1/memory/5312-149-0x00007FF673610000-0x00007FF673962000-memory.dmp	UPX
behavioral1/memory/4908-148-0x00007FF7EE790000-0x00007FF7EEAE2000-memory.dmp	UPX
behavioral1/memory/1140-147-0x00007FF758B00000-0x00007FF758E52000-memory.dmp	UPX
behavioral1/memory/4704-144-0x00007FF7609C0000-0x00007FF760D12000-memory.dmp	UPX
behavioral1/memory/5364-143-0x00007FF6FDB30000-0x00007FF6FDE82000-memory.dmp	UPX
behavioral1/memory/3852-142-0x00007FF7E4CB0000-0x00007FF7E5002000-memory.dmp	UPX
behavioral1/memory/5112-141-0x00007FF687F20000-0x00007FF688272000-memory.dmp	UPX
behavioral1/memory/1472-140-0x00007FF642B60000-0x00007FF642EB2000-memory.dmp	UPX
behavioral1/memory/5420-139-0x00007FF7B3A80000-0x00007FF7B3DD2000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/4940-0-0x00007FF7EACA0000-0x00007FF7EAFF2000-memory.dmp	xmrig
behavioral1/files/0x0008000000024617-5.dat	xmrig
behavioral1/files/0x000700000002461e-30.dat	xmrig
behavioral1/files/0x0007000000024622-45.dat	xmrig
behavioral1/files/0x0007000000024626-60.dat	xmrig
behavioral1/memory/1472-58-0x00007FF642B60000-0x00007FF642EB2000-memory.dmp	xmrig
behavioral1/files/0x0007000000024628-81.dat	xmrig
behavioral1/files/0x0007000000024627-95.dat	xmrig
behavioral1/files/0x000700000002462c-107.dat	xmrig
behavioral1/memory/3852-113-0x00007FF7E4CB0000-0x00007FF7E5002000-memory.dmp	xmrig
behavioral1/memory/3688-115-0x00007FF739AF0000-0x00007FF739E42000-memory.dmp	xmrig
behavioral1/memory/1140-114-0x00007FF758B00000-0x00007FF758E52000-memory.dmp	xmrig
behavioral1/memory/768-112-0x00007FF70A1F0000-0x00007FF70A542000-memory.dmp	xmrig
behavioral1/memory/5112-111-0x00007FF687F20000-0x00007FF688272000-memory.dmp	xmrig
behavioral1/memory/3360-110-0x00007FF792670000-0x00007FF7929C2000-memory.dmp	xmrig
behavioral1/memory/4888-109-0x00007FF7E5030000-0x00007FF7E5382000-memory.dmp	xmrig
behavioral1/files/0x000700000002462b-105.dat	xmrig
behavioral1/memory/3048-104-0x00007FF6A2880000-0x00007FF6A2BD2000-memory.dmp	xmrig
behavioral1/memory/5312-103-0x00007FF673610000-0x00007FF673962000-memory.dmp	xmrig
behavioral1/files/0x000700000002462a-101.dat	xmrig
behavioral1/files/0x0007000000024629-99.dat	xmrig
behavioral1/memory/5364-98-0x00007FF6FDB30000-0x00007FF6FDE82000-memory.dmp	xmrig
behavioral1/memory/2324-97-0x00007FF65A6C0000-0x00007FF65AA12000-memory.dmp	xmrig
behavioral1/files/0x0007000000024620-89.dat	xmrig
behavioral1/memory/4272-88-0x00007FF7E4FE0000-0x00007FF7E5332000-memory.dmp	xmrig
behavioral1/memory/5420-87-0x00007FF7B3A80000-0x00007FF7B3DD2000-memory.dmp	xmrig
behavioral1/files/0x0007000000024623-82.dat	xmrig
behavioral1/memory/4908-72-0x00007FF7EE790000-0x00007FF7EEAE2000-memory.dmp	xmrig
behavioral1/files/0x0007000000024621-69.dat	xmrig
behavioral1/files/0x000700000002461f-67.dat	xmrig
behavioral1/files/0x0007000000024625-55.dat	xmrig
behavioral1/files/0x0007000000024624-52.dat	xmrig
behavioral1/files/0x000700000002461d-49.dat	xmrig
behavioral1/memory/4644-44-0x00007FF798020000-0x00007FF798372000-memory.dmp	xmrig
behavioral1/files/0x000700000002461c-35.dat	xmrig
behavioral1/files/0x000700000002461b-28.dat	xmrig
behavioral1/memory/4704-27-0x00007FF7609C0000-0x00007FF760D12000-memory.dmp	xmrig
behavioral1/memory/4628-22-0x00007FF7F6870000-0x00007FF7F6BC2000-memory.dmp	xmrig
behavioral1/memory/4496-7-0x00007FF73F9E0000-0x00007FF73FD32000-memory.dmp	xmrig
behavioral1/files/0x000700000002462d-120.dat	xmrig
behavioral1/files/0x000700000002462e-121.dat	xmrig
behavioral1/memory/2648-126-0x00007FF7E7EC0000-0x00007FF7E8212000-memory.dmp	xmrig
behavioral1/memory/5008-127-0x00007FF6C7850000-0x00007FF6C7BA2000-memory.dmp	xmrig
behavioral1/memory/4940-128-0x00007FF7EACA0000-0x00007FF7EAFF2000-memory.dmp	xmrig
behavioral1/memory/4496-129-0x00007FF73F9E0000-0x00007FF73FD32000-memory.dmp	xmrig
behavioral1/memory/4628-130-0x00007FF7F6870000-0x00007FF7F6BC2000-memory.dmp	xmrig
behavioral1/memory/4704-131-0x00007FF7609C0000-0x00007FF760D12000-memory.dmp	xmrig
behavioral1/memory/4644-132-0x00007FF798020000-0x00007FF798372000-memory.dmp	xmrig
behavioral1/memory/4908-134-0x00007FF7EE790000-0x00007FF7EEAE2000-memory.dmp	xmrig
behavioral1/memory/1472-133-0x00007FF642B60000-0x00007FF642EB2000-memory.dmp	xmrig
behavioral1/memory/4496-135-0x00007FF73F9E0000-0x00007FF73FD32000-memory.dmp	xmrig
behavioral1/memory/4628-136-0x00007FF7F6870000-0x00007FF7F6BC2000-memory.dmp	xmrig
behavioral1/memory/4272-137-0x00007FF7E4FE0000-0x00007FF7E5332000-memory.dmp	xmrig
behavioral1/memory/2324-145-0x00007FF65A6C0000-0x00007FF65AA12000-memory.dmp	xmrig
behavioral1/memory/4644-146-0x00007FF798020000-0x00007FF798372000-memory.dmp	xmrig
behavioral1/memory/5312-149-0x00007FF673610000-0x00007FF673962000-memory.dmp	xmrig
behavioral1/memory/4908-148-0x00007FF7EE790000-0x00007FF7EEAE2000-memory.dmp	xmrig
behavioral1/memory/1140-147-0x00007FF758B00000-0x00007FF758E52000-memory.dmp	xmrig
behavioral1/memory/4704-144-0x00007FF7609C0000-0x00007FF760D12000-memory.dmp	xmrig
behavioral1/memory/5364-143-0x00007FF6FDB30000-0x00007FF6FDE82000-memory.dmp	xmrig
behavioral1/memory/3852-142-0x00007FF7E4CB0000-0x00007FF7E5002000-memory.dmp	xmrig
behavioral1/memory/5112-141-0x00007FF687F20000-0x00007FF688272000-memory.dmp	xmrig
behavioral1/memory/1472-140-0x00007FF642B60000-0x00007FF642EB2000-memory.dmp	xmrig
behavioral1/memory/5420-139-0x00007FF7B3A80000-0x00007FF7B3DD2000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4496	BjSPZHd.exe
4628	yguBJMf.exe
4644	QWnnOWX.exe
4704	upEEQKg.exe
5112	xoXmfUe.exe
1472	tdYAuQY.exe
4908	hQAAknl.exe
5420	scunbxQ.exe
768	dGEQjDN.exe
4272	MqLdDGG.exe
2324	cqtWxDj.exe
5364	fidNLvf.exe
3852	rZNlvpj.exe
5312	ZitWCTI.exe
1140	erxISOZ.exe
3048	RswxKFA.exe
4888	fwOyPAB.exe
3688	vhCPxro.exe
3360	bsbjHLE.exe
2648	qNdKKcN.exe
5008	COlWGwI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4940-0-0x00007FF7EACA0000-0x00007FF7EAFF2000-memory.dmp	upx
behavioral1/files/0x0008000000024617-5.dat	upx
behavioral1/files/0x000700000002461e-30.dat	upx
behavioral1/files/0x0007000000024622-45.dat	upx
behavioral1/files/0x0007000000024626-60.dat	upx
behavioral1/memory/1472-58-0x00007FF642B60000-0x00007FF642EB2000-memory.dmp	upx
behavioral1/files/0x0007000000024628-81.dat	upx
behavioral1/files/0x0007000000024627-95.dat	upx
behavioral1/files/0x000700000002462c-107.dat	upx
behavioral1/memory/3852-113-0x00007FF7E4CB0000-0x00007FF7E5002000-memory.dmp	upx
behavioral1/memory/3688-115-0x00007FF739AF0000-0x00007FF739E42000-memory.dmp	upx
behavioral1/memory/1140-114-0x00007FF758B00000-0x00007FF758E52000-memory.dmp	upx
behavioral1/memory/768-112-0x00007FF70A1F0000-0x00007FF70A542000-memory.dmp	upx
behavioral1/memory/5112-111-0x00007FF687F20000-0x00007FF688272000-memory.dmp	upx
behavioral1/memory/3360-110-0x00007FF792670000-0x00007FF7929C2000-memory.dmp	upx
behavioral1/memory/4888-109-0x00007FF7E5030000-0x00007FF7E5382000-memory.dmp	upx
behavioral1/files/0x000700000002462b-105.dat	upx
behavioral1/memory/3048-104-0x00007FF6A2880000-0x00007FF6A2BD2000-memory.dmp	upx
behavioral1/memory/5312-103-0x00007FF673610000-0x00007FF673962000-memory.dmp	upx
behavioral1/files/0x000700000002462a-101.dat	upx
behavioral1/files/0x0007000000024629-99.dat	upx
behavioral1/memory/5364-98-0x00007FF6FDB30000-0x00007FF6FDE82000-memory.dmp	upx
behavioral1/memory/2324-97-0x00007FF65A6C0000-0x00007FF65AA12000-memory.dmp	upx
behavioral1/files/0x0007000000024620-89.dat	upx
behavioral1/memory/4272-88-0x00007FF7E4FE0000-0x00007FF7E5332000-memory.dmp	upx
behavioral1/memory/5420-87-0x00007FF7B3A80000-0x00007FF7B3DD2000-memory.dmp	upx
behavioral1/files/0x0007000000024623-82.dat	upx
behavioral1/memory/4908-72-0x00007FF7EE790000-0x00007FF7EEAE2000-memory.dmp	upx
behavioral1/files/0x0007000000024621-69.dat	upx
behavioral1/files/0x000700000002461f-67.dat	upx
behavioral1/files/0x0007000000024625-55.dat	upx
behavioral1/files/0x0007000000024624-52.dat	upx
behavioral1/files/0x000700000002461d-49.dat	upx
behavioral1/memory/4644-44-0x00007FF798020000-0x00007FF798372000-memory.dmp	upx
behavioral1/files/0x000700000002461c-35.dat	upx
behavioral1/files/0x000700000002461b-28.dat	upx
behavioral1/memory/4704-27-0x00007FF7609C0000-0x00007FF760D12000-memory.dmp	upx
behavioral1/memory/4628-22-0x00007FF7F6870000-0x00007FF7F6BC2000-memory.dmp	upx
behavioral1/memory/4496-7-0x00007FF73F9E0000-0x00007FF73FD32000-memory.dmp	upx
behavioral1/files/0x000700000002462d-120.dat	upx
behavioral1/files/0x000700000002462e-121.dat	upx
behavioral1/memory/2648-126-0x00007FF7E7EC0000-0x00007FF7E8212000-memory.dmp	upx
behavioral1/memory/5008-127-0x00007FF6C7850000-0x00007FF6C7BA2000-memory.dmp	upx
behavioral1/memory/4940-128-0x00007FF7EACA0000-0x00007FF7EAFF2000-memory.dmp	upx
behavioral1/memory/4496-129-0x00007FF73F9E0000-0x00007FF73FD32000-memory.dmp	upx
behavioral1/memory/4628-130-0x00007FF7F6870000-0x00007FF7F6BC2000-memory.dmp	upx
behavioral1/memory/4704-131-0x00007FF7609C0000-0x00007FF760D12000-memory.dmp	upx
behavioral1/memory/4644-132-0x00007FF798020000-0x00007FF798372000-memory.dmp	upx
behavioral1/memory/4908-134-0x00007FF7EE790000-0x00007FF7EEAE2000-memory.dmp	upx
behavioral1/memory/1472-133-0x00007FF642B60000-0x00007FF642EB2000-memory.dmp	upx
behavioral1/memory/4496-135-0x00007FF73F9E0000-0x00007FF73FD32000-memory.dmp	upx
behavioral1/memory/4628-136-0x00007FF7F6870000-0x00007FF7F6BC2000-memory.dmp	upx
behavioral1/memory/4272-137-0x00007FF7E4FE0000-0x00007FF7E5332000-memory.dmp	upx
behavioral1/memory/2324-145-0x00007FF65A6C0000-0x00007FF65AA12000-memory.dmp	upx
behavioral1/memory/4644-146-0x00007FF798020000-0x00007FF798372000-memory.dmp	upx
behavioral1/memory/5312-149-0x00007FF673610000-0x00007FF673962000-memory.dmp	upx
behavioral1/memory/4908-148-0x00007FF7EE790000-0x00007FF7EEAE2000-memory.dmp	upx
behavioral1/memory/1140-147-0x00007FF758B00000-0x00007FF758E52000-memory.dmp	upx
behavioral1/memory/4704-144-0x00007FF7609C0000-0x00007FF760D12000-memory.dmp	upx
behavioral1/memory/5364-143-0x00007FF6FDB30000-0x00007FF6FDE82000-memory.dmp	upx
behavioral1/memory/3852-142-0x00007FF7E4CB0000-0x00007FF7E5002000-memory.dmp	upx
behavioral1/memory/5112-141-0x00007FF687F20000-0x00007FF688272000-memory.dmp	upx
behavioral1/memory/1472-140-0x00007FF642B60000-0x00007FF642EB2000-memory.dmp	upx
behavioral1/memory/5420-139-0x00007FF7B3A80000-0x00007FF7B3DD2000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\scunbxQ.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\dGEQjDN.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fidNLvf.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\bsbjHLE.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\QWnnOWX.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\cqtWxDj.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\RswxKFA.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fwOyPAB.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\yguBJMf.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\xoXmfUe.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\MqLdDGG.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\vhCPxro.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\qNdKKcN.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\COlWGwI.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\BjSPZHd.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\tdYAuQY.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ZitWCTI.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\erxISOZ.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\rZNlvpj.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\upEEQKg.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\hQAAknl.exe	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4496	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	86
PID 4940 wrote to memory of 4628	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	87
PID 4940 wrote to memory of 4644	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	88
PID 4940 wrote to memory of 4704	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	89
PID 4940 wrote to memory of 5112	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 4940 wrote to memory of 1472	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 4940 wrote to memory of 4908	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 4940 wrote to memory of 5420	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 4940 wrote to memory of 768	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 4940 wrote to memory of 4272	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 4940 wrote to memory of 2324	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 4940 wrote to memory of 5364	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 4940 wrote to memory of 3852	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 4940 wrote to memory of 5312	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 4940 wrote to memory of 1140	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 4940 wrote to memory of 3048	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 4940 wrote to memory of 4888	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 4940 wrote to memory of 3688	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 4940 wrote to memory of 3360	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 4940 wrote to memory of 2648	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 4940 wrote to memory of 5008	4940	2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_a39b6e01b90c820ed6dda8f05c79d33a_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\System\BjSPZHd.exe
  C:\Windows\System\BjSPZHd.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\yguBJMf.exe
  C:\Windows\System\yguBJMf.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\QWnnOWX.exe
  C:\Windows\System\QWnnOWX.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\upEEQKg.exe
  C:\Windows\System\upEEQKg.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\xoXmfUe.exe
  C:\Windows\System\xoXmfUe.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\tdYAuQY.exe
  C:\Windows\System\tdYAuQY.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\hQAAknl.exe
  C:\Windows\System\hQAAknl.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\scunbxQ.exe
  C:\Windows\System\scunbxQ.exe
  2⤵
  - Executes dropped EXE
  PID:5420
- C:\Windows\System\dGEQjDN.exe
  C:\Windows\System\dGEQjDN.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\MqLdDGG.exe
  C:\Windows\System\MqLdDGG.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\cqtWxDj.exe
  C:\Windows\System\cqtWxDj.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\fidNLvf.exe
  C:\Windows\System\fidNLvf.exe
  2⤵
  - Executes dropped EXE
  PID:5364
- C:\Windows\System\rZNlvpj.exe
  C:\Windows\System\rZNlvpj.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\ZitWCTI.exe
  C:\Windows\System\ZitWCTI.exe
  2⤵
  - Executes dropped EXE
  PID:5312
- C:\Windows\System\erxISOZ.exe
  C:\Windows\System\erxISOZ.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\RswxKFA.exe
  C:\Windows\System\RswxKFA.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\fwOyPAB.exe
  C:\Windows\System\fwOyPAB.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\vhCPxro.exe
  C:\Windows\System\vhCPxro.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\bsbjHLE.exe
  C:\Windows\System\bsbjHLE.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\qNdKKcN.exe
  C:\Windows\System\qNdKKcN.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\COlWGwI.exe
  C:\Windows\System\COlWGwI.exe
  2⤵
  - Executes dropped EXE
  PID:5008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BjSPZHd.exe

Path C:\Windows\System\BjSPZHd.exe
Size 8.3MB
SHA256 ba02d1852124d6357fe4e20acb0d964c121c5e5356c78746249a174bec753a0d
MD5 ea8577f2401ce3b8e1943f8cfcb12239
SHA1 a93090165673ee7f5fabc7cf1cf6944ee03d0a87
SHA512 cbc06f858448ccf89a2f65eb4652b950c4d6fbbaa5cb10c3dafbb3f3c6100fb1dd241a51e415cfbfcee74b946ea7594b4272f72e1f8ab49b0eec251ec1174644
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUk:v+D56utgpPF8u/7k
TLSH
T1B5965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COlWGwI.exe

Path C:\Windows\System\COlWGwI.exe
Size 8.3MB
SHA256 5de9c273e6d7f9f5502b48d2e5c43a878d85fbada759816fcbdffe0be9a41ec0
MD5 c791290e8a809718f200da1a013f009c
SHA1 93495fc4ab5465df67498ea38d8b748d03fe6909
SHA512 86443c016512f55667a9951df6c84945fe712d6c3782c07f278c59bbe9c8bb3ad9db9982a3536c95eb978e27ae1c82686ef90ab5eb84a390b83fb7f9ef59c19b
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU/:v+D56utgpPF8u/7/
TLSH
T118965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MqLdDGG.exe

Path C:\Windows\System\MqLdDGG.exe
Size 8.3MB
SHA256 182891547591a03139869c117a2794b5529deaed34cce54b2b316f5eb010d80a
MD5 90c369c9ffbd5ecf2f50196c959e4138
SHA1 ee15dbd10da556ecea5b655a10348e5e1bac82ba
SHA512 0737d601ff13b89e402d51a7c0412fc5e12f63620d0a3799e33e9c5bd3209201ebffcc667653458f0670c9578bb5d74b8fb4655538eb0bdb792045f1d6238a79
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUK:v+D56utgpPF8u/7K
TLSH
T130965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QWnnOWX.exe

Path C:\Windows\System\QWnnOWX.exe
Size 8.3MB
SHA256 0ceaa616f74b077c7b526c050a8a26b2b5fe76b63c72641dd9c287a056eea2bf
MD5 c15b518fe1267cd8d0bbabf4e9385a77
SHA1 cdd7eba7a31182960d8692e599152a4beef3400e
SHA512 bd47551eaef2c80e6ee0724fbd4b6b7a6b4d0c7eb00801c2046f189b9331cce9f7f28d74ce6e653d618cd0a971467a5dd7ef0e8ffe3bf3ea6961ba0d8c203512
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUw:v+D56utgpPF8u/7w
TLSH
T18D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RswxKFA.exe

Path C:\Windows\System\RswxKFA.exe
Size 8.3MB
SHA256 485b7dd0f88ed1a733fc9d52363cc3687161a284cf78e40167ba08aac9bf5aa8
MD5 f799e5ef81beb8b8ab79cce5168228d9
SHA1 31c5dde990ef69c15ea2190f69c4473b146ce2fe
SHA512 b2998eab8ee16a43dbd905b18b7e4818c4fc25fb00a0f49cf9cbc0d66c685caea7d5a0f8861d4a0976d3027540e9f4516f807f415af530785e16b4f2ed3ba4d1
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUr:v+D56utgpPF8u/7r
TLSH
T171965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZitWCTI.exe

Path C:\Windows\System\ZitWCTI.exe
Size 8.3MB
SHA256 cba80e2d1f98291b91593c134b3cb544c2e2ec862dbea40069ceb7dcba6159ee
MD5 f3138dac7b90212d8f2c7f634d150b46
SHA1 fc8ea9c1edcc8e67c5ab7a782f50062d6dc26032
SHA512 e7b007f7778002878598c93842080fbf1bcb098371f9763d28b34f1b5da9e43b51b7a3b2906d4d2ffafbcb80f914d3f7326963e2fb66abc2345c1fe8c57ac9d6
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUI:v+D56utgpPF8u/7I
TLSH
T1E8965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bsbjHLE.exe

Path C:\Windows\System\bsbjHLE.exe
Size 8.3MB
SHA256 2ef6e37ac825e04a1c7ad96bba20705702f10d2ba0840757bf30fc37ef29231d
MD5 0395f1a3759bd804d6b4aa9880c504a7
SHA1 3b98f77f817ff480175072de2c53665311d8fdfe
SHA512 5a4be407c9f81446d1897b5054f7b53a77445687a549566725226ccef28c884d7d541a5cc8eb3df4cf22a75e1ab19bfc11fc2adbfa7b2a6ac1b65e3e6b2ab480
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUB:v+D56utgpPF8u/7B
TLSH
T106965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cqtWxDj.exe

Path C:\Windows\System\cqtWxDj.exe
Size 8.3MB
SHA256 4b1c855ad319ed2dca0f09aa077a525bc7c86cbcfe3766513a77bac4f78eaa32
MD5 26a8016e04a9512dd37b5cf7168744d5
SHA1 800ce694fced0feef7553b62847ba02943b76f66
SHA512 92d98289be3a38a8c39ce2887262602badfff0c5cc075e475acca0774578d189f9cf54d494ebcd31fbaa9edff087fad6656a8ef35a1d07de8f2f6879f9228921
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUD:v+D56utgpPF8u/7D
TLSH
T101965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dGEQjDN.exe

Path C:\Windows\System\dGEQjDN.exe
Size 8.3MB
SHA256 454879a4279b1486225d33d619cdac0b7a295e4931afd7e4a1956301fcc79db4
MD5 4ddd89d13728d3c9a661689a8f04b215
SHA1 2f1865d2141d3a1136f8066eb007a42453eee16f
SHA512 c64dc1f85141e54514c81b69bdcccfc7dbe4f5febfd24b93ec09424593a48003900ba92c3cae8afe2ce6b8fa44663f593ae8d66602389083aa106bbc65e046d2
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUn:v+D56utgpPF8u/7n
TLSH
T136965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

erxISOZ.exe

Path C:\Windows\System\erxISOZ.exe
Size 8.3MB
SHA256 5cc8d2984ec6c7adf17b420223557393ece487d94bb66eafd3ba5dbb23fd3950
MD5 d7f37af4e3597e6a9a5574ceabbd1290
SHA1 3b91d719268dcd523fa9a74b289fc48fcce5c8a8
SHA512 73c977ad8cfe90e9bd4d89250c4e89d4c12300069bce4c4ac932d1d7c44ec567208e47535b60bc8ea9d861f56fb3d7eeecf82f1f49c41522ce1a75d09d462426
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUt:v+D56utgpPF8u/7t
TLSH
T166965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fidNLvf.exe

Path C:\Windows\System\fidNLvf.exe
Size 8.3MB
SHA256 f1b217a6659ace1ca86b4c640b6cf316ec6aeda1a89e5b289835f70ee8b94e42
MD5 c6763b520461dcd5e68c2316d01dbab7
SHA1 010fd3dc3991a346b82ea859dfcfec491f255c4b
SHA512 ea06896f55c2261666dc8e8e63e255556216f8fce567a84e7230167dcc90937ba7731f783342d78ebc9b2149849bd2721a7370d16b06704540c8b3c525ad4713
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUi:v+D56utgpPF8u/7i
TLSH
T131965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fwOyPAB.exe

Path C:\Windows\System\fwOyPAB.exe
Size 8.3MB
SHA256 c9c4c6df0ced9917675c991423569b1a52a65938adc6f38399a8a8306157b5bd
MD5 88dd5a6a1c6c718c4810c5c71539a4bf
SHA1 0e23c0f95971b37d6ed0c70853aa13a2e3a148bb
SHA512 b78f1e5302865b0b8702c6f7d1d879ed148720b5e49f658e76bfe80d2f042b45c6b6f315eb5290a8791b5d837fd063639c8be868246cf76c8ca0ac6f50b39893
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUp:v+D56utgpPF8u/7p
TLSH
T1DC965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hQAAknl.exe

Path C:\Windows\System\hQAAknl.exe
Size 8.3MB
SHA256 c105175ac89c3757af90e1b34c685ed6e807e41da38de6cd9f533533472847b4
MD5 6ab81d7009e048b3d3421703c28d718e
SHA1 fba30e3cb167683c4e793c0c914a00d4487adef6
SHA512 452878f9b772f170b2901088e855f888c40258b706e18e312e1a02380a2230b1bb5bce7e1fca10cbca8ec2d235ccccc7492aa6fee7ced993a990593c2dc3f193
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUN:v+D56utgpPF8u/7N
TLSH
T17A965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qNdKKcN.exe

Path C:\Windows\System\qNdKKcN.exe
Size 8.3MB
SHA256 4162a2e6ad3b3d0d6cbc4bc4deba1074acf75757b9e190d77e06980fec6d574a
MD5 9f7a14b1087530cdcc0f983121ea3bdb
SHA1 76e72740e419abc88bafa15db6129fa51b56ade6
SHA512 e3d25e80ceaa6cd4a5455c0f9f2492f62a11806e69bde8471e67c0766ed3d80f31a60bc30e352719d2b71f0a3cdefaf229fe0038832247c7f3a40a8266393c2b
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUo:v+D56utgpPF8u/7o
TLSH
T137965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rZNlvpj.exe

Path C:\Windows\System\rZNlvpj.exe
Size 8.3MB
SHA256 dd311e83d478db86e2179c0511514616a08e76f18aeacecf2779a86e66854a80
MD5 70dee8dec23d38028ee56c080108edfb
SHA1 796afe5462d15f45b8ff5429a7eda986ab2f0858
SHA512 fc607e6121e6e9fc4b2ca3da18aa3c7b833e67f1dbed6aa3d28e23445e2db8f06e40bbad7dc03f7c6147b67531e0017e27869c7ccfec21a02b8dada95a59d886
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUt:v+D56utgpPF8u/7t
TLSH
T19A965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scunbxQ.exe

Path C:\Windows\System\scunbxQ.exe
Size 8.3MB
SHA256 4a5ce71f07586b2e90ad0aa85ce210696b31fcbb663c6635218a0307612defb0
MD5 f553c6a7cdf5670dba570105faa847ce
SHA1 4463b663c25f96f3075644be530cb12782cdc6f3
SHA512 453863341d6643bede2971726eb34b732b6a23d859ff992da9fe1a0c224efe2e31cf98804c1d69be26ae412d770433f924244a63f6afe79da6dae3ea2fe52272
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUF:v+D56utgpPF8u/7F
TLSH
T14C965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tdYAuQY.exe

Path C:\Windows\System\tdYAuQY.exe
Size 8.3MB
SHA256 09b8e4b705a4b5136f6dff57db9307885b82819b8ced2acedea9190645124d54
MD5 3bec260f798b3efde0a9033437eed5c7
SHA1 d830dd69f4d05128f6462a4a3220e1e4bc20f463
SHA512 5d2129b22b6e90ad9c9d6251e606695899665cb7495b81bb1128efb5cb885f041f6182b3e3cdf8103f1ad03a755975395bbaade4787c26893662b747dab81155
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUj:v+D56utgpPF8u/7j
TLSH
T1AE965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upEEQKg.exe

Path C:\Windows\System\upEEQKg.exe
Size 8.3MB
SHA256 0c1729649822c6491008b5127fe2c53905687544bf2bfaaa07dca897da853c01
MD5 b58b3b3cb096253fc207d21d7dcd67c3
SHA1 9cb92ec1cc01319fd98e7a296ff2327318b33fa1
SHA512 455683ce793579f1b9de283e9c796fc4a727280243e0002bf67f6cdfea15f391eeded52a5ced47fdc770f8e7e5e55e53234edd74825f9c78056b684481719812
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUN:v+D56utgpPF8u/7N
TLSH
T137965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vhCPxro.exe

Path C:\Windows\System\vhCPxro.exe
Size 8.3MB
SHA256 6d425c59d205d8051c431b2d0dab0bb0e731ab17c56b0508510137443e6e4d6c
MD5 9c47ce1225436ff3a202729a513445f2
SHA1 9df21f8339a2ea6f4aa9574853b4c483913eeda5
SHA512 e3f1d572608836920254f25e632118fd17f7ea028b72952839d6d29db55bea1714b4f5d6e3e3b533d9568affbefa682df22ecddbd9e6d702eb0b949310874bfb
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUy:v+D56utgpPF8u/7y
TLSH
T10E965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xoXmfUe.exe

Path C:\Windows\System\xoXmfUe.exe
Size 8.3MB
SHA256 0b989d7ff68271b43e956868963c1f915b4b4827bef1e0202d95ca0bfff963db
MD5 bf6d95fe748b6760def7b9cd75295dd8
SHA1 122e062f8acde4c895a2756933005c8211a1e6a3
SHA512 d2c025fcac49837a61418a827da089cc9de63a80116d16a9bf1c30e3821bb7da0e7e1f9879ca15cf7dfc48813bfdf0a810878eb78fff7aec529bffa99854ca99
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU4:v+D56utgpPF8u/74
TLSH
T1CF965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yguBJMf.exe

Path C:\Windows\System\yguBJMf.exe
Size 8.3MB
SHA256 d806c667692f59b19eefc8d4b6ade4bdf89614107cdb4565488027014d80d8a2
MD5 97489d48ebb3b9dd2fc947314268a627
SHA1 6a6e266f4ac487e1f98d530d7f478a6e67efcbad
SHA512 465a63721af89e45313d723e2ccbc3e6a31029a4d13679d11a30110ad36f8c1e999bb68708dbb4e41d7133972fbb38ebeb0b6394deda0cd4c1224bfd58175d57
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUY:v+D56utgpPF8u/7Y
TLSH
T1B6965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/768-138-0x00007FF70A1F0000-0x00007FF70A542000-memory.dmp

Download

memory/768-112-0x00007FF70A1F0000-0x00007FF70A542000-memory.dmp

Download

memory/1140-114-0x00007FF758B00000-0x00007FF758E52000-memory.dmp

Download

memory/1140-147-0x00007FF758B00000-0x00007FF758E52000-memory.dmp

Download

memory/1472-140-0x00007FF642B60000-0x00007FF642EB2000-memory.dmp

Download

memory/1472-58-0x00007FF642B60000-0x00007FF642EB2000-memory.dmp

Download

memory/1472-133-0x00007FF642B60000-0x00007FF642EB2000-memory.dmp

Download

memory/2324-97-0x00007FF65A6C0000-0x00007FF65AA12000-memory.dmp

Download

memory/2324-145-0x00007FF65A6C0000-0x00007FF65AA12000-memory.dmp

Download

memory/2648-126-0x00007FF7E7EC0000-0x00007FF7E8212000-memory.dmp

Download

memory/2648-154-0x00007FF7E7EC0000-0x00007FF7E8212000-memory.dmp

Download

memory/3048-104-0x00007FF6A2880000-0x00007FF6A2BD2000-memory.dmp

Download

memory/3048-152-0x00007FF6A2880000-0x00007FF6A2BD2000-memory.dmp

Download

memory/3360-150-0x00007FF792670000-0x00007FF7929C2000-memory.dmp

Download

memory/3360-110-0x00007FF792670000-0x00007FF7929C2000-memory.dmp

Download

memory/3688-115-0x00007FF739AF0000-0x00007FF739E42000-memory.dmp

Download

memory/3688-151-0x00007FF739AF0000-0x00007FF739E42000-memory.dmp

Download

memory/3852-113-0x00007FF7E4CB0000-0x00007FF7E5002000-memory.dmp

Download

memory/3852-142-0x00007FF7E4CB0000-0x00007FF7E5002000-memory.dmp

Download

memory/4272-88-0x00007FF7E4FE0000-0x00007FF7E5332000-memory.dmp

Download

memory/4272-137-0x00007FF7E4FE0000-0x00007FF7E5332000-memory.dmp

Download

memory/4496-129-0x00007FF73F9E0000-0x00007FF73FD32000-memory.dmp

Download

memory/4496-135-0x00007FF73F9E0000-0x00007FF73FD32000-memory.dmp

Download

memory/4496-7-0x00007FF73F9E0000-0x00007FF73FD32000-memory.dmp

Download

memory/4628-22-0x00007FF7F6870000-0x00007FF7F6BC2000-memory.dmp

Download

memory/4628-130-0x00007FF7F6870000-0x00007FF7F6BC2000-memory.dmp

Download

memory/4628-136-0x00007FF7F6870000-0x00007FF7F6BC2000-memory.dmp

Download

memory/4644-146-0x00007FF798020000-0x00007FF798372000-memory.dmp

Download

memory/4644-132-0x00007FF798020000-0x00007FF798372000-memory.dmp

Download

memory/4644-44-0x00007FF798020000-0x00007FF798372000-memory.dmp

Download

memory/4704-131-0x00007FF7609C0000-0x00007FF760D12000-memory.dmp

Download

memory/4704-144-0x00007FF7609C0000-0x00007FF760D12000-memory.dmp

Download

memory/4704-27-0x00007FF7609C0000-0x00007FF760D12000-memory.dmp

Download

memory/4888-109-0x00007FF7E5030000-0x00007FF7E5382000-memory.dmp

Download

memory/4888-153-0x00007FF7E5030000-0x00007FF7E5382000-memory.dmp

Download

memory/4908-134-0x00007FF7EE790000-0x00007FF7EEAE2000-memory.dmp

Download

memory/4908-72-0x00007FF7EE790000-0x00007FF7EEAE2000-memory.dmp

Download

memory/4908-148-0x00007FF7EE790000-0x00007FF7EEAE2000-memory.dmp

Download

memory/4940-0-0x00007FF7EACA0000-0x00007FF7EAFF2000-memory.dmp

Download

memory/4940-128-0x00007FF7EACA0000-0x00007FF7EAFF2000-memory.dmp

Download

memory/4940-1-0x000001E245C30000-0x000001E245C40000-memory.dmp

Download

memory/5008-127-0x00007FF6C7850000-0x00007FF6C7BA2000-memory.dmp

Download

memory/5008-155-0x00007FF6C7850000-0x00007FF6C7BA2000-memory.dmp

Download

memory/5112-111-0x00007FF687F20000-0x00007FF688272000-memory.dmp

Download

memory/5112-141-0x00007FF687F20000-0x00007FF688272000-memory.dmp

Download

memory/5312-149-0x00007FF673610000-0x00007FF673962000-memory.dmp

Download

memory/5312-103-0x00007FF673610000-0x00007FF673962000-memory.dmp

Download

memory/5364-143-0x00007FF6FDB30000-0x00007FF6FDE82000-memory.dmp

Download

memory/5364-98-0x00007FF6FDB30000-0x00007FF6FDE82000-memory.dmp

Download

memory/5420-139-0x00007FF7B3A80000-0x00007FF7B3DD2000-memory.dmp

Download

memory/5420-87-0x00007FF7B3A80000-0x00007FF7B3DD2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads