cobaltstrike | 796df754a748a9473606de724ec824ebc6c04759ad18c8a129c2b6e1d618ccd1

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample261027-nlr65a1s8n
SHA256 796df754a748a9473606de724ec824ebc6c04759ad18c8a129c2b6e1d618ccd1
MD5 957eaaa0e1a31b9c2ac25e27498f1919
SHA1 6934c78c042b0228d3c82d6eb41a722e880dfa1e
SHA512 bd7971b4b36ea3ded4ff2ea773876fef70b4f11582d6d52a385a63a847796f35ad0b89c8a93eb4a311ea598f4817300fc5d294c09227b41fd021d05c7433760b
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUO:v+D56utgpPF8u/7O
TLSH
T19F965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000a00000001b2e2-5.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ca-9.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5c7-17.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5cb-23.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5cc-28.dat	cobalt_reflective_dll
behavioral2/files/0x0004000000008f26-35.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ce-41.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5cf-47.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5d0-55.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5d1-61.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5d2-68.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5d4-76.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5d5-82.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5d6-86.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5d7-90.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5d9-101.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5db-110.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5dc-116.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5de-120.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5da-107.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5d8-97.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000a00000001b2e2-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ca-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5c7-17.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5cb-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5cc-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0004000000008f26-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ce-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5cf-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5d0-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5d1-61.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5d2-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5d4-76.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5d5-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5d6-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5d7-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5d9-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5db-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5dc-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5de-120.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5da-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5d8-97.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/5332-0-0x00007FF744A40000-0x00007FF744D92000-memory.dmp	UPX
behavioral2/files/0x000a00000001b2e2-5.dat	UPX
behavioral2/memory/4028-7-0x00007FF629F10000-0x00007FF62A262000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5ca-9.dat	UPX
behavioral2/memory/3128-12-0x00007FF6222E0000-0x00007FF622632000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5c7-17.dat	UPX
behavioral2/memory/5864-18-0x00007FF6E08F0000-0x00007FF6E0C42000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5cb-23.dat	UPX
behavioral2/memory/5168-24-0x00007FF7273F0000-0x00007FF727742000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5cc-28.dat	UPX
behavioral2/memory/3448-32-0x00007FF6BDC60000-0x00007FF6BDFB2000-memory.dmp	UPX
behavioral2/files/0x0004000000008f26-35.dat	UPX
behavioral2/files/0x000c00000001c5ce-41.dat	UPX
behavioral2/memory/3360-44-0x00007FF6B6C70000-0x00007FF6B6FC2000-memory.dmp	UPX
behavioral2/memory/4060-38-0x00007FF660A20000-0x00007FF660D72000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5cf-47.dat	UPX
behavioral2/memory/4668-49-0x00007FF7391A0000-0x00007FF7394F2000-memory.dmp	UPX
behavioral2/memory/5332-48-0x00007FF744A40000-0x00007FF744D92000-memory.dmp	UPX
behavioral2/memory/4028-52-0x00007FF629F10000-0x00007FF62A262000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5d0-55.dat	UPX
behavioral2/memory/992-56-0x00007FF6A0B70000-0x00007FF6A0EC2000-memory.dmp	UPX
behavioral2/memory/3128-59-0x00007FF6222E0000-0x00007FF622632000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5d1-61.dat	UPX
behavioral2/memory/5864-64-0x00007FF6E08F0000-0x00007FF6E0C42000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5d2-68.dat	UPX
behavioral2/memory/1400-66-0x00007FF62EA10000-0x00007FF62ED62000-memory.dmp	UPX
behavioral2/memory/4692-71-0x00007FF665BC0000-0x00007FF665F12000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5d4-76.dat	UPX
behavioral2/files/0x000c00000001c5d5-82.dat	UPX
behavioral2/files/0x000c00000001c5d6-86.dat	UPX
behavioral2/files/0x000c00000001c5d7-90.dat	UPX
behavioral2/files/0x000c00000001c5d9-101.dat	UPX
behavioral2/files/0x000c00000001c5db-110.dat	UPX
behavioral2/files/0x000c00000001c5dc-116.dat	UPX
behavioral2/files/0x000c00000001c5de-120.dat	UPX
behavioral2/files/0x000c00000001c5da-107.dat	UPX
behavioral2/files/0x000c00000001c5d8-97.dat	UPX
behavioral2/memory/5168-70-0x00007FF7273F0000-0x00007FF727742000-memory.dmp	UPX
behavioral2/memory/5932-123-0x00007FF7122E0000-0x00007FF712632000-memory.dmp	UPX
behavioral2/memory/1484-124-0x00007FF610FE0000-0x00007FF611332000-memory.dmp	UPX
behavioral2/memory/2632-125-0x00007FF6A16A0000-0x00007FF6A19F2000-memory.dmp	UPX
behavioral2/memory/1148-126-0x00007FF757BA0000-0x00007FF757EF2000-memory.dmp	UPX
behavioral2/memory/5016-127-0x00007FF6522C0000-0x00007FF652612000-memory.dmp	UPX
behavioral2/memory/4844-128-0x00007FF6B4030000-0x00007FF6B4382000-memory.dmp	UPX
behavioral2/memory/2412-129-0x00007FF7B8290000-0x00007FF7B85E2000-memory.dmp	UPX
behavioral2/memory/2744-131-0x00007FF611880000-0x00007FF611BD2000-memory.dmp	UPX
behavioral2/memory/2248-133-0x00007FF6E3F40000-0x00007FF6E4292000-memory.dmp	UPX
behavioral2/memory/3448-132-0x00007FF6BDC60000-0x00007FF6BDFB2000-memory.dmp	UPX
behavioral2/memory/6112-130-0x00007FF6AAC50000-0x00007FF6AAFA2000-memory.dmp	UPX
behavioral2/memory/4060-134-0x00007FF660A20000-0x00007FF660D72000-memory.dmp	UPX
behavioral2/memory/3360-135-0x00007FF6B6C70000-0x00007FF6B6FC2000-memory.dmp	UPX
behavioral2/memory/4668-136-0x00007FF7391A0000-0x00007FF7394F2000-memory.dmp	UPX
behavioral2/memory/992-137-0x00007FF6A0B70000-0x00007FF6A0EC2000-memory.dmp	UPX
behavioral2/memory/4692-138-0x00007FF665BC0000-0x00007FF665F12000-memory.dmp	UPX
behavioral2/memory/5932-139-0x00007FF7122E0000-0x00007FF712632000-memory.dmp	UPX
behavioral2/memory/4028-140-0x00007FF629F10000-0x00007FF62A262000-memory.dmp	UPX
behavioral2/memory/3128-141-0x00007FF6222E0000-0x00007FF622632000-memory.dmp	UPX
behavioral2/memory/5864-142-0x00007FF6E08F0000-0x00007FF6E0C42000-memory.dmp	UPX
behavioral2/memory/5168-143-0x00007FF7273F0000-0x00007FF727742000-memory.dmp	UPX
behavioral2/memory/3448-144-0x00007FF6BDC60000-0x00007FF6BDFB2000-memory.dmp	UPX
behavioral2/memory/4060-145-0x00007FF660A20000-0x00007FF660D72000-memory.dmp	UPX
behavioral2/memory/3360-146-0x00007FF6B6C70000-0x00007FF6B6FC2000-memory.dmp	UPX
behavioral2/memory/4668-147-0x00007FF7391A0000-0x00007FF7394F2000-memory.dmp	UPX
behavioral2/memory/992-148-0x00007FF6A0B70000-0x00007FF6A0EC2000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/5332-0-0x00007FF744A40000-0x00007FF744D92000-memory.dmp	xmrig
behavioral2/files/0x000a00000001b2e2-5.dat	xmrig
behavioral2/memory/4028-7-0x00007FF629F10000-0x00007FF62A262000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5ca-9.dat	xmrig
behavioral2/memory/3128-12-0x00007FF6222E0000-0x00007FF622632000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5c7-17.dat	xmrig
behavioral2/memory/5864-18-0x00007FF6E08F0000-0x00007FF6E0C42000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5cb-23.dat	xmrig
behavioral2/memory/5168-24-0x00007FF7273F0000-0x00007FF727742000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5cc-28.dat	xmrig
behavioral2/memory/3448-32-0x00007FF6BDC60000-0x00007FF6BDFB2000-memory.dmp	xmrig
behavioral2/files/0x0004000000008f26-35.dat	xmrig
behavioral2/files/0x000c00000001c5ce-41.dat	xmrig
behavioral2/memory/3360-44-0x00007FF6B6C70000-0x00007FF6B6FC2000-memory.dmp	xmrig
behavioral2/memory/4060-38-0x00007FF660A20000-0x00007FF660D72000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5cf-47.dat	xmrig
behavioral2/memory/4668-49-0x00007FF7391A0000-0x00007FF7394F2000-memory.dmp	xmrig
behavioral2/memory/5332-48-0x00007FF744A40000-0x00007FF744D92000-memory.dmp	xmrig
behavioral2/memory/4028-52-0x00007FF629F10000-0x00007FF62A262000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5d0-55.dat	xmrig
behavioral2/memory/992-56-0x00007FF6A0B70000-0x00007FF6A0EC2000-memory.dmp	xmrig
behavioral2/memory/3128-59-0x00007FF6222E0000-0x00007FF622632000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5d1-61.dat	xmrig
behavioral2/memory/5864-64-0x00007FF6E08F0000-0x00007FF6E0C42000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5d2-68.dat	xmrig
behavioral2/memory/1400-66-0x00007FF62EA10000-0x00007FF62ED62000-memory.dmp	xmrig
behavioral2/memory/4692-71-0x00007FF665BC0000-0x00007FF665F12000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5d4-76.dat	xmrig
behavioral2/files/0x000c00000001c5d5-82.dat	xmrig
behavioral2/files/0x000c00000001c5d6-86.dat	xmrig
behavioral2/files/0x000c00000001c5d7-90.dat	xmrig
behavioral2/files/0x000c00000001c5d9-101.dat	xmrig
behavioral2/files/0x000c00000001c5db-110.dat	xmrig
behavioral2/files/0x000c00000001c5dc-116.dat	xmrig
behavioral2/files/0x000c00000001c5de-120.dat	xmrig
behavioral2/files/0x000c00000001c5da-107.dat	xmrig
behavioral2/files/0x000c00000001c5d8-97.dat	xmrig
behavioral2/memory/5168-70-0x00007FF7273F0000-0x00007FF727742000-memory.dmp	xmrig
behavioral2/memory/5932-123-0x00007FF7122E0000-0x00007FF712632000-memory.dmp	xmrig
behavioral2/memory/1484-124-0x00007FF610FE0000-0x00007FF611332000-memory.dmp	xmrig
behavioral2/memory/2632-125-0x00007FF6A16A0000-0x00007FF6A19F2000-memory.dmp	xmrig
behavioral2/memory/1148-126-0x00007FF757BA0000-0x00007FF757EF2000-memory.dmp	xmrig
behavioral2/memory/5016-127-0x00007FF6522C0000-0x00007FF652612000-memory.dmp	xmrig
behavioral2/memory/4844-128-0x00007FF6B4030000-0x00007FF6B4382000-memory.dmp	xmrig
behavioral2/memory/2412-129-0x00007FF7B8290000-0x00007FF7B85E2000-memory.dmp	xmrig
behavioral2/memory/2744-131-0x00007FF611880000-0x00007FF611BD2000-memory.dmp	xmrig
behavioral2/memory/2248-133-0x00007FF6E3F40000-0x00007FF6E4292000-memory.dmp	xmrig
behavioral2/memory/3448-132-0x00007FF6BDC60000-0x00007FF6BDFB2000-memory.dmp	xmrig
behavioral2/memory/6112-130-0x00007FF6AAC50000-0x00007FF6AAFA2000-memory.dmp	xmrig
behavioral2/memory/4060-134-0x00007FF660A20000-0x00007FF660D72000-memory.dmp	xmrig
behavioral2/memory/3360-135-0x00007FF6B6C70000-0x00007FF6B6FC2000-memory.dmp	xmrig
behavioral2/memory/4668-136-0x00007FF7391A0000-0x00007FF7394F2000-memory.dmp	xmrig
behavioral2/memory/992-137-0x00007FF6A0B70000-0x00007FF6A0EC2000-memory.dmp	xmrig
behavioral2/memory/4692-138-0x00007FF665BC0000-0x00007FF665F12000-memory.dmp	xmrig
behavioral2/memory/5932-139-0x00007FF7122E0000-0x00007FF712632000-memory.dmp	xmrig
behavioral2/memory/4028-140-0x00007FF629F10000-0x00007FF62A262000-memory.dmp	xmrig
behavioral2/memory/3128-141-0x00007FF6222E0000-0x00007FF622632000-memory.dmp	xmrig
behavioral2/memory/5864-142-0x00007FF6E08F0000-0x00007FF6E0C42000-memory.dmp	xmrig
behavioral2/memory/5168-143-0x00007FF7273F0000-0x00007FF727742000-memory.dmp	xmrig
behavioral2/memory/3448-144-0x00007FF6BDC60000-0x00007FF6BDFB2000-memory.dmp	xmrig
behavioral2/memory/4060-145-0x00007FF660A20000-0x00007FF660D72000-memory.dmp	xmrig
behavioral2/memory/3360-146-0x00007FF6B6C70000-0x00007FF6B6FC2000-memory.dmp	xmrig
behavioral2/memory/4668-147-0x00007FF7391A0000-0x00007FF7394F2000-memory.dmp	xmrig
behavioral2/memory/992-148-0x00007FF6A0B70000-0x00007FF6A0EC2000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4028	zNyUWko.exe
3128	BUMBpIY.exe
5864	fznYbLa.exe
5168	MdkljZR.exe
3448	NqFxvPl.exe
4060	LNEUTKZ.exe
3360	lEThkzP.exe
4668	yHUemhO.exe
992	smvDjiM.exe
1400	smFqhct.exe
4692	FfpGgBa.exe
5932	YeMuSiF.exe
2248	LcuCgQl.exe
1484	PrlkXkv.exe
2632	jlbmbLA.exe
1148	CJHjnIn.exe
5016	UPrKnFA.exe
4844	RycDwgO.exe
2412	RUgvqtF.exe
6112	ZSSTpge.exe
2744	wpLuXvY.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5332-0-0x00007FF744A40000-0x00007FF744D92000-memory.dmp	upx
behavioral2/files/0x000a00000001b2e2-5.dat	upx
behavioral2/memory/4028-7-0x00007FF629F10000-0x00007FF62A262000-memory.dmp	upx
behavioral2/files/0x000c00000001c5ca-9.dat	upx
behavioral2/memory/3128-12-0x00007FF6222E0000-0x00007FF622632000-memory.dmp	upx
behavioral2/files/0x000d00000001c5c7-17.dat	upx
behavioral2/memory/5864-18-0x00007FF6E08F0000-0x00007FF6E0C42000-memory.dmp	upx
behavioral2/files/0x000c00000001c5cb-23.dat	upx
behavioral2/memory/5168-24-0x00007FF7273F0000-0x00007FF727742000-memory.dmp	upx
behavioral2/files/0x000c00000001c5cc-28.dat	upx
behavioral2/memory/3448-32-0x00007FF6BDC60000-0x00007FF6BDFB2000-memory.dmp	upx
behavioral2/files/0x0004000000008f26-35.dat	upx
behavioral2/files/0x000c00000001c5ce-41.dat	upx
behavioral2/memory/3360-44-0x00007FF6B6C70000-0x00007FF6B6FC2000-memory.dmp	upx
behavioral2/memory/4060-38-0x00007FF660A20000-0x00007FF660D72000-memory.dmp	upx
behavioral2/files/0x000c00000001c5cf-47.dat	upx
behavioral2/memory/4668-49-0x00007FF7391A0000-0x00007FF7394F2000-memory.dmp	upx
behavioral2/memory/5332-48-0x00007FF744A40000-0x00007FF744D92000-memory.dmp	upx
behavioral2/memory/4028-52-0x00007FF629F10000-0x00007FF62A262000-memory.dmp	upx
behavioral2/files/0x000c00000001c5d0-55.dat	upx
behavioral2/memory/992-56-0x00007FF6A0B70000-0x00007FF6A0EC2000-memory.dmp	upx
behavioral2/memory/3128-59-0x00007FF6222E0000-0x00007FF622632000-memory.dmp	upx
behavioral2/files/0x000c00000001c5d1-61.dat	upx
behavioral2/memory/5864-64-0x00007FF6E08F0000-0x00007FF6E0C42000-memory.dmp	upx
behavioral2/files/0x000c00000001c5d2-68.dat	upx
behavioral2/memory/1400-66-0x00007FF62EA10000-0x00007FF62ED62000-memory.dmp	upx
behavioral2/memory/4692-71-0x00007FF665BC0000-0x00007FF665F12000-memory.dmp	upx
behavioral2/files/0x000c00000001c5d4-76.dat	upx
behavioral2/files/0x000c00000001c5d5-82.dat	upx
behavioral2/files/0x000c00000001c5d6-86.dat	upx
behavioral2/files/0x000c00000001c5d7-90.dat	upx
behavioral2/files/0x000c00000001c5d9-101.dat	upx
behavioral2/files/0x000c00000001c5db-110.dat	upx
behavioral2/files/0x000c00000001c5dc-116.dat	upx
behavioral2/files/0x000c00000001c5de-120.dat	upx
behavioral2/files/0x000c00000001c5da-107.dat	upx
behavioral2/files/0x000c00000001c5d8-97.dat	upx
behavioral2/memory/5168-70-0x00007FF7273F0000-0x00007FF727742000-memory.dmp	upx
behavioral2/memory/5932-123-0x00007FF7122E0000-0x00007FF712632000-memory.dmp	upx
behavioral2/memory/1484-124-0x00007FF610FE0000-0x00007FF611332000-memory.dmp	upx
behavioral2/memory/2632-125-0x00007FF6A16A0000-0x00007FF6A19F2000-memory.dmp	upx
behavioral2/memory/1148-126-0x00007FF757BA0000-0x00007FF757EF2000-memory.dmp	upx
behavioral2/memory/5016-127-0x00007FF6522C0000-0x00007FF652612000-memory.dmp	upx
behavioral2/memory/4844-128-0x00007FF6B4030000-0x00007FF6B4382000-memory.dmp	upx
behavioral2/memory/2412-129-0x00007FF7B8290000-0x00007FF7B85E2000-memory.dmp	upx
behavioral2/memory/2744-131-0x00007FF611880000-0x00007FF611BD2000-memory.dmp	upx
behavioral2/memory/2248-133-0x00007FF6E3F40000-0x00007FF6E4292000-memory.dmp	upx
behavioral2/memory/3448-132-0x00007FF6BDC60000-0x00007FF6BDFB2000-memory.dmp	upx
behavioral2/memory/6112-130-0x00007FF6AAC50000-0x00007FF6AAFA2000-memory.dmp	upx
behavioral2/memory/4060-134-0x00007FF660A20000-0x00007FF660D72000-memory.dmp	upx
behavioral2/memory/3360-135-0x00007FF6B6C70000-0x00007FF6B6FC2000-memory.dmp	upx
behavioral2/memory/4668-136-0x00007FF7391A0000-0x00007FF7394F2000-memory.dmp	upx
behavioral2/memory/992-137-0x00007FF6A0B70000-0x00007FF6A0EC2000-memory.dmp	upx
behavioral2/memory/4692-138-0x00007FF665BC0000-0x00007FF665F12000-memory.dmp	upx
behavioral2/memory/5932-139-0x00007FF7122E0000-0x00007FF712632000-memory.dmp	upx
behavioral2/memory/4028-140-0x00007FF629F10000-0x00007FF62A262000-memory.dmp	upx
behavioral2/memory/3128-141-0x00007FF6222E0000-0x00007FF622632000-memory.dmp	upx
behavioral2/memory/5864-142-0x00007FF6E08F0000-0x00007FF6E0C42000-memory.dmp	upx
behavioral2/memory/5168-143-0x00007FF7273F0000-0x00007FF727742000-memory.dmp	upx
behavioral2/memory/3448-144-0x00007FF6BDC60000-0x00007FF6BDFB2000-memory.dmp	upx
behavioral2/memory/4060-145-0x00007FF660A20000-0x00007FF660D72000-memory.dmp	upx
behavioral2/memory/3360-146-0x00007FF6B6C70000-0x00007FF6B6FC2000-memory.dmp	upx
behavioral2/memory/4668-147-0x00007FF7391A0000-0x00007FF7394F2000-memory.dmp	upx
behavioral2/memory/992-148-0x00007FF6A0B70000-0x00007FF6A0EC2000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\lEThkzP.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\wpLuXvY.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\BUMBpIY.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\FfpGgBa.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\YeMuSiF.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\jlbmbLA.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\CJHjnIn.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\UPrKnFA.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\zNyUWko.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\smvDjiM.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\smFqhct.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\LcuCgQl.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\RycDwgO.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fznYbLa.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\LNEUTKZ.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\yHUemhO.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\PrlkXkv.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\RUgvqtF.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ZSSTpge.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\MdkljZR.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\NqFxvPl.exe	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5332 wrote to memory of 4028	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	89
PID 5332 wrote to memory of 3128	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 5332 wrote to memory of 5864	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 5332 wrote to memory of 5168	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 5332 wrote to memory of 3448	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 5332 wrote to memory of 4060	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 5332 wrote to memory of 3360	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 5332 wrote to memory of 4668	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 5332 wrote to memory of 992	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 5332 wrote to memory of 1400	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 5332 wrote to memory of 4692	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 5332 wrote to memory of 5932	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 5332 wrote to memory of 2248	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 5332 wrote to memory of 1484	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 5332 wrote to memory of 2632	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 5332 wrote to memory of 1148	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 5332 wrote to memory of 5016	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 5332 wrote to memory of 4844	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 5332 wrote to memory of 2412	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 5332 wrote to memory of 6112	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 5332 wrote to memory of 2744	5332	2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_957eaaa0e1a31b9c2ac25e27498f1919_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5332
- C:\Windows\System\zNyUWko.exe
  C:\Windows\System\zNyUWko.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\BUMBpIY.exe
  C:\Windows\System\BUMBpIY.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\fznYbLa.exe
  C:\Windows\System\fznYbLa.exe
  2⤵
  - Executes dropped EXE
  PID:5864
- C:\Windows\System\MdkljZR.exe
  C:\Windows\System\MdkljZR.exe
  2⤵
  - Executes dropped EXE
  PID:5168
- C:\Windows\System\NqFxvPl.exe
  C:\Windows\System\NqFxvPl.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\LNEUTKZ.exe
  C:\Windows\System\LNEUTKZ.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\lEThkzP.exe
  C:\Windows\System\lEThkzP.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\yHUemhO.exe
  C:\Windows\System\yHUemhO.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\smvDjiM.exe
  C:\Windows\System\smvDjiM.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\smFqhct.exe
  C:\Windows\System\smFqhct.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\FfpGgBa.exe
  C:\Windows\System\FfpGgBa.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\YeMuSiF.exe
  C:\Windows\System\YeMuSiF.exe
  2⤵
  - Executes dropped EXE
  PID:5932
- C:\Windows\System\LcuCgQl.exe
  C:\Windows\System\LcuCgQl.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\PrlkXkv.exe
  C:\Windows\System\PrlkXkv.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\jlbmbLA.exe
  C:\Windows\System\jlbmbLA.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\CJHjnIn.exe
  C:\Windows\System\CJHjnIn.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\UPrKnFA.exe
  C:\Windows\System\UPrKnFA.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\RycDwgO.exe
  C:\Windows\System\RycDwgO.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\RUgvqtF.exe
  C:\Windows\System\RUgvqtF.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\ZSSTpge.exe
  C:\Windows\System\ZSSTpge.exe
  2⤵
  - Executes dropped EXE
  PID:6112
- C:\Windows\System\wpLuXvY.exe
  C:\Windows\System\wpLuXvY.exe
  2⤵
  - Executes dropped EXE
  PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BUMBpIY.exe

Path C:\Windows\System\BUMBpIY.exe
Size 8.3MB
SHA256 e824e3ad7cb23c2904b57d45ac4d7135d1b395f886f1b0d8c6967f82f42a715e
MD5 25ac497734093af9f75adf87de028084
SHA1 610593b2b7b4430b467effdb3142d7f5ecb3f2ae
SHA512 1106d52b4692c7af5d08a72bfd20ce1fefbf4cf68bb3709acdac4e4e8cb8e68d1d461f68e9812f2bf515d93da7b2a56052759fe782ced3184d0807daa8523383
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUf:v+D56utgpPF8u/7f
TLSH
T1DF965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CJHjnIn.exe

Path C:\Windows\System\CJHjnIn.exe
Size 8.3MB
SHA256 f9c95b6fa12255feb2b2d09d8a25ee30371ced17af19ae5e0df74129d9561ec9
MD5 84fcb1ca4cb2eedc0f9f4a4c265edd0e
SHA1 fa3356710f6b4a930fe78ef61728ef0c7f68956e
SHA512 a9a6614b8a013cb20d53f60ddbe9f1abe8062d03e61e44fa710f394d231ae25631a9e260947a32f64e7cd792b7918a065f0009b1279e1f7a93fa1f9e7ad84b36
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU3:v+D56utgpPF8u/73
TLSH
T17F965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FfpGgBa.exe

Path C:\Windows\System\FfpGgBa.exe
Size 8.3MB
SHA256 3b48c7057bd5dd4da4430827018d51e91f47444a1dc070d422b01b43d1102276
MD5 ea97e6b1faf9589be13975423bf50949
SHA1 1aec8ad1a3038929aaf4af053b350b4b2e4bb5bd
SHA512 75143ad9947213dd01c08c7b7d46a1841b83fcca6c13ef1a9e37aea331e12b1576fe6bcb4bf59626aa4aba45e635fe6f55e7456826450a6dd7c1ae66b8a6f0bc
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUT:v+D56utgpPF8u/7T
TLSH
T16E965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LNEUTKZ.exe

Path C:\Windows\System\LNEUTKZ.exe
Size 8.3MB
SHA256 67b1607c8d13ce9ab4c86c6150d59fb08b6c236cc70cc2fef80001a21b0a3250
MD5 4bc083e6985723e222aa0a6d2d452d60
SHA1 827de52661bd3761a80c96fad1906565c525bbab
SHA512 6ac0963d1c45cf9b9175e18abd72bff2fc31f1bdf6f167d1f0dc5c31c2396b5a7dcc15c943c2ba068c6c4509a7f903a57b76fd878fbd11b11980dd18a3d2440a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUv:v+D56utgpPF8u/7v
TLSH
T1F3965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LcuCgQl.exe

Path C:\Windows\System\LcuCgQl.exe
Size 8.3MB
SHA256 81fba461434606e1afbb397ea4f076e2f5ae4f15111a8e471e8c803b8b26a1d1
MD5 1417c59d92138b83ee7ccf495c43f5d6
SHA1 eb298f412bfced6a936bb281a546a2bf951df753
SHA512 edf5374b5770c8fa3fa7fcb6656f22e41c6cd83a98b026deeaa925dad1a50d9e2290cc1340451e22fb23380f3671e00e03ba0b1916bbd919324af311090b2541
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUZ:v+D56utgpPF8u/7Z
TLSH
T102965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MdkljZR.exe

Path C:\Windows\System\MdkljZR.exe
Size 8.3MB
SHA256 8e78c91a2e3a766b5fd39dce07b8eff85a5d7188c7e2bd0b2e3db1d24fe7eed9
MD5 8b6b0e933378165220e88993ee834f96
SHA1 75f585eb7fce7fdaf4744f90095a70d0f83d28ac
SHA512 3d0223af7bf42debeda131c48b3dc30cd2ec71fea1cf3209340db4998a35b93703c905a151b7097b2fbaa71cd900cc08fb774a6375ebef5da660b1f354c41b1c
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUw:v+D56utgpPF8u/7w
TLSH
T1D6965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NqFxvPl.exe

Path C:\Windows\System\NqFxvPl.exe
Size 8.3MB
SHA256 e9985e7bdf330af1b40aed85039710308f00dd4af3180b32065dcb8ec6a5ce20
MD5 dc0ba77724539248fd2a6151e4792401
SHA1 e85ef17ab0c698434439377115c35a40052ad5c6
SHA512 dc40a03e3c28cc88a539db75855e67f088b3bd13179d62e6bad9abede65908e60714a83e02c57d30f7afd2d58539402f2a7a993ae5e0896ab75e8df78eda2b8c
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUu:v+D56utgpPF8u/7u
TLSH
T16D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrlkXkv.exe

Path C:\Windows\System\PrlkXkv.exe
Size 8.3MB
SHA256 d7fe0579fa900ac0d4d4d4f47c8009126b0c1feaf45560e59446e9d863fe5118
MD5 e2e12d8e6f389eb7fc69b65e3eda5d45
SHA1 857b685c01bfb64c9e67a3bc78a4fec797998d70
SHA512 526b8261d3b7ef4c9252003229c91aa90c51938373db9262cdf9b3bc2f21f576818a07f5a86ded431b609ebd43ba9d6d22a3ca0e25acd5c9827cece250e21e13
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUK:v+D56utgpPF8u/7K
TLSH
T117965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RUgvqtF.exe

Path C:\Windows\System\RUgvqtF.exe
Size 8.3MB
SHA256 dfda07e7ba8a78909b83447ae3781f82f4ad29f2d90772260fb6adad0015c329
MD5 1fb50d2f539696a1ba181d888a39aa73
SHA1 f0dd229b9e101fb4cb5852a3a6a18410637c71ed
SHA512 8b2bec3a7e573c17c4618c3467d2aeeef66a2b29d175d712659af5d8d55c38347c40c8f36350e5e3e496d5a5fcdbb6a99393d34a9661989e6127b6f4a64c363d
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUr:v+D56utgpPF8u/7r
TLSH
T10D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RycDwgO.exe

Path C:\Windows\System\RycDwgO.exe
Size 8.3MB
SHA256 6a52f8003537409b5fced06bdd2875df0a3b9c47216321e69844896c258bfd90
MD5 9dbfadaeaad75c55d74a54783b422a39
SHA1 54fa6156c133a09adc600fed6bf9c9db077435c2
SHA512 96a766f52c75c9c37456db2e18a99933015b4eddf215aa84a2c5ca70921621e4fca6180807e2a23181f78607e8b800e78bfbf07f8f12e1044edb1329ed5ad8f0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU4:v+D56utgpPF8u/74
TLSH
T18C965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UPrKnFA.exe

Path C:\Windows\System\UPrKnFA.exe
Size 8.3MB
SHA256 867f42ebde4853b39a7cf6ebc13450834d1185c67e47e55a2a2b9e6f7a671105
MD5 09ef462769daf3152ca0ee241b41294e
SHA1 275f11e6fb23527792cce2099c2afdc9fb575ca7
SHA512 3b5aac5d7d9f9a94efe43bf84cb279a9bbfb4b19e3fe496792f04d176f6fe3ab08176c1eb73f99096da02872eb867dbac6e27b7ac10fc4873cfc1b1348ec533d
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUg:v+D56utgpPF8u/7g
TLSH
T112965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YeMuSiF.exe

Path C:\Windows\System\YeMuSiF.exe
Size 8.3MB
SHA256 82eb52cc0e8123290fd98e524fe7ee9f4239da2a840a21a4f9c9cd573c71c116
MD5 e40214072f41d531213a953471c7ab09
SHA1 ed14e3e44b5a64c8b50c7a55b0d7ffb5bdc73143
SHA512 22a87f61b0d4dda056205e2597f09cc1014f44c7714ff47d8ec9666990279817fde48658f88470c06ab9eee4c0ba989dfcdeb1568075c1d5f6e5209738d2b716
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUJ:v+D56utgpPF8u/7J
TLSH
T11D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZSSTpge.exe

Path C:\Windows\System\ZSSTpge.exe
Size 8.3MB
SHA256 3478e8f08c083c4afa8095d55ea6e12da8ef21d64b66c0b8bec935b12d400ef2
MD5 fe3a29a12c5cb0e023b925cfcd19d8a9
SHA1 29eb6d6b3b4af5d35d703b4c9a42c9ffe13acb0b
SHA512 d238970b59562f08bc20c985c125b49ab0f18726cb512e60190b546572e26657b9115055e8a4f3bbe3c3f00f51a21f482ca620e3637216a76f4980c6f5aec5f5
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUl:v+D56utgpPF8u/7l
TLSH
T189965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fznYbLa.exe

Path C:\Windows\System\fznYbLa.exe
Size 8.3MB
SHA256 ee00861a2f79947aa95ee5998da2d7ad73f89bf6633c9938eca3974f31318572
MD5 56caf52ac3312199dc30a2d596c2ad87
SHA1 15753f553074b4748068e6c015f4fbfd6cec36d7
SHA512 2ec7daf26516cec23be489ac7ab3333af752b4b0cab7555dd4ffff0e1293afe7687d9b303a41a3a96b21cfd73542021055070ff77160e20044d19fdb22337138
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUq:v+D56utgpPF8u/7q
TLSH
T178965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jlbmbLA.exe

Path C:\Windows\System\jlbmbLA.exe
Size 8.3MB
SHA256 423ab5819b637acc3cefb32cfa7d49a09d6153f13b2fe5944ec7923235352b61
MD5 4623f96b74f5cc6cb20433d57a59d6df
SHA1 070b58ac0ee495ea38ce0a51ee3b67400da656f4
SHA512 b2748c465fd935908a9dc07568bf1459eeace7bc4da0ec86c89e82a3e124828a6d0b2c2e0acb09ee57711e61dbb98b2b1eb30806560327e021b4e0a94c6382ec
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUL:v+D56utgpPF8u/7L
TLSH
T146965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lEThkzP.exe

Path C:\Windows\System\lEThkzP.exe
Size 8.3MB
SHA256 519303a808c5b1e69655f37271a9293fc5844e7a89cbf7456215a54b493fbead
MD5 9a9623102c4da0d20efddfb2fccaf121
SHA1 9d9728e66d9a0591be2dcf63528872cfd05a2713
SHA512 24948a2f40a685d9487dd89c91f8812fa27a5a07e144f48226343890504afa731b9d12ab722968c4a009ea4327e0215142a91f0025ed9d270e1e03741a9b6fcb
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUj:v+D56utgpPF8u/7j
TLSH
T1A7965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smFqhct.exe

Path C:\Windows\System\smFqhct.exe
Size 8.3MB
SHA256 3532f94c62e5441f175ed2afdb3b1516fbac7659cc1c2bf306d84ac238092da9
MD5 401276f8b8a3771d526deddcd4b4cd46
SHA1 15d6d42065e14a5a0c59c2fcca5d6cd437e3c0f6
SHA512 7382a52b6862ef2ef0fc241595343ca102a91bd1628d21687b4b8e99c406ac4eb26f045384411a4252d9d825d0e581e3ccfe4267839d6e239c7c91a136cc65cd
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUz:v+D56utgpPF8u/7z
TLSH
T121965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smvDjiM.exe

Path C:\Windows\System\smvDjiM.exe
Size 8.3MB
SHA256 26b8ba9897a6817c6af607a87ecd9f175c1ae9d3f6d3e575a94bb5f73964f8ae
MD5 766602147872e98b37e950045a6c1690
SHA1 33b2997d21176ac3e7861880c6897d41cf9eb290
SHA512 31ab9d84e0927200b642a7daf7e45c96832d489d5275dd82cc380828200a5e2f7257f1efef59b8ecb62b8254137dec4d5c9bd2efc89447acd8a521533ed3196c
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUN:v+D56utgpPF8u/7N
TLSH
T148965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpLuXvY.exe

Path C:\Windows\System\wpLuXvY.exe
Size 8.3MB
SHA256 661d95efb93df2a98c20e07c3bcdcd339a0c8708462c1931951949448b1a2444
MD5 93d749071440ccb52a15dfd541f9166c
SHA1 44e207a62ab5ef69beff813a6533bbf59bb440d6
SHA512 1b1983d5eef388706276e39f42e6247bd526b1a5c7ae7eb42364ce68a106717026275d709fa9afd2f98f99155ba184738bfd367d07809bc09e2a5729847a6209
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUi:v+D56utgpPF8u/7i
TLSH
T11D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yHUemhO.exe

Path C:\Windows\System\yHUemhO.exe
Size 8.3MB
SHA256 94bb09b0b0a65c6d6c1a53a82f7f705f7d49ca6c6f362429861b25772a94699d
MD5 81b624670b9826ffcfb9ffe94bed33e5
SHA1 788b7e88817880416a8ad8a2cfba5c7e26f419d6
SHA512 64df76bae91f22ffc6a6b905ab65c321a5c05df8f108fdd488d6bbb0024fa7ad5bcd699347e2da48ec8a262132641c3803d0b331c29a170cee25a03fc3ce59c2
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUz:v+D56utgpPF8u/7z
TLSH
T189965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zNyUWko.exe

Path C:\Windows\System\zNyUWko.exe
Size 8.3MB
SHA256 d1dd8f900cc9e149dc3a01d5f6189707295bad4433e092213dc5544b027dcf8e
MD5 524f93ade37bf36b02db85bcf073f8b7
SHA1 20ca300af37659f349a069d8e28f51567b3fe9e3
SHA512 55dba0ff3a6633de13596ab66430018a6b917ec50dd5fab61d925c61f7d048967f63f06f83d4051b47c2ba0a02a2de1fbcf1140bbc18cd6460aed076f79116f4
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUa:v+D56utgpPF8u/7a
TLSH
T180965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/992-56-0x00007FF6A0B70000-0x00007FF6A0EC2000-memory.dmp

Download

memory/992-148-0x00007FF6A0B70000-0x00007FF6A0EC2000-memory.dmp

Download

memory/992-137-0x00007FF6A0B70000-0x00007FF6A0EC2000-memory.dmp

Download

memory/1148-126-0x00007FF757BA0000-0x00007FF757EF2000-memory.dmp

Download

memory/1148-156-0x00007FF757BA0000-0x00007FF757EF2000-memory.dmp

Download

memory/1400-149-0x00007FF62EA10000-0x00007FF62ED62000-memory.dmp

Download

memory/1400-66-0x00007FF62EA10000-0x00007FF62ED62000-memory.dmp

Download

memory/1484-124-0x00007FF610FE0000-0x00007FF611332000-memory.dmp

Download

memory/1484-153-0x00007FF610FE0000-0x00007FF611332000-memory.dmp

Download

memory/2248-133-0x00007FF6E3F40000-0x00007FF6E4292000-memory.dmp

Download

memory/2248-151-0x00007FF6E3F40000-0x00007FF6E4292000-memory.dmp

Download

memory/2412-129-0x00007FF7B8290000-0x00007FF7B85E2000-memory.dmp

Download

memory/2412-158-0x00007FF7B8290000-0x00007FF7B85E2000-memory.dmp

Download

memory/2632-125-0x00007FF6A16A0000-0x00007FF6A19F2000-memory.dmp

Download

memory/2632-157-0x00007FF6A16A0000-0x00007FF6A19F2000-memory.dmp

Download

memory/2744-131-0x00007FF611880000-0x00007FF611BD2000-memory.dmp

Download

memory/2744-159-0x00007FF611880000-0x00007FF611BD2000-memory.dmp

Download

memory/3128-59-0x00007FF6222E0000-0x00007FF622632000-memory.dmp

Download

memory/3128-141-0x00007FF6222E0000-0x00007FF622632000-memory.dmp

Download

memory/3128-12-0x00007FF6222E0000-0x00007FF622632000-memory.dmp

Download

memory/3360-146-0x00007FF6B6C70000-0x00007FF6B6FC2000-memory.dmp

Download

memory/3360-44-0x00007FF6B6C70000-0x00007FF6B6FC2000-memory.dmp

Download

memory/3360-135-0x00007FF6B6C70000-0x00007FF6B6FC2000-memory.dmp

Download

memory/3448-144-0x00007FF6BDC60000-0x00007FF6BDFB2000-memory.dmp

Download

memory/3448-132-0x00007FF6BDC60000-0x00007FF6BDFB2000-memory.dmp

Download

memory/3448-32-0x00007FF6BDC60000-0x00007FF6BDFB2000-memory.dmp

Download

memory/4028-140-0x00007FF629F10000-0x00007FF62A262000-memory.dmp

Download

memory/4028-7-0x00007FF629F10000-0x00007FF62A262000-memory.dmp

Download

memory/4028-52-0x00007FF629F10000-0x00007FF62A262000-memory.dmp

Download

memory/4060-145-0x00007FF660A20000-0x00007FF660D72000-memory.dmp

Download

memory/4060-38-0x00007FF660A20000-0x00007FF660D72000-memory.dmp

Download

memory/4060-134-0x00007FF660A20000-0x00007FF660D72000-memory.dmp

Download

memory/4668-49-0x00007FF7391A0000-0x00007FF7394F2000-memory.dmp

Download

memory/4668-136-0x00007FF7391A0000-0x00007FF7394F2000-memory.dmp

Download

memory/4668-147-0x00007FF7391A0000-0x00007FF7394F2000-memory.dmp

Download

memory/4692-71-0x00007FF665BC0000-0x00007FF665F12000-memory.dmp

Download

memory/4692-138-0x00007FF665BC0000-0x00007FF665F12000-memory.dmp

Download

memory/4692-150-0x00007FF665BC0000-0x00007FF665F12000-memory.dmp

Download

memory/4844-128-0x00007FF6B4030000-0x00007FF6B4382000-memory.dmp

Download

memory/4844-154-0x00007FF6B4030000-0x00007FF6B4382000-memory.dmp

Download

memory/5016-127-0x00007FF6522C0000-0x00007FF652612000-memory.dmp

Download

memory/5016-155-0x00007FF6522C0000-0x00007FF652612000-memory.dmp

Download

memory/5168-24-0x00007FF7273F0000-0x00007FF727742000-memory.dmp

Download

memory/5168-70-0x00007FF7273F0000-0x00007FF727742000-memory.dmp

Download

memory/5168-143-0x00007FF7273F0000-0x00007FF727742000-memory.dmp

Download

memory/5332-0-0x00007FF744A40000-0x00007FF744D92000-memory.dmp

Download

memory/5332-48-0x00007FF744A40000-0x00007FF744D92000-memory.dmp

Download

memory/5332-1-0x000001A974850000-0x000001A974860000-memory.dmp

Download

memory/5864-64-0x00007FF6E08F0000-0x00007FF6E0C42000-memory.dmp

Download

memory/5864-142-0x00007FF6E08F0000-0x00007FF6E0C42000-memory.dmp

Download

memory/5864-18-0x00007FF6E08F0000-0x00007FF6E0C42000-memory.dmp

Download

memory/5932-139-0x00007FF7122E0000-0x00007FF712632000-memory.dmp

Download

memory/5932-152-0x00007FF7122E0000-0x00007FF712632000-memory.dmp

Download

memory/5932-123-0x00007FF7122E0000-0x00007FF712632000-memory.dmp

Download

memory/6112-130-0x00007FF6AAC50000-0x00007FF6AAFA2000-memory.dmp

Download

memory/6112-160-0x00007FF6AAC50000-0x00007FF6AAFA2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads