cobaltstrike | e2de7906f6c1ee28bf665d37c4a84eee713b5f98111160cec6e2a351be2ed70c

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample261027-pkgvfa1w6m
SHA256 e2de7906f6c1ee28bf665d37c4a84eee713b5f98111160cec6e2a351be2ed70c
MD5 8afe30f4df26b7574495e540ced86d4c
SHA1 3be7c7eec4cbc7d0eaf4aff05b36e9bbdff7bdb9
SHA512 bc480c413497d6d05cb2899f26361b933d12e3edcda1e9581f0696e999a4092a07f03f3ed961c7bf49225accdf077053c5f8d550473f6860c6cc79d3667c6552
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU3:v+D56utgpPF8u/73
TLSH
T15F965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x0007000000024747-6.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024749-20.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024748-21.dat	cobalt_reflective_dll
behavioral1/files/0x0009000000024743-11.dat	cobalt_reflective_dll
behavioral1/files/0x0002000000022c06-32.dat	cobalt_reflective_dll
behavioral1/files/0x0002000000022c07-43.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002474d-93.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024751-107.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024750-105.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002474f-102.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002474e-98.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002474c-88.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002474b-83.dat	cobalt_reflective_dll
behavioral1/files/0x0002000000022c42-78.dat	cobalt_reflective_dll
behavioral1/files/0x0002000000022c41-73.dat	cobalt_reflective_dll
behavioral1/files/0x0002000000022c40-68.dat	cobalt_reflective_dll
behavioral1/files/0x0002000000022c3f-63.dat	cobalt_reflective_dll
behavioral1/files/0x0002000000022c3e-58.dat	cobalt_reflective_dll
behavioral1/files/0x0002000000022c3d-53.dat	cobalt_reflective_dll
behavioral1/files/0x0002000000022c08-48.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002474a-28.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024747-6.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024749-20.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024748-21.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0009000000024743-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0002000000022c06-32.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0002000000022c07-43.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002474d-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024751-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024750-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002474f-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002474e-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002474c-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002474b-83.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0002000000022c42-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0002000000022c41-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0002000000022c40-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0002000000022c3f-63.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0002000000022c3e-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0002000000022c3d-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0002000000022c08-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002474a-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral1/memory/5236-0-0x00007FF6129F0000-0x00007FF612D42000-memory.dmp	UPX
behavioral1/files/0x0007000000024747-6.dat	UPX
behavioral1/memory/3524-17-0x00007FF7B9500000-0x00007FF7B9852000-memory.dmp	UPX
behavioral1/files/0x0007000000024749-20.dat	UPX
behavioral1/files/0x0007000000024748-21.dat	UPX
behavioral1/memory/5756-15-0x00007FF7F5210000-0x00007FF7F5562000-memory.dmp	UPX
behavioral1/files/0x0009000000024743-11.dat	UPX
behavioral1/files/0x0002000000022c06-32.dat	UPX
behavioral1/files/0x0002000000022c07-43.dat	UPX
behavioral1/files/0x000700000002474d-93.dat	UPX
behavioral1/files/0x0007000000024751-107.dat	UPX
behavioral1/files/0x0007000000024750-105.dat	UPX
behavioral1/files/0x000700000002474f-102.dat	UPX
behavioral1/files/0x000700000002474e-98.dat	UPX
behavioral1/files/0x000700000002474c-88.dat	UPX
behavioral1/files/0x000700000002474b-83.dat	UPX
behavioral1/files/0x0002000000022c42-78.dat	UPX
behavioral1/files/0x0002000000022c41-73.dat	UPX
behavioral1/files/0x0002000000022c40-68.dat	UPX
behavioral1/files/0x0002000000022c3f-63.dat	UPX
behavioral1/files/0x0002000000022c3e-58.dat	UPX
behavioral1/files/0x0002000000022c3d-53.dat	UPX
behavioral1/files/0x0002000000022c08-48.dat	UPX
behavioral1/files/0x000700000002474a-28.dat	UPX
behavioral1/memory/616-109-0x00007FF64F210000-0x00007FF64F562000-memory.dmp	UPX
behavioral1/memory/5520-110-0x00007FF6913E0000-0x00007FF691732000-memory.dmp	UPX
behavioral1/memory/5752-111-0x00007FF636C90000-0x00007FF636FE2000-memory.dmp	UPX
behavioral1/memory/3060-112-0x00007FF7F9590000-0x00007FF7F98E2000-memory.dmp	UPX
behavioral1/memory/3124-113-0x00007FF79E950000-0x00007FF79ECA2000-memory.dmp	UPX
behavioral1/memory/4032-114-0x00007FF66FB60000-0x00007FF66FEB2000-memory.dmp	UPX
behavioral1/memory/6036-115-0x00007FF7A4DF0000-0x00007FF7A5142000-memory.dmp	UPX
behavioral1/memory/5152-116-0x00007FF786B30000-0x00007FF786E82000-memory.dmp	UPX
behavioral1/memory/2312-117-0x00007FF6F9670000-0x00007FF6F99C2000-memory.dmp	UPX
behavioral1/memory/5076-118-0x00007FF6AE1A0000-0x00007FF6AE4F2000-memory.dmp	UPX
behavioral1/memory/5572-119-0x00007FF79E4B0000-0x00007FF79E802000-memory.dmp	UPX
behavioral1/memory/4808-120-0x00007FF79B2C0000-0x00007FF79B612000-memory.dmp	UPX
behavioral1/memory/1816-121-0x00007FF63FA30000-0x00007FF63FD82000-memory.dmp	UPX
behavioral1/memory/4652-122-0x00007FF7309F0000-0x00007FF730D42000-memory.dmp	UPX
behavioral1/memory/5784-123-0x00007FF77BCF0000-0x00007FF77C042000-memory.dmp	UPX
behavioral1/memory/3428-124-0x00007FF617770000-0x00007FF617AC2000-memory.dmp	UPX
behavioral1/memory/3580-125-0x00007FF65EA00000-0x00007FF65ED52000-memory.dmp	UPX
behavioral1/memory/5508-126-0x00007FF7EED10000-0x00007FF7EF062000-memory.dmp	UPX
behavioral1/memory/5656-127-0x00007FF62D330000-0x00007FF62D682000-memory.dmp	UPX
behavioral1/memory/5236-128-0x00007FF6129F0000-0x00007FF612D42000-memory.dmp	UPX
behavioral1/memory/5756-129-0x00007FF7F5210000-0x00007FF7F5562000-memory.dmp	UPX
behavioral1/memory/616-130-0x00007FF64F210000-0x00007FF64F562000-memory.dmp	UPX
behavioral1/memory/3524-131-0x00007FF7B9500000-0x00007FF7B9852000-memory.dmp	UPX
behavioral1/memory/5756-132-0x00007FF7F5210000-0x00007FF7F5562000-memory.dmp	UPX
behavioral1/memory/616-134-0x00007FF64F210000-0x00007FF64F562000-memory.dmp	UPX
behavioral1/memory/5656-133-0x00007FF62D330000-0x00007FF62D682000-memory.dmp	UPX
behavioral1/memory/5520-135-0x00007FF6913E0000-0x00007FF691732000-memory.dmp	UPX
behavioral1/memory/5752-136-0x00007FF636C90000-0x00007FF636FE2000-memory.dmp	UPX
behavioral1/memory/3428-142-0x00007FF617770000-0x00007FF617AC2000-memory.dmp	UPX
behavioral1/memory/3124-150-0x00007FF79E950000-0x00007FF79ECA2000-memory.dmp	UPX
behavioral1/memory/4032-149-0x00007FF66FB60000-0x00007FF66FEB2000-memory.dmp	UPX
behavioral1/memory/6036-148-0x00007FF7A4DF0000-0x00007FF7A5142000-memory.dmp	UPX
behavioral1/memory/5152-147-0x00007FF786B30000-0x00007FF786E82000-memory.dmp	UPX
behavioral1/memory/5076-146-0x00007FF6AE1A0000-0x00007FF6AE4F2000-memory.dmp	UPX
behavioral1/memory/2312-145-0x00007FF6F9670000-0x00007FF6F99C2000-memory.dmp	UPX
behavioral1/memory/5572-144-0x00007FF79E4B0000-0x00007FF79E802000-memory.dmp	UPX
behavioral1/memory/4808-143-0x00007FF79B2C0000-0x00007FF79B612000-memory.dmp	UPX
behavioral1/memory/5508-141-0x00007FF7EED10000-0x00007FF7EF062000-memory.dmp	UPX
behavioral1/memory/5784-140-0x00007FF77BCF0000-0x00007FF77C042000-memory.dmp	UPX
behavioral1/memory/3580-139-0x00007FF65EA00000-0x00007FF65ED52000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/5236-0-0x00007FF6129F0000-0x00007FF612D42000-memory.dmp	xmrig
behavioral1/files/0x0007000000024747-6.dat	xmrig
behavioral1/memory/3524-17-0x00007FF7B9500000-0x00007FF7B9852000-memory.dmp	xmrig
behavioral1/files/0x0007000000024749-20.dat	xmrig
behavioral1/files/0x0007000000024748-21.dat	xmrig
behavioral1/memory/5756-15-0x00007FF7F5210000-0x00007FF7F5562000-memory.dmp	xmrig
behavioral1/files/0x0009000000024743-11.dat	xmrig
behavioral1/files/0x0002000000022c06-32.dat	xmrig
behavioral1/files/0x0002000000022c07-43.dat	xmrig
behavioral1/files/0x000700000002474d-93.dat	xmrig
behavioral1/files/0x0007000000024751-107.dat	xmrig
behavioral1/files/0x0007000000024750-105.dat	xmrig
behavioral1/files/0x000700000002474f-102.dat	xmrig
behavioral1/files/0x000700000002474e-98.dat	xmrig
behavioral1/files/0x000700000002474c-88.dat	xmrig
behavioral1/files/0x000700000002474b-83.dat	xmrig
behavioral1/files/0x0002000000022c42-78.dat	xmrig
behavioral1/files/0x0002000000022c41-73.dat	xmrig
behavioral1/files/0x0002000000022c40-68.dat	xmrig
behavioral1/files/0x0002000000022c3f-63.dat	xmrig
behavioral1/files/0x0002000000022c3e-58.dat	xmrig
behavioral1/files/0x0002000000022c3d-53.dat	xmrig
behavioral1/files/0x0002000000022c08-48.dat	xmrig
behavioral1/files/0x000700000002474a-28.dat	xmrig
behavioral1/memory/616-109-0x00007FF64F210000-0x00007FF64F562000-memory.dmp	xmrig
behavioral1/memory/5520-110-0x00007FF6913E0000-0x00007FF691732000-memory.dmp	xmrig
behavioral1/memory/5752-111-0x00007FF636C90000-0x00007FF636FE2000-memory.dmp	xmrig
behavioral1/memory/3060-112-0x00007FF7F9590000-0x00007FF7F98E2000-memory.dmp	xmrig
behavioral1/memory/3124-113-0x00007FF79E950000-0x00007FF79ECA2000-memory.dmp	xmrig
behavioral1/memory/4032-114-0x00007FF66FB60000-0x00007FF66FEB2000-memory.dmp	xmrig
behavioral1/memory/6036-115-0x00007FF7A4DF0000-0x00007FF7A5142000-memory.dmp	xmrig
behavioral1/memory/5152-116-0x00007FF786B30000-0x00007FF786E82000-memory.dmp	xmrig
behavioral1/memory/2312-117-0x00007FF6F9670000-0x00007FF6F99C2000-memory.dmp	xmrig
behavioral1/memory/5076-118-0x00007FF6AE1A0000-0x00007FF6AE4F2000-memory.dmp	xmrig
behavioral1/memory/5572-119-0x00007FF79E4B0000-0x00007FF79E802000-memory.dmp	xmrig
behavioral1/memory/4808-120-0x00007FF79B2C0000-0x00007FF79B612000-memory.dmp	xmrig
behavioral1/memory/1816-121-0x00007FF63FA30000-0x00007FF63FD82000-memory.dmp	xmrig
behavioral1/memory/4652-122-0x00007FF7309F0000-0x00007FF730D42000-memory.dmp	xmrig
behavioral1/memory/5784-123-0x00007FF77BCF0000-0x00007FF77C042000-memory.dmp	xmrig
behavioral1/memory/3428-124-0x00007FF617770000-0x00007FF617AC2000-memory.dmp	xmrig
behavioral1/memory/3580-125-0x00007FF65EA00000-0x00007FF65ED52000-memory.dmp	xmrig
behavioral1/memory/5508-126-0x00007FF7EED10000-0x00007FF7EF062000-memory.dmp	xmrig
behavioral1/memory/5656-127-0x00007FF62D330000-0x00007FF62D682000-memory.dmp	xmrig
behavioral1/memory/5236-128-0x00007FF6129F0000-0x00007FF612D42000-memory.dmp	xmrig
behavioral1/memory/5756-129-0x00007FF7F5210000-0x00007FF7F5562000-memory.dmp	xmrig
behavioral1/memory/616-130-0x00007FF64F210000-0x00007FF64F562000-memory.dmp	xmrig
behavioral1/memory/3524-131-0x00007FF7B9500000-0x00007FF7B9852000-memory.dmp	xmrig
behavioral1/memory/5756-132-0x00007FF7F5210000-0x00007FF7F5562000-memory.dmp	xmrig
behavioral1/memory/616-134-0x00007FF64F210000-0x00007FF64F562000-memory.dmp	xmrig
behavioral1/memory/5656-133-0x00007FF62D330000-0x00007FF62D682000-memory.dmp	xmrig
behavioral1/memory/5520-135-0x00007FF6913E0000-0x00007FF691732000-memory.dmp	xmrig
behavioral1/memory/5752-136-0x00007FF636C90000-0x00007FF636FE2000-memory.dmp	xmrig
behavioral1/memory/3428-142-0x00007FF617770000-0x00007FF617AC2000-memory.dmp	xmrig
behavioral1/memory/3124-150-0x00007FF79E950000-0x00007FF79ECA2000-memory.dmp	xmrig
behavioral1/memory/4032-149-0x00007FF66FB60000-0x00007FF66FEB2000-memory.dmp	xmrig
behavioral1/memory/6036-148-0x00007FF7A4DF0000-0x00007FF7A5142000-memory.dmp	xmrig
behavioral1/memory/5152-147-0x00007FF786B30000-0x00007FF786E82000-memory.dmp	xmrig
behavioral1/memory/5076-146-0x00007FF6AE1A0000-0x00007FF6AE4F2000-memory.dmp	xmrig
behavioral1/memory/2312-145-0x00007FF6F9670000-0x00007FF6F99C2000-memory.dmp	xmrig
behavioral1/memory/5572-144-0x00007FF79E4B0000-0x00007FF79E802000-memory.dmp	xmrig
behavioral1/memory/4808-143-0x00007FF79B2C0000-0x00007FF79B612000-memory.dmp	xmrig
behavioral1/memory/5508-141-0x00007FF7EED10000-0x00007FF7EF062000-memory.dmp	xmrig
behavioral1/memory/5784-140-0x00007FF77BCF0000-0x00007FF77C042000-memory.dmp	xmrig
behavioral1/memory/3580-139-0x00007FF65EA00000-0x00007FF65ED52000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
5756	KJWygbM.exe
3524	BDBiPvi.exe
616	HOhirEa.exe
5656	gzEYwvL.exe
5520	zbNVLBo.exe
5752	wrtHDAJ.exe
3060	drUMHRG.exe
3124	JDyCbQz.exe
4032	fZuxcCD.exe
6036	PSTGSas.exe
5152	ODRsPbn.exe
2312	tOOJuXg.exe
5076	hJxdvBw.exe
5572	ozSQcIB.exe
4808	IKNyENK.exe
1816	FUBaiHJ.exe
4652	fcgHViX.exe
5784	GxvJfyr.exe
3428	PByxpTY.exe
3580	gnWiAJR.exe
5508	FYKdYzR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5236-0-0x00007FF6129F0000-0x00007FF612D42000-memory.dmp	upx
behavioral1/files/0x0007000000024747-6.dat	upx
behavioral1/memory/3524-17-0x00007FF7B9500000-0x00007FF7B9852000-memory.dmp	upx
behavioral1/files/0x0007000000024749-20.dat	upx
behavioral1/files/0x0007000000024748-21.dat	upx
behavioral1/memory/5756-15-0x00007FF7F5210000-0x00007FF7F5562000-memory.dmp	upx
behavioral1/files/0x0009000000024743-11.dat	upx
behavioral1/files/0x0002000000022c06-32.dat	upx
behavioral1/files/0x0002000000022c07-43.dat	upx
behavioral1/files/0x000700000002474d-93.dat	upx
behavioral1/files/0x0007000000024751-107.dat	upx
behavioral1/files/0x0007000000024750-105.dat	upx
behavioral1/files/0x000700000002474f-102.dat	upx
behavioral1/files/0x000700000002474e-98.dat	upx
behavioral1/files/0x000700000002474c-88.dat	upx
behavioral1/files/0x000700000002474b-83.dat	upx
behavioral1/files/0x0002000000022c42-78.dat	upx
behavioral1/files/0x0002000000022c41-73.dat	upx
behavioral1/files/0x0002000000022c40-68.dat	upx
behavioral1/files/0x0002000000022c3f-63.dat	upx
behavioral1/files/0x0002000000022c3e-58.dat	upx
behavioral1/files/0x0002000000022c3d-53.dat	upx
behavioral1/files/0x0002000000022c08-48.dat	upx
behavioral1/files/0x000700000002474a-28.dat	upx
behavioral1/memory/616-109-0x00007FF64F210000-0x00007FF64F562000-memory.dmp	upx
behavioral1/memory/5520-110-0x00007FF6913E0000-0x00007FF691732000-memory.dmp	upx
behavioral1/memory/5752-111-0x00007FF636C90000-0x00007FF636FE2000-memory.dmp	upx
behavioral1/memory/3060-112-0x00007FF7F9590000-0x00007FF7F98E2000-memory.dmp	upx
behavioral1/memory/3124-113-0x00007FF79E950000-0x00007FF79ECA2000-memory.dmp	upx
behavioral1/memory/4032-114-0x00007FF66FB60000-0x00007FF66FEB2000-memory.dmp	upx
behavioral1/memory/6036-115-0x00007FF7A4DF0000-0x00007FF7A5142000-memory.dmp	upx
behavioral1/memory/5152-116-0x00007FF786B30000-0x00007FF786E82000-memory.dmp	upx
behavioral1/memory/2312-117-0x00007FF6F9670000-0x00007FF6F99C2000-memory.dmp	upx
behavioral1/memory/5076-118-0x00007FF6AE1A0000-0x00007FF6AE4F2000-memory.dmp	upx
behavioral1/memory/5572-119-0x00007FF79E4B0000-0x00007FF79E802000-memory.dmp	upx
behavioral1/memory/4808-120-0x00007FF79B2C0000-0x00007FF79B612000-memory.dmp	upx
behavioral1/memory/1816-121-0x00007FF63FA30000-0x00007FF63FD82000-memory.dmp	upx
behavioral1/memory/4652-122-0x00007FF7309F0000-0x00007FF730D42000-memory.dmp	upx
behavioral1/memory/5784-123-0x00007FF77BCF0000-0x00007FF77C042000-memory.dmp	upx
behavioral1/memory/3428-124-0x00007FF617770000-0x00007FF617AC2000-memory.dmp	upx
behavioral1/memory/3580-125-0x00007FF65EA00000-0x00007FF65ED52000-memory.dmp	upx
behavioral1/memory/5508-126-0x00007FF7EED10000-0x00007FF7EF062000-memory.dmp	upx
behavioral1/memory/5656-127-0x00007FF62D330000-0x00007FF62D682000-memory.dmp	upx
behavioral1/memory/5236-128-0x00007FF6129F0000-0x00007FF612D42000-memory.dmp	upx
behavioral1/memory/5756-129-0x00007FF7F5210000-0x00007FF7F5562000-memory.dmp	upx
behavioral1/memory/616-130-0x00007FF64F210000-0x00007FF64F562000-memory.dmp	upx
behavioral1/memory/3524-131-0x00007FF7B9500000-0x00007FF7B9852000-memory.dmp	upx
behavioral1/memory/5756-132-0x00007FF7F5210000-0x00007FF7F5562000-memory.dmp	upx
behavioral1/memory/616-134-0x00007FF64F210000-0x00007FF64F562000-memory.dmp	upx
behavioral1/memory/5656-133-0x00007FF62D330000-0x00007FF62D682000-memory.dmp	upx
behavioral1/memory/5520-135-0x00007FF6913E0000-0x00007FF691732000-memory.dmp	upx
behavioral1/memory/5752-136-0x00007FF636C90000-0x00007FF636FE2000-memory.dmp	upx
behavioral1/memory/3428-142-0x00007FF617770000-0x00007FF617AC2000-memory.dmp	upx
behavioral1/memory/3124-150-0x00007FF79E950000-0x00007FF79ECA2000-memory.dmp	upx
behavioral1/memory/4032-149-0x00007FF66FB60000-0x00007FF66FEB2000-memory.dmp	upx
behavioral1/memory/6036-148-0x00007FF7A4DF0000-0x00007FF7A5142000-memory.dmp	upx
behavioral1/memory/5152-147-0x00007FF786B30000-0x00007FF786E82000-memory.dmp	upx
behavioral1/memory/5076-146-0x00007FF6AE1A0000-0x00007FF6AE4F2000-memory.dmp	upx
behavioral1/memory/2312-145-0x00007FF6F9670000-0x00007FF6F99C2000-memory.dmp	upx
behavioral1/memory/5572-144-0x00007FF79E4B0000-0x00007FF79E802000-memory.dmp	upx
behavioral1/memory/4808-143-0x00007FF79B2C0000-0x00007FF79B612000-memory.dmp	upx
behavioral1/memory/5508-141-0x00007FF7EED10000-0x00007FF7EF062000-memory.dmp	upx
behavioral1/memory/5784-140-0x00007FF77BCF0000-0x00007FF77C042000-memory.dmp	upx
behavioral1/memory/3580-139-0x00007FF65EA00000-0x00007FF65ED52000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\zbNVLBo.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ODRsPbn.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\HOhirEa.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\tOOJuXg.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fcgHViX.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\GxvJfyr.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\PByxpTY.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\KJWygbM.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\gzEYwvL.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\drUMHRG.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fZuxcCD.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\hJxdvBw.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\gnWiAJR.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\BDBiPvi.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\wrtHDAJ.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\JDyCbQz.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\PSTGSas.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ozSQcIB.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\IKNyENK.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\FUBaiHJ.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\FYKdYzR.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5236 wrote to memory of 5756	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	89
PID 5236 wrote to memory of 3524	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 5236 wrote to memory of 616	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 5236 wrote to memory of 5656	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 5236 wrote to memory of 5520	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 5236 wrote to memory of 5752	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 5236 wrote to memory of 3060	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 5236 wrote to memory of 3124	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 5236 wrote to memory of 4032	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 5236 wrote to memory of 6036	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 5236 wrote to memory of 5152	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 5236 wrote to memory of 2312	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 5236 wrote to memory of 5076	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 5236 wrote to memory of 5572	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 5236 wrote to memory of 4808	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 5236 wrote to memory of 1816	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 5236 wrote to memory of 4652	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 5236 wrote to memory of 5784	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 5236 wrote to memory of 3428	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 5236 wrote to memory of 3580	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 5236 wrote to memory of 5508	5236	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Windows\System\KJWygbM.exe
  C:\Windows\System\KJWygbM.exe
  2⤵
  - Executes dropped EXE
  PID:5756
- C:\Windows\System\BDBiPvi.exe
  C:\Windows\System\BDBiPvi.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\HOhirEa.exe
  C:\Windows\System\HOhirEa.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\gzEYwvL.exe
  C:\Windows\System\gzEYwvL.exe
  2⤵
  - Executes dropped EXE
  PID:5656
- C:\Windows\System\zbNVLBo.exe
  C:\Windows\System\zbNVLBo.exe
  2⤵
  - Executes dropped EXE
  PID:5520
- C:\Windows\System\wrtHDAJ.exe
  C:\Windows\System\wrtHDAJ.exe
  2⤵
  - Executes dropped EXE
  PID:5752
- C:\Windows\System\drUMHRG.exe
  C:\Windows\System\drUMHRG.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\JDyCbQz.exe
  C:\Windows\System\JDyCbQz.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\fZuxcCD.exe
  C:\Windows\System\fZuxcCD.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\PSTGSas.exe
  C:\Windows\System\PSTGSas.exe
  2⤵
  - Executes dropped EXE
  PID:6036
- C:\Windows\System\ODRsPbn.exe
  C:\Windows\System\ODRsPbn.exe
  2⤵
  - Executes dropped EXE
  PID:5152
- C:\Windows\System\tOOJuXg.exe
  C:\Windows\System\tOOJuXg.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\hJxdvBw.exe
  C:\Windows\System\hJxdvBw.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\ozSQcIB.exe
  C:\Windows\System\ozSQcIB.exe
  2⤵
  - Executes dropped EXE
  PID:5572
- C:\Windows\System\IKNyENK.exe
  C:\Windows\System\IKNyENK.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\FUBaiHJ.exe
  C:\Windows\System\FUBaiHJ.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\fcgHViX.exe
  C:\Windows\System\fcgHViX.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\GxvJfyr.exe
  C:\Windows\System\GxvJfyr.exe
  2⤵
  - Executes dropped EXE
  PID:5784
- C:\Windows\System\PByxpTY.exe
  C:\Windows\System\PByxpTY.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\gnWiAJR.exe
  C:\Windows\System\gnWiAJR.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\FYKdYzR.exe
  C:\Windows\System\FYKdYzR.exe
  2⤵
  - Executes dropped EXE
  PID:5508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BDBiPvi.exe

Path C:\Windows\System\BDBiPvi.exe
Size 8.3MB
SHA256 ac9147cb27e49c0116dd32e25b556a59021289a35f41270688316bc6ea31648b
MD5 e536788aabcf3dd4175951bccd6f8b50
SHA1 d3f638e2abcf1040915c5e6cae191f5912d0a843
SHA512 d81873a8f4fa0d06061a77d4fe459d92eb9d1acef7afbf9679cf3a243dfb0bb9dbd1b67ad7d4c80e498cd0199969ab1a5806ed580de2564317cf97a08da09079
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUb:v+D56utgpPF8u/7b
TLSH
T191965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FUBaiHJ.exe

Path C:\Windows\System\FUBaiHJ.exe
Size 8.3MB
SHA256 1feaefca1cd314f84088da662d17db158b14113afe3bb5e4b1604e39932c16fd
MD5 b4912a0659aa4774c33c7f50fcc67d2f
SHA1 6b8987869ed384415e4e3a684b4a9a23b198f552
SHA512 088ed293dda3456566ede5d23401ee211c0c7f3fa0e30d4c1c45957ac82deeccd429bf0301a84e3aa97baf96018f486ebc0ca4b98b4f4a121ef4ccf69d9290e3
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU2:v+D56utgpPF8u/72
TLSH
T1E7965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FYKdYzR.exe

Path C:\Windows\System\FYKdYzR.exe
Size 8.3MB
SHA256 6b6d74f0ddcfaddc79dc54a65cacd059bd726c68eca00c8269efe0f43fd68b43
MD5 7c43cae0fe3fcbeeff70fa0fe6f9f6d2
SHA1 f65b5dd4309ada9d346aba329df857602f8160ff
SHA512 f61b7dd244239e15890a75265b3f85909fe692f4bfc759d6ceb9530f0e162887061f39f3ef3017c2d722851d0cf7ee1fdc83918e1c997dfd23c8a67c01e5920a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUD:v+D56utgpPF8u/7D
TLSH
T10D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GxvJfyr.exe

Path C:\Windows\System\GxvJfyr.exe
Size 8.3MB
SHA256 e9c346737ba22d894ccf1878b2382e3d34479e09e6a28b1efdd9b53b8634c9e7
MD5 95d076fdad175145b06b78bc97b933d3
SHA1 05d6d92a6cf0c979b4f06edb0dd2b90ae4a5c65d
SHA512 5ccfbca1a6b8ce551b7fef1e00fdfd999ce1f474ea8098025c57e39af8738141ee1f269e070ca2e535e7d4c76abf38b1f149067fadcfac0f1f353d2682222bd7
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUe:v+D56utgpPF8u/7e
TLSH
T1E2965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HOhirEa.exe

Path C:\Windows\System\HOhirEa.exe
Size 8.3MB
SHA256 89f052e048b11dd2dc4246f4cea502296c98250c04ed0becb0c0c14b411e7a12
MD5 6bf93a4dcf9035a830d58173da3ec3ac
SHA1 5d624cefb037dab3e677b531d96b8ab66f0500fc
SHA512 e385f6c30ee9270718833cdc81b4c61796e83bbd2030836706c664df746da8ed40fefffd960d4a1a2b72649b140e54b15f2c607d255c1f4d8381493e1c25d797
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUr:v+D56utgpPF8u/7r
TLSH
T114965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IKNyENK.exe

Path C:\Windows\System\IKNyENK.exe
Size 8.3MB
SHA256 04e0ed7f9f05f2d8cedeef2274a79a04d7659b8267b5aea6a6ed1c2eec18a2fb
MD5 d03236abe19a9ab5abd2a4f98894d216
SHA1 494a8fff021d0f9e306108b7b002999fb9dfe89c
SHA512 49a65e07b37fc107bb5c25dd444c7bf0d26f4cd43c381e1b2c20e3d4daa2096165e6132bc4c97d2ffa9b6098f5358b96b2a0e26e83309b7e3e91a4a130527ce3
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUL:v+D56utgpPF8u/7L
TLSH
T196965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JDyCbQz.exe

Path C:\Windows\System\JDyCbQz.exe
Size 8.3MB
SHA256 2763e6018ce7cde0243a3808ed51ddb0903f8339dfada42da03ded9239862f17
MD5 e09e6ade80d8bb765b988eee31448653
SHA1 5a1ad6f544b7b7c6ab01ad35629a119126413b4c
SHA512 ee3bc5f84883adc65d8a9580bc5b9a50b590e1ebe07311197a0f280db22a50ff352a16abe6f0cc226fb663f9ab70f14135883ccb9b4c0dcbe9971785a9adbf44
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUG:v+D56utgpPF8u/7G
TLSH
T128965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KJWygbM.exe

Path C:\Windows\System\KJWygbM.exe
Size 8.3MB
SHA256 6b13be721999ed4bb0b120574f976b92c693f620f7e9688f6791530c42b72524
MD5 9c4e7f900c8aac0f22ed9b19755231d4
SHA1 315407cb94cf310ac4225979bba50967455a1823
SHA512 01e751bd98c5aab2b9b43cf63ef72fb5eb204d206f2f51d9a4deca7ded7ab71b4cdf3e566dd4da69484ef4ddc901ba3b0ba0a137af43028763e3fde0248d8ec9
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUc:v+D56utgpPF8u/7c
TLSH
T178965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ODRsPbn.exe

Path C:\Windows\System\ODRsPbn.exe
Size 8.3MB
SHA256 1592f244314c5127472ed7cd78a997632b29f9aabc9cb6e53a4c4ba81739a36e
MD5 08c311502bfe66e2fc716af6eed20563
SHA1 86d8da8895ea0e100312c4931bf0c44077c9eec9
SHA512 147cae80b66935862f2aefe385b61c9076f465645521c1e46fdc943f87ec9875aa261f91569185157a3cceb264c5942f5428f06853ff8e3ab714d0d2174343f0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUd:v+D56utgpPF8u/7d
TLSH
T1DC965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PByxpTY.exe

Path C:\Windows\System\PByxpTY.exe
Size 8.3MB
SHA256 4f547869b2b24327239a36c7c2ee0faec2a1b94d2c2ec615c83897157120e8b9
MD5 8e47d8a6721372e7c22a0b2443f3b92e
SHA1 56a1c0b1f6849815108aeb8c50c8dc98de868a21
SHA512 a0b3743f0ec7c103120f097d599d4d7ba74870026fc64951b033533ad349fa2cae31e125bfa211b5a0662d93bd94b499a4e5a4b25a72f4da73490c5197460051
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUu:v+D56utgpPF8u/7u
TLSH
T199965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSTGSas.exe

Path C:\Windows\System\PSTGSas.exe
Size 8.3MB
SHA256 5469a2635b2e32aa68b4f9f30ac272d131cfdc9e1e5e9dddb5c1f53ca1edc2ac
MD5 4b6f3836051fef1080c03f4a33323ea3
SHA1 689b1686c3f295323a0beeef41f09152c512f19b
SHA512 34b29d347a721f5c6788c2b87ded9ec37dec2841062d6bc1d820d7ee1edfd166e2d7e9a0c678d04200122ab989e034ab6121eda0561ed3f3492429f0c7d8110a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU0:v+D56utgpPF8u/70
TLSH
T119965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drUMHRG.exe

Path C:\Windows\System\drUMHRG.exe
Size 8.3MB
SHA256 7cb9feacf4526b6766af724ee8f0c6cc8f233bfd1b92774dd7a4498638099184
MD5 abc1c21eedb054508c09f7cde7a0a6e0
SHA1 d7743788b100342f7abd88e180225cf3b9c71227
SHA512 7b84f23d739592da8de61104065628665d01f33cc371f2974a5110e6d98a4e5eb1f56bea3a16bce118f0373e5e24d395368ee29f14622c2de85d7e978be3e153
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUE:v+D56utgpPF8u/7E
TLSH
T1ED965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fZuxcCD.exe

Path C:\Windows\System\fZuxcCD.exe
Size 8.3MB
SHA256 1fbc240baaed01465ac6c55c495d52bd64fee2237fbfccd5c6ba18c64a0c8817
MD5 0bc0f5c4e9bd355fd3e388677befc43b
SHA1 a2e36971966369972894539a00e840f3e59bccea
SHA512 8b326765ce2315c76a3ec378da77b69ee9f8f3a8b0bfa381da506e4318c5920c8a6c3c2cbbcd7803d9c1e95a54f6d8083112b886ee196c2d5525e607e8e58790
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUM:v+D56utgpPF8u/7M
TLSH
T140965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcgHViX.exe

Path C:\Windows\System\fcgHViX.exe
Size 8.3MB
SHA256 6853a990a6311256ccfeba7cb17acd0163a66b140a6aa2b3ee9457a63dc19755
MD5 b0114eaa0d6b5a5aa3f13d1602bafbf0
SHA1 2f58a32cd92dcb24a7885b2a147beec873b5daef
SHA512 fee0118e3bc20768ea2b08affdcab4f33dcd3cda2a9ce99d9a75647a71c58043cf77d5313513a772a447a6f663e969208551dd25c22f83f2cdb6957583011f63
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUU:v+D56utgpPF8u/7U
TLSH
T116965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gnWiAJR.exe

Path C:\Windows\System\gnWiAJR.exe
Size 8.3MB
SHA256 3ed5a996f46462ddc92e3580c3c29fdbeb962c457164d5fcf85d6f1daf1d675e
MD5 78069dbdd20aedea803190c4cebc5cd0
SHA1 8f8aad2afcb041010eb68095be821191447c483a
SHA512 d2a707da56418bfc37f66da50d0f0c321a1b31402e3c481d5fb6c7e4ff26151adee76f1dc2c231e061412ff8f455fb1650e72c1f7c132297c60a72712cff2302
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUX:v+D56utgpPF8u/7X
TLSH
T162965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gzEYwvL.exe

Path C:\Windows\System\gzEYwvL.exe
Size 8.3MB
SHA256 a9b1e54a3bb9708e4dfec9ecfd79e7475d5563a5cbb7b6fe72f60a34706c3c39
MD5 1075e39391b5455229035cb2b0b5f75d
SHA1 fd46d623e7a036cb616285fdc5c94a6cf10aea1c
SHA512 d2c9a44efdfad9542e4a0723ebd0e7ec87945633dbd36ec4305068fe4b920970f0f932e37f26620b636b4ef1083556d8d2c389415a857b4ab8260e23c1770f75
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUy:v+D56utgpPF8u/7y
TLSH
T16E965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hJxdvBw.exe

Path C:\Windows\System\hJxdvBw.exe
Size 8.3MB
SHA256 d19ca2ceb610a01d85f2581476f15269f2935584156421e1d346da8d2492b759
MD5 c0b32f334e7d633ddf44caf57f9b5432
SHA1 cbd37062615e4d84ca1a952e555127951df6fbc2
SHA512 5b79688a5b1e007adc865cd22c6c854d16c319998787aad7e61fb4f68e0787691a08ac615b4420264dd939dd776dc061af57bfcb75dab1653cddc234eeb06d92
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU3:v+D56utgpPF8u/73
TLSH
T1AC965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ozSQcIB.exe

Path C:\Windows\System\ozSQcIB.exe
Size 8.3MB
SHA256 8d6f901977d58f9c11cf651fd1772842fb3469cdd2011d3493060d13742b1017
MD5 f18f9c01ac555b36acb917b0b3be4c78
SHA1 f04e4dad512835eb64574d87bc071d88f00fbb3f
SHA512 e2adc0b33d4cb60779fd885f50098922b60c36aea1c9e0aa7e47e738187a65771a2f2a67227845ab061e8554eefaf1413eb05e1137f54ffd818f0d9685ebc677
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU/:v+D56utgpPF8u/7/
TLSH
T14E965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tOOJuXg.exe

Path C:\Windows\System\tOOJuXg.exe
Size 8.3MB
SHA256 f833124fd90355ce3c2138bafbad42641676f88a511a1cf89d45951eaac4a9e8
MD5 ed41e472ba52a2ca77d1c69085966652
SHA1 6d4ab6ec2c8f236eb712a1de24055d9099d00023
SHA512 b75f1f6bf6f700f3597ed109c16a9414f702423210e3eb1813a631c36bf742ff0fae12c2bc2cedf0dc60bf5d61dddb4bcccf4e72406cb36df81d9642bf46b0ec
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUD:v+D56utgpPF8u/7D
TLSH
T1BF965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrtHDAJ.exe

Path C:\Windows\System\wrtHDAJ.exe
Size 8.3MB
SHA256 efcdbad82d2093ff2e9fd7af24546d4396d4b02244002c839e19da0e83636385
MD5 41f414e841fa0b0b40295b26bc5a3501
SHA1 96d3be1e9f77bb4a01f1da7de47a54862baf3cfc
SHA512 318d4efe92e3abbf9962a1fdf54264f5c1f31a4c312ed858dc6082cc6732cfa53b78b0f1929c6783759768e021fe1b067e3eabd56b69d6338bf0ee49e753a1f1
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUd:v+D56utgpPF8u/7d
TLSH
T13F965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zbNVLBo.exe

Path C:\Windows\System\zbNVLBo.exe
Size 8.3MB
SHA256 a160015ae79f1990b169f71311ea2eebe7455094c7d5647c63d00c54fb9b1d38
MD5 8b50d71e32b28fdecd62175e82cd85a6
SHA1 9d15d491f5b4b3ff5f44667e0f790c6099704101
SHA512 46426edc57db845785a35e288a3eb0581c9e91cf0661c824a618a02a423b71b01b7e840cbdab1d326b684ef40295908f90e4633a32d39664e31f81593e9b9c3e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUs:v+D56utgpPF8u/7s
TLSH
T145965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/616-130-0x00007FF64F210000-0x00007FF64F562000-memory.dmp

Download

memory/616-134-0x00007FF64F210000-0x00007FF64F562000-memory.dmp

Download

memory/616-109-0x00007FF64F210000-0x00007FF64F562000-memory.dmp

Download

memory/1816-121-0x00007FF63FA30000-0x00007FF63FD82000-memory.dmp

Download

memory/1816-137-0x00007FF63FA30000-0x00007FF63FD82000-memory.dmp

Download

memory/2312-117-0x00007FF6F9670000-0x00007FF6F99C2000-memory.dmp

Download

memory/2312-145-0x00007FF6F9670000-0x00007FF6F99C2000-memory.dmp

Download

memory/3060-151-0x00007FF7F9590000-0x00007FF7F98E2000-memory.dmp

Download

memory/3060-112-0x00007FF7F9590000-0x00007FF7F98E2000-memory.dmp

Download

memory/3124-113-0x00007FF79E950000-0x00007FF79ECA2000-memory.dmp

Download

memory/3124-150-0x00007FF79E950000-0x00007FF79ECA2000-memory.dmp

Download

memory/3428-124-0x00007FF617770000-0x00007FF617AC2000-memory.dmp

Download

memory/3428-142-0x00007FF617770000-0x00007FF617AC2000-memory.dmp

Download

memory/3524-131-0x00007FF7B9500000-0x00007FF7B9852000-memory.dmp

Download

memory/3524-17-0x00007FF7B9500000-0x00007FF7B9852000-memory.dmp

Download

memory/3580-139-0x00007FF65EA00000-0x00007FF65ED52000-memory.dmp

Download

memory/3580-125-0x00007FF65EA00000-0x00007FF65ED52000-memory.dmp

Download

memory/4032-149-0x00007FF66FB60000-0x00007FF66FEB2000-memory.dmp

Download

memory/4032-114-0x00007FF66FB60000-0x00007FF66FEB2000-memory.dmp

Download

memory/4652-122-0x00007FF7309F0000-0x00007FF730D42000-memory.dmp

Download

memory/4652-138-0x00007FF7309F0000-0x00007FF730D42000-memory.dmp

Download

memory/4808-120-0x00007FF79B2C0000-0x00007FF79B612000-memory.dmp

Download

memory/4808-143-0x00007FF79B2C0000-0x00007FF79B612000-memory.dmp

Download

memory/5076-118-0x00007FF6AE1A0000-0x00007FF6AE4F2000-memory.dmp

Download

memory/5076-146-0x00007FF6AE1A0000-0x00007FF6AE4F2000-memory.dmp

Download

memory/5152-116-0x00007FF786B30000-0x00007FF786E82000-memory.dmp

Download

memory/5152-147-0x00007FF786B30000-0x00007FF786E82000-memory.dmp

Download

memory/5236-0-0x00007FF6129F0000-0x00007FF612D42000-memory.dmp

Download

memory/5236-128-0x00007FF6129F0000-0x00007FF612D42000-memory.dmp

Download

memory/5236-1-0x00000297B12D0000-0x00000297B12E0000-memory.dmp

Download

memory/5508-126-0x00007FF7EED10000-0x00007FF7EF062000-memory.dmp

Download

memory/5508-141-0x00007FF7EED10000-0x00007FF7EF062000-memory.dmp

Download

memory/5520-110-0x00007FF6913E0000-0x00007FF691732000-memory.dmp

Download

memory/5520-135-0x00007FF6913E0000-0x00007FF691732000-memory.dmp

Download

memory/5572-144-0x00007FF79E4B0000-0x00007FF79E802000-memory.dmp

Download

memory/5572-119-0x00007FF79E4B0000-0x00007FF79E802000-memory.dmp

Download

memory/5656-133-0x00007FF62D330000-0x00007FF62D682000-memory.dmp

Download

memory/5656-127-0x00007FF62D330000-0x00007FF62D682000-memory.dmp

Download

memory/5752-136-0x00007FF636C90000-0x00007FF636FE2000-memory.dmp

Download

memory/5752-111-0x00007FF636C90000-0x00007FF636FE2000-memory.dmp

Download

memory/5756-129-0x00007FF7F5210000-0x00007FF7F5562000-memory.dmp

Download

memory/5756-132-0x00007FF7F5210000-0x00007FF7F5562000-memory.dmp

Download

memory/5756-15-0x00007FF7F5210000-0x00007FF7F5562000-memory.dmp

Download

memory/5784-123-0x00007FF77BCF0000-0x00007FF77C042000-memory.dmp

Download

memory/5784-140-0x00007FF77BCF0000-0x00007FF77C042000-memory.dmp

Download

memory/6036-148-0x00007FF7A4DF0000-0x00007FF7A5142000-memory.dmp

Download

memory/6036-115-0x00007FF7A4DF0000-0x00007FF7A5142000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads