cobaltstrike | e2de7906f6c1ee28bf665d37c4a84eee713b5f98111160cec6e2a351be2ed70c

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample261027-pkgvfa1w6m
SHA256 e2de7906f6c1ee28bf665d37c4a84eee713b5f98111160cec6e2a351be2ed70c
MD5 8afe30f4df26b7574495e540ced86d4c
SHA1 3be7c7eec4cbc7d0eaf4aff05b36e9bbdff7bdb9
SHA512 bc480c413497d6d05cb2899f26361b933d12e3edcda1e9581f0696e999a4092a07f03f3ed961c7bf49225accdf077053c5f8d550473f6860c6cc79d3667c6552
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU3:v+D56utgpPF8u/73
TLSH
T15F965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x001100000001b8aa-5.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c583-11.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c584-17.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c585-23.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c586-28.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c588-38.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c589-43.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c58a-48.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c58b-52.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c58e-67.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c591-82.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c592-88.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c596-107.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c595-103.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c594-98.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c593-93.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c590-78.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c58f-73.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c58d-63.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c58c-58.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c587-33.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x001100000001b8aa-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c583-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c584-17.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c585-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c586-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c588-38.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c589-43.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c58a-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c58b-52.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c58e-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c591-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c592-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c596-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c595-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c594-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c593-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c590-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c58f-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c58d-63.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c58c-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c587-33.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3124-0-0x00007FF65CD30000-0x00007FF65D082000-memory.dmp	UPX
behavioral2/files/0x001100000001b8aa-5.dat	UPX
behavioral2/memory/6052-6-0x00007FF731B50000-0x00007FF731EA2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c583-11.dat	UPX
behavioral2/memory/5200-12-0x00007FF6313E0000-0x00007FF631732000-memory.dmp	UPX
behavioral2/files/0x000d00000001c584-17.dat	UPX
behavioral2/files/0x000d00000001c585-23.dat	UPX
behavioral2/files/0x000d00000001c586-28.dat	UPX
behavioral2/files/0x000d00000001c588-38.dat	UPX
behavioral2/files/0x000d00000001c589-43.dat	UPX
behavioral2/files/0x000d00000001c58a-48.dat	UPX
behavioral2/files/0x000d00000001c58b-52.dat	UPX
behavioral2/files/0x000d00000001c58e-67.dat	UPX
behavioral2/files/0x000d00000001c591-82.dat	UPX
behavioral2/files/0x000d00000001c592-88.dat	UPX
behavioral2/files/0x000d00000001c596-107.dat	UPX
behavioral2/files/0x000d00000001c595-103.dat	UPX
behavioral2/files/0x000d00000001c594-98.dat	UPX
behavioral2/files/0x000d00000001c593-93.dat	UPX
behavioral2/files/0x000d00000001c590-78.dat	UPX
behavioral2/files/0x000d00000001c58f-73.dat	UPX
behavioral2/files/0x000d00000001c58d-63.dat	UPX
behavioral2/files/0x000d00000001c58c-58.dat	UPX
behavioral2/files/0x000d00000001c587-33.dat	UPX
behavioral2/memory/2980-109-0x00007FF648740000-0x00007FF648A92000-memory.dmp	UPX
behavioral2/memory/1200-110-0x00007FF65EAB0000-0x00007FF65EE02000-memory.dmp	UPX
behavioral2/memory/1000-112-0x00007FF6990C0000-0x00007FF699412000-memory.dmp	UPX
behavioral2/memory/2756-111-0x00007FF682990000-0x00007FF682CE2000-memory.dmp	UPX
behavioral2/memory/2368-113-0x00007FF732B20000-0x00007FF732E72000-memory.dmp	UPX
behavioral2/memory/3048-115-0x00007FF709A10000-0x00007FF709D62000-memory.dmp	UPX
behavioral2/memory/236-118-0x00007FF687950000-0x00007FF687CA2000-memory.dmp	UPX
behavioral2/memory/4896-117-0x00007FF72A710000-0x00007FF72AA62000-memory.dmp	UPX
behavioral2/memory/3400-119-0x00007FF712540000-0x00007FF712892000-memory.dmp	UPX
behavioral2/memory/1396-120-0x00007FF6A6D30000-0x00007FF6A7082000-memory.dmp	UPX
behavioral2/memory/2576-122-0x00007FF7F3900000-0x00007FF7F3C52000-memory.dmp	UPX
behavioral2/memory/1556-123-0x00007FF776A40000-0x00007FF776D92000-memory.dmp	UPX
behavioral2/memory/3212-125-0x00007FF761EE0000-0x00007FF762232000-memory.dmp	UPX
behavioral2/memory/5420-127-0x00007FF608910000-0x00007FF608C62000-memory.dmp	UPX
behavioral2/memory/1176-126-0x00007FF62CE30000-0x00007FF62D182000-memory.dmp	UPX
behavioral2/memory/2720-124-0x00007FF6884F0000-0x00007FF688842000-memory.dmp	UPX
behavioral2/memory/1652-121-0x00007FF7204E0000-0x00007FF720832000-memory.dmp	UPX
behavioral2/memory/3572-116-0x00007FF61AB50000-0x00007FF61AEA2000-memory.dmp	UPX
behavioral2/memory/2812-114-0x00007FF6EC6A0000-0x00007FF6EC9F2000-memory.dmp	UPX
behavioral2/memory/3124-128-0x00007FF65CD30000-0x00007FF65D082000-memory.dmp	UPX
behavioral2/memory/6052-129-0x00007FF731B50000-0x00007FF731EA2000-memory.dmp	UPX
behavioral2/memory/5200-130-0x00007FF6313E0000-0x00007FF631732000-memory.dmp	UPX
behavioral2/memory/2980-131-0x00007FF648740000-0x00007FF648A92000-memory.dmp	UPX
behavioral2/memory/6052-132-0x00007FF731B50000-0x00007FF731EA2000-memory.dmp	UPX
behavioral2/memory/5200-133-0x00007FF6313E0000-0x00007FF631732000-memory.dmp	UPX
behavioral2/memory/2980-134-0x00007FF648740000-0x00007FF648A92000-memory.dmp	UPX
behavioral2/memory/1200-136-0x00007FF65EAB0000-0x00007FF65EE02000-memory.dmp	UPX
behavioral2/memory/5420-135-0x00007FF608910000-0x00007FF608C62000-memory.dmp	UPX
behavioral2/memory/2368-137-0x00007FF732B20000-0x00007FF732E72000-memory.dmp	UPX
behavioral2/memory/2812-139-0x00007FF6EC6A0000-0x00007FF6EC9F2000-memory.dmp	UPX
behavioral2/memory/3048-138-0x00007FF709A10000-0x00007FF709D62000-memory.dmp	UPX
behavioral2/memory/4896-143-0x00007FF72A710000-0x00007FF72AA62000-memory.dmp	UPX
behavioral2/memory/1652-145-0x00007FF7204E0000-0x00007FF720832000-memory.dmp	UPX
behavioral2/memory/1176-149-0x00007FF62CE30000-0x00007FF62D182000-memory.dmp	UPX
behavioral2/memory/1396-152-0x00007FF6A6D30000-0x00007FF6A7082000-memory.dmp	UPX
behavioral2/memory/3400-151-0x00007FF712540000-0x00007FF712892000-memory.dmp	UPX
behavioral2/memory/3212-150-0x00007FF761EE0000-0x00007FF762232000-memory.dmp	UPX
behavioral2/memory/2576-148-0x00007FF7F3900000-0x00007FF7F3C52000-memory.dmp	UPX
behavioral2/memory/1556-147-0x00007FF776A40000-0x00007FF776D92000-memory.dmp	UPX
behavioral2/memory/2720-146-0x00007FF6884F0000-0x00007FF688842000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3124-0-0x00007FF65CD30000-0x00007FF65D082000-memory.dmp	xmrig
behavioral2/files/0x001100000001b8aa-5.dat	xmrig
behavioral2/memory/6052-6-0x00007FF731B50000-0x00007FF731EA2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c583-11.dat	xmrig
behavioral2/memory/5200-12-0x00007FF6313E0000-0x00007FF631732000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c584-17.dat	xmrig
behavioral2/files/0x000d00000001c585-23.dat	xmrig
behavioral2/files/0x000d00000001c586-28.dat	xmrig
behavioral2/files/0x000d00000001c588-38.dat	xmrig
behavioral2/files/0x000d00000001c589-43.dat	xmrig
behavioral2/files/0x000d00000001c58a-48.dat	xmrig
behavioral2/files/0x000d00000001c58b-52.dat	xmrig
behavioral2/files/0x000d00000001c58e-67.dat	xmrig
behavioral2/files/0x000d00000001c591-82.dat	xmrig
behavioral2/files/0x000d00000001c592-88.dat	xmrig
behavioral2/files/0x000d00000001c596-107.dat	xmrig
behavioral2/files/0x000d00000001c595-103.dat	xmrig
behavioral2/files/0x000d00000001c594-98.dat	xmrig
behavioral2/files/0x000d00000001c593-93.dat	xmrig
behavioral2/files/0x000d00000001c590-78.dat	xmrig
behavioral2/files/0x000d00000001c58f-73.dat	xmrig
behavioral2/files/0x000d00000001c58d-63.dat	xmrig
behavioral2/files/0x000d00000001c58c-58.dat	xmrig
behavioral2/files/0x000d00000001c587-33.dat	xmrig
behavioral2/memory/2980-109-0x00007FF648740000-0x00007FF648A92000-memory.dmp	xmrig
behavioral2/memory/1200-110-0x00007FF65EAB0000-0x00007FF65EE02000-memory.dmp	xmrig
behavioral2/memory/1000-112-0x00007FF6990C0000-0x00007FF699412000-memory.dmp	xmrig
behavioral2/memory/2756-111-0x00007FF682990000-0x00007FF682CE2000-memory.dmp	xmrig
behavioral2/memory/2368-113-0x00007FF732B20000-0x00007FF732E72000-memory.dmp	xmrig
behavioral2/memory/3048-115-0x00007FF709A10000-0x00007FF709D62000-memory.dmp	xmrig
behavioral2/memory/236-118-0x00007FF687950000-0x00007FF687CA2000-memory.dmp	xmrig
behavioral2/memory/4896-117-0x00007FF72A710000-0x00007FF72AA62000-memory.dmp	xmrig
behavioral2/memory/3400-119-0x00007FF712540000-0x00007FF712892000-memory.dmp	xmrig
behavioral2/memory/1396-120-0x00007FF6A6D30000-0x00007FF6A7082000-memory.dmp	xmrig
behavioral2/memory/2576-122-0x00007FF7F3900000-0x00007FF7F3C52000-memory.dmp	xmrig
behavioral2/memory/1556-123-0x00007FF776A40000-0x00007FF776D92000-memory.dmp	xmrig
behavioral2/memory/3212-125-0x00007FF761EE0000-0x00007FF762232000-memory.dmp	xmrig
behavioral2/memory/5420-127-0x00007FF608910000-0x00007FF608C62000-memory.dmp	xmrig
behavioral2/memory/1176-126-0x00007FF62CE30000-0x00007FF62D182000-memory.dmp	xmrig
behavioral2/memory/2720-124-0x00007FF6884F0000-0x00007FF688842000-memory.dmp	xmrig
behavioral2/memory/1652-121-0x00007FF7204E0000-0x00007FF720832000-memory.dmp	xmrig
behavioral2/memory/3572-116-0x00007FF61AB50000-0x00007FF61AEA2000-memory.dmp	xmrig
behavioral2/memory/2812-114-0x00007FF6EC6A0000-0x00007FF6EC9F2000-memory.dmp	xmrig
behavioral2/memory/3124-128-0x00007FF65CD30000-0x00007FF65D082000-memory.dmp	xmrig
behavioral2/memory/6052-129-0x00007FF731B50000-0x00007FF731EA2000-memory.dmp	xmrig
behavioral2/memory/5200-130-0x00007FF6313E0000-0x00007FF631732000-memory.dmp	xmrig
behavioral2/memory/2980-131-0x00007FF648740000-0x00007FF648A92000-memory.dmp	xmrig
behavioral2/memory/6052-132-0x00007FF731B50000-0x00007FF731EA2000-memory.dmp	xmrig
behavioral2/memory/5200-133-0x00007FF6313E0000-0x00007FF631732000-memory.dmp	xmrig
behavioral2/memory/2980-134-0x00007FF648740000-0x00007FF648A92000-memory.dmp	xmrig
behavioral2/memory/1200-136-0x00007FF65EAB0000-0x00007FF65EE02000-memory.dmp	xmrig
behavioral2/memory/5420-135-0x00007FF608910000-0x00007FF608C62000-memory.dmp	xmrig
behavioral2/memory/2368-137-0x00007FF732B20000-0x00007FF732E72000-memory.dmp	xmrig
behavioral2/memory/2812-139-0x00007FF6EC6A0000-0x00007FF6EC9F2000-memory.dmp	xmrig
behavioral2/memory/3048-138-0x00007FF709A10000-0x00007FF709D62000-memory.dmp	xmrig
behavioral2/memory/4896-143-0x00007FF72A710000-0x00007FF72AA62000-memory.dmp	xmrig
behavioral2/memory/1652-145-0x00007FF7204E0000-0x00007FF720832000-memory.dmp	xmrig
behavioral2/memory/1176-149-0x00007FF62CE30000-0x00007FF62D182000-memory.dmp	xmrig
behavioral2/memory/1396-152-0x00007FF6A6D30000-0x00007FF6A7082000-memory.dmp	xmrig
behavioral2/memory/3400-151-0x00007FF712540000-0x00007FF712892000-memory.dmp	xmrig
behavioral2/memory/3212-150-0x00007FF761EE0000-0x00007FF762232000-memory.dmp	xmrig
behavioral2/memory/2576-148-0x00007FF7F3900000-0x00007FF7F3C52000-memory.dmp	xmrig
behavioral2/memory/1556-147-0x00007FF776A40000-0x00007FF776D92000-memory.dmp	xmrig
behavioral2/memory/2720-146-0x00007FF6884F0000-0x00007FF688842000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
6052	NmqezBE.exe
5200	WuuiReX.exe
2980	iGQNJPd.exe
5420	GziqRXF.exe
1200	PCCQgjj.exe
2756	GAYuZiW.exe
1000	nbRwAHH.exe
2368	bSjyYTU.exe
2812	hKmMQUF.exe
3048	atkPbeV.exe
3572	lPFQKOi.exe
4896	toKAaFX.exe
236	fRVpPGi.exe
3400	IEXvqnQ.exe
1396	HiqnHUu.exe
1652	OAieqiL.exe
2576	wdmqyDC.exe
1556	LCaJwXx.exe
2720	IjzKfmp.exe
3212	ngEMpFN.exe
1176	RSSAgCi.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3124-0-0x00007FF65CD30000-0x00007FF65D082000-memory.dmp	upx
behavioral2/files/0x001100000001b8aa-5.dat	upx
behavioral2/memory/6052-6-0x00007FF731B50000-0x00007FF731EA2000-memory.dmp	upx
behavioral2/files/0x000d00000001c583-11.dat	upx
behavioral2/memory/5200-12-0x00007FF6313E0000-0x00007FF631732000-memory.dmp	upx
behavioral2/files/0x000d00000001c584-17.dat	upx
behavioral2/files/0x000d00000001c585-23.dat	upx
behavioral2/files/0x000d00000001c586-28.dat	upx
behavioral2/files/0x000d00000001c588-38.dat	upx
behavioral2/files/0x000d00000001c589-43.dat	upx
behavioral2/files/0x000d00000001c58a-48.dat	upx
behavioral2/files/0x000d00000001c58b-52.dat	upx
behavioral2/files/0x000d00000001c58e-67.dat	upx
behavioral2/files/0x000d00000001c591-82.dat	upx
behavioral2/files/0x000d00000001c592-88.dat	upx
behavioral2/files/0x000d00000001c596-107.dat	upx
behavioral2/files/0x000d00000001c595-103.dat	upx
behavioral2/files/0x000d00000001c594-98.dat	upx
behavioral2/files/0x000d00000001c593-93.dat	upx
behavioral2/files/0x000d00000001c590-78.dat	upx
behavioral2/files/0x000d00000001c58f-73.dat	upx
behavioral2/files/0x000d00000001c58d-63.dat	upx
behavioral2/files/0x000d00000001c58c-58.dat	upx
behavioral2/files/0x000d00000001c587-33.dat	upx
behavioral2/memory/2980-109-0x00007FF648740000-0x00007FF648A92000-memory.dmp	upx
behavioral2/memory/1200-110-0x00007FF65EAB0000-0x00007FF65EE02000-memory.dmp	upx
behavioral2/memory/1000-112-0x00007FF6990C0000-0x00007FF699412000-memory.dmp	upx
behavioral2/memory/2756-111-0x00007FF682990000-0x00007FF682CE2000-memory.dmp	upx
behavioral2/memory/2368-113-0x00007FF732B20000-0x00007FF732E72000-memory.dmp	upx
behavioral2/memory/3048-115-0x00007FF709A10000-0x00007FF709D62000-memory.dmp	upx
behavioral2/memory/236-118-0x00007FF687950000-0x00007FF687CA2000-memory.dmp	upx
behavioral2/memory/4896-117-0x00007FF72A710000-0x00007FF72AA62000-memory.dmp	upx
behavioral2/memory/3400-119-0x00007FF712540000-0x00007FF712892000-memory.dmp	upx
behavioral2/memory/1396-120-0x00007FF6A6D30000-0x00007FF6A7082000-memory.dmp	upx
behavioral2/memory/2576-122-0x00007FF7F3900000-0x00007FF7F3C52000-memory.dmp	upx
behavioral2/memory/1556-123-0x00007FF776A40000-0x00007FF776D92000-memory.dmp	upx
behavioral2/memory/3212-125-0x00007FF761EE0000-0x00007FF762232000-memory.dmp	upx
behavioral2/memory/5420-127-0x00007FF608910000-0x00007FF608C62000-memory.dmp	upx
behavioral2/memory/1176-126-0x00007FF62CE30000-0x00007FF62D182000-memory.dmp	upx
behavioral2/memory/2720-124-0x00007FF6884F0000-0x00007FF688842000-memory.dmp	upx
behavioral2/memory/1652-121-0x00007FF7204E0000-0x00007FF720832000-memory.dmp	upx
behavioral2/memory/3572-116-0x00007FF61AB50000-0x00007FF61AEA2000-memory.dmp	upx
behavioral2/memory/2812-114-0x00007FF6EC6A0000-0x00007FF6EC9F2000-memory.dmp	upx
behavioral2/memory/3124-128-0x00007FF65CD30000-0x00007FF65D082000-memory.dmp	upx
behavioral2/memory/6052-129-0x00007FF731B50000-0x00007FF731EA2000-memory.dmp	upx
behavioral2/memory/5200-130-0x00007FF6313E0000-0x00007FF631732000-memory.dmp	upx
behavioral2/memory/2980-131-0x00007FF648740000-0x00007FF648A92000-memory.dmp	upx
behavioral2/memory/6052-132-0x00007FF731B50000-0x00007FF731EA2000-memory.dmp	upx
behavioral2/memory/5200-133-0x00007FF6313E0000-0x00007FF631732000-memory.dmp	upx
behavioral2/memory/2980-134-0x00007FF648740000-0x00007FF648A92000-memory.dmp	upx
behavioral2/memory/1200-136-0x00007FF65EAB0000-0x00007FF65EE02000-memory.dmp	upx
behavioral2/memory/5420-135-0x00007FF608910000-0x00007FF608C62000-memory.dmp	upx
behavioral2/memory/2368-137-0x00007FF732B20000-0x00007FF732E72000-memory.dmp	upx
behavioral2/memory/2812-139-0x00007FF6EC6A0000-0x00007FF6EC9F2000-memory.dmp	upx
behavioral2/memory/3048-138-0x00007FF709A10000-0x00007FF709D62000-memory.dmp	upx
behavioral2/memory/4896-143-0x00007FF72A710000-0x00007FF72AA62000-memory.dmp	upx
behavioral2/memory/1652-145-0x00007FF7204E0000-0x00007FF720832000-memory.dmp	upx
behavioral2/memory/1176-149-0x00007FF62CE30000-0x00007FF62D182000-memory.dmp	upx
behavioral2/memory/1396-152-0x00007FF6A6D30000-0x00007FF6A7082000-memory.dmp	upx
behavioral2/memory/3400-151-0x00007FF712540000-0x00007FF712892000-memory.dmp	upx
behavioral2/memory/3212-150-0x00007FF761EE0000-0x00007FF762232000-memory.dmp	upx
behavioral2/memory/2576-148-0x00007FF7F3900000-0x00007FF7F3C52000-memory.dmp	upx
behavioral2/memory/1556-147-0x00007FF776A40000-0x00007FF776D92000-memory.dmp	upx
behavioral2/memory/2720-146-0x00007FF6884F0000-0x00007FF688842000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\NmqezBE.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\WuuiReX.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\iGQNJPd.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\nbRwAHH.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\lPFQKOi.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\IjzKfmp.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\PCCQgjj.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\HiqnHUu.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\LCaJwXx.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ngEMpFN.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\GAYuZiW.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\bSjyYTU.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\hKmMQUF.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\wdmqyDC.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\GziqRXF.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\atkPbeV.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fRVpPGi.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\IEXvqnQ.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\OAieqiL.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\RSSAgCi.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\toKAaFX.exe	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 6052	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 3124 wrote to memory of 5200	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 3124 wrote to memory of 2980	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 3124 wrote to memory of 5420	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 3124 wrote to memory of 1200	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 3124 wrote to memory of 2756	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 3124 wrote to memory of 1000	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 3124 wrote to memory of 2368	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 3124 wrote to memory of 2812	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 3124 wrote to memory of 3048	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 3124 wrote to memory of 3572	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 3124 wrote to memory of 4896	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 3124 wrote to memory of 236	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 3124 wrote to memory of 3400	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 3124 wrote to memory of 1396	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 3124 wrote to memory of 1652	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 3124 wrote to memory of 2576	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 3124 wrote to memory of 1556	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 3124 wrote to memory of 2720	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109
PID 3124 wrote to memory of 3212	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	110
PID 3124 wrote to memory of 1176	3124	2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_8afe30f4df26b7574495e540ced86d4c_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\System\NmqezBE.exe
  C:\Windows\System\NmqezBE.exe
  2⤵
  - Executes dropped EXE
  PID:6052
- C:\Windows\System\WuuiReX.exe
  C:\Windows\System\WuuiReX.exe
  2⤵
  - Executes dropped EXE
  PID:5200
- C:\Windows\System\iGQNJPd.exe
  C:\Windows\System\iGQNJPd.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\GziqRXF.exe
  C:\Windows\System\GziqRXF.exe
  2⤵
  - Executes dropped EXE
  PID:5420
- C:\Windows\System\PCCQgjj.exe
  C:\Windows\System\PCCQgjj.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\GAYuZiW.exe
  C:\Windows\System\GAYuZiW.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\nbRwAHH.exe
  C:\Windows\System\nbRwAHH.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\bSjyYTU.exe
  C:\Windows\System\bSjyYTU.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\hKmMQUF.exe
  C:\Windows\System\hKmMQUF.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\atkPbeV.exe
  C:\Windows\System\atkPbeV.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\lPFQKOi.exe
  C:\Windows\System\lPFQKOi.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\toKAaFX.exe
  C:\Windows\System\toKAaFX.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\fRVpPGi.exe
  C:\Windows\System\fRVpPGi.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\IEXvqnQ.exe
  C:\Windows\System\IEXvqnQ.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\HiqnHUu.exe
  C:\Windows\System\HiqnHUu.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\OAieqiL.exe
  C:\Windows\System\OAieqiL.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\wdmqyDC.exe
  C:\Windows\System\wdmqyDC.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\LCaJwXx.exe
  C:\Windows\System\LCaJwXx.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\IjzKfmp.exe
  C:\Windows\System\IjzKfmp.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\ngEMpFN.exe
  C:\Windows\System\ngEMpFN.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\RSSAgCi.exe
  C:\Windows\System\RSSAgCi.exe
  2⤵
  - Executes dropped EXE
  PID:1176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

GAYuZiW.exe

Path C:\Windows\System\GAYuZiW.exe
Size 8.3MB
SHA256 e6d223e11f3eb6d8d2d4c7ce62d102c40ab0b662b88212f7c51e7568c15a9a1d
MD5 cc89aa12d88da5cb010cba3467a95f35
SHA1 c072a0c9de6a6c8e867e0712105744bc540301fd
SHA512 26a2c01cc977b8b661dc05679b319dca758dde338eb05eef5353069adb4e3a398323bc906875c14d697e797c02160f37bf5336410df69ad826a928c7dc832fd6
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUL:v+D56utgpPF8u/7L
TLSH
T19D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GziqRXF.exe

Path C:\Windows\System\GziqRXF.exe
Size 8.3MB
SHA256 94186d8275415ff09c97cb8a1af69e53c36bfe2eccfefaf7697ca2eca16a611b
MD5 dc2afaf9f7a1bd4ae418c777f8d39a1a
SHA1 fa52c0bd7eec8375318fffd455d7181d9ac7aee4
SHA512 3ef274197f7d7ce0b3fceffbd5467d17e41dc2676ccd6bcc4f4bd8c34690f9d540e2f239ca3418f4e3e6d0c2db1ad38c5eee9e210a8c9a99535e4177895e829e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUB:v+D56utgpPF8u/7B
TLSH
T189965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HiqnHUu.exe

Path C:\Windows\System\HiqnHUu.exe
Size 8.3MB
SHA256 04471eb8f1e61567bdd9940cacd80691c2974c5d4b4a106e9ad63ca8ed656e9c
MD5 951acab817ff53d3be590763fb3ab6cc
SHA1 987392f3f8542f56cb2b11f8c1d3511843ab9751
SHA512 5a07fe195d412f227bac186f14330d136722a5c332cd831779a16ee234bd58f55af44142823977e62fb3914df6c1d5c5c6edebb01989335b3a242377f48523c5
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUB:v+D56utgpPF8u/7B
TLSH
T134965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEXvqnQ.exe

Path C:\Windows\System\IEXvqnQ.exe
Size 8.3MB
SHA256 8ea05c4c400e414899181c14aaa9abac72963c273218d72209b0088765f3f314
MD5 5c30bc1afb6ea9c13e54831d527fdc34
SHA1 d8318f90801172d46ba3c2521ffafb7de329cd70
SHA512 18bc29a829b3617a4580bea057f407deb9e99ffdbcb6234f03d2a4a91cbb98fcd73e43f8ec71052b48eeeb2e027c074b85e10478c9a5c3ed1626063be11e96f0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUl:v+D56utgpPF8u/7l
TLSH
T13D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IjzKfmp.exe

Path C:\Windows\System\IjzKfmp.exe
Size 8.3MB
SHA256 c1eb759b3c598b58a8a93b7ea57e06a6265a99304024ece379afa2b1a9ad8acb
MD5 a5dd4a509fae8305a99218de4cd039dc
SHA1 834976090e3d6dd48a2fdecf06927dbdd7ab6f03
SHA512 efd71d82157811c072cdacf263e9d3c0ab2705be8877bf102f1059b6a8ca3257b1643c4d40318db0f0ce0d423d0000f2008c5ae8ea0065da97b84d8d25242b36
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUK:v+D56utgpPF8u/7K
TLSH
T104965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LCaJwXx.exe

Path C:\Windows\System\LCaJwXx.exe
Size 8.3MB
SHA256 0bfaf2e5b6ba840d6ac567b6d355d7c53a376bf9bd6ccf33fec32e2499194bc2
MD5 865ef75587ce5a5262ecde227eb1e251
SHA1 176b99a7cf95b166641123dfab070e5ec672623f
SHA512 db3e69fc7a6e0329036b3d4adcf52b0b1008f3b10888c93ed2137ac90bb4c10ec2273830c9e769dba04ef2fcf7cc6ea18f81809beabd314fde1bc641a3ba4e09
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUM:v+D56utgpPF8u/7M
TLSH
T1BD965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NmqezBE.exe

Path C:\Windows\System\NmqezBE.exe
Size 8.3MB
SHA256 20d3ab69ccdb00a014ef06e63b30d0e77bd320d39be3a7bac3b1d3fe56fd52ee
MD5 d0812ef1228bc8bd7bb82bfbce63e29b
SHA1 1369b6705d224d1301007cdbb0b1832710849f2a
SHA512 f2dfc0db7303d0e159967a2e09e3ff88e11a32821e44178ef4f36e9e4bc2b265be505277ecfb16358d0c4c2edfa737b82d9f0ecf1bf61e2d1b48268dbd5ecfe0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU5:v+D56utgpPF8u/75
TLSH
T133965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OAieqiL.exe

Path C:\Windows\System\OAieqiL.exe
Size 8.3MB
SHA256 7d2e32733e8aa62ba36f162d0375747f0a1357c8a9415f1c86d3a2dc6954d31f
MD5 1a9be8ac1346f3fc67a18e43788c23ee
SHA1 8545081a768f34b31bd408a83ce4de14d12b372c
SHA512 044f3124b2336cd42d8be53df08b6c9df94f9205b9289e091785bba4b27a0b402b97c583a7bf9fcde6ce17f7f1dfc84d3de37b5370bd7e09f9b965cf543e4467
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUJ:v+D56utgpPF8u/7J
TLSH
T14C965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PCCQgjj.exe

Path C:\Windows\System\PCCQgjj.exe
Size 8.3MB
SHA256 0aca30ae0b6098b6be0a41c45fd89655582d4b5f004770c19ec25f6ff6979c71
MD5 224c21ac73c82c2b586655bc0d977b6b
SHA1 80749b789fb39a6853e0d89c846ddf477db23cf2
SHA512 3e0592e98c245f3ae0371733cdcbc9b5f84f73c6d513eb5d235f23861b612538b32a13fd533c3fe1ea0ee73ffd3ffad2272d47cc761093bab2428a7ced1e270b
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUJ:v+D56utgpPF8u/7J
TLSH
T146965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RSSAgCi.exe

Path C:\Windows\System\RSSAgCi.exe
Size 8.3MB
SHA256 05701a31c3296c8cef15e1f5daf5abee879afcf80c39c6fde86cf933c928816a
MD5 e26430559c1ab37187fd37439d598e8e
SHA1 3a3f5a79a3007f9da9b7f54462b6c576c538b27d
SHA512 0ab8f2f279aac286d268adf9bca351399f6573fd3bd0c992dde2e7f22ca259a2118d8217c07e31ad7c3f60aa999e058067b073d71adaea350dfc8b8bcfd7a58c
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUx:v+D56utgpPF8u/7x
TLSH
T18B965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WuuiReX.exe

Path C:\Windows\System\WuuiReX.exe
Size 8.3MB
SHA256 9138229b36de04c2ea4ae0b790de851344e4ff89859ddf5861f8c460c4f61e34
MD5 8ed0a1ee978552a74aa73794ef8514d1
SHA1 4b700da225d55fc7901d9fcb573f0c02a7ab8edc
SHA512 e2a8c7f137043572a4e47c8770ba36ea8ae73fb21e1ed0044947f94b0f48186f56415f76120fed766b1e54c1e9b850c9f35aa4cb38025cbceaf92d8d90b9f973
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUz:v+D56utgpPF8u/7z
TLSH
T154965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atkPbeV.exe

Path C:\Windows\System\atkPbeV.exe
Size 8.3MB
SHA256 960ac2ed666b047fa4f01d8354620c8af50a071c2a9aef12e5dba64fa529595f
MD5 e7311d38de427d78e865768995305aaa
SHA1 2bb5343990902c34b40ee7e88e31a516c5c66181
SHA512 379c450f3159fdfbbb0e608585a00f13d707d73f96aa956fbd057f5ddd8ea6313f5e1395f05e1d38c34126303697b4001dbe59d74e8fce961e74411ea29811f9
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUf:v+D56utgpPF8u/7f
TLSH
T128965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bSjyYTU.exe

Path C:\Windows\System\bSjyYTU.exe
Size 8.3MB
SHA256 1ba0b937e96cf316a784738c182cb2b7d503576324ce5dca15d92324accdd4ca
MD5 8ea4f650abd5e92ef32a3e5d651d9e02
SHA1 0b5457a11417a57694544a636491af8b740fa214
SHA512 eb799d7433e2de3c568f58f483e0e95a246f68b46e750b6d08bdb3c7f8c3323386961ce084f7d0034311a75048cc87df6d55e3ff97b424555d30d6b76fa69376
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUm:v+D56utgpPF8u/7m
TLSH
T1A7965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fRVpPGi.exe

Path C:\Windows\System\fRVpPGi.exe
Size 8.3MB
SHA256 8d513f397f418ef1eb215396795503d51af3dff802f9f61b0aeab33695215b9c
MD5 800568cda00d9ba0882617c02a6745c1
SHA1 31221b05439399a29330ba0d1d51834dc8b43369
SHA512 6377d998871e77faf93484e932d2797a161d8d8f2a6eb0db90069562bdd60c559507b050bef429081e36b10859af468c33fbf5daec9eccfa52d9143130293b66
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUX:v+D56utgpPF8u/7X
TLSH
T1AB965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hKmMQUF.exe

Path C:\Windows\System\hKmMQUF.exe
Size 8.3MB
SHA256 ea8186f25f523bc9d53537be22f976d686604ea5b42d43e011d09f393d652314
MD5 95a4a4c13a038820940d1b8dad938b54
SHA1 90303bfa3f54f9e3fc12b972a9c7ffec247246c3
SHA512 3c265fd63adf6da234de4295d6c52e827eb9f6189c4dcd38da5269a94ecd683caa1b4f6985b4f00d7f93ac5ca5f0d7366be5009c95b2e56cee710f7225356a45
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU3:v+D56utgpPF8u/73
TLSH
T182965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iGQNJPd.exe

Path C:\Windows\System\iGQNJPd.exe
Size 8.3MB
SHA256 c3459a62b590ade7ba3dadc974f13911130cc51e0fa0b6300465be169cfb5c71
MD5 6395418a7a80da4c9a16989073ec065f
SHA1 2b5f51c1dfab7b364196527277a717a812df8fce
SHA512 d16be2cc74bcb7679d56298c99be4f1511c84fc94655bd7483900d832e1bbe925e0e1d1714370dd1536b3430342e0879cc8bd01e3f3476935755eec34d2b4c3c
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUr:v+D56utgpPF8u/7r
TLSH
T1FC965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lPFQKOi.exe

Path C:\Windows\System\lPFQKOi.exe
Size 8.3MB
SHA256 ae4eaff35539f424a83af563bfa611f1f071f6b753faa0d7e1c84a5f403696d0
MD5 f60d9088c5891b95c7db5ecfbeb850f4
SHA1 291100f1ffa73690cd1e87b336b86ca1b4416858
SHA512 88474825f8bd6b95f77bbcf7df825413cf877a6f839ba20122d0f7414bc31e2d20909bd7080c3c76c9684f739ac979bedf168af05962d6102743af0d3ad0ae22
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUM:v+D56utgpPF8u/7M
TLSH
T147965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nbRwAHH.exe

Path C:\Windows\System\nbRwAHH.exe
Size 8.3MB
SHA256 728ff7ced1689e75ea0e58e3ef5923858126ba4aa9f66e22c70e728a80997a77
MD5 051e62ee24d4168ad38ee3ea5cebd01c
SHA1 5bfe20b601120602fe289ae896f2c02c6cdeeae2
SHA512 a5d67c25ae4b8b1779f9bf364057e0062a9505899e6c1bd499aa99058c72bc9a426d4f31c2d6e5f7da3689d381796aac05364bccdd9668ec839198047b5091d4
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUD:v+D56utgpPF8u/7D
TLSH
T1C9965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ngEMpFN.exe

Path C:\Windows\System\ngEMpFN.exe
Size 8.3MB
SHA256 fc725eace9394615324afce11a2e3542f9dc82fd85df1cec2fc584ded27bc359
MD5 bc4eef89d9b673c9219e6e27c670a505
SHA1 10f9f06fc49107ec92de7d0f5bcd85aa75c471ba
SHA512 84106b3e314e93bfafa999da6aebc98da4435a84d9ff72ddab06db263d6816fc821f73ec19042ab18da9750b990b6f3cd1d58f4c39ed8a9cf6c3e923c13796f7
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUP:v+D56utgpPF8u/7P
TLSH
T177965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toKAaFX.exe

Path C:\Windows\System\toKAaFX.exe
Size 8.3MB
SHA256 f779b867974ccc6229a0c4d5e9a6072e0cee7ff017a4d5d51a3b1d165bab480e
MD5 bcca3fd181b97ea3a128b11c17b3b60e
SHA1 63cc6c81df3dc031fa1c84f9960ee2d10269def5
SHA512 00685d0f530b588b75eccad8d4668815e65291e8426ebc3f40f5001e54b07d8f090f1f32442c9ab5e9dbd5d3d03abc7a39c7cf617462da51309c771b3099ad7d
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUq:v+D56utgpPF8u/7q
TLSH
T187965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wdmqyDC.exe

Path C:\Windows\System\wdmqyDC.exe
Size 8.3MB
SHA256 e9c279538595b5e211ed05c1da97ca48b2d3bc848bc80f9740666a5d80f7b8be
MD5 c684aff6692752b777b503947293ff79
SHA1 f18fe165818c60931930226cd5ba35c456ebebe6
SHA512 a949708b083d1a8692bf1872f1b4e74ff8e979b73e265f3bfa78e9ea3b2ff083ecc3144f58f57ec60990b25e0919c4370d576a9211a003b36977da7538481ca6
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUs:v+D56utgpPF8u/7s
TLSH
T187965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-118-0x00007FF687950000-0x00007FF687CA2000-memory.dmp

Download

memory/236-144-0x00007FF687950000-0x00007FF687CA2000-memory.dmp

Download

memory/1000-112-0x00007FF6990C0000-0x00007FF699412000-memory.dmp

Download

memory/1000-140-0x00007FF6990C0000-0x00007FF699412000-memory.dmp

Download

memory/1176-126-0x00007FF62CE30000-0x00007FF62D182000-memory.dmp

Download

memory/1176-149-0x00007FF62CE30000-0x00007FF62D182000-memory.dmp

Download

memory/1200-110-0x00007FF65EAB0000-0x00007FF65EE02000-memory.dmp

Download

memory/1200-136-0x00007FF65EAB0000-0x00007FF65EE02000-memory.dmp

Download

memory/1396-152-0x00007FF6A6D30000-0x00007FF6A7082000-memory.dmp

Download

memory/1396-120-0x00007FF6A6D30000-0x00007FF6A7082000-memory.dmp

Download

memory/1556-147-0x00007FF776A40000-0x00007FF776D92000-memory.dmp

Download

memory/1556-123-0x00007FF776A40000-0x00007FF776D92000-memory.dmp

Download

memory/1652-145-0x00007FF7204E0000-0x00007FF720832000-memory.dmp

Download

memory/1652-121-0x00007FF7204E0000-0x00007FF720832000-memory.dmp

Download

memory/2368-113-0x00007FF732B20000-0x00007FF732E72000-memory.dmp

Download

memory/2368-137-0x00007FF732B20000-0x00007FF732E72000-memory.dmp

Download

memory/2576-122-0x00007FF7F3900000-0x00007FF7F3C52000-memory.dmp

Download

memory/2576-148-0x00007FF7F3900000-0x00007FF7F3C52000-memory.dmp

Download

memory/2720-124-0x00007FF6884F0000-0x00007FF688842000-memory.dmp

Download

memory/2720-146-0x00007FF6884F0000-0x00007FF688842000-memory.dmp

Download

memory/2756-111-0x00007FF682990000-0x00007FF682CE2000-memory.dmp

Download

memory/2756-141-0x00007FF682990000-0x00007FF682CE2000-memory.dmp

Download

memory/2812-114-0x00007FF6EC6A0000-0x00007FF6EC9F2000-memory.dmp

Download

memory/2812-139-0x00007FF6EC6A0000-0x00007FF6EC9F2000-memory.dmp

Download

memory/2980-134-0x00007FF648740000-0x00007FF648A92000-memory.dmp

Download

memory/2980-109-0x00007FF648740000-0x00007FF648A92000-memory.dmp

Download

memory/2980-131-0x00007FF648740000-0x00007FF648A92000-memory.dmp

Download

memory/3048-115-0x00007FF709A10000-0x00007FF709D62000-memory.dmp

Download

memory/3048-138-0x00007FF709A10000-0x00007FF709D62000-memory.dmp

Download

memory/3124-128-0x00007FF65CD30000-0x00007FF65D082000-memory.dmp

Download

memory/3124-1-0x0000021E01E70000-0x0000021E01E80000-memory.dmp

Download

memory/3124-0-0x00007FF65CD30000-0x00007FF65D082000-memory.dmp

Download

memory/3212-125-0x00007FF761EE0000-0x00007FF762232000-memory.dmp

Download

memory/3212-150-0x00007FF761EE0000-0x00007FF762232000-memory.dmp

Download

memory/3400-151-0x00007FF712540000-0x00007FF712892000-memory.dmp

Download

memory/3400-119-0x00007FF712540000-0x00007FF712892000-memory.dmp

Download

memory/3572-116-0x00007FF61AB50000-0x00007FF61AEA2000-memory.dmp

Download

memory/3572-142-0x00007FF61AB50000-0x00007FF61AEA2000-memory.dmp

Download

memory/4896-143-0x00007FF72A710000-0x00007FF72AA62000-memory.dmp

Download

memory/4896-117-0x00007FF72A710000-0x00007FF72AA62000-memory.dmp

Download

memory/5200-130-0x00007FF6313E0000-0x00007FF631732000-memory.dmp

Download

memory/5200-133-0x00007FF6313E0000-0x00007FF631732000-memory.dmp

Download

memory/5200-12-0x00007FF6313E0000-0x00007FF631732000-memory.dmp

Download

memory/5420-135-0x00007FF608910000-0x00007FF608C62000-memory.dmp

Download

memory/5420-127-0x00007FF608910000-0x00007FF608C62000-memory.dmp

Download

memory/6052-6-0x00007FF731B50000-0x00007FF731EA2000-memory.dmp

Download

memory/6052-132-0x00007FF731B50000-0x00007FF731EA2000-memory.dmp

Download

memory/6052-129-0x00007FF731B50000-0x00007FF731EA2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads