cobaltstrike | 12272d1fd8e9204ec80788993e6712f6c0949320200b96d4939fbced199f1a7d

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 18:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample261027-wmldzawset
SHA256 12272d1fd8e9204ec80788993e6712f6c0949320200b96d4939fbced199f1a7d
MD5 4c85d43a72c5e71725d6e0edf24734dc
SHA1 0510f67a0bf193b2721fa2fffadf25ef83499cce
SHA512 958606f5c588a6ec35f19a3a234cdec254f04d4cd11657699882e27554f95b62a7bade71251cbd416e9cf912cc7475c0fc4f0107f34ab0672644cf339e86114b
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUB:v+D56utgpPF8u/7B
TLSH
T15B965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000e00000001c489-4.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c48d-11.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c48e-17.dat	cobalt_reflective_dll
behavioral2/files/0x000e00000001c48a-27.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c490-33.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c491-39.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c493-44.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c494-49.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c495-54.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c497-64.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c498-68.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c499-73.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c49b-84.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4a0-108.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4a1-113.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c49f-104.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c49e-99.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c49d-94.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c49a-79.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c496-59.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c48f-24.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c489-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c48d-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c48e-17.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000e00000001c48a-27.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c490-33.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c491-39.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c493-44.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c494-49.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c495-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c497-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c498-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c499-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c49b-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4a0-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4a1-113.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c49f-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c49e-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c49d-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c49a-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c496-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c48f-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/908-0-0x00007FF7CEC80000-0x00007FF7CEFD2000-memory.dmp	UPX
behavioral2/files/0x000e00000001c489-4.dat	UPX
behavioral2/memory/4596-6-0x00007FF7D4230000-0x00007FF7D4582000-memory.dmp	UPX
behavioral2/files/0x000d00000001c48d-11.dat	UPX
behavioral2/memory/4860-13-0x00007FF699F80000-0x00007FF69A2D2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c48e-17.dat	UPX
behavioral2/memory/2768-18-0x00007FF7C0490000-0x00007FF7C07E2000-memory.dmp	UPX
behavioral2/files/0x000e00000001c48a-27.dat	UPX
behavioral2/files/0x000d00000001c490-33.dat	UPX
behavioral2/files/0x000d00000001c491-39.dat	UPX
behavioral2/files/0x000d00000001c493-44.dat	UPX
behavioral2/files/0x000d00000001c494-49.dat	UPX
behavioral2/files/0x000d00000001c495-54.dat	UPX
behavioral2/files/0x000d00000001c497-64.dat	UPX
behavioral2/files/0x000d00000001c498-68.dat	UPX
behavioral2/files/0x000d00000001c499-73.dat	UPX
behavioral2/files/0x000d00000001c49b-84.dat	UPX
behavioral2/files/0x000d00000001c4a0-108.dat	UPX
behavioral2/files/0x000d00000001c4a1-113.dat	UPX
behavioral2/files/0x000d00000001c49f-104.dat	UPX
behavioral2/files/0x000d00000001c49e-99.dat	UPX
behavioral2/files/0x000d00000001c49d-94.dat	UPX
behavioral2/memory/4836-93-0x00007FF6BEA00000-0x00007FF6BED52000-memory.dmp	UPX
behavioral2/memory/2604-92-0x00007FF7A43A0000-0x00007FF7A46F2000-memory.dmp	UPX
behavioral2/memory/2068-91-0x00007FF7FB1A0000-0x00007FF7FB4F2000-memory.dmp	UPX
behavioral2/memory/4168-90-0x00007FF6D2EA0000-0x00007FF6D31F2000-memory.dmp	UPX
behavioral2/memory/1684-89-0x00007FF629F50000-0x00007FF62A2A2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c49a-79.dat	UPX
behavioral2/files/0x000d00000001c496-59.dat	UPX
behavioral2/files/0x000d00000001c48f-24.dat	UPX
behavioral2/memory/5624-115-0x00007FF6A5440000-0x00007FF6A5792000-memory.dmp	UPX
behavioral2/memory/1060-116-0x00007FF755F70000-0x00007FF7562C2000-memory.dmp	UPX
behavioral2/memory/4292-118-0x00007FF731150000-0x00007FF7314A2000-memory.dmp	UPX
behavioral2/memory/1084-119-0x00007FF721AB0000-0x00007FF721E02000-memory.dmp	UPX
behavioral2/memory/4264-117-0x00007FF700DA0000-0x00007FF7010F2000-memory.dmp	UPX
behavioral2/memory/4636-120-0x00007FF732450000-0x00007FF7327A2000-memory.dmp	UPX
behavioral2/memory/4780-121-0x00007FF642740000-0x00007FF642A92000-memory.dmp	UPX
behavioral2/memory/6048-122-0x00007FF764AF0000-0x00007FF764E42000-memory.dmp	UPX
behavioral2/memory/2728-124-0x00007FF7F0110000-0x00007FF7F0462000-memory.dmp	UPX
behavioral2/memory/5400-126-0x00007FF740E20000-0x00007FF741172000-memory.dmp	UPX
behavioral2/memory/3212-127-0x00007FF769C60000-0x00007FF769FB2000-memory.dmp	UPX
behavioral2/memory/4496-125-0x00007FF7BF960000-0x00007FF7BFCB2000-memory.dmp	UPX
behavioral2/memory/5028-123-0x00007FF7A8AA0000-0x00007FF7A8DF2000-memory.dmp	UPX
behavioral2/memory/908-128-0x00007FF7CEC80000-0x00007FF7CEFD2000-memory.dmp	UPX
behavioral2/memory/4596-129-0x00007FF7D4230000-0x00007FF7D4582000-memory.dmp	UPX
behavioral2/memory/4860-130-0x00007FF699F80000-0x00007FF69A2D2000-memory.dmp	UPX
behavioral2/memory/2768-131-0x00007FF7C0490000-0x00007FF7C07E2000-memory.dmp	UPX
behavioral2/memory/4596-132-0x00007FF7D4230000-0x00007FF7D4582000-memory.dmp	UPX
behavioral2/memory/4860-133-0x00007FF699F80000-0x00007FF69A2D2000-memory.dmp	UPX
behavioral2/memory/2768-134-0x00007FF7C0490000-0x00007FF7C07E2000-memory.dmp	UPX
behavioral2/memory/1684-135-0x00007FF629F50000-0x00007FF62A2A2000-memory.dmp	UPX
behavioral2/memory/5400-136-0x00007FF740E20000-0x00007FF741172000-memory.dmp	UPX
behavioral2/memory/4168-137-0x00007FF6D2EA0000-0x00007FF6D31F2000-memory.dmp	UPX
behavioral2/memory/2604-138-0x00007FF7A43A0000-0x00007FF7A46F2000-memory.dmp	UPX
behavioral2/memory/2068-139-0x00007FF7FB1A0000-0x00007FF7FB4F2000-memory.dmp	UPX
behavioral2/memory/4836-140-0x00007FF6BEA00000-0x00007FF6BED52000-memory.dmp	UPX
behavioral2/memory/4292-141-0x00007FF731150000-0x00007FF7314A2000-memory.dmp	UPX
behavioral2/memory/5624-144-0x00007FF6A5440000-0x00007FF6A5792000-memory.dmp	UPX
behavioral2/memory/1060-143-0x00007FF755F70000-0x00007FF7562C2000-memory.dmp	UPX
behavioral2/memory/4264-142-0x00007FF700DA0000-0x00007FF7010F2000-memory.dmp	UPX
behavioral2/memory/4780-145-0x00007FF642740000-0x00007FF642A92000-memory.dmp	UPX
behavioral2/memory/1084-147-0x00007FF721AB0000-0x00007FF721E02000-memory.dmp	UPX
behavioral2/memory/3212-150-0x00007FF769C60000-0x00007FF769FB2000-memory.dmp	UPX
behavioral2/memory/5028-149-0x00007FF7A8AA0000-0x00007FF7A8DF2000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/908-0-0x00007FF7CEC80000-0x00007FF7CEFD2000-memory.dmp	xmrig
behavioral2/files/0x000e00000001c489-4.dat	xmrig
behavioral2/memory/4596-6-0x00007FF7D4230000-0x00007FF7D4582000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c48d-11.dat	xmrig
behavioral2/memory/4860-13-0x00007FF699F80000-0x00007FF69A2D2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c48e-17.dat	xmrig
behavioral2/memory/2768-18-0x00007FF7C0490000-0x00007FF7C07E2000-memory.dmp	xmrig
behavioral2/files/0x000e00000001c48a-27.dat	xmrig
behavioral2/files/0x000d00000001c490-33.dat	xmrig
behavioral2/files/0x000d00000001c491-39.dat	xmrig
behavioral2/files/0x000d00000001c493-44.dat	xmrig
behavioral2/files/0x000d00000001c494-49.dat	xmrig
behavioral2/files/0x000d00000001c495-54.dat	xmrig
behavioral2/files/0x000d00000001c497-64.dat	xmrig
behavioral2/files/0x000d00000001c498-68.dat	xmrig
behavioral2/files/0x000d00000001c499-73.dat	xmrig
behavioral2/files/0x000d00000001c49b-84.dat	xmrig
behavioral2/files/0x000d00000001c4a0-108.dat	xmrig
behavioral2/files/0x000d00000001c4a1-113.dat	xmrig
behavioral2/files/0x000d00000001c49f-104.dat	xmrig
behavioral2/files/0x000d00000001c49e-99.dat	xmrig
behavioral2/files/0x000d00000001c49d-94.dat	xmrig
behavioral2/memory/4836-93-0x00007FF6BEA00000-0x00007FF6BED52000-memory.dmp	xmrig
behavioral2/memory/2604-92-0x00007FF7A43A0000-0x00007FF7A46F2000-memory.dmp	xmrig
behavioral2/memory/2068-91-0x00007FF7FB1A0000-0x00007FF7FB4F2000-memory.dmp	xmrig
behavioral2/memory/4168-90-0x00007FF6D2EA0000-0x00007FF6D31F2000-memory.dmp	xmrig
behavioral2/memory/1684-89-0x00007FF629F50000-0x00007FF62A2A2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c49a-79.dat	xmrig
behavioral2/files/0x000d00000001c496-59.dat	xmrig
behavioral2/files/0x000d00000001c48f-24.dat	xmrig
behavioral2/memory/5624-115-0x00007FF6A5440000-0x00007FF6A5792000-memory.dmp	xmrig
behavioral2/memory/1060-116-0x00007FF755F70000-0x00007FF7562C2000-memory.dmp	xmrig
behavioral2/memory/4292-118-0x00007FF731150000-0x00007FF7314A2000-memory.dmp	xmrig
behavioral2/memory/1084-119-0x00007FF721AB0000-0x00007FF721E02000-memory.dmp	xmrig
behavioral2/memory/4264-117-0x00007FF700DA0000-0x00007FF7010F2000-memory.dmp	xmrig
behavioral2/memory/4636-120-0x00007FF732450000-0x00007FF7327A2000-memory.dmp	xmrig
behavioral2/memory/4780-121-0x00007FF642740000-0x00007FF642A92000-memory.dmp	xmrig
behavioral2/memory/6048-122-0x00007FF764AF0000-0x00007FF764E42000-memory.dmp	xmrig
behavioral2/memory/2728-124-0x00007FF7F0110000-0x00007FF7F0462000-memory.dmp	xmrig
behavioral2/memory/5400-126-0x00007FF740E20000-0x00007FF741172000-memory.dmp	xmrig
behavioral2/memory/3212-127-0x00007FF769C60000-0x00007FF769FB2000-memory.dmp	xmrig
behavioral2/memory/4496-125-0x00007FF7BF960000-0x00007FF7BFCB2000-memory.dmp	xmrig
behavioral2/memory/5028-123-0x00007FF7A8AA0000-0x00007FF7A8DF2000-memory.dmp	xmrig
behavioral2/memory/908-128-0x00007FF7CEC80000-0x00007FF7CEFD2000-memory.dmp	xmrig
behavioral2/memory/4596-129-0x00007FF7D4230000-0x00007FF7D4582000-memory.dmp	xmrig
behavioral2/memory/4860-130-0x00007FF699F80000-0x00007FF69A2D2000-memory.dmp	xmrig
behavioral2/memory/2768-131-0x00007FF7C0490000-0x00007FF7C07E2000-memory.dmp	xmrig
behavioral2/memory/4596-132-0x00007FF7D4230000-0x00007FF7D4582000-memory.dmp	xmrig
behavioral2/memory/4860-133-0x00007FF699F80000-0x00007FF69A2D2000-memory.dmp	xmrig
behavioral2/memory/2768-134-0x00007FF7C0490000-0x00007FF7C07E2000-memory.dmp	xmrig
behavioral2/memory/1684-135-0x00007FF629F50000-0x00007FF62A2A2000-memory.dmp	xmrig
behavioral2/memory/5400-136-0x00007FF740E20000-0x00007FF741172000-memory.dmp	xmrig
behavioral2/memory/4168-137-0x00007FF6D2EA0000-0x00007FF6D31F2000-memory.dmp	xmrig
behavioral2/memory/2604-138-0x00007FF7A43A0000-0x00007FF7A46F2000-memory.dmp	xmrig
behavioral2/memory/2068-139-0x00007FF7FB1A0000-0x00007FF7FB4F2000-memory.dmp	xmrig
behavioral2/memory/4836-140-0x00007FF6BEA00000-0x00007FF6BED52000-memory.dmp	xmrig
behavioral2/memory/4292-141-0x00007FF731150000-0x00007FF7314A2000-memory.dmp	xmrig
behavioral2/memory/5624-144-0x00007FF6A5440000-0x00007FF6A5792000-memory.dmp	xmrig
behavioral2/memory/1060-143-0x00007FF755F70000-0x00007FF7562C2000-memory.dmp	xmrig
behavioral2/memory/4264-142-0x00007FF700DA0000-0x00007FF7010F2000-memory.dmp	xmrig
behavioral2/memory/4780-145-0x00007FF642740000-0x00007FF642A92000-memory.dmp	xmrig
behavioral2/memory/1084-147-0x00007FF721AB0000-0x00007FF721E02000-memory.dmp	xmrig
behavioral2/memory/3212-150-0x00007FF769C60000-0x00007FF769FB2000-memory.dmp	xmrig
behavioral2/memory/5028-149-0x00007FF7A8AA0000-0x00007FF7A8DF2000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4596	MiEFxAd.exe
4860	OArfLnd.exe
2768	GBqejKS.exe
1684	VeljGkc.exe
5400	PGOcCYE.exe
4168	fGsJmEV.exe
2068	Wjcyowt.exe
2604	jozJnXQ.exe
4836	iMMxzKd.exe
5624	SSgPCfW.exe
1060	UyNVNpD.exe
4264	fyIwccB.exe
4292	pLqxesJ.exe
1084	ZOSDwGB.exe
4636	cSQTiZr.exe
4780	vIvGUPY.exe
6048	uVjBxsU.exe
3212	TzhPaZo.exe
5028	RBJrIxN.exe
2728	bgQafPK.exe
4496	tggPeJK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/908-0-0x00007FF7CEC80000-0x00007FF7CEFD2000-memory.dmp	upx
behavioral2/files/0x000e00000001c489-4.dat	upx
behavioral2/memory/4596-6-0x00007FF7D4230000-0x00007FF7D4582000-memory.dmp	upx
behavioral2/files/0x000d00000001c48d-11.dat	upx
behavioral2/memory/4860-13-0x00007FF699F80000-0x00007FF69A2D2000-memory.dmp	upx
behavioral2/files/0x000d00000001c48e-17.dat	upx
behavioral2/memory/2768-18-0x00007FF7C0490000-0x00007FF7C07E2000-memory.dmp	upx
behavioral2/files/0x000e00000001c48a-27.dat	upx
behavioral2/files/0x000d00000001c490-33.dat	upx
behavioral2/files/0x000d00000001c491-39.dat	upx
behavioral2/files/0x000d00000001c493-44.dat	upx
behavioral2/files/0x000d00000001c494-49.dat	upx
behavioral2/files/0x000d00000001c495-54.dat	upx
behavioral2/files/0x000d00000001c497-64.dat	upx
behavioral2/files/0x000d00000001c498-68.dat	upx
behavioral2/files/0x000d00000001c499-73.dat	upx
behavioral2/files/0x000d00000001c49b-84.dat	upx
behavioral2/files/0x000d00000001c4a0-108.dat	upx
behavioral2/files/0x000d00000001c4a1-113.dat	upx
behavioral2/files/0x000d00000001c49f-104.dat	upx
behavioral2/files/0x000d00000001c49e-99.dat	upx
behavioral2/files/0x000d00000001c49d-94.dat	upx
behavioral2/memory/4836-93-0x00007FF6BEA00000-0x00007FF6BED52000-memory.dmp	upx
behavioral2/memory/2604-92-0x00007FF7A43A0000-0x00007FF7A46F2000-memory.dmp	upx
behavioral2/memory/2068-91-0x00007FF7FB1A0000-0x00007FF7FB4F2000-memory.dmp	upx
behavioral2/memory/4168-90-0x00007FF6D2EA0000-0x00007FF6D31F2000-memory.dmp	upx
behavioral2/memory/1684-89-0x00007FF629F50000-0x00007FF62A2A2000-memory.dmp	upx
behavioral2/files/0x000d00000001c49a-79.dat	upx
behavioral2/files/0x000d00000001c496-59.dat	upx
behavioral2/files/0x000d00000001c48f-24.dat	upx
behavioral2/memory/5624-115-0x00007FF6A5440000-0x00007FF6A5792000-memory.dmp	upx
behavioral2/memory/1060-116-0x00007FF755F70000-0x00007FF7562C2000-memory.dmp	upx
behavioral2/memory/4292-118-0x00007FF731150000-0x00007FF7314A2000-memory.dmp	upx
behavioral2/memory/1084-119-0x00007FF721AB0000-0x00007FF721E02000-memory.dmp	upx
behavioral2/memory/4264-117-0x00007FF700DA0000-0x00007FF7010F2000-memory.dmp	upx
behavioral2/memory/4636-120-0x00007FF732450000-0x00007FF7327A2000-memory.dmp	upx
behavioral2/memory/4780-121-0x00007FF642740000-0x00007FF642A92000-memory.dmp	upx
behavioral2/memory/6048-122-0x00007FF764AF0000-0x00007FF764E42000-memory.dmp	upx
behavioral2/memory/2728-124-0x00007FF7F0110000-0x00007FF7F0462000-memory.dmp	upx
behavioral2/memory/5400-126-0x00007FF740E20000-0x00007FF741172000-memory.dmp	upx
behavioral2/memory/3212-127-0x00007FF769C60000-0x00007FF769FB2000-memory.dmp	upx
behavioral2/memory/4496-125-0x00007FF7BF960000-0x00007FF7BFCB2000-memory.dmp	upx
behavioral2/memory/5028-123-0x00007FF7A8AA0000-0x00007FF7A8DF2000-memory.dmp	upx
behavioral2/memory/908-128-0x00007FF7CEC80000-0x00007FF7CEFD2000-memory.dmp	upx
behavioral2/memory/4596-129-0x00007FF7D4230000-0x00007FF7D4582000-memory.dmp	upx
behavioral2/memory/4860-130-0x00007FF699F80000-0x00007FF69A2D2000-memory.dmp	upx
behavioral2/memory/2768-131-0x00007FF7C0490000-0x00007FF7C07E2000-memory.dmp	upx
behavioral2/memory/4596-132-0x00007FF7D4230000-0x00007FF7D4582000-memory.dmp	upx
behavioral2/memory/4860-133-0x00007FF699F80000-0x00007FF69A2D2000-memory.dmp	upx
behavioral2/memory/2768-134-0x00007FF7C0490000-0x00007FF7C07E2000-memory.dmp	upx
behavioral2/memory/1684-135-0x00007FF629F50000-0x00007FF62A2A2000-memory.dmp	upx
behavioral2/memory/5400-136-0x00007FF740E20000-0x00007FF741172000-memory.dmp	upx
behavioral2/memory/4168-137-0x00007FF6D2EA0000-0x00007FF6D31F2000-memory.dmp	upx
behavioral2/memory/2604-138-0x00007FF7A43A0000-0x00007FF7A46F2000-memory.dmp	upx
behavioral2/memory/2068-139-0x00007FF7FB1A0000-0x00007FF7FB4F2000-memory.dmp	upx
behavioral2/memory/4836-140-0x00007FF6BEA00000-0x00007FF6BED52000-memory.dmp	upx
behavioral2/memory/4292-141-0x00007FF731150000-0x00007FF7314A2000-memory.dmp	upx
behavioral2/memory/5624-144-0x00007FF6A5440000-0x00007FF6A5792000-memory.dmp	upx
behavioral2/memory/1060-143-0x00007FF755F70000-0x00007FF7562C2000-memory.dmp	upx
behavioral2/memory/4264-142-0x00007FF700DA0000-0x00007FF7010F2000-memory.dmp	upx
behavioral2/memory/4780-145-0x00007FF642740000-0x00007FF642A92000-memory.dmp	upx
behavioral2/memory/1084-147-0x00007FF721AB0000-0x00007FF721E02000-memory.dmp	upx
behavioral2/memory/3212-150-0x00007FF769C60000-0x00007FF769FB2000-memory.dmp	upx
behavioral2/memory/5028-149-0x00007FF7A8AA0000-0x00007FF7A8DF2000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\GBqejKS.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fyIwccB.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\pLqxesJ.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\bgQafPK.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\MiEFxAd.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\OArfLnd.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\VeljGkc.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\Wjcyowt.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\PGOcCYE.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fGsJmEV.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\iMMxzKd.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\UyNVNpD.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ZOSDwGB.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\cSQTiZr.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\uVjBxsU.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\TzhPaZo.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\jozJnXQ.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\SSgPCfW.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\vIvGUPY.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\RBJrIxN.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\tggPeJK.exe	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 4596	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 908 wrote to memory of 4860	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 908 wrote to memory of 2768	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 908 wrote to memory of 1684	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 908 wrote to memory of 5400	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 908 wrote to memory of 4168	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 908 wrote to memory of 2068	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 908 wrote to memory of 2604	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 908 wrote to memory of 4836	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 908 wrote to memory of 5624	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 908 wrote to memory of 1060	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 908 wrote to memory of 4264	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 908 wrote to memory of 4292	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 908 wrote to memory of 1084	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 908 wrote to memory of 4636	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 908 wrote to memory of 4780	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 908 wrote to memory of 6048	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 908 wrote to memory of 3212	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 908 wrote to memory of 5028	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109
PID 908 wrote to memory of 2728	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	110
PID 908 wrote to memory of 4496	908	2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_4c85d43a72c5e71725d6e0edf24734dc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\System\MiEFxAd.exe
  C:\Windows\System\MiEFxAd.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\OArfLnd.exe
  C:\Windows\System\OArfLnd.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\GBqejKS.exe
  C:\Windows\System\GBqejKS.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\VeljGkc.exe
  C:\Windows\System\VeljGkc.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\PGOcCYE.exe
  C:\Windows\System\PGOcCYE.exe
  2⤵
  - Executes dropped EXE
  PID:5400
- C:\Windows\System\fGsJmEV.exe
  C:\Windows\System\fGsJmEV.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\Wjcyowt.exe
  C:\Windows\System\Wjcyowt.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\jozJnXQ.exe
  C:\Windows\System\jozJnXQ.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\iMMxzKd.exe
  C:\Windows\System\iMMxzKd.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\SSgPCfW.exe
  C:\Windows\System\SSgPCfW.exe
  2⤵
  - Executes dropped EXE
  PID:5624
- C:\Windows\System\UyNVNpD.exe
  C:\Windows\System\UyNVNpD.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\fyIwccB.exe
  C:\Windows\System\fyIwccB.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\pLqxesJ.exe
  C:\Windows\System\pLqxesJ.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\ZOSDwGB.exe
  C:\Windows\System\ZOSDwGB.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\cSQTiZr.exe
  C:\Windows\System\cSQTiZr.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\vIvGUPY.exe
  C:\Windows\System\vIvGUPY.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\uVjBxsU.exe
  C:\Windows\System\uVjBxsU.exe
  2⤵
  - Executes dropped EXE
  PID:6048
- C:\Windows\System\TzhPaZo.exe
  C:\Windows\System\TzhPaZo.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\RBJrIxN.exe
  C:\Windows\System\RBJrIxN.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\bgQafPK.exe
  C:\Windows\System\bgQafPK.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\tggPeJK.exe
  C:\Windows\System\tggPeJK.exe
  2⤵
  - Executes dropped EXE
  PID:4496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

GBqejKS.exe

Path C:\Windows\System\GBqejKS.exe
Size 8.3MB
SHA256 c4633edd99211e4abf4a407dca80afb56aa6520008bda1011e2c554dad8ef2b7
MD5 38da8210c79661dce7588bb961f8d495
SHA1 2472f8058f37350511a64d406ccb85c301235705
SHA512 925729e6bde1221d2bb851e4838ec77c3f94f1f493a4ba6555aa8d521b5e25abe8b81832f5ac2016e2e2eae74730a7be096b2414b79dbcbec4414347de26efb8
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU+:v+D56utgpPF8u/7+
TLSH
T1C1965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MiEFxAd.exe

Path C:\Windows\System\MiEFxAd.exe
Size 8.3MB
SHA256 478a55d6773f024aad6885d638b5218f8ba11e96fecfc32255ea436ebde09b12
MD5 5c78f97323c022dbc67c3fd48d6899bc
SHA1 2ee3a89dcb02f4507af19fd959b6f47d4d2e23d5
SHA512 f7d482f543a94c7b89ea3a9516347da230760109a8fd235afce1f12c3f62b988e50a7c28a9b109dbbbfd83d418f54c0c82b0b467e3a1777f32374ddc68658ec7
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU7:v+D56utgpPF8u/77
TLSH
T1E7965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OArfLnd.exe

Path C:\Windows\System\OArfLnd.exe
Size 8.3MB
SHA256 83e53f24112d50c2f8bbe682813baa939deb2472e1da80b7f04ec00a7d6fa62d
MD5 d0b09131e10e0c535ce8e91642a2d21c
SHA1 2586126fe6fc6f95e4fef6f316d058c77b632bb4
SHA512 49f6d2d9fd0be19556e42fd34fc55a33fc27bb400d9288691e400782743e05f1374db35351033b2c299691a0d512a265d460ed5c3a2c1dbf8d525b5ef8461ebc
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUM:v+D56utgpPF8u/7M
TLSH
T147965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PGOcCYE.exe

Path C:\Windows\System\PGOcCYE.exe
Size 8.3MB
SHA256 b7d239bff78a041ba720af52ce8042584c103fa75b90155a4498b5694d8b23bb
MD5 7ccd6b84bd435caff239c104eeea54a5
SHA1 3f2592018a77494c72ebd1b042c82d2fa9369d9f
SHA512 30cb5fe18693543fb6ffa846edc865b6a67867840994bd1492550a84b5400023efcab6f52b01eabe03a7f67eb580a5189d145dcea5c5e2055a110d1dd59fe3c2
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUb:v+D56utgpPF8u/7b
TLSH
T192965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RBJrIxN.exe

Path C:\Windows\System\RBJrIxN.exe
Size 8.3MB
SHA256 2a9222c59e095487bc4fe59aea5a913d3542aabbfe020eedb833c9b63bd68b36
MD5 0733c0e3c9381b9176f9e71a470a65b1
SHA1 89b401d9889547b5f3cabc0a146c4c30e233d028
SHA512 99d0c1041697c5bed45f7fe2c51f6fa42f039cb9cdeae741eb55a1d0be7b3ca96c2e7c64cb5da66234d1cec07d1005f8595418b6b5399b205a1cd1472581e33c
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUm:v+D56utgpPF8u/7m
TLSH
T10A965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SSgPCfW.exe

Path C:\Windows\System\SSgPCfW.exe
Size 8.3MB
SHA256 84d90e63b9237e72ffe7d704f159167f11fc3cc0d01fa195c96feb9cb5b28dba
MD5 8afac990cc32c44b01661896f5e0b882
SHA1 ea56597d3e547154c2f70907cef978ba219b0b7b
SHA512 aeee37d1ae4908cd23dd7414266b755d4059a7c9f71f2ab376723fce506bc08795ad4c6ea951103ff11d2db04fa2fd173150970a490f98916f88dd6112e8ed54
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUN:v+D56utgpPF8u/7N
TLSH
T100965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TzhPaZo.exe

Path C:\Windows\System\TzhPaZo.exe
Size 8.3MB
SHA256 cb92946e7d9df78c16be17a66f3f686816bac6f08a4c2cf2b1bfd5207269448c
MD5 bc45dbe2f155c8fd8025b88ce9efd0a9
SHA1 fc817f31ca8b82d43c6fec635a46953ad05dca82
SHA512 b380b72cf3c11d14ede8f0a7960befc4b8ce2aceaeadd0a44ca5ea7ebcedc68426207d5f0355100e10e636de4c8e7ad4ef2717fe703af8470c4ccb5e6845c4ee
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUY:v+D56utgpPF8u/7Y
TLSH
T1C8965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UyNVNpD.exe

Path C:\Windows\System\UyNVNpD.exe
Size 8.3MB
SHA256 52486d467bda51aeed4464a8b8ba9aa90472caa7f53b608220e4446759b749b1
MD5 5ad1bf7d589cc7cbf05b3e653b83a99a
SHA1 63032c86308359508f50433d59a99dd554945429
SHA512 71bb120651ea613a4b509858390d40420a9168814f8748846fe2da1faf201acb4781e31601bc2f7e6e074ca13287c4452941e9cfc47793782c101fbb2aa98402
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUC:v+D56utgpPF8u/7C
TLSH
T115965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VeljGkc.exe

Path C:\Windows\System\VeljGkc.exe
Size 8.3MB
SHA256 006b78221dd7b7613e34bf4660d785e84b04a1605e8f5710a292402737c88ee2
MD5 470c956cc8eb88d5ce217ef7d9a7d0b6
SHA1 44e02c0ac5a98e9b1767bc31a82c925222221cfa
SHA512 19cf800d1d4ee169a181c68549ed209679edfa062da12dbd5e9d9a86a13a913228c17794c9837e6951f23f4a68b4b0d52a6763f5df5c36bb29a930dd3999eab7
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUA:v+D56utgpPF8u/7A
TLSH
T1D8965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wjcyowt.exe

Path C:\Windows\System\Wjcyowt.exe
Size 8.3MB
SHA256 063bdf8820c5dac10b1e47a409a28b440d735c89590504168f75178668a61a1c
MD5 ff3debcf2e557744eba80650540a69f6
SHA1 0cd09d88739221754e2d6c8acd12b58f77550607
SHA512 4d51523f89699d0d663e366208273dc44bcf66b247f81dd2d4213ab726472cf684354a421112b6568f2e86085cbead94973e936fd1988de0de5ee9f5411c19a9
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU6:v+D56utgpPF8u/76
TLSH
T1B1965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZOSDwGB.exe

Path C:\Windows\System\ZOSDwGB.exe
Size 8.3MB
SHA256 d364608ea9c6baa8121688f26bef5ebf99c4f438e8316956877866c1b3d18816
MD5 f649f04f3660dda383a5a079e32c64bf
SHA1 0e44165bf6a4e079329f5d77d4b4ecaeff6c41e6
SHA512 106113d934b86de930c35872b51a5b8d630703fb5df4b657e9e8580be24e14cc9f82e3d6369e4808c5e15e4862cc71997bb2aad53c4131dac128d614f30fe790
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU5:v+D56utgpPF8u/75
TLSH
T120965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bgQafPK.exe

Path C:\Windows\System\bgQafPK.exe
Size 8.3MB
SHA256 d17f80f7cf7ebb5494bd2ff348036eaf6ef406c8c0d0af527d79a5b0a3b73a7f
MD5 dcd38c7a48d8a666360810b6a52b769b
SHA1 43156c3a0a5a22ec1f54b82fdcbd61881878a0c6
SHA512 0f3c6d8647fbd57182a8d258db387e8ceed3996fc561cf1273e8e330f844d02da57946ede140a1da2a6c3d556f2a6375bd92d562187a72897905e2d43b8623f4
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUA:v+D56utgpPF8u/7A
TLSH
T15C965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cSQTiZr.exe

Path C:\Windows\System\cSQTiZr.exe
Size 8.3MB
SHA256 0f8a0685fca9159736332e111351ac4f447dec3d6347e44e5a9c2b6b1b64acb0
MD5 ed5b16a57140c2dd60d91d357aa3bf16
SHA1 8f75b6c6793b36f5a815eabf04bc953b21e15c5f
SHA512 3f0da6ffcc13c60df77a10a9bc8b9e43a5ec9f35753bf83ef78ddd9495f07c448038e180050f2397cdf39294ee383676d726c33d972e282ad52cc34461ae8544
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU8:v+D56utgpPF8u/78
TLSH
T192965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fGsJmEV.exe

Path C:\Windows\System\fGsJmEV.exe
Size 8.3MB
SHA256 94331eafa05bbc683d4c27f39dda0897152af83d6cc51bc7b2a980e8cf99d9dc
MD5 df99c7c2cb66fa93c10bf58d1857dd27
SHA1 f30589b193f39039b1c8c0586fd8d0d8ecd93af2
SHA512 66f4a2a4bb3888f19bb53553a5c670383ad542d979d1b0c82ed2b6782ab620a2673695724cd174cb64b59db82abaedf4d01baf2613048419cd79a65809275004
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUg:v+D56utgpPF8u/7g
TLSH
T10A965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fyIwccB.exe

Path C:\Windows\System\fyIwccB.exe
Size 8.3MB
SHA256 8f25b02cd087aadb4e151a29b020c7864e771331243502bb871b2924ddc56878
MD5 c7e639a7bc19aa8979910a8f2d4740e4
SHA1 3bd0c174e30e11e60b93a44ad622c2bd636359e3
SHA512 1762164ade6b72fb326c0921bb714fa924b2a9fba46aec75d4602fcfd793ff1bd57587a7355d63e93acbd7ac1cfc91d89f472fa7d9389ab86c210c365d178658
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU6:v+D56utgpPF8u/76
TLSH
T1B3965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iMMxzKd.exe

Path C:\Windows\System\iMMxzKd.exe
Size 8.3MB
SHA256 7915102a1cf35e90c4edc729cd78af1733805c0e5828caf3e3cc634f227a4224
MD5 d12f8cf52b172c5639980e5abc8d2509
SHA1 aacfaf98ea223c5e86b020081fa602f3e63628a0
SHA512 74a7754c8a925a9fc76c8323c78d2bd8d57427cd7c1671f03a0a3aebec2ee3a9a4f4302804db4b03216b2bfddb1edcc24f105ee82fa763210ead7e00103e961d
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUf:v+D56utgpPF8u/7f
TLSH
T1EE965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jozJnXQ.exe

Path C:\Windows\System\jozJnXQ.exe
Size 8.3MB
SHA256 ba0389b0fd33fd13c53043b7c21c39f280bd398a91cb231a024b2e0b7d42926d
MD5 7103c0430940124de050bf715969b88c
SHA1 6af69c025665393c9c42cde72e84b20cf4a3c51d
SHA512 a373be46637a34f6af1d9566d84911d411cf37bd48e175bcc05f681fe810dc1747cc2474d4ff4f68d8a841afd7b98c6c8e562da98c98a78c1a1082b2eddc6f9f
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU4:v+D56utgpPF8u/74
TLSH
T187965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pLqxesJ.exe

Path C:\Windows\System\pLqxesJ.exe
Size 8.3MB
SHA256 6f4cba5f98842cde342eb6d905bc72beb7d3885a19d767a35ffce1096ffa5d66
MD5 83d2e03b6f7046c730db0a4c610eded3
SHA1 51db5dfaef275bad2d7821cbe82c61998b671b2b
SHA512 ae7a97de88d852d7ea0f6f0d2e2d0790f552bb6daa58890a13a593d6986841d699cf99348f4e1230d40a7a22652d1ef7d9178dcfc13b602d7a740cce6212c237
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUU:v+D56utgpPF8u/7U
TLSH
T11C965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tggPeJK.exe

Path C:\Windows\System\tggPeJK.exe
Size 8.3MB
SHA256 20598835e39c36900f2e5c1474daeae8ec99da17efc68e5f6926f3b07b19e0bf
MD5 0a19267828867057f40c7151558cc2b5
SHA1 b4dc5311753afe27adec570824a9a3b42ef2fe95
SHA512 b71f58fb91c9941e03049205dc06a530bfa2f1a14cf9cbea95417df382d995cdc6d785187abcbb62efcd37e6d723437b2af50e034d98461bf35fe70fe3b03cad
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUL:v+D56utgpPF8u/7L
TLSH
T1A7965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uVjBxsU.exe

Path C:\Windows\System\uVjBxsU.exe
Size 8.3MB
SHA256 7ee28d558e44012420d6a0d1d3e8ff4df58730d41f2a427a609eb9423027978b
MD5 7625e835d58d834b96e71f489f32c8ef
SHA1 686c0666c989f522a7a8890b15c65b607bd339f7
SHA512 2a9b92963ed02e6b8826097dab6d4218766d3942cdaf87aa4af147f3871bbea7f878e73e11a72165bd95aecd7fa18c60c7639b1a8237a60cc7f1efe1f0b46cbc
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUx:v+D56utgpPF8u/7x
TLSH
T198965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vIvGUPY.exe

Path C:\Windows\System\vIvGUPY.exe
Size 8.3MB
SHA256 52a5fff1b2c0b100d0517195d628b532747630a360f8b72d725c52064d9ca1b5
MD5 344ac5bd40d997d88d3527934743e76c
SHA1 d14a7c50d33dcf36c037932d4fcba12a8e17b5d4
SHA512 7fb0bc9e8417354a5d292e54a9dacf88197b1dc8091f11f9f8531e7f53cb232b6f2aa8d5dc1256ae99be19beecb0d86ef52edc66b7bdae92cacb978649dd1d19
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUg:v+D56utgpPF8u/7g
TLSH
T1F1965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/908-128-0x00007FF7CEC80000-0x00007FF7CEFD2000-memory.dmp

Download

memory/908-0-0x00007FF7CEC80000-0x00007FF7CEFD2000-memory.dmp

Download

memory/908-1-0x00000140A2B20000-0x00000140A2B30000-memory.dmp

Download

memory/1060-143-0x00007FF755F70000-0x00007FF7562C2000-memory.dmp

Download

memory/1060-116-0x00007FF755F70000-0x00007FF7562C2000-memory.dmp

Download

memory/1084-119-0x00007FF721AB0000-0x00007FF721E02000-memory.dmp

Download

memory/1084-147-0x00007FF721AB0000-0x00007FF721E02000-memory.dmp

Download

memory/1684-89-0x00007FF629F50000-0x00007FF62A2A2000-memory.dmp

Download

memory/1684-135-0x00007FF629F50000-0x00007FF62A2A2000-memory.dmp

Download

memory/2068-139-0x00007FF7FB1A0000-0x00007FF7FB4F2000-memory.dmp

Download

memory/2068-91-0x00007FF7FB1A0000-0x00007FF7FB4F2000-memory.dmp

Download

memory/2604-92-0x00007FF7A43A0000-0x00007FF7A46F2000-memory.dmp

Download

memory/2604-138-0x00007FF7A43A0000-0x00007FF7A46F2000-memory.dmp

Download

memory/2728-152-0x00007FF7F0110000-0x00007FF7F0462000-memory.dmp

Download

memory/2728-124-0x00007FF7F0110000-0x00007FF7F0462000-memory.dmp

Download

memory/2768-134-0x00007FF7C0490000-0x00007FF7C07E2000-memory.dmp

Download

memory/2768-18-0x00007FF7C0490000-0x00007FF7C07E2000-memory.dmp

Download

memory/2768-131-0x00007FF7C0490000-0x00007FF7C07E2000-memory.dmp

Download

memory/3212-150-0x00007FF769C60000-0x00007FF769FB2000-memory.dmp

Download

memory/3212-127-0x00007FF769C60000-0x00007FF769FB2000-memory.dmp

Download

memory/4168-90-0x00007FF6D2EA0000-0x00007FF6D31F2000-memory.dmp

Download

memory/4168-137-0x00007FF6D2EA0000-0x00007FF6D31F2000-memory.dmp

Download

memory/4264-142-0x00007FF700DA0000-0x00007FF7010F2000-memory.dmp

Download

memory/4264-117-0x00007FF700DA0000-0x00007FF7010F2000-memory.dmp

Download

memory/4292-118-0x00007FF731150000-0x00007FF7314A2000-memory.dmp

Download

memory/4292-141-0x00007FF731150000-0x00007FF7314A2000-memory.dmp

Download

memory/4496-151-0x00007FF7BF960000-0x00007FF7BFCB2000-memory.dmp

Download

memory/4496-125-0x00007FF7BF960000-0x00007FF7BFCB2000-memory.dmp

Download

memory/4596-129-0x00007FF7D4230000-0x00007FF7D4582000-memory.dmp

Download

memory/4596-6-0x00007FF7D4230000-0x00007FF7D4582000-memory.dmp

Download

memory/4596-132-0x00007FF7D4230000-0x00007FF7D4582000-memory.dmp

Download

memory/4636-146-0x00007FF732450000-0x00007FF7327A2000-memory.dmp

Download

memory/4636-120-0x00007FF732450000-0x00007FF7327A2000-memory.dmp

Download

memory/4780-145-0x00007FF642740000-0x00007FF642A92000-memory.dmp

Download

memory/4780-121-0x00007FF642740000-0x00007FF642A92000-memory.dmp

Download

memory/4836-93-0x00007FF6BEA00000-0x00007FF6BED52000-memory.dmp

Download

memory/4836-140-0x00007FF6BEA00000-0x00007FF6BED52000-memory.dmp

Download

memory/4860-13-0x00007FF699F80000-0x00007FF69A2D2000-memory.dmp

Download

memory/4860-133-0x00007FF699F80000-0x00007FF69A2D2000-memory.dmp

Download

memory/4860-130-0x00007FF699F80000-0x00007FF69A2D2000-memory.dmp

Download

memory/5028-123-0x00007FF7A8AA0000-0x00007FF7A8DF2000-memory.dmp

Download

memory/5028-149-0x00007FF7A8AA0000-0x00007FF7A8DF2000-memory.dmp

Download

memory/5400-126-0x00007FF740E20000-0x00007FF741172000-memory.dmp

Download

memory/5400-136-0x00007FF740E20000-0x00007FF741172000-memory.dmp

Download

memory/5624-144-0x00007FF6A5440000-0x00007FF6A5792000-memory.dmp

Download

memory/5624-115-0x00007FF6A5440000-0x00007FF6A5792000-memory.dmp

Download

memory/6048-148-0x00007FF764AF0000-0x00007FF764E42000-memory.dmp

Download

memory/6048-122-0x00007FF764AF0000-0x00007FF764E42000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads