cobaltstrike | 03d83b4d5d72e8a68eb34d11ec4c4f61be0e15e5d58cfe8c2f4ee2d186252cf6

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 5.9MB
Sample261029-e5p2fawx3q
SHA256 03d83b4d5d72e8a68eb34d11ec4c4f61be0e15e5d58cfe8c2f4ee2d186252cf6
MD5 dd6942327e4c86ad01314914fe6ededc
SHA1 05dd060a1d248c94b9076eb4355c6eeae6a8de41
SHA512 b6cabb619c7f19e019ca87bc1c3fb9fe1dd3f2708c267b34aa4e23d9df953aaa867e4c5d805c998bb52cfe0c3eecbb8bb217472912686a9881031a813ad194c6
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:T+856utgpPF8u/78
TLSH
T147565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x0009000000024395-12.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024460-47.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024468-83.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024463-96.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002446d-112.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002446c-110.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002446b-108.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002446a-106.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024469-104.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024467-100.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024462-90.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024461-87.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024466-77.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024464-76.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024465-75.dat	cobalt_reflective_dll
behavioral1/files/0x000d00000002439f-65.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002445d-63.dat	cobalt_reflective_dll
behavioral1/files/0x000900000002439e-57.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002445f-30.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002445e-28.dat	cobalt_reflective_dll
behavioral1/files/0x000c000000021467-19.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral1/files/0x0009000000024395-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024460-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024468-83.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024463-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002446d-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002446c-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002446b-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002446a-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024469-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024467-100.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024462-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024461-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024466-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024464-76.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024465-75.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000d00000002439f-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002445d-63.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000900000002439e-57.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002445f-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002445e-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000c000000021467-19.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral1/memory/4452-0-0x00007FF6A4D60000-0x00007FF6A50B4000-memory.dmp	UPX
behavioral1/files/0x0009000000024395-12.dat	UPX
behavioral1/files/0x0007000000024460-47.dat	UPX
behavioral1/memory/3744-45-0x00007FF7F1DF0000-0x00007FF7F2144000-memory.dmp	UPX
behavioral1/files/0x0007000000024468-83.dat	UPX
behavioral1/files/0x0007000000024463-96.dat	UPX
behavioral1/memory/992-114-0x00007FF6DE830000-0x00007FF6DEB84000-memory.dmp	UPX
behavioral1/memory/1200-120-0x00007FF6FE090000-0x00007FF6FE3E4000-memory.dmp	UPX
behavioral1/memory/2256-125-0x00007FF788180000-0x00007FF7884D4000-memory.dmp	UPX
behavioral1/memory/1092-127-0x00007FF627030000-0x00007FF627384000-memory.dmp	UPX
behavioral1/memory/2456-126-0x00007FF7F4AC0000-0x00007FF7F4E14000-memory.dmp	UPX
behavioral1/memory/2812-124-0x00007FF68AAC0000-0x00007FF68AE14000-memory.dmp	UPX
behavioral1/memory/4284-123-0x00007FF63D120000-0x00007FF63D474000-memory.dmp	UPX
behavioral1/memory/2484-122-0x00007FF63B010000-0x00007FF63B364000-memory.dmp	UPX
behavioral1/memory/4936-121-0x00007FF77B840000-0x00007FF77BB94000-memory.dmp	UPX
behavioral1/memory/3848-119-0x00007FF6F2290000-0x00007FF6F25E4000-memory.dmp	UPX
behavioral1/memory/4680-118-0x00007FF7EF700000-0x00007FF7EFA54000-memory.dmp	UPX
behavioral1/memory/4064-117-0x00007FF636660000-0x00007FF6369B4000-memory.dmp	UPX
behavioral1/memory/820-116-0x00007FF6B8DF0000-0x00007FF6B9144000-memory.dmp	UPX
behavioral1/memory/2920-115-0x00007FF654A90000-0x00007FF654DE4000-memory.dmp	UPX
behavioral1/files/0x000700000002446d-112.dat	UPX
behavioral1/files/0x000700000002446c-110.dat	UPX
behavioral1/files/0x000700000002446b-108.dat	UPX
behavioral1/files/0x000700000002446a-106.dat	UPX
behavioral1/files/0x0007000000024469-104.dat	UPX
behavioral1/files/0x0007000000024467-100.dat	UPX
behavioral1/memory/5004-99-0x00007FF628190000-0x00007FF6284E4000-memory.dmp	UPX
behavioral1/memory/684-98-0x00007FF61DF50000-0x00007FF61E2A4000-memory.dmp	UPX
behavioral1/memory/952-93-0x00007FF6FA900000-0x00007FF6FAC54000-memory.dmp	UPX
behavioral1/files/0x0007000000024462-90.dat	UPX
behavioral1/files/0x0007000000024461-87.dat	UPX
behavioral1/memory/4532-81-0x00007FF679260000-0x00007FF6795B4000-memory.dmp	UPX
behavioral1/files/0x0007000000024466-77.dat	UPX
behavioral1/files/0x0007000000024464-76.dat	UPX
behavioral1/files/0x0007000000024465-75.dat	UPX
behavioral1/files/0x000d00000002439f-65.dat	UPX
behavioral1/files/0x000700000002445d-63.dat	UPX
behavioral1/files/0x000900000002439e-57.dat	UPX
behavioral1/memory/2988-37-0x00007FF78C380000-0x00007FF78C6D4000-memory.dmp	UPX
behavioral1/files/0x000700000002445f-30.dat	UPX
behavioral1/files/0x000700000002445e-28.dat	UPX
behavioral1/files/0x000c000000021467-19.dat	UPX
behavioral1/memory/3212-22-0x00007FF6E70E0000-0x00007FF6E7434000-memory.dmp	UPX
behavioral1/memory/4452-128-0x00007FF6A4D60000-0x00007FF6A50B4000-memory.dmp	UPX
behavioral1/memory/3744-131-0x00007FF7F1DF0000-0x00007FF7F2144000-memory.dmp	UPX
behavioral1/memory/2988-130-0x00007FF78C380000-0x00007FF78C6D4000-memory.dmp	UPX
behavioral1/memory/3212-129-0x00007FF6E70E0000-0x00007FF6E7434000-memory.dmp	UPX
behavioral1/memory/3212-132-0x00007FF6E70E0000-0x00007FF6E7434000-memory.dmp	UPX
behavioral1/memory/2256-133-0x00007FF788180000-0x00007FF7884D4000-memory.dmp	UPX
behavioral1/memory/4532-134-0x00007FF679260000-0x00007FF6795B4000-memory.dmp	UPX
behavioral1/memory/2456-145-0x00007FF7F4AC0000-0x00007FF7F4E14000-memory.dmp	UPX
behavioral1/memory/4284-146-0x00007FF63D120000-0x00007FF63D474000-memory.dmp	UPX
behavioral1/memory/3744-152-0x00007FF7F1DF0000-0x00007FF7F2144000-memory.dmp	UPX
behavioral1/memory/952-151-0x00007FF6FA900000-0x00007FF6FAC54000-memory.dmp	UPX
behavioral1/memory/2812-150-0x00007FF68AAC0000-0x00007FF68AE14000-memory.dmp	UPX
behavioral1/memory/2988-149-0x00007FF78C380000-0x00007FF78C6D4000-memory.dmp	UPX
behavioral1/memory/820-148-0x00007FF6B8DF0000-0x00007FF6B9144000-memory.dmp	UPX
behavioral1/memory/2920-147-0x00007FF654A90000-0x00007FF654DE4000-memory.dmp	UPX
behavioral1/memory/3848-144-0x00007FF6F2290000-0x00007FF6F25E4000-memory.dmp	UPX
behavioral1/memory/1092-143-0x00007FF627030000-0x00007FF627384000-memory.dmp	UPX
behavioral1/memory/684-142-0x00007FF61DF50000-0x00007FF61E2A4000-memory.dmp	UPX
behavioral1/memory/4064-141-0x00007FF636660000-0x00007FF6369B4000-memory.dmp	UPX
behavioral1/memory/1200-140-0x00007FF6FE090000-0x00007FF6FE3E4000-memory.dmp	UPX
behavioral1/memory/992-139-0x00007FF6DE830000-0x00007FF6DEB84000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/4452-0-0x00007FF6A4D60000-0x00007FF6A50B4000-memory.dmp	xmrig
behavioral1/files/0x0009000000024395-12.dat	xmrig
behavioral1/files/0x0007000000024460-47.dat	xmrig
behavioral1/memory/3744-45-0x00007FF7F1DF0000-0x00007FF7F2144000-memory.dmp	xmrig
behavioral1/files/0x0007000000024468-83.dat	xmrig
behavioral1/files/0x0007000000024463-96.dat	xmrig
behavioral1/memory/992-114-0x00007FF6DE830000-0x00007FF6DEB84000-memory.dmp	xmrig
behavioral1/memory/1200-120-0x00007FF6FE090000-0x00007FF6FE3E4000-memory.dmp	xmrig
behavioral1/memory/2256-125-0x00007FF788180000-0x00007FF7884D4000-memory.dmp	xmrig
behavioral1/memory/1092-127-0x00007FF627030000-0x00007FF627384000-memory.dmp	xmrig
behavioral1/memory/2456-126-0x00007FF7F4AC0000-0x00007FF7F4E14000-memory.dmp	xmrig
behavioral1/memory/2812-124-0x00007FF68AAC0000-0x00007FF68AE14000-memory.dmp	xmrig
behavioral1/memory/4284-123-0x00007FF63D120000-0x00007FF63D474000-memory.dmp	xmrig
behavioral1/memory/2484-122-0x00007FF63B010000-0x00007FF63B364000-memory.dmp	xmrig
behavioral1/memory/4936-121-0x00007FF77B840000-0x00007FF77BB94000-memory.dmp	xmrig
behavioral1/memory/3848-119-0x00007FF6F2290000-0x00007FF6F25E4000-memory.dmp	xmrig
behavioral1/memory/4680-118-0x00007FF7EF700000-0x00007FF7EFA54000-memory.dmp	xmrig
behavioral1/memory/4064-117-0x00007FF636660000-0x00007FF6369B4000-memory.dmp	xmrig
behavioral1/memory/820-116-0x00007FF6B8DF0000-0x00007FF6B9144000-memory.dmp	xmrig
behavioral1/memory/2920-115-0x00007FF654A90000-0x00007FF654DE4000-memory.dmp	xmrig
behavioral1/files/0x000700000002446d-112.dat	xmrig
behavioral1/files/0x000700000002446c-110.dat	xmrig
behavioral1/files/0x000700000002446b-108.dat	xmrig
behavioral1/files/0x000700000002446a-106.dat	xmrig
behavioral1/files/0x0007000000024469-104.dat	xmrig
behavioral1/files/0x0007000000024467-100.dat	xmrig
behavioral1/memory/5004-99-0x00007FF628190000-0x00007FF6284E4000-memory.dmp	xmrig
behavioral1/memory/684-98-0x00007FF61DF50000-0x00007FF61E2A4000-memory.dmp	xmrig
behavioral1/memory/952-93-0x00007FF6FA900000-0x00007FF6FAC54000-memory.dmp	xmrig
behavioral1/files/0x0007000000024462-90.dat	xmrig
behavioral1/files/0x0007000000024461-87.dat	xmrig
behavioral1/memory/4532-81-0x00007FF679260000-0x00007FF6795B4000-memory.dmp	xmrig
behavioral1/files/0x0007000000024466-77.dat	xmrig
behavioral1/files/0x0007000000024464-76.dat	xmrig
behavioral1/files/0x0007000000024465-75.dat	xmrig
behavioral1/files/0x000d00000002439f-65.dat	xmrig
behavioral1/files/0x000700000002445d-63.dat	xmrig
behavioral1/files/0x000900000002439e-57.dat	xmrig
behavioral1/memory/2988-37-0x00007FF78C380000-0x00007FF78C6D4000-memory.dmp	xmrig
behavioral1/files/0x000700000002445f-30.dat	xmrig
behavioral1/files/0x000700000002445e-28.dat	xmrig
behavioral1/files/0x000c000000021467-19.dat	xmrig
behavioral1/memory/3212-22-0x00007FF6E70E0000-0x00007FF6E7434000-memory.dmp	xmrig
behavioral1/memory/4452-128-0x00007FF6A4D60000-0x00007FF6A50B4000-memory.dmp	xmrig
behavioral1/memory/3744-131-0x00007FF7F1DF0000-0x00007FF7F2144000-memory.dmp	xmrig
behavioral1/memory/2988-130-0x00007FF78C380000-0x00007FF78C6D4000-memory.dmp	xmrig
behavioral1/memory/3212-129-0x00007FF6E70E0000-0x00007FF6E7434000-memory.dmp	xmrig
behavioral1/memory/3212-132-0x00007FF6E70E0000-0x00007FF6E7434000-memory.dmp	xmrig
behavioral1/memory/2256-133-0x00007FF788180000-0x00007FF7884D4000-memory.dmp	xmrig
behavioral1/memory/4532-134-0x00007FF679260000-0x00007FF6795B4000-memory.dmp	xmrig
behavioral1/memory/2456-145-0x00007FF7F4AC0000-0x00007FF7F4E14000-memory.dmp	xmrig
behavioral1/memory/4284-146-0x00007FF63D120000-0x00007FF63D474000-memory.dmp	xmrig
behavioral1/memory/3744-152-0x00007FF7F1DF0000-0x00007FF7F2144000-memory.dmp	xmrig
behavioral1/memory/952-151-0x00007FF6FA900000-0x00007FF6FAC54000-memory.dmp	xmrig
behavioral1/memory/2812-150-0x00007FF68AAC0000-0x00007FF68AE14000-memory.dmp	xmrig
behavioral1/memory/2988-149-0x00007FF78C380000-0x00007FF78C6D4000-memory.dmp	xmrig
behavioral1/memory/820-148-0x00007FF6B8DF0000-0x00007FF6B9144000-memory.dmp	xmrig
behavioral1/memory/2920-147-0x00007FF654A90000-0x00007FF654DE4000-memory.dmp	xmrig
behavioral1/memory/3848-144-0x00007FF6F2290000-0x00007FF6F25E4000-memory.dmp	xmrig
behavioral1/memory/1092-143-0x00007FF627030000-0x00007FF627384000-memory.dmp	xmrig
behavioral1/memory/684-142-0x00007FF61DF50000-0x00007FF61E2A4000-memory.dmp	xmrig
behavioral1/memory/4064-141-0x00007FF636660000-0x00007FF6369B4000-memory.dmp	xmrig
behavioral1/memory/1200-140-0x00007FF6FE090000-0x00007FF6FE3E4000-memory.dmp	xmrig
behavioral1/memory/992-139-0x00007FF6DE830000-0x00007FF6DEB84000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3212	OBEikLX.exe
2988	FRNXiNL.exe
2812	RuLcMPF.exe
3744	xPJApvV.exe
952	qqPjlyR.exe
2256	aHkLLPK.exe
4532	RJbleiK.exe
2456	iWdAgHU.exe
684	KiWeHlI.exe
5004	gqbqFxb.exe
992	xJHikYt.exe
2920	sotgwTD.exe
820	boDRCID.exe
4064	DOlxEws.exe
1092	ycMjthW.exe
4680	tCFoPpN.exe
3848	QXTtjoK.exe
1200	XfzTiYD.exe
4936	dOyDXdg.exe
2484	jbgNLsI.exe
4284	MFwOoko.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4452-0-0x00007FF6A4D60000-0x00007FF6A50B4000-memory.dmp	upx
behavioral1/files/0x0009000000024395-12.dat	upx
behavioral1/files/0x0007000000024460-47.dat	upx
behavioral1/memory/3744-45-0x00007FF7F1DF0000-0x00007FF7F2144000-memory.dmp	upx
behavioral1/files/0x0007000000024468-83.dat	upx
behavioral1/files/0x0007000000024463-96.dat	upx
behavioral1/memory/992-114-0x00007FF6DE830000-0x00007FF6DEB84000-memory.dmp	upx
behavioral1/memory/1200-120-0x00007FF6FE090000-0x00007FF6FE3E4000-memory.dmp	upx
behavioral1/memory/2256-125-0x00007FF788180000-0x00007FF7884D4000-memory.dmp	upx
behavioral1/memory/1092-127-0x00007FF627030000-0x00007FF627384000-memory.dmp	upx
behavioral1/memory/2456-126-0x00007FF7F4AC0000-0x00007FF7F4E14000-memory.dmp	upx
behavioral1/memory/2812-124-0x00007FF68AAC0000-0x00007FF68AE14000-memory.dmp	upx
behavioral1/memory/4284-123-0x00007FF63D120000-0x00007FF63D474000-memory.dmp	upx
behavioral1/memory/2484-122-0x00007FF63B010000-0x00007FF63B364000-memory.dmp	upx
behavioral1/memory/4936-121-0x00007FF77B840000-0x00007FF77BB94000-memory.dmp	upx
behavioral1/memory/3848-119-0x00007FF6F2290000-0x00007FF6F25E4000-memory.dmp	upx
behavioral1/memory/4680-118-0x00007FF7EF700000-0x00007FF7EFA54000-memory.dmp	upx
behavioral1/memory/4064-117-0x00007FF636660000-0x00007FF6369B4000-memory.dmp	upx
behavioral1/memory/820-116-0x00007FF6B8DF0000-0x00007FF6B9144000-memory.dmp	upx
behavioral1/memory/2920-115-0x00007FF654A90000-0x00007FF654DE4000-memory.dmp	upx
behavioral1/files/0x000700000002446d-112.dat	upx
behavioral1/files/0x000700000002446c-110.dat	upx
behavioral1/files/0x000700000002446b-108.dat	upx
behavioral1/files/0x000700000002446a-106.dat	upx
behavioral1/files/0x0007000000024469-104.dat	upx
behavioral1/files/0x0007000000024467-100.dat	upx
behavioral1/memory/5004-99-0x00007FF628190000-0x00007FF6284E4000-memory.dmp	upx
behavioral1/memory/684-98-0x00007FF61DF50000-0x00007FF61E2A4000-memory.dmp	upx
behavioral1/memory/952-93-0x00007FF6FA900000-0x00007FF6FAC54000-memory.dmp	upx
behavioral1/files/0x0007000000024462-90.dat	upx
behavioral1/files/0x0007000000024461-87.dat	upx
behavioral1/memory/4532-81-0x00007FF679260000-0x00007FF6795B4000-memory.dmp	upx
behavioral1/files/0x0007000000024466-77.dat	upx
behavioral1/files/0x0007000000024464-76.dat	upx
behavioral1/files/0x0007000000024465-75.dat	upx
behavioral1/files/0x000d00000002439f-65.dat	upx
behavioral1/files/0x000700000002445d-63.dat	upx
behavioral1/files/0x000900000002439e-57.dat	upx
behavioral1/memory/2988-37-0x00007FF78C380000-0x00007FF78C6D4000-memory.dmp	upx
behavioral1/files/0x000700000002445f-30.dat	upx
behavioral1/files/0x000700000002445e-28.dat	upx
behavioral1/files/0x000c000000021467-19.dat	upx
behavioral1/memory/3212-22-0x00007FF6E70E0000-0x00007FF6E7434000-memory.dmp	upx
behavioral1/memory/4452-128-0x00007FF6A4D60000-0x00007FF6A50B4000-memory.dmp	upx
behavioral1/memory/3744-131-0x00007FF7F1DF0000-0x00007FF7F2144000-memory.dmp	upx
behavioral1/memory/2988-130-0x00007FF78C380000-0x00007FF78C6D4000-memory.dmp	upx
behavioral1/memory/3212-129-0x00007FF6E70E0000-0x00007FF6E7434000-memory.dmp	upx
behavioral1/memory/3212-132-0x00007FF6E70E0000-0x00007FF6E7434000-memory.dmp	upx
behavioral1/memory/2256-133-0x00007FF788180000-0x00007FF7884D4000-memory.dmp	upx
behavioral1/memory/4532-134-0x00007FF679260000-0x00007FF6795B4000-memory.dmp	upx
behavioral1/memory/2456-145-0x00007FF7F4AC0000-0x00007FF7F4E14000-memory.dmp	upx
behavioral1/memory/4284-146-0x00007FF63D120000-0x00007FF63D474000-memory.dmp	upx
behavioral1/memory/3744-152-0x00007FF7F1DF0000-0x00007FF7F2144000-memory.dmp	upx
behavioral1/memory/952-151-0x00007FF6FA900000-0x00007FF6FAC54000-memory.dmp	upx
behavioral1/memory/2812-150-0x00007FF68AAC0000-0x00007FF68AE14000-memory.dmp	upx
behavioral1/memory/2988-149-0x00007FF78C380000-0x00007FF78C6D4000-memory.dmp	upx
behavioral1/memory/820-148-0x00007FF6B8DF0000-0x00007FF6B9144000-memory.dmp	upx
behavioral1/memory/2920-147-0x00007FF654A90000-0x00007FF654DE4000-memory.dmp	upx
behavioral1/memory/3848-144-0x00007FF6F2290000-0x00007FF6F25E4000-memory.dmp	upx
behavioral1/memory/1092-143-0x00007FF627030000-0x00007FF627384000-memory.dmp	upx
behavioral1/memory/684-142-0x00007FF61DF50000-0x00007FF61E2A4000-memory.dmp	upx
behavioral1/memory/4064-141-0x00007FF636660000-0x00007FF6369B4000-memory.dmp	upx
behavioral1/memory/1200-140-0x00007FF6FE090000-0x00007FF6FE3E4000-memory.dmp	upx
behavioral1/memory/992-139-0x00007FF6DE830000-0x00007FF6DEB84000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\OBEikLX.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\xPJApvV.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\qqPjlyR.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\RJbleiK.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\KiWeHlI.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\dOyDXdg.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\MFwOoko.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\boDRCID.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\jbgNLsI.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\RuLcMPF.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\iWdAgHU.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ycMjthW.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\tCFoPpN.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\FRNXiNL.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\aHkLLPK.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\gqbqFxb.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\xJHikYt.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\sotgwTD.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\DOlxEws.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\QXTtjoK.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\XfzTiYD.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 3212	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	86
PID 4452 wrote to memory of 2988	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	87
PID 4452 wrote to memory of 2812	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	88
PID 4452 wrote to memory of 3744	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	89
PID 4452 wrote to memory of 952	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 4452 wrote to memory of 2256	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 4452 wrote to memory of 4532	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 4452 wrote to memory of 2456	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 4452 wrote to memory of 684	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 4452 wrote to memory of 5004	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 4452 wrote to memory of 992	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 4452 wrote to memory of 2920	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 4452 wrote to memory of 820	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 4452 wrote to memory of 4064	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 4452 wrote to memory of 1092	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 4452 wrote to memory of 4680	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 4452 wrote to memory of 3848	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 4452 wrote to memory of 1200	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 4452 wrote to memory of 4936	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 4452 wrote to memory of 2484	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 4452 wrote to memory of 4284	4452	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\System\OBEikLX.exe
  C:\Windows\System\OBEikLX.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\FRNXiNL.exe
  C:\Windows\System\FRNXiNL.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\RuLcMPF.exe
  C:\Windows\System\RuLcMPF.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\xPJApvV.exe
  C:\Windows\System\xPJApvV.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\qqPjlyR.exe
  C:\Windows\System\qqPjlyR.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\aHkLLPK.exe
  C:\Windows\System\aHkLLPK.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\RJbleiK.exe
  C:\Windows\System\RJbleiK.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\iWdAgHU.exe
  C:\Windows\System\iWdAgHU.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\KiWeHlI.exe
  C:\Windows\System\KiWeHlI.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\gqbqFxb.exe
  C:\Windows\System\gqbqFxb.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\xJHikYt.exe
  C:\Windows\System\xJHikYt.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\sotgwTD.exe
  C:\Windows\System\sotgwTD.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\boDRCID.exe
  C:\Windows\System\boDRCID.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\DOlxEws.exe
  C:\Windows\System\DOlxEws.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\ycMjthW.exe
  C:\Windows\System\ycMjthW.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\tCFoPpN.exe
  C:\Windows\System\tCFoPpN.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\QXTtjoK.exe
  C:\Windows\System\QXTtjoK.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\XfzTiYD.exe
  C:\Windows\System\XfzTiYD.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\dOyDXdg.exe
  C:\Windows\System\dOyDXdg.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\jbgNLsI.exe
  C:\Windows\System\jbgNLsI.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\MFwOoko.exe
  C:\Windows\System\MFwOoko.exe
  2⤵
  - Executes dropped EXE
  PID:4284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DOlxEws.exe

Path C:\Windows\System\DOlxEws.exe
Size 5.9MB
SHA256 d854d6ff1fe734140f28ba0154ea0fad3c876964c92418a6835c56215916c458
MD5 47042551ca05e7d7cda5eb19b3e0c068
SHA1 9042582354880d0fdf7edad1482bb525a19f150c
SHA512 ff51b5db3f5ed86f5e2c0d2c0411c3064ca874f3b546d31c5ea6a289ce5b9c61d8d0ee94fc4192b557c7464cf5c934842a53233dcdf0b0aeca3bf96b39f831fa
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:T+856utgpPF8u/7E
TLSH
T14F565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FRNXiNL.exe

Path C:\Windows\System\FRNXiNL.exe
Size 5.9MB
SHA256 7aefa306bac0f2b4966e5041d7ac8b93eff513e2ab9e18f81c467ef3f904418c
MD5 5747f6f696ac27ed598a172e60a35bf9
SHA1 285e9dc9cb7cd8dbd27130119882eb95d69f9845
SHA512 8da8a55372d0f2d9154973bb8ae7e98ecdd769ed7d7f929a2a23529e8a8523108f528437f21208e05cbc0c7ccf36c5f0cb33a4d888643b6fec6701bbfdb6b6ba
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:T+856utgpPF8u/7Y
TLSH
T1BC565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KiWeHlI.exe

Path C:\Windows\System\KiWeHlI.exe
Size 5.9MB
SHA256 be7e3954f4d347665befdaab0f9d6c51845fbdb498956fcbdab7c9f06070afba
MD5 34553a4d6dfd89640bfa43593ded8f6b
SHA1 39fc32b547ebb5453e9a46a2cb178699bd07b7f8
SHA512 9fa46d980e46b6ccdd57b541a093ef4618b4f971163b6af6b44bb297fcd2a9bd57d5ca4d0a92cc28444278107127fbe27c22b57b5205db68742ac0b22540671a
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:T+856utgpPF8u/7j
TLSH
T1A0565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MFwOoko.exe

Path C:\Windows\System\MFwOoko.exe
Size 5.9MB
SHA256 3500a18b12eabc86a59419c991bed507edca4f01746221a7887b3bccf1955454
MD5 30af42bc3338810f7d3b6afa402b61b1
SHA1 b7986b96abc82465926b55adf58cfb6ed76db5be
SHA512 fb8fd679a1e3119398077acdd41aa6c2f3155ffccb2a9b511de4663bb5b051ab1ada2c103bcc2454a2ab82bdfb179f5275445638411eb7e078e89fe5e0443938
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:T+856utgpPF8u/7c
TLSH
T113565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OBEikLX.exe

Path C:\Windows\System\OBEikLX.exe
Size 5.9MB
SHA256 8548c91723485982ba038b7733c71b8363f26ef5be8c64287b5e863a8bd52f71
MD5 9c14adadd73c2a2897b374d19d776834
SHA1 fbc302de99d5a262bf2602be6c63cfd746727f73
SHA512 130f7c1844caae9ab3643d50c89327c58324d74e71ddd4ca9183d03d31594d368737b53aa7106db1824432f19c2706c574f9ad0b18058b2763c1f10b96bc55bd
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:T+856utgpPF8u/70
TLSH
T17B565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QXTtjoK.exe

Path C:\Windows\System\QXTtjoK.exe
Size 5.9MB
SHA256 6979331ed5d3ab024d7a028fc419f19baa9af1e56f93514ef338fabe439806a2
MD5 6301cd2e7fdf6b5f56575ae5530848ad
SHA1 b5e034fbc256621600888e3a37c41596e95fe4e3
SHA512 23adf6cf4e272c7fa727f4330eaef373ba27cdadb84bea38bcbe82cad4fa1d37ecde78e842022cacfe3b53dfeb55cb98eecd62bd0cf49b15e7e04f1f4bcb4f78
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:T+856utgpPF8u/7w
TLSH
T141565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RJbleiK.exe

Path C:\Windows\System\RJbleiK.exe
Size 5.9MB
SHA256 af87e9494153de3c0c89c595a180067365339e2fc7e6e6fcba77f7b077894045
MD5 739c1b8aee92b99b48aca12ff467b791
SHA1 24a9ef90e9603d98c8f5f8ab095dcef012d6362d
SHA512 ba0b619e47e88be0a5e7df5c32540d68ec44726c959bdf322a52b3535540526661aa14fd3885bdb364fb001e61ae2d3f2550f130e0d10c630e1e9f030b9a48d7
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:T+856utgpPF8u/7v
TLSH
T1A2565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuLcMPF.exe

Path C:\Windows\System\RuLcMPF.exe
Size 5.9MB
SHA256 5d2602d2ea5099a1d9a5edf72d07038292494c379f08bcbb40e4945d44db0329
MD5 302474e186e6dd7fc6e72a27c1279fa8
SHA1 41dcaa627c61af2f44c389acafe282c7e215b1df
SHA512 ade558532c0ed84e40a53946053d47d6aa1e6d60381cf22162740640babd6ea5899c11a721382dca3baa3a523529c55012e5c90c5df76bab8123e87a2a189202
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:T+856utgpPF8u/78
TLSH
T18B565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XfzTiYD.exe

Path C:\Windows\System\XfzTiYD.exe
Size 5.9MB
SHA256 5248a3d22d180d4d48b8479a9e79d92cc8e9d81f269f48825735a65d06bed37a
MD5 c6c151ac0e2316b69a34f8a23b439c11
SHA1 52b08824d462eb2d24d947e206aede4c884938cd
SHA512 776fc31d2d844aeca8be7edfa4d0d601030354ca08c8751501488c397f9acfac2e9239ffa1853922ebb1d3e5a723ace82aa47cc5dd9c2db0f011c32c28c77aca
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:T+856utgpPF8u/7N
TLSH
T19B565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aHkLLPK.exe

Path C:\Windows\System\aHkLLPK.exe
Size 5.9MB
SHA256 58616db16a1ef1e518b77493369a7ed55bf339ed2ec26ccbefb89a1799d5e51f
MD5 f3c2912cf81199382fadbc023d49af2d
SHA1 1863ad30d8edc8569c740a6cc93b6185e41e53c3
SHA512 6acd2fdc9c8ef6bbe1e034346ba6210e7fde9d5e70f43ecfef8d5670e511dd458fed39c98804998da58ede9b6b6a9491213e8e186c25be3a07cfc3b25bfcc5f1
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:T+856utgpPF8u/7x
TLSH
T1A6565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boDRCID.exe

Path C:\Windows\System\boDRCID.exe
Size 5.9MB
SHA256 4afcedb0be6da3330e56ebffc9cfb82b5d8054f0393722451815cb0ada12c74b
MD5 5d169cabe7f71edee838359d3ab191ae
SHA1 7e169a5a0f40ae17f7d4ae82d4c734438b3ac3ca
SHA512 2f3116c2123bc779a6199ecc06811aa10a46b8986a6a839c239d8c20422881a33535880726080bfaa78ce1073fe30d98cecd800fd727224d26a489bb58c74eab
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:T+856utgpPF8u/7l
TLSH
T133565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dOyDXdg.exe

Path C:\Windows\System\dOyDXdg.exe
Size 5.9MB
SHA256 4d3d08c43d5e87b9b0bb19b8970a2bdd211b7982fa599ec59aa75cb791a344f6
MD5 39e64f9f7a53bf5cf7b95ed0f54880c3
SHA1 147936f88e6c030801da0bfc484e539a1d148c52
SHA512 27a41795db149fe26965d7abad83e66d575f13b6e867cc000fce8ee66591fc0feb9b86e26a9f45fa614306085f642c491542d0e3ac28006d958e6340eda52035
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:T+856utgpPF8u/7R
TLSH
T1A8565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gqbqFxb.exe

Path C:\Windows\System\gqbqFxb.exe
Size 5.9MB
SHA256 2526dddcb7a645aca0ccfee8b9867dfb07dc5003cbfcf32f5394e0c9fa1a2196
MD5 99e5e4b2f72756593dafab3b59e41625
SHA1 e9be4c9837ff10c3fcedc8f2c757633e870984a8
SHA512 084b599be34ec7a92d53f832b5560dfeb752434f324cab4b4d75a2f5cc6cecfe756cfc146715c5ad2d5368fc50e8d2a680b7653ce0b1bba3aabc5b59f0d57315
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:T+856utgpPF8u/7A
TLSH
T13C565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iWdAgHU.exe

Path C:\Windows\System\iWdAgHU.exe
Size 5.9MB
SHA256 adbcdc1e7c93cfbc9d042a8a4a803d16e0b356ef161e6aaeeeebd12832bd7dc9
MD5 8bf25b7a87e238c3a4e26b2d8b53753d
SHA1 3a0834f2398b2da108835f7295b81a06723c3fb3
SHA512 ef9edc542af03b7b010df47648f371f269c1b699b3e3d3cee06091079359dd0fea609ae11ee4a44f3953f501ec99a631137015a1ef261f025e950bbcf2abbbbb
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:T+856utgpPF8u/7q
TLSH
T1C7565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jbgNLsI.exe

Path C:\Windows\System\jbgNLsI.exe
Size 5.9MB
SHA256 d62aa72fe033966de22db6449eac8cfda6802c8121c3e91158fe94bd97946309
MD5 d0210924b85b3506addbceae5a3296a0
SHA1 27f1f8851cc8473317e6d3dc69bbbd9ca9ac825f
SHA512 472d84e68b5f0cb03e1a3930c3ea3a72c60e7a37e04c8c9b7896fc51454e1a09eb548c2479c87cb97d692dd2155c055064f04861e3c5432c033ff2ec30b0f674
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:T+856utgpPF8u/72
TLSH
T1C5565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qqPjlyR.exe

Path C:\Windows\System\qqPjlyR.exe
Size 5.9MB
SHA256 e46d1f8411e46c5770572dfb8a01dafed791626d38bc47c6c04a21bf133ed189
MD5 f1191d714af1b6aaf99ac351a02a5806
SHA1 d29d6383eefe10140bb9dfeed38cf57f9ad7a091
SHA512 1369a9f17500d3dae780a5bd6b557db0139fd8846a6a49134a094ff60f3eba18735aee6e7365e3a993d9ea430a692d49ce08ea7859d0154a46b68566605f8f34
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:T+856utgpPF8u/79
TLSH
T19D565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sotgwTD.exe

Path C:\Windows\System\sotgwTD.exe
Size 5.9MB
SHA256 11182e92805857c5a3a80817e1884fd12b13e12fa2454a18690752bbd8ae0dcb
MD5 2800fd194f3d84bdd8b7fbaaa450739f
SHA1 f8058482406ed011b9cd5fcd3621a5001b0c34c0
SHA512 49d2e1c396189f734d9a2383cb0a4ab64bf0f13d7917d1ecf510f91108aa37dda523894ca1ca9ac915714bc7b50d4753e9121d0be1242c8139ed0358dadb4b7b
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:T+856utgpPF8u/7C
TLSH
T19E565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tCFoPpN.exe

Path C:\Windows\System\tCFoPpN.exe
Size 5.9MB
SHA256 e7e24ab130b5dcc610873701da8adb40033ff0aac73abc93f8c780a98d3214d3
MD5 22af19be60a3a0fe8e000fe0a2451562
SHA1 2c3e0b1fbcfcc8938ae87cca04d994e42430a4fb
SHA512 ef3126536407f1ad47970fb338db6102dd45d0dabd38ae6a342aaf0c2fb57064b8ede7a2d5de39285e73cd0aaac0ba0533971226de05dbdf8f7e6f33fe0ed667
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:T+856utgpPF8u/7A
TLSH
T1CA565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xJHikYt.exe

Path C:\Windows\System\xJHikYt.exe
Size 5.9MB
SHA256 38a607dd7c26c52a50e0924795abdde8b8889042e08aece9bb47899bf5acf9ec
MD5 34eabf50b9898cba03642565f629ad47
SHA1 3d522931a84313d4c5b36b0844e6178fc31d15e8
SHA512 2571add51a778200395bf1b1bfb38db652ee59b638d52a14ff79ba8326999cfe910515ef93ef3073da4a3a5ea7855ca78f63fdad618b4aef87694719d30ec74e
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:T+856utgpPF8u/7Y
TLSH
T105565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xPJApvV.exe

Path C:\Windows\System\xPJApvV.exe
Size 5.9MB
SHA256 7f2fd2cdd5f908cee9707bb31c7b6439448d35d3882ddbbe6803dab793f700bb
MD5 dfe2d47094b3ce444e22f3ff0f6e942e
SHA1 eb3aff2d0d03097ff7887dbeba990d40ee5124bf
SHA512 ce1b465b36b6bd414a8e82bc580a7673eacf567d88624c843ec11fb7febb69627e19efcf44d55c894cddb83e691cce4ad7cca6cf3ee1c20707422d2287d8372e
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:T+856utgpPF8u/7w
TLSH
T1AB565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ycMjthW.exe

Path C:\Windows\System\ycMjthW.exe
Size 5.9MB
SHA256 f29b3027e34d732486c9c9e797b0f9e9596f5055654f65262cb858569fc49aa9
MD5 9d3dc09b4d750d7a1ed2a74524a3f34f
SHA1 932562ae48e0fcbc3d7fa4627199f30ad7aba3b2
SHA512 c09deb133c8f920289cc7141afcd4872d30853513f57a7340a48587e6c44c899428692a5fadca59706d2fe5c973a4fc252871f6900e4f24ef3850427a90b1731
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:T+856utgpPF8u/7w
TLSH
T163565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/684-142-0x00007FF61DF50000-0x00007FF61E2A4000-memory.dmp

Download

memory/684-98-0x00007FF61DF50000-0x00007FF61E2A4000-memory.dmp

Download

memory/820-116-0x00007FF6B8DF0000-0x00007FF6B9144000-memory.dmp

Download

memory/820-148-0x00007FF6B8DF0000-0x00007FF6B9144000-memory.dmp

Download

memory/952-151-0x00007FF6FA900000-0x00007FF6FAC54000-memory.dmp

Download

memory/952-93-0x00007FF6FA900000-0x00007FF6FAC54000-memory.dmp

Download

memory/992-139-0x00007FF6DE830000-0x00007FF6DEB84000-memory.dmp

Download

memory/992-114-0x00007FF6DE830000-0x00007FF6DEB84000-memory.dmp

Download

memory/1092-143-0x00007FF627030000-0x00007FF627384000-memory.dmp

Download

memory/1092-127-0x00007FF627030000-0x00007FF627384000-memory.dmp

Download

memory/1200-140-0x00007FF6FE090000-0x00007FF6FE3E4000-memory.dmp

Download

memory/1200-120-0x00007FF6FE090000-0x00007FF6FE3E4000-memory.dmp

Download

memory/2256-125-0x00007FF788180000-0x00007FF7884D4000-memory.dmp

Download

memory/2256-133-0x00007FF788180000-0x00007FF7884D4000-memory.dmp

Download

memory/2456-126-0x00007FF7F4AC0000-0x00007FF7F4E14000-memory.dmp

Download

memory/2456-145-0x00007FF7F4AC0000-0x00007FF7F4E14000-memory.dmp

Download

memory/2484-122-0x00007FF63B010000-0x00007FF63B364000-memory.dmp

Download

memory/2484-136-0x00007FF63B010000-0x00007FF63B364000-memory.dmp

Download

memory/2812-124-0x00007FF68AAC0000-0x00007FF68AE14000-memory.dmp

Download

memory/2812-150-0x00007FF68AAC0000-0x00007FF68AE14000-memory.dmp

Download

memory/2920-147-0x00007FF654A90000-0x00007FF654DE4000-memory.dmp

Download

memory/2920-115-0x00007FF654A90000-0x00007FF654DE4000-memory.dmp

Download

memory/2988-37-0x00007FF78C380000-0x00007FF78C6D4000-memory.dmp

Download

memory/2988-130-0x00007FF78C380000-0x00007FF78C6D4000-memory.dmp

Download

memory/2988-149-0x00007FF78C380000-0x00007FF78C6D4000-memory.dmp

Download

memory/3212-129-0x00007FF6E70E0000-0x00007FF6E7434000-memory.dmp

Download

memory/3212-132-0x00007FF6E70E0000-0x00007FF6E7434000-memory.dmp

Download

memory/3212-22-0x00007FF6E70E0000-0x00007FF6E7434000-memory.dmp

Download

memory/3744-131-0x00007FF7F1DF0000-0x00007FF7F2144000-memory.dmp

Download

memory/3744-45-0x00007FF7F1DF0000-0x00007FF7F2144000-memory.dmp

Download

memory/3744-152-0x00007FF7F1DF0000-0x00007FF7F2144000-memory.dmp

Download

memory/3848-119-0x00007FF6F2290000-0x00007FF6F25E4000-memory.dmp

Download

memory/3848-144-0x00007FF6F2290000-0x00007FF6F25E4000-memory.dmp

Download

memory/4064-117-0x00007FF636660000-0x00007FF6369B4000-memory.dmp

Download

memory/4064-141-0x00007FF636660000-0x00007FF6369B4000-memory.dmp

Download

memory/4284-146-0x00007FF63D120000-0x00007FF63D474000-memory.dmp

Download

memory/4284-123-0x00007FF63D120000-0x00007FF63D474000-memory.dmp

Download

memory/4452-1-0x000002839BD20000-0x000002839BD30000-memory.dmp

Download

memory/4452-128-0x00007FF6A4D60000-0x00007FF6A50B4000-memory.dmp

Download

memory/4452-0-0x00007FF6A4D60000-0x00007FF6A50B4000-memory.dmp

Download

memory/4532-81-0x00007FF679260000-0x00007FF6795B4000-memory.dmp

Download

memory/4532-134-0x00007FF679260000-0x00007FF6795B4000-memory.dmp

Download

memory/4680-118-0x00007FF7EF700000-0x00007FF7EFA54000-memory.dmp

Download

memory/4680-135-0x00007FF7EF700000-0x00007FF7EFA54000-memory.dmp

Download

memory/4936-121-0x00007FF77B840000-0x00007FF77BB94000-memory.dmp

Download

memory/4936-138-0x00007FF77B840000-0x00007FF77BB94000-memory.dmp

Download

memory/5004-99-0x00007FF628190000-0x00007FF6284E4000-memory.dmp

Download

memory/5004-137-0x00007FF628190000-0x00007FF6284E4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads