cobaltstrike | 03d83b4d5d72e8a68eb34d11ec4c4f61be0e15e5d58cfe8c2f4ee2d186252cf6

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 5.9MB
Sample261029-e5p2fawx3q
SHA256 03d83b4d5d72e8a68eb34d11ec4c4f61be0e15e5d58cfe8c2f4ee2d186252cf6
MD5 dd6942327e4c86ad01314914fe6ededc
SHA1 05dd060a1d248c94b9076eb4355c6eeae6a8de41
SHA512 b6cabb619c7f19e019ca87bc1c3fb9fe1dd3f2708c267b34aa4e23d9df953aaa867e4c5d805c998bb52cfe0c3eecbb8bb217472912686a9881031a813ad194c6
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:T+856utgpPF8u/78
TLSH
T147565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000e00000001c543-4.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c556-9.dat	cobalt_reflective_dll
behavioral2/files/0x000e00000001c553-18.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c557-23.dat	cobalt_reflective_dll
behavioral2/files/0x0004000000008f26-28.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c559-35.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c55a-41.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c55b-47.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c55c-53.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c55d-59.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c55e-69.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c55f-75.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c561-86.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c562-96.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c566-124.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c567-131.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c568-137.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c565-117.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c564-110.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c563-103.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c560-82.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c543-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c556-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000e00000001c553-18.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c557-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0004000000008f26-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c559-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c55a-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c55b-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c55c-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c55d-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c55e-69.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c55f-75.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c561-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c562-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c566-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c567-131.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c568-137.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c565-117.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c564-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c563-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c560-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2084-0-0x00007FF71FB00000-0x00007FF71FE54000-memory.dmp	UPX
behavioral2/files/0x000e00000001c543-4.dat	UPX
behavioral2/memory/3000-8-0x00007FF7DDFE0000-0x00007FF7DE334000-memory.dmp	UPX
behavioral2/files/0x000d00000001c556-9.dat	UPX
behavioral2/memory/6048-14-0x00007FF627130000-0x00007FF627484000-memory.dmp	UPX
behavioral2/files/0x000e00000001c553-18.dat	UPX
behavioral2/memory/1728-20-0x00007FF7A03D0000-0x00007FF7A0724000-memory.dmp	UPX
behavioral2/files/0x000d00000001c557-23.dat	UPX
behavioral2/memory/2000-24-0x00007FF713410000-0x00007FF713764000-memory.dmp	UPX
behavioral2/files/0x0004000000008f26-28.dat	UPX
behavioral2/memory/4980-31-0x00007FF6EB830000-0x00007FF6EBB84000-memory.dmp	UPX
behavioral2/files/0x000d00000001c559-35.dat	UPX
behavioral2/files/0x000d00000001c55a-41.dat	UPX
behavioral2/files/0x000d00000001c55b-47.dat	UPX
behavioral2/files/0x000d00000001c55c-53.dat	UPX
behavioral2/files/0x000d00000001c55d-59.dat	UPX
behavioral2/files/0x000d00000001c55e-69.dat	UPX
behavioral2/files/0x000d00000001c55f-75.dat	UPX
behavioral2/memory/1728-80-0x00007FF7A03D0000-0x00007FF7A0724000-memory.dmp	UPX
behavioral2/files/0x000d00000001c561-86.dat	UPX
behavioral2/files/0x000d00000001c562-96.dat	UPX
behavioral2/memory/236-102-0x00007FF732A60000-0x00007FF732DB4000-memory.dmp	UPX
behavioral2/memory/3044-108-0x00007FF7DA4B0000-0x00007FF7DA804000-memory.dmp	UPX
behavioral2/memory/5040-115-0x00007FF696440000-0x00007FF696794000-memory.dmp	UPX
behavioral2/files/0x000d00000001c566-124.dat	UPX
behavioral2/files/0x000d00000001c567-131.dat	UPX
behavioral2/files/0x000d00000001c568-137.dat	UPX
behavioral2/memory/1152-136-0x00007FF6E7BA0000-0x00007FF6E7EF4000-memory.dmp	UPX
behavioral2/memory/2064-135-0x00007FF64FC00000-0x00007FF64FF54000-memory.dmp	UPX
behavioral2/memory/1568-130-0x00007FF749960000-0x00007FF749CB4000-memory.dmp	UPX
behavioral2/memory/5740-129-0x00007FF6F04D0000-0x00007FF6F0824000-memory.dmp	UPX
behavioral2/memory/996-123-0x00007FF659510000-0x00007FF659864000-memory.dmp	UPX
behavioral2/memory/1340-122-0x00007FF7A7560000-0x00007FF7A78B4000-memory.dmp	UPX
behavioral2/files/0x000d00000001c565-117.dat	UPX
behavioral2/memory/1632-116-0x00007FF7828B0000-0x00007FF782C04000-memory.dmp	UPX
behavioral2/files/0x000d00000001c564-110.dat	UPX
behavioral2/memory/5856-109-0x00007FF61EFA0000-0x00007FF61F2F4000-memory.dmp	UPX
behavioral2/files/0x000d00000001c563-103.dat	UPX
behavioral2/memory/4716-101-0x00007FF7BBF20000-0x00007FF7BC274000-memory.dmp	UPX
behavioral2/memory/760-95-0x00007FF72D370000-0x00007FF72D6C4000-memory.dmp	UPX
behavioral2/memory/4980-94-0x00007FF6EB830000-0x00007FF6EBB84000-memory.dmp	UPX
behavioral2/memory/1744-88-0x00007FF76D840000-0x00007FF76DB94000-memory.dmp	UPX
behavioral2/memory/2000-87-0x00007FF713410000-0x00007FF713764000-memory.dmp	UPX
behavioral2/files/0x000d00000001c560-82.dat	UPX
behavioral2/memory/960-81-0x00007FF7853F0000-0x00007FF785744000-memory.dmp	UPX
behavioral2/memory/3540-74-0x00007FF669500000-0x00007FF669854000-memory.dmp	UPX
behavioral2/memory/2064-68-0x00007FF64FC00000-0x00007FF64FF54000-memory.dmp	UPX
behavioral2/memory/3000-67-0x00007FF7DDFE0000-0x00007FF7DE334000-memory.dmp	UPX
behavioral2/memory/5740-61-0x00007FF6F04D0000-0x00007FF6F0824000-memory.dmp	UPX
behavioral2/memory/2084-60-0x00007FF71FB00000-0x00007FF71FE54000-memory.dmp	UPX
behavioral2/memory/1340-54-0x00007FF7A7560000-0x00007FF7A78B4000-memory.dmp	UPX
behavioral2/memory/5040-48-0x00007FF696440000-0x00007FF696794000-memory.dmp	UPX
behavioral2/memory/3044-42-0x00007FF7DA4B0000-0x00007FF7DA804000-memory.dmp	UPX
behavioral2/memory/4716-36-0x00007FF7BBF20000-0x00007FF7BC274000-memory.dmp	UPX
behavioral2/memory/3540-139-0x00007FF669500000-0x00007FF669854000-memory.dmp	UPX
behavioral2/memory/960-140-0x00007FF7853F0000-0x00007FF785744000-memory.dmp	UPX
behavioral2/memory/1744-141-0x00007FF76D840000-0x00007FF76DB94000-memory.dmp	UPX
behavioral2/memory/760-142-0x00007FF72D370000-0x00007FF72D6C4000-memory.dmp	UPX
behavioral2/memory/236-143-0x00007FF732A60000-0x00007FF732DB4000-memory.dmp	UPX
behavioral2/memory/5856-144-0x00007FF61EFA0000-0x00007FF61F2F4000-memory.dmp	UPX
behavioral2/memory/1632-145-0x00007FF7828B0000-0x00007FF782C04000-memory.dmp	UPX
behavioral2/memory/996-146-0x00007FF659510000-0x00007FF659864000-memory.dmp	UPX
behavioral2/memory/1568-147-0x00007FF749960000-0x00007FF749CB4000-memory.dmp	UPX
behavioral2/memory/1152-148-0x00007FF6E7BA0000-0x00007FF6E7EF4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2084-0-0x00007FF71FB00000-0x00007FF71FE54000-memory.dmp	xmrig
behavioral2/files/0x000e00000001c543-4.dat	xmrig
behavioral2/memory/3000-8-0x00007FF7DDFE0000-0x00007FF7DE334000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c556-9.dat	xmrig
behavioral2/memory/6048-14-0x00007FF627130000-0x00007FF627484000-memory.dmp	xmrig
behavioral2/files/0x000e00000001c553-18.dat	xmrig
behavioral2/memory/1728-20-0x00007FF7A03D0000-0x00007FF7A0724000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c557-23.dat	xmrig
behavioral2/memory/2000-24-0x00007FF713410000-0x00007FF713764000-memory.dmp	xmrig
behavioral2/files/0x0004000000008f26-28.dat	xmrig
behavioral2/memory/4980-31-0x00007FF6EB830000-0x00007FF6EBB84000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c559-35.dat	xmrig
behavioral2/files/0x000d00000001c55a-41.dat	xmrig
behavioral2/files/0x000d00000001c55b-47.dat	xmrig
behavioral2/files/0x000d00000001c55c-53.dat	xmrig
behavioral2/files/0x000d00000001c55d-59.dat	xmrig
behavioral2/files/0x000d00000001c55e-69.dat	xmrig
behavioral2/files/0x000d00000001c55f-75.dat	xmrig
behavioral2/memory/1728-80-0x00007FF7A03D0000-0x00007FF7A0724000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c561-86.dat	xmrig
behavioral2/files/0x000d00000001c562-96.dat	xmrig
behavioral2/memory/236-102-0x00007FF732A60000-0x00007FF732DB4000-memory.dmp	xmrig
behavioral2/memory/3044-108-0x00007FF7DA4B0000-0x00007FF7DA804000-memory.dmp	xmrig
behavioral2/memory/5040-115-0x00007FF696440000-0x00007FF696794000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c566-124.dat	xmrig
behavioral2/files/0x000d00000001c567-131.dat	xmrig
behavioral2/files/0x000d00000001c568-137.dat	xmrig
behavioral2/memory/1152-136-0x00007FF6E7BA0000-0x00007FF6E7EF4000-memory.dmp	xmrig
behavioral2/memory/2064-135-0x00007FF64FC00000-0x00007FF64FF54000-memory.dmp	xmrig
behavioral2/memory/1568-130-0x00007FF749960000-0x00007FF749CB4000-memory.dmp	xmrig
behavioral2/memory/5740-129-0x00007FF6F04D0000-0x00007FF6F0824000-memory.dmp	xmrig
behavioral2/memory/996-123-0x00007FF659510000-0x00007FF659864000-memory.dmp	xmrig
behavioral2/memory/1340-122-0x00007FF7A7560000-0x00007FF7A78B4000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c565-117.dat	xmrig
behavioral2/memory/1632-116-0x00007FF7828B0000-0x00007FF782C04000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c564-110.dat	xmrig
behavioral2/memory/5856-109-0x00007FF61EFA0000-0x00007FF61F2F4000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c563-103.dat	xmrig
behavioral2/memory/4716-101-0x00007FF7BBF20000-0x00007FF7BC274000-memory.dmp	xmrig
behavioral2/memory/760-95-0x00007FF72D370000-0x00007FF72D6C4000-memory.dmp	xmrig
behavioral2/memory/4980-94-0x00007FF6EB830000-0x00007FF6EBB84000-memory.dmp	xmrig
behavioral2/memory/1744-88-0x00007FF76D840000-0x00007FF76DB94000-memory.dmp	xmrig
behavioral2/memory/2000-87-0x00007FF713410000-0x00007FF713764000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c560-82.dat	xmrig
behavioral2/memory/960-81-0x00007FF7853F0000-0x00007FF785744000-memory.dmp	xmrig
behavioral2/memory/3540-74-0x00007FF669500000-0x00007FF669854000-memory.dmp	xmrig
behavioral2/memory/2064-68-0x00007FF64FC00000-0x00007FF64FF54000-memory.dmp	xmrig
behavioral2/memory/3000-67-0x00007FF7DDFE0000-0x00007FF7DE334000-memory.dmp	xmrig
behavioral2/memory/5740-61-0x00007FF6F04D0000-0x00007FF6F0824000-memory.dmp	xmrig
behavioral2/memory/2084-60-0x00007FF71FB00000-0x00007FF71FE54000-memory.dmp	xmrig
behavioral2/memory/1340-54-0x00007FF7A7560000-0x00007FF7A78B4000-memory.dmp	xmrig
behavioral2/memory/5040-48-0x00007FF696440000-0x00007FF696794000-memory.dmp	xmrig
behavioral2/memory/3044-42-0x00007FF7DA4B0000-0x00007FF7DA804000-memory.dmp	xmrig
behavioral2/memory/4716-36-0x00007FF7BBF20000-0x00007FF7BC274000-memory.dmp	xmrig
behavioral2/memory/3540-139-0x00007FF669500000-0x00007FF669854000-memory.dmp	xmrig
behavioral2/memory/960-140-0x00007FF7853F0000-0x00007FF785744000-memory.dmp	xmrig
behavioral2/memory/1744-141-0x00007FF76D840000-0x00007FF76DB94000-memory.dmp	xmrig
behavioral2/memory/760-142-0x00007FF72D370000-0x00007FF72D6C4000-memory.dmp	xmrig
behavioral2/memory/236-143-0x00007FF732A60000-0x00007FF732DB4000-memory.dmp	xmrig
behavioral2/memory/5856-144-0x00007FF61EFA0000-0x00007FF61F2F4000-memory.dmp	xmrig
behavioral2/memory/1632-145-0x00007FF7828B0000-0x00007FF782C04000-memory.dmp	xmrig
behavioral2/memory/996-146-0x00007FF659510000-0x00007FF659864000-memory.dmp	xmrig
behavioral2/memory/1568-147-0x00007FF749960000-0x00007FF749CB4000-memory.dmp	xmrig
behavioral2/memory/1152-148-0x00007FF6E7BA0000-0x00007FF6E7EF4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3000	UOBsVNA.exe
6048	miAfmgp.exe
1728	beVmmsL.exe
2000	FXQVfGA.exe
4980	XAJZcFO.exe
4716	fiumnej.exe
3044	lXWxOGd.exe
5040	UkAAiUT.exe
1340	OvNRbdL.exe
5740	LACQXFh.exe
2064	qhUgKOj.exe
3540	jolNQcU.exe
960	gxroyTb.exe
1744	IhwHQGd.exe
760	ogZXrCi.exe
236	TyiweHT.exe
5856	xgnTbnV.exe
1632	SYBSyOX.exe
996	HVrcMWW.exe
1568	NEwVEkS.exe
1152	jtMAEGe.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2084-0-0x00007FF71FB00000-0x00007FF71FE54000-memory.dmp	upx
behavioral2/files/0x000e00000001c543-4.dat	upx
behavioral2/memory/3000-8-0x00007FF7DDFE0000-0x00007FF7DE334000-memory.dmp	upx
behavioral2/files/0x000d00000001c556-9.dat	upx
behavioral2/memory/6048-14-0x00007FF627130000-0x00007FF627484000-memory.dmp	upx
behavioral2/files/0x000e00000001c553-18.dat	upx
behavioral2/memory/1728-20-0x00007FF7A03D0000-0x00007FF7A0724000-memory.dmp	upx
behavioral2/files/0x000d00000001c557-23.dat	upx
behavioral2/memory/2000-24-0x00007FF713410000-0x00007FF713764000-memory.dmp	upx
behavioral2/files/0x0004000000008f26-28.dat	upx
behavioral2/memory/4980-31-0x00007FF6EB830000-0x00007FF6EBB84000-memory.dmp	upx
behavioral2/files/0x000d00000001c559-35.dat	upx
behavioral2/files/0x000d00000001c55a-41.dat	upx
behavioral2/files/0x000d00000001c55b-47.dat	upx
behavioral2/files/0x000d00000001c55c-53.dat	upx
behavioral2/files/0x000d00000001c55d-59.dat	upx
behavioral2/files/0x000d00000001c55e-69.dat	upx
behavioral2/files/0x000d00000001c55f-75.dat	upx
behavioral2/memory/1728-80-0x00007FF7A03D0000-0x00007FF7A0724000-memory.dmp	upx
behavioral2/files/0x000d00000001c561-86.dat	upx
behavioral2/files/0x000d00000001c562-96.dat	upx
behavioral2/memory/236-102-0x00007FF732A60000-0x00007FF732DB4000-memory.dmp	upx
behavioral2/memory/3044-108-0x00007FF7DA4B0000-0x00007FF7DA804000-memory.dmp	upx
behavioral2/memory/5040-115-0x00007FF696440000-0x00007FF696794000-memory.dmp	upx
behavioral2/files/0x000d00000001c566-124.dat	upx
behavioral2/files/0x000d00000001c567-131.dat	upx
behavioral2/files/0x000d00000001c568-137.dat	upx
behavioral2/memory/1152-136-0x00007FF6E7BA0000-0x00007FF6E7EF4000-memory.dmp	upx
behavioral2/memory/2064-135-0x00007FF64FC00000-0x00007FF64FF54000-memory.dmp	upx
behavioral2/memory/1568-130-0x00007FF749960000-0x00007FF749CB4000-memory.dmp	upx
behavioral2/memory/5740-129-0x00007FF6F04D0000-0x00007FF6F0824000-memory.dmp	upx
behavioral2/memory/996-123-0x00007FF659510000-0x00007FF659864000-memory.dmp	upx
behavioral2/memory/1340-122-0x00007FF7A7560000-0x00007FF7A78B4000-memory.dmp	upx
behavioral2/files/0x000d00000001c565-117.dat	upx
behavioral2/memory/1632-116-0x00007FF7828B0000-0x00007FF782C04000-memory.dmp	upx
behavioral2/files/0x000d00000001c564-110.dat	upx
behavioral2/memory/5856-109-0x00007FF61EFA0000-0x00007FF61F2F4000-memory.dmp	upx
behavioral2/files/0x000d00000001c563-103.dat	upx
behavioral2/memory/4716-101-0x00007FF7BBF20000-0x00007FF7BC274000-memory.dmp	upx
behavioral2/memory/760-95-0x00007FF72D370000-0x00007FF72D6C4000-memory.dmp	upx
behavioral2/memory/4980-94-0x00007FF6EB830000-0x00007FF6EBB84000-memory.dmp	upx
behavioral2/memory/1744-88-0x00007FF76D840000-0x00007FF76DB94000-memory.dmp	upx
behavioral2/memory/2000-87-0x00007FF713410000-0x00007FF713764000-memory.dmp	upx
behavioral2/files/0x000d00000001c560-82.dat	upx
behavioral2/memory/960-81-0x00007FF7853F0000-0x00007FF785744000-memory.dmp	upx
behavioral2/memory/3540-74-0x00007FF669500000-0x00007FF669854000-memory.dmp	upx
behavioral2/memory/2064-68-0x00007FF64FC00000-0x00007FF64FF54000-memory.dmp	upx
behavioral2/memory/3000-67-0x00007FF7DDFE0000-0x00007FF7DE334000-memory.dmp	upx
behavioral2/memory/5740-61-0x00007FF6F04D0000-0x00007FF6F0824000-memory.dmp	upx
behavioral2/memory/2084-60-0x00007FF71FB00000-0x00007FF71FE54000-memory.dmp	upx
behavioral2/memory/1340-54-0x00007FF7A7560000-0x00007FF7A78B4000-memory.dmp	upx
behavioral2/memory/5040-48-0x00007FF696440000-0x00007FF696794000-memory.dmp	upx
behavioral2/memory/3044-42-0x00007FF7DA4B0000-0x00007FF7DA804000-memory.dmp	upx
behavioral2/memory/4716-36-0x00007FF7BBF20000-0x00007FF7BC274000-memory.dmp	upx
behavioral2/memory/3540-139-0x00007FF669500000-0x00007FF669854000-memory.dmp	upx
behavioral2/memory/960-140-0x00007FF7853F0000-0x00007FF785744000-memory.dmp	upx
behavioral2/memory/1744-141-0x00007FF76D840000-0x00007FF76DB94000-memory.dmp	upx
behavioral2/memory/760-142-0x00007FF72D370000-0x00007FF72D6C4000-memory.dmp	upx
behavioral2/memory/236-143-0x00007FF732A60000-0x00007FF732DB4000-memory.dmp	upx
behavioral2/memory/5856-144-0x00007FF61EFA0000-0x00007FF61F2F4000-memory.dmp	upx
behavioral2/memory/1632-145-0x00007FF7828B0000-0x00007FF782C04000-memory.dmp	upx
behavioral2/memory/996-146-0x00007FF659510000-0x00007FF659864000-memory.dmp	upx
behavioral2/memory/1568-147-0x00007FF749960000-0x00007FF749CB4000-memory.dmp	upx
behavioral2/memory/1152-148-0x00007FF6E7BA0000-0x00007FF6E7EF4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\FXQVfGA.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fiumnej.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\LACQXFh.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\IhwHQGd.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\SYBSyOX.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\beVmmsL.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\XAJZcFO.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\UkAAiUT.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\OvNRbdL.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\jolNQcU.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\xgnTbnV.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\UOBsVNA.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\qhUgKOj.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ogZXrCi.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\HVrcMWW.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\NEwVEkS.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\jtMAEGe.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\miAfmgp.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\lXWxOGd.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\gxroyTb.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\TyiweHT.exe	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 3000	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 2084 wrote to memory of 6048	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 2084 wrote to memory of 1728	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 2084 wrote to memory of 2000	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 2084 wrote to memory of 4980	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 2084 wrote to memory of 4716	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 2084 wrote to memory of 3044	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 2084 wrote to memory of 5040	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 2084 wrote to memory of 1340	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 2084 wrote to memory of 5740	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 2084 wrote to memory of 2064	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 2084 wrote to memory of 3540	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 2084 wrote to memory of 960	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 2084 wrote to memory of 1744	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 2084 wrote to memory of 760	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 2084 wrote to memory of 236	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 2084 wrote to memory of 5856	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 2084 wrote to memory of 1632	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 2084 wrote to memory of 996	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 2084 wrote to memory of 1568	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109
PID 2084 wrote to memory of 1152	2084	2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_dd6942327e4c86ad01314914fe6ededc_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\System\UOBsVNA.exe
  C:\Windows\System\UOBsVNA.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\miAfmgp.exe
  C:\Windows\System\miAfmgp.exe
  2⤵
  - Executes dropped EXE
  PID:6048
- C:\Windows\System\beVmmsL.exe
  C:\Windows\System\beVmmsL.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\FXQVfGA.exe
  C:\Windows\System\FXQVfGA.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\XAJZcFO.exe
  C:\Windows\System\XAJZcFO.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\fiumnej.exe
  C:\Windows\System\fiumnej.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\lXWxOGd.exe
  C:\Windows\System\lXWxOGd.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\UkAAiUT.exe
  C:\Windows\System\UkAAiUT.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\OvNRbdL.exe
  C:\Windows\System\OvNRbdL.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\LACQXFh.exe
  C:\Windows\System\LACQXFh.exe
  2⤵
  - Executes dropped EXE
  PID:5740
- C:\Windows\System\qhUgKOj.exe
  C:\Windows\System\qhUgKOj.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\jolNQcU.exe
  C:\Windows\System\jolNQcU.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\gxroyTb.exe
  C:\Windows\System\gxroyTb.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\IhwHQGd.exe
  C:\Windows\System\IhwHQGd.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\ogZXrCi.exe
  C:\Windows\System\ogZXrCi.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\TyiweHT.exe
  C:\Windows\System\TyiweHT.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\xgnTbnV.exe
  C:\Windows\System\xgnTbnV.exe
  2⤵
  - Executes dropped EXE
  PID:5856
- C:\Windows\System\SYBSyOX.exe
  C:\Windows\System\SYBSyOX.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\HVrcMWW.exe
  C:\Windows\System\HVrcMWW.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\NEwVEkS.exe
  C:\Windows\System\NEwVEkS.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\jtMAEGe.exe
  C:\Windows\System\jtMAEGe.exe
  2⤵
  - Executes dropped EXE
  PID:1152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

FXQVfGA.exe

Path C:\Windows\System\FXQVfGA.exe
Size 5.9MB
SHA256 7f7eca98fc7394f14e4a3e2918939be7621a5d8f3adf5317fde10641e73bc0c9
MD5 125ef4bde8f4e65c4d3cde255272ad7b
SHA1 647c13f008330f0d8283f0d8827269fa1b77ba0a
SHA512 49d03e3ada1363318493497efc0815f049f8ec954821114a8e8d37d440a03e19b27822803a1c1f434f78e7fb9c35b670a4abcf815755304450155149a30bd95d
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:T+856utgpPF8u/7e
TLSH
T1AB565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HVrcMWW.exe

Path C:\Windows\System\HVrcMWW.exe
Size 5.9MB
SHA256 cf0d887982b5ad7beee1025f5ac3c94c1114f55a30adc0b89b44cf33115af70e
MD5 c983e63fade03ccd5345f063c5a2d836
SHA1 49ae48ae3a178385adc43bd51fd990e4162fa476
SHA512 1a9576008e63be47001155006a534b1fa34481b34a8382cd71db0e0270c6456bb7e089abd4326343f4796bab24ae2b9236efc60826b782f520f658f7a475703a
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:T+856utgpPF8u/75
TLSH
T1BF565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IhwHQGd.exe

Path C:\Windows\System\IhwHQGd.exe
Size 5.9MB
SHA256 ebff5e8ffd6ebf926e82027f196a6115f2e895acca9ff989c4534174927df69e
MD5 c308b1e98b522d47ab804017d66fd59e
SHA1 fe07f2c850350eb8f6eed623dd4ccb3713e41b23
SHA512 e8f59f03fd63849a37b1249bae4bb8249f0a97eae25974133f05fbe325dcfb43fd2128a856162436a6ad87eaf7c523aa86415a6026774aa938d6b64e92f4ef40
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:T+856utgpPF8u/7U
TLSH
T142565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LACQXFh.exe

Path C:\Windows\System\LACQXFh.exe
Size 5.9MB
SHA256 41ca9b8724d6497729ffb4e68778897c2c3069e48605efe6f40350680c597358
MD5 dc1f7bf83e862e7563c8636b2e905112
SHA1 d20b55af74144bf8a65ae682f70192b9121dd6cb
SHA512 401bd178e34122ad1c5d4ec43228c899daecd0bec12df88a33e37899b412d4d77f1a5d7650fe1c9c281206c79c788bb7ca29875cafcfc07c7a03b146e294afa1
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:T+856utgpPF8u/7h
TLSH
T13B565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NEwVEkS.exe

Path C:\Windows\System\NEwVEkS.exe
Size 5.9MB
SHA256 10204a85837944bc5f52283043993c5a183f0e8a7ce67b2a33cc6a09a0bbb34b
MD5 92b71c2d53063cd6cef1beb2a2d997c2
SHA1 41d550ef907b7aa10e2666ba75beec5401c809a2
SHA512 6ab7befeead7b714aa56019cd41f1e78d82a0825a73e6e330e932e563e087c31a454c48b7134342b39e31201457f690612e480bf8de0d5324a8ed0fd2472521d
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:T+856utgpPF8u/7Q
TLSH
T11A565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OvNRbdL.exe

Path C:\Windows\System\OvNRbdL.exe
Size 5.9MB
SHA256 41d44c641a66feb763ab99c6b034148d864ed5b1ee53b4f55444cef9202455da
MD5 8bf164cb11b9a4dff6de5bfab6940b76
SHA1 fd3b4d70c7d3754c2726b223d13b9b9d665b37b2
SHA512 b7a92b977ef0ae3c16ee50777074709e7a10b3d30e43a2e1ebf52138da5292d046386d1c4b67c23ba2fef50c647702a695078ce6c39dc87b857c9c562249b62f
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:T+856utgpPF8u/7O
TLSH
T1AE565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SYBSyOX.exe

Path C:\Windows\System\SYBSyOX.exe
Size 5.9MB
SHA256 8926bc5af110ff91256949e9053aecd1a0d71b6ab07ae6af3ffa9285e1f5faf6
MD5 21710afdac6917727af7a0036f24dd84
SHA1 28b16d08dfa678946aa8fdc574b5a15810e4df68
SHA512 7eb61633b77265d73ca8acd415a218d6f2642e4e85653a5f82c03f813acf48d98b7a155900897a93a3b1165c13945f045946f4a3c7460ef32916551a941c8fd1
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:T+856utgpPF8u/79
TLSH
T12A565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TyiweHT.exe

Path C:\Windows\System\TyiweHT.exe
Size 5.9MB
SHA256 9c54133ba01797095b48cee99fc23a8c4c9c19953a7f3820b2bf787b3c07845c
MD5 186f2c8376e58c712843d47f83f970cb
SHA1 5bb812e2c305d091257fb0d7df4e26d3504dda69
SHA512 7e61b176478ede8af3073b8bd4b3947ddedb1de330c80376a02f0549a8ce2afa1b96f41d43d8908a996aca067cf08abdb8c7c69b7f9c3fcc03411fc8b040e41f
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:T+856utgpPF8u/7i
TLSH
T12C565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UOBsVNA.exe

Path C:\Windows\System\UOBsVNA.exe
Size 5.9MB
SHA256 9b2fd24cdd3a6c26ab0fe28201529736b8194d89ba84b8b11d4be07d50ddb53e
MD5 a122d783e7cf8112fb5e11fcd42c00c6
SHA1 042ef7ec7fde46c3a4d1db660c4e04a2a08921b7
SHA512 fb63403cbeef6c649c7ecdb66ea55f8cd4deed11019a6b37405d06a2361345a690b1077914edd986adc59a3a978bb0c73a9d21883bdeac5928f0061f0e8b6bf1
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:T+856utgpPF8u/7h
TLSH
T1C7565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UkAAiUT.exe

Path C:\Windows\System\UkAAiUT.exe
Size 5.9MB
SHA256 2da19a665d89038196a2790ad7b86cd249de986a74c1e664d3007cc119503ddc
MD5 589803b54f73f624fd18cc06db9791e2
SHA1 f9c99800da96fdea79cffab25a62afec839bf155
SHA512 60b7422261688e33defc66190df53d7b7b309d0db67333a889073ba8031f8c832bf51fc19d38a7740609eeb286c73160c0928320e5a493d96b77df4820a4734e
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:T+856utgpPF8u/7h
TLSH
T175565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XAJZcFO.exe

Path C:\Windows\System\XAJZcFO.exe
Size 5.9MB
SHA256 81bec9fa7b6138f86dd4798bf793fd8a5960e49cfd5789fa545bfd12d2c1d770
MD5 19c48abb70eebcdfa7c30eb1a48a0be7
SHA1 475ef98320da50335d55fa9a34e6e63b7025eed0
SHA512 18b2093ea95a21c36c3a4f48940760a5f0b5e0e666a9fda684bf5de84146d9f7f4ec7742b42ccba78a89e6b00086bc320ba531489486a808c24f6f357b1bb914
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:T+856utgpPF8u/7s
TLSH
T18C565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

beVmmsL.exe

Path C:\Windows\System\beVmmsL.exe
Size 5.9MB
SHA256 065c1dc509c13711e7c2e5e302770ca70c32aae272dc857b2fab2ac37b1975a9
MD5 e72311d4114940606b9d793cab7e967f
SHA1 0812a8cee3086ba32ad20bddafc311197ca66747
SHA512 0974b1719599f0a5e0463960fb6adfe864aa5576a40da9acc8e41358e3db308a841ebae71ff1d165344847dc6350c297b8fe278671c3d31fd141cdd597691c9b
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:T+856utgpPF8u/7C
TLSH
T1D7565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fiumnej.exe

Path C:\Windows\System\fiumnej.exe
Size 5.9MB
SHA256 0a48a0d51b59da9bcff7daae326d8c5930a91cbfc144e06eb993148a6f6ff02d
MD5 f57698fb4c78f82f55c31d5391f623ff
SHA1 9da6955eb18eadb6c278c7563407c2f812788d54
SHA512 ae8f03a571ce3377d52eab24f84cfdaa32e0d1da8aefd8c12aba73fa3855aa80cb2b6435b2bf59956c32101fbe698eb002280ff3589aea51f05414bf5463699e
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:T+856utgpPF8u/7Y
TLSH
T11B565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gxroyTb.exe

Path C:\Windows\System\gxroyTb.exe
Size 5.9MB
SHA256 08ccf29ee1295819757ececfe736201d6d16c7cb330236765e651cc15dcc9d95
MD5 5090b8ae104c382cfe235807036a7c7a
SHA1 29de95fcca15737c3c89d3df6b9baae42ac46589
SHA512 39a705f49f41cfc49d29c336f9d49fc071b2b8e33c147beabbe813c9416e12a33c3736f2fd72a1248b4627c8fe96cdf9ff71cb9dd0937547bb8421b80bccb307
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:T+856utgpPF8u/7A
TLSH
T11E565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jolNQcU.exe

Path C:\Windows\System\jolNQcU.exe
Size 5.9MB
SHA256 57a1fcaac06f3ff917b1d0cede2222d4e3e25f6692323143e206124492e25a00
MD5 0f4a2a6976f73027bfc5d5ac8c9cf576
SHA1 5e74f50c0370067cd4728ac828ce2eda2164d1e0
SHA512 ad50a649252cec84c79f4c95cbd683d8a19a28e43b6f50c3f418ef458005fea52cbdd2a42e37e21acbd52bac475c4d7a3bd92f8c56ba881c9aa30289ed2a7d26
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:T+856utgpPF8u/7S
TLSH
T133565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jtMAEGe.exe

Path C:\Windows\System\jtMAEGe.exe
Size 5.9MB
SHA256 c1eab8bad72b8e6c81321dadd83a1a5695ea23bfcbca980bebdba36912f4af93
MD5 0e618a655e4a6fcefc6ef6c045c779c0
SHA1 ced05e863dfecb033258f20344a2dad1f835fccf
SHA512 1ba0247150dbee6416c0e052ce1d9c00a19fcd53f21440aecb7e729e4260cf72527b81822e7a93808a9febd25a2e711d34aee8c6da5784253f73f76947922d0a
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:T+856utgpPF8u/7q
TLSH
T195565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lXWxOGd.exe

Path C:\Windows\System\lXWxOGd.exe
Size 5.9MB
SHA256 4f32b7edd560daa303833a3f67ef1cb716eb12efeb9706ed1230d71633b8023c
MD5 80deeac52df104712a64cb082ac82735
SHA1 72bf4a0c51ef1ac5caf80097ea89f16d860b637a
SHA512 5134f482545a50efcb123bf719eeafee44ce1441458bdd48d140540774ae29cade219697ab9ee3c62ebdc544fbb01d739ec7596fece3ed36b22e2fab83f13230
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:T+856utgpPF8u/7t
TLSH
T112565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

miAfmgp.exe

Path C:\Windows\System\miAfmgp.exe
Size 5.9MB
SHA256 78cdac06c3397e2e100b788dc9a967764909c8e6e3f555844969a121bff2a3c8
MD5 276dc06731d37d357212a7380ddba0ab
SHA1 08efe91eca225cb7767a26574d3be42c74243549
SHA512 88396c0dcf988c13baf38ca76cbae4717754585dc0492cb8d6c22a3dbec4e23d3ec47868b238cda618f119fce1cddf7876e7ee524dccad1d1d498b943516d168
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:T+856utgpPF8u/7A
TLSH
T117565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ogZXrCi.exe

Path C:\Windows\System\ogZXrCi.exe
Size 5.9MB
SHA256 3c10504a780208030d470c40b3df4ef3e4f7878afb3dd0640fa97e313fad3239
MD5 fb43ef36a82d431dc875bca6fee65a55
SHA1 602b0efc8bab73eed601cdf52902bbe1ac233157
SHA512 4685ab23d7b65ecf09ca297e43b593ecb007cda81308a56c0394387a4ae143e62d3151fd22ed44dbc3583452e6df054764cbb7eb161815ecec5e74b4fe55c04d
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:T+856utgpPF8u/7+
TLSH
T1D7565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qhUgKOj.exe

Path C:\Windows\System\qhUgKOj.exe
Size 5.9MB
SHA256 2a0d043740219544cb6afe83d85c412f41bfe82e0319e8dcb158c8b9ac27a4fc
MD5 820661bb6994c08f644c1182456809e1
SHA1 0aca55aa51b15d997797afcc7878e41c7d3b06b2
SHA512 7e68ed55bab376a33a97cbed72bd2264bfcc5990e0e0700703420aa551a619427d2937839f4618900dcbdb2db1a20fa0fa1365393be0a80d44ec358027b2ad28
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:T+856utgpPF8u/71
TLSH
T156565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xgnTbnV.exe

Path C:\Windows\System\xgnTbnV.exe
Size 5.9MB
SHA256 7abf8a4fffa9cd2ff03a0bf8ca0c445c8cf431e9f61812ed0b3bcd6020ba5453
MD5 851ca813aaa6f6ecdf068d159721d860
SHA1 93d74a33b773e7531b8adabd736bb1d988da7c36
SHA512 0bd32ab9d8ee2c742f43617f9b50e4271b58de7418e68188bc9577d1f6b9892e5959c3cc46fca04ad2377086bd0ae10fe249e70bb96c805db658414586fbae97
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:T+856utgpPF8u/7n
TLSH
T1A7565C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-165-0x00007FF732A60000-0x00007FF732DB4000-memory.dmp

Download

memory/236-102-0x00007FF732A60000-0x00007FF732DB4000-memory.dmp

Download

memory/236-143-0x00007FF732A60000-0x00007FF732DB4000-memory.dmp

Download

memory/760-142-0x00007FF72D370000-0x00007FF72D6C4000-memory.dmp

Download

memory/760-95-0x00007FF72D370000-0x00007FF72D6C4000-memory.dmp

Download

memory/760-163-0x00007FF72D370000-0x00007FF72D6C4000-memory.dmp

Download

memory/960-81-0x00007FF7853F0000-0x00007FF785744000-memory.dmp

Download

memory/960-140-0x00007FF7853F0000-0x00007FF785744000-memory.dmp

Download

memory/960-162-0x00007FF7853F0000-0x00007FF785744000-memory.dmp

Download

memory/996-168-0x00007FF659510000-0x00007FF659864000-memory.dmp

Download

memory/996-146-0x00007FF659510000-0x00007FF659864000-memory.dmp

Download

memory/996-123-0x00007FF659510000-0x00007FF659864000-memory.dmp

Download

memory/1152-148-0x00007FF6E7BA0000-0x00007FF6E7EF4000-memory.dmp

Download

memory/1152-167-0x00007FF6E7BA0000-0x00007FF6E7EF4000-memory.dmp

Download

memory/1152-136-0x00007FF6E7BA0000-0x00007FF6E7EF4000-memory.dmp

Download

memory/1340-54-0x00007FF7A7560000-0x00007FF7A78B4000-memory.dmp

Download

memory/1340-122-0x00007FF7A7560000-0x00007FF7A78B4000-memory.dmp

Download

memory/1340-158-0x00007FF7A7560000-0x00007FF7A78B4000-memory.dmp

Download

memory/1568-166-0x00007FF749960000-0x00007FF749CB4000-memory.dmp

Download

memory/1568-130-0x00007FF749960000-0x00007FF749CB4000-memory.dmp

Download

memory/1568-147-0x00007FF749960000-0x00007FF749CB4000-memory.dmp

Download

memory/1632-116-0x00007FF7828B0000-0x00007FF782C04000-memory.dmp

Download

memory/1632-169-0x00007FF7828B0000-0x00007FF782C04000-memory.dmp

Download

memory/1632-145-0x00007FF7828B0000-0x00007FF782C04000-memory.dmp

Download

memory/1728-20-0x00007FF7A03D0000-0x00007FF7A0724000-memory.dmp

Download

memory/1728-151-0x00007FF7A03D0000-0x00007FF7A0724000-memory.dmp

Download

memory/1728-80-0x00007FF7A03D0000-0x00007FF7A0724000-memory.dmp

Download

memory/1744-141-0x00007FF76D840000-0x00007FF76DB94000-memory.dmp

Download

memory/1744-161-0x00007FF76D840000-0x00007FF76DB94000-memory.dmp

Download

memory/1744-88-0x00007FF76D840000-0x00007FF76DB94000-memory.dmp

Download

memory/2000-87-0x00007FF713410000-0x00007FF713764000-memory.dmp

Download

memory/2000-24-0x00007FF713410000-0x00007FF713764000-memory.dmp

Download

memory/2000-152-0x00007FF713410000-0x00007FF713764000-memory.dmp

Download

memory/2064-68-0x00007FF64FC00000-0x00007FF64FF54000-memory.dmp

Download

memory/2064-135-0x00007FF64FC00000-0x00007FF64FF54000-memory.dmp

Download

memory/2064-160-0x00007FF64FC00000-0x00007FF64FF54000-memory.dmp

Download

memory/2084-1-0x000001BDD9CA0000-0x000001BDD9CB0000-memory.dmp

Download

memory/2084-60-0x00007FF71FB00000-0x00007FF71FE54000-memory.dmp

Download

memory/2084-0-0x00007FF71FB00000-0x00007FF71FE54000-memory.dmp

Download

memory/3000-8-0x00007FF7DDFE0000-0x00007FF7DE334000-memory.dmp

Download

memory/3000-67-0x00007FF7DDFE0000-0x00007FF7DE334000-memory.dmp

Download

memory/3000-149-0x00007FF7DDFE0000-0x00007FF7DE334000-memory.dmp

Download

memory/3044-42-0x00007FF7DA4B0000-0x00007FF7DA804000-memory.dmp

Download

memory/3044-108-0x00007FF7DA4B0000-0x00007FF7DA804000-memory.dmp

Download

memory/3044-155-0x00007FF7DA4B0000-0x00007FF7DA804000-memory.dmp

Download

memory/3540-74-0x00007FF669500000-0x00007FF669854000-memory.dmp

Download

memory/3540-139-0x00007FF669500000-0x00007FF669854000-memory.dmp

Download

memory/3540-159-0x00007FF669500000-0x00007FF669854000-memory.dmp

Download

memory/4716-101-0x00007FF7BBF20000-0x00007FF7BC274000-memory.dmp

Download

memory/4716-154-0x00007FF7BBF20000-0x00007FF7BC274000-memory.dmp

Download

memory/4716-36-0x00007FF7BBF20000-0x00007FF7BC274000-memory.dmp

Download

memory/4980-31-0x00007FF6EB830000-0x00007FF6EBB84000-memory.dmp

Download

memory/4980-153-0x00007FF6EB830000-0x00007FF6EBB84000-memory.dmp

Download

memory/4980-94-0x00007FF6EB830000-0x00007FF6EBB84000-memory.dmp

Download

memory/5040-156-0x00007FF696440000-0x00007FF696794000-memory.dmp

Download

memory/5040-48-0x00007FF696440000-0x00007FF696794000-memory.dmp

Download

memory/5040-115-0x00007FF696440000-0x00007FF696794000-memory.dmp

Download

memory/5740-157-0x00007FF6F04D0000-0x00007FF6F0824000-memory.dmp

Download

memory/5740-129-0x00007FF6F04D0000-0x00007FF6F0824000-memory.dmp

Download

memory/5740-61-0x00007FF6F04D0000-0x00007FF6F0824000-memory.dmp

Download

memory/5856-109-0x00007FF61EFA0000-0x00007FF61F2F4000-memory.dmp

Download

memory/5856-144-0x00007FF61EFA0000-0x00007FF61F2F4000-memory.dmp

Download

memory/5856-164-0x00007FF61EFA0000-0x00007FF61F2F4000-memory.dmp

Download

memory/6048-150-0x00007FF627130000-0x00007FF627484000-memory.dmp

Download

memory/6048-14-0x00007FF627130000-0x00007FF627484000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads