cobaltstrike | 67ad4d52eec99dbc9d6af5fe7c87958f927c82333083c2d2c01b1c4d62d5792c

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample261102-2vfrcaxvcw
SHA256 67ad4d52eec99dbc9d6af5fe7c87958f927c82333083c2d2c01b1c4d62d5792c
MD5 c8754326fad66658d283419071876585
SHA1 4825968c806f7bf9ab3f612db4d8196f3760cfaf
SHA512 2cc3e998862f7bc8badaa0856cf9e0367ce9b1c0b579cd8c7090f4e1e2a814e880dceea078386c78672087111e6fc9f9265ebd543bd65acfce2673b5eb26ff8e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUK:v+D56utgpPF8u/7K
TLSH
T194965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00070000000187c7-5.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5e0-9.dat	cobalt_reflective_dll
behavioral2/files/0x001c00000001c570-17.dat	cobalt_reflective_dll
behavioral2/files/0x0004000000000433-23.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e2-28.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e3-34.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e4-40.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e5-46.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e6-55.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e7-61.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e8-69.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5e9-76.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5eb-82.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ec-87.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ee-97.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5f0-108.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5f1-122.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5f2-127.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5f3-131.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ef-103.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ed-93.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x00070000000187c7-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5e0-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x001c00000001c570-17.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0004000000000433-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e2-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e3-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e4-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e5-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e6-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e7-61.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e8-69.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5e9-76.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5eb-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ec-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ee-97.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5f0-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5f1-122.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5f2-127.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5f3-131.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ef-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ed-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4128-0-0x00007FF6BD8A0000-0x00007FF6BDBF2000-memory.dmp	UPX
behavioral2/files/0x00070000000187c7-5.dat	UPX
behavioral2/memory/4320-7-0x00007FF6711B0000-0x00007FF671502000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5e0-9.dat	UPX
behavioral2/memory/4680-12-0x00007FF65BBE0000-0x00007FF65BF32000-memory.dmp	UPX
behavioral2/files/0x001c00000001c570-17.dat	UPX
behavioral2/memory/6032-18-0x00007FF776CC0000-0x00007FF777012000-memory.dmp	UPX
behavioral2/files/0x0004000000000433-23.dat	UPX
behavioral2/files/0x000c00000001c5e2-28.dat	UPX
behavioral2/files/0x000c00000001c5e3-34.dat	UPX
behavioral2/files/0x000c00000001c5e4-40.dat	UPX
behavioral2/memory/2664-43-0x00007FF7D9C20000-0x00007FF7D9F72000-memory.dmp	UPX
behavioral2/memory/4528-44-0x00007FF663560000-0x00007FF6638B2000-memory.dmp	UPX
behavioral2/memory/1988-30-0x00007FF7E0980000-0x00007FF7E0CD2000-memory.dmp	UPX
behavioral2/memory/4888-24-0x00007FF7D32E0000-0x00007FF7D3632000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5e5-46.dat	UPX
behavioral2/memory/4128-48-0x00007FF6BD8A0000-0x00007FF6BDBF2000-memory.dmp	UPX
behavioral2/memory/4456-51-0x00007FF696B70000-0x00007FF696EC2000-memory.dmp	UPX
behavioral2/memory/4320-52-0x00007FF6711B0000-0x00007FF671502000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5e6-55.dat	UPX
behavioral2/memory/2616-56-0x00007FF622BB0000-0x00007FF622F02000-memory.dmp	UPX
behavioral2/memory/4680-59-0x00007FF65BBE0000-0x00007FF65BF32000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5e7-61.dat	UPX
behavioral2/memory/2604-66-0x00007FF6458E0000-0x00007FF645C32000-memory.dmp	UPX
behavioral2/memory/6032-63-0x00007FF776CC0000-0x00007FF777012000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5e8-69.dat	UPX
behavioral2/files/0x000c00000001c5e9-76.dat	UPX
behavioral2/memory/4116-73-0x00007FF755A20000-0x00007FF755D72000-memory.dmp	UPX
behavioral2/memory/1988-79-0x00007FF7E0980000-0x00007FF7E0CD2000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5eb-82.dat	UPX
behavioral2/files/0x000c00000001c5ec-87.dat	UPX
behavioral2/files/0x000c00000001c5ee-97.dat	UPX
behavioral2/files/0x000c00000001c5f0-108.dat	UPX
behavioral2/memory/5952-117-0x00007FF69CF00000-0x00007FF69D252000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5f1-122.dat	UPX
behavioral2/files/0x000c00000001c5f2-127.dat	UPX
behavioral2/memory/3680-132-0x00007FF77E060000-0x00007FF77E3B2000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5f3-131.dat	UPX
behavioral2/memory/2336-126-0x00007FF77AE60000-0x00007FF77B1B2000-memory.dmp	UPX
behavioral2/memory/5732-121-0x00007FF6DF670000-0x00007FF6DF9C2000-memory.dmp	UPX
behavioral2/memory/5664-120-0x00007FF6415C0000-0x00007FF641912000-memory.dmp	UPX
behavioral2/memory/4780-119-0x00007FF6496D0000-0x00007FF649A22000-memory.dmp	UPX
behavioral2/memory/2948-118-0x00007FF714DB0000-0x00007FF715102000-memory.dmp	UPX
behavioral2/memory/4652-116-0x00007FF703520000-0x00007FF703872000-memory.dmp	UPX
behavioral2/memory/2876-115-0x00007FF748770000-0x00007FF748AC2000-memory.dmp	UPX
behavioral2/memory/4624-114-0x00007FF760640000-0x00007FF760992000-memory.dmp	UPX
behavioral2/memory/2664-113-0x00007FF7D9C20000-0x00007FF7D9F72000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5ef-103.dat	UPX
behavioral2/files/0x000c00000001c5ed-93.dat	UPX
behavioral2/memory/4888-72-0x00007FF7D32E0000-0x00007FF7D3632000-memory.dmp	UPX
behavioral2/memory/4456-135-0x00007FF696B70000-0x00007FF696EC2000-memory.dmp	UPX
behavioral2/memory/2616-136-0x00007FF622BB0000-0x00007FF622F02000-memory.dmp	UPX
behavioral2/memory/5664-137-0x00007FF6415C0000-0x00007FF641912000-memory.dmp	UPX
behavioral2/memory/4320-138-0x00007FF6711B0000-0x00007FF671502000-memory.dmp	UPX
behavioral2/memory/2336-139-0x00007FF77AE60000-0x00007FF77B1B2000-memory.dmp	UPX
behavioral2/memory/4680-140-0x00007FF65BBE0000-0x00007FF65BF32000-memory.dmp	UPX
behavioral2/memory/6032-141-0x00007FF776CC0000-0x00007FF777012000-memory.dmp	UPX
behavioral2/memory/4888-142-0x00007FF7D32E0000-0x00007FF7D3632000-memory.dmp	UPX
behavioral2/memory/3680-143-0x00007FF77E060000-0x00007FF77E3B2000-memory.dmp	UPX
behavioral2/memory/2664-146-0x00007FF7D9C20000-0x00007FF7D9F72000-memory.dmp	UPX
behavioral2/memory/4528-145-0x00007FF663560000-0x00007FF6638B2000-memory.dmp	UPX
behavioral2/memory/1988-144-0x00007FF7E0980000-0x00007FF7E0CD2000-memory.dmp	UPX
behavioral2/memory/4456-147-0x00007FF696B70000-0x00007FF696EC2000-memory.dmp	UPX
behavioral2/memory/2616-148-0x00007FF622BB0000-0x00007FF622F02000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4128-0-0x00007FF6BD8A0000-0x00007FF6BDBF2000-memory.dmp	xmrig
behavioral2/files/0x00070000000187c7-5.dat	xmrig
behavioral2/memory/4320-7-0x00007FF6711B0000-0x00007FF671502000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5e0-9.dat	xmrig
behavioral2/memory/4680-12-0x00007FF65BBE0000-0x00007FF65BF32000-memory.dmp	xmrig
behavioral2/files/0x001c00000001c570-17.dat	xmrig
behavioral2/memory/6032-18-0x00007FF776CC0000-0x00007FF777012000-memory.dmp	xmrig
behavioral2/files/0x0004000000000433-23.dat	xmrig
behavioral2/files/0x000c00000001c5e2-28.dat	xmrig
behavioral2/files/0x000c00000001c5e3-34.dat	xmrig
behavioral2/files/0x000c00000001c5e4-40.dat	xmrig
behavioral2/memory/2664-43-0x00007FF7D9C20000-0x00007FF7D9F72000-memory.dmp	xmrig
behavioral2/memory/4528-44-0x00007FF663560000-0x00007FF6638B2000-memory.dmp	xmrig
behavioral2/memory/1988-30-0x00007FF7E0980000-0x00007FF7E0CD2000-memory.dmp	xmrig
behavioral2/memory/4888-24-0x00007FF7D32E0000-0x00007FF7D3632000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5e5-46.dat	xmrig
behavioral2/memory/4128-48-0x00007FF6BD8A0000-0x00007FF6BDBF2000-memory.dmp	xmrig
behavioral2/memory/4456-51-0x00007FF696B70000-0x00007FF696EC2000-memory.dmp	xmrig
behavioral2/memory/4320-52-0x00007FF6711B0000-0x00007FF671502000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5e6-55.dat	xmrig
behavioral2/memory/2616-56-0x00007FF622BB0000-0x00007FF622F02000-memory.dmp	xmrig
behavioral2/memory/4680-59-0x00007FF65BBE0000-0x00007FF65BF32000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5e7-61.dat	xmrig
behavioral2/memory/2604-66-0x00007FF6458E0000-0x00007FF645C32000-memory.dmp	xmrig
behavioral2/memory/6032-63-0x00007FF776CC0000-0x00007FF777012000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5e8-69.dat	xmrig
behavioral2/files/0x000c00000001c5e9-76.dat	xmrig
behavioral2/memory/4116-73-0x00007FF755A20000-0x00007FF755D72000-memory.dmp	xmrig
behavioral2/memory/1988-79-0x00007FF7E0980000-0x00007FF7E0CD2000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5eb-82.dat	xmrig
behavioral2/files/0x000c00000001c5ec-87.dat	xmrig
behavioral2/files/0x000c00000001c5ee-97.dat	xmrig
behavioral2/files/0x000c00000001c5f0-108.dat	xmrig
behavioral2/memory/5952-117-0x00007FF69CF00000-0x00007FF69D252000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5f1-122.dat	xmrig
behavioral2/files/0x000c00000001c5f2-127.dat	xmrig
behavioral2/memory/3680-132-0x00007FF77E060000-0x00007FF77E3B2000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5f3-131.dat	xmrig
behavioral2/memory/2336-126-0x00007FF77AE60000-0x00007FF77B1B2000-memory.dmp	xmrig
behavioral2/memory/5732-121-0x00007FF6DF670000-0x00007FF6DF9C2000-memory.dmp	xmrig
behavioral2/memory/5664-120-0x00007FF6415C0000-0x00007FF641912000-memory.dmp	xmrig
behavioral2/memory/4780-119-0x00007FF6496D0000-0x00007FF649A22000-memory.dmp	xmrig
behavioral2/memory/2948-118-0x00007FF714DB0000-0x00007FF715102000-memory.dmp	xmrig
behavioral2/memory/4652-116-0x00007FF703520000-0x00007FF703872000-memory.dmp	xmrig
behavioral2/memory/2876-115-0x00007FF748770000-0x00007FF748AC2000-memory.dmp	xmrig
behavioral2/memory/4624-114-0x00007FF760640000-0x00007FF760992000-memory.dmp	xmrig
behavioral2/memory/2664-113-0x00007FF7D9C20000-0x00007FF7D9F72000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5ef-103.dat	xmrig
behavioral2/files/0x000c00000001c5ed-93.dat	xmrig
behavioral2/memory/4888-72-0x00007FF7D32E0000-0x00007FF7D3632000-memory.dmp	xmrig
behavioral2/memory/4456-135-0x00007FF696B70000-0x00007FF696EC2000-memory.dmp	xmrig
behavioral2/memory/2616-136-0x00007FF622BB0000-0x00007FF622F02000-memory.dmp	xmrig
behavioral2/memory/5664-137-0x00007FF6415C0000-0x00007FF641912000-memory.dmp	xmrig
behavioral2/memory/4320-138-0x00007FF6711B0000-0x00007FF671502000-memory.dmp	xmrig
behavioral2/memory/2336-139-0x00007FF77AE60000-0x00007FF77B1B2000-memory.dmp	xmrig
behavioral2/memory/4680-140-0x00007FF65BBE0000-0x00007FF65BF32000-memory.dmp	xmrig
behavioral2/memory/6032-141-0x00007FF776CC0000-0x00007FF777012000-memory.dmp	xmrig
behavioral2/memory/4888-142-0x00007FF7D32E0000-0x00007FF7D3632000-memory.dmp	xmrig
behavioral2/memory/3680-143-0x00007FF77E060000-0x00007FF77E3B2000-memory.dmp	xmrig
behavioral2/memory/2664-146-0x00007FF7D9C20000-0x00007FF7D9F72000-memory.dmp	xmrig
behavioral2/memory/4528-145-0x00007FF663560000-0x00007FF6638B2000-memory.dmp	xmrig
behavioral2/memory/1988-144-0x00007FF7E0980000-0x00007FF7E0CD2000-memory.dmp	xmrig
behavioral2/memory/4456-147-0x00007FF696B70000-0x00007FF696EC2000-memory.dmp	xmrig
behavioral2/memory/2616-148-0x00007FF622BB0000-0x00007FF622F02000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4320	HHfDRAA.exe
4680	WKUvQgy.exe
6032	dwdOIbd.exe
4888	KIzkQKk.exe
1988	ypSmUby.exe
2664	ZTmFCnj.exe
4528	ENpzhkW.exe
4456	sGOzOrO.exe
2616	uwqdbqW.exe
2604	InUAHir.exe
4116	gjbXTcJ.exe
4624	mtRYvPR.exe
5732	IFWPmLU.exe
2876	JyQmazL.exe
4652	sujQfyA.exe
5952	nQqRWMV.exe
2948	oWWJGcu.exe
4780	jsHnRHF.exe
5664	cdtumqh.exe
2336	tIkUYJw.exe
3680	hMJmHEI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4128-0-0x00007FF6BD8A0000-0x00007FF6BDBF2000-memory.dmp	upx
behavioral2/files/0x00070000000187c7-5.dat	upx
behavioral2/memory/4320-7-0x00007FF6711B0000-0x00007FF671502000-memory.dmp	upx
behavioral2/files/0x000d00000001c5e0-9.dat	upx
behavioral2/memory/4680-12-0x00007FF65BBE0000-0x00007FF65BF32000-memory.dmp	upx
behavioral2/files/0x001c00000001c570-17.dat	upx
behavioral2/memory/6032-18-0x00007FF776CC0000-0x00007FF777012000-memory.dmp	upx
behavioral2/files/0x0004000000000433-23.dat	upx
behavioral2/files/0x000c00000001c5e2-28.dat	upx
behavioral2/files/0x000c00000001c5e3-34.dat	upx
behavioral2/files/0x000c00000001c5e4-40.dat	upx
behavioral2/memory/2664-43-0x00007FF7D9C20000-0x00007FF7D9F72000-memory.dmp	upx
behavioral2/memory/4528-44-0x00007FF663560000-0x00007FF6638B2000-memory.dmp	upx
behavioral2/memory/1988-30-0x00007FF7E0980000-0x00007FF7E0CD2000-memory.dmp	upx
behavioral2/memory/4888-24-0x00007FF7D32E0000-0x00007FF7D3632000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e5-46.dat	upx
behavioral2/memory/4128-48-0x00007FF6BD8A0000-0x00007FF6BDBF2000-memory.dmp	upx
behavioral2/memory/4456-51-0x00007FF696B70000-0x00007FF696EC2000-memory.dmp	upx
behavioral2/memory/4320-52-0x00007FF6711B0000-0x00007FF671502000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e6-55.dat	upx
behavioral2/memory/2616-56-0x00007FF622BB0000-0x00007FF622F02000-memory.dmp	upx
behavioral2/memory/4680-59-0x00007FF65BBE0000-0x00007FF65BF32000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e7-61.dat	upx
behavioral2/memory/2604-66-0x00007FF6458E0000-0x00007FF645C32000-memory.dmp	upx
behavioral2/memory/6032-63-0x00007FF776CC0000-0x00007FF777012000-memory.dmp	upx
behavioral2/files/0x000c00000001c5e8-69.dat	upx
behavioral2/files/0x000c00000001c5e9-76.dat	upx
behavioral2/memory/4116-73-0x00007FF755A20000-0x00007FF755D72000-memory.dmp	upx
behavioral2/memory/1988-79-0x00007FF7E0980000-0x00007FF7E0CD2000-memory.dmp	upx
behavioral2/files/0x000c00000001c5eb-82.dat	upx
behavioral2/files/0x000c00000001c5ec-87.dat	upx
behavioral2/files/0x000c00000001c5ee-97.dat	upx
behavioral2/files/0x000c00000001c5f0-108.dat	upx
behavioral2/memory/5952-117-0x00007FF69CF00000-0x00007FF69D252000-memory.dmp	upx
behavioral2/files/0x000c00000001c5f1-122.dat	upx
behavioral2/files/0x000c00000001c5f2-127.dat	upx
behavioral2/memory/3680-132-0x00007FF77E060000-0x00007FF77E3B2000-memory.dmp	upx
behavioral2/files/0x000c00000001c5f3-131.dat	upx
behavioral2/memory/2336-126-0x00007FF77AE60000-0x00007FF77B1B2000-memory.dmp	upx
behavioral2/memory/5732-121-0x00007FF6DF670000-0x00007FF6DF9C2000-memory.dmp	upx
behavioral2/memory/5664-120-0x00007FF6415C0000-0x00007FF641912000-memory.dmp	upx
behavioral2/memory/4780-119-0x00007FF6496D0000-0x00007FF649A22000-memory.dmp	upx
behavioral2/memory/2948-118-0x00007FF714DB0000-0x00007FF715102000-memory.dmp	upx
behavioral2/memory/4652-116-0x00007FF703520000-0x00007FF703872000-memory.dmp	upx
behavioral2/memory/2876-115-0x00007FF748770000-0x00007FF748AC2000-memory.dmp	upx
behavioral2/memory/4624-114-0x00007FF760640000-0x00007FF760992000-memory.dmp	upx
behavioral2/memory/2664-113-0x00007FF7D9C20000-0x00007FF7D9F72000-memory.dmp	upx
behavioral2/files/0x000c00000001c5ef-103.dat	upx
behavioral2/files/0x000c00000001c5ed-93.dat	upx
behavioral2/memory/4888-72-0x00007FF7D32E0000-0x00007FF7D3632000-memory.dmp	upx
behavioral2/memory/4456-135-0x00007FF696B70000-0x00007FF696EC2000-memory.dmp	upx
behavioral2/memory/2616-136-0x00007FF622BB0000-0x00007FF622F02000-memory.dmp	upx
behavioral2/memory/5664-137-0x00007FF6415C0000-0x00007FF641912000-memory.dmp	upx
behavioral2/memory/4320-138-0x00007FF6711B0000-0x00007FF671502000-memory.dmp	upx
behavioral2/memory/2336-139-0x00007FF77AE60000-0x00007FF77B1B2000-memory.dmp	upx
behavioral2/memory/4680-140-0x00007FF65BBE0000-0x00007FF65BF32000-memory.dmp	upx
behavioral2/memory/6032-141-0x00007FF776CC0000-0x00007FF777012000-memory.dmp	upx
behavioral2/memory/4888-142-0x00007FF7D32E0000-0x00007FF7D3632000-memory.dmp	upx
behavioral2/memory/3680-143-0x00007FF77E060000-0x00007FF77E3B2000-memory.dmp	upx
behavioral2/memory/2664-146-0x00007FF7D9C20000-0x00007FF7D9F72000-memory.dmp	upx
behavioral2/memory/4528-145-0x00007FF663560000-0x00007FF6638B2000-memory.dmp	upx
behavioral2/memory/1988-144-0x00007FF7E0980000-0x00007FF7E0CD2000-memory.dmp	upx
behavioral2/memory/4456-147-0x00007FF696B70000-0x00007FF696EC2000-memory.dmp	upx
behavioral2/memory/2616-148-0x00007FF622BB0000-0x00007FF622F02000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\sGOzOrO.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\gjbXTcJ.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\nQqRWMV.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\HHfDRAA.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\KIzkQKk.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\JyQmazL.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\jsHnRHF.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\hMJmHEI.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\WKUvQgy.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ZTmFCnj.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\InUAHir.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\sujQfyA.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\uwqdbqW.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\IFWPmLU.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\oWWJGcu.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\cdtumqh.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\tIkUYJw.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\mtRYvPR.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\dwdOIbd.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ypSmUby.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ENpzhkW.exe	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4320	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	89
PID 4128 wrote to memory of 4680	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 4128 wrote to memory of 6032	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 4128 wrote to memory of 4888	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 4128 wrote to memory of 1988	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 4128 wrote to memory of 2664	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 4128 wrote to memory of 4528	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 4128 wrote to memory of 4456	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 4128 wrote to memory of 2616	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 4128 wrote to memory of 2604	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 4128 wrote to memory of 4116	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 4128 wrote to memory of 4624	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 4128 wrote to memory of 5732	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 4128 wrote to memory of 2876	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 4128 wrote to memory of 4652	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 4128 wrote to memory of 5952	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 4128 wrote to memory of 2948	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 4128 wrote to memory of 4780	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 4128 wrote to memory of 5664	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 4128 wrote to memory of 2336	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 4128 wrote to memory of 3680	4128	2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_c8754326fad66658d283419071876585_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\System\HHfDRAA.exe
  C:\Windows\System\HHfDRAA.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\WKUvQgy.exe
  C:\Windows\System\WKUvQgy.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\dwdOIbd.exe
  C:\Windows\System\dwdOIbd.exe
  2⤵
  - Executes dropped EXE
  PID:6032
- C:\Windows\System\KIzkQKk.exe
  C:\Windows\System\KIzkQKk.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\ypSmUby.exe
  C:\Windows\System\ypSmUby.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\ZTmFCnj.exe
  C:\Windows\System\ZTmFCnj.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\ENpzhkW.exe
  C:\Windows\System\ENpzhkW.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\sGOzOrO.exe
  C:\Windows\System\sGOzOrO.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\uwqdbqW.exe
  C:\Windows\System\uwqdbqW.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\InUAHir.exe
  C:\Windows\System\InUAHir.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\gjbXTcJ.exe
  C:\Windows\System\gjbXTcJ.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\mtRYvPR.exe
  C:\Windows\System\mtRYvPR.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\IFWPmLU.exe
  C:\Windows\System\IFWPmLU.exe
  2⤵
  - Executes dropped EXE
  PID:5732
- C:\Windows\System\JyQmazL.exe
  C:\Windows\System\JyQmazL.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\sujQfyA.exe
  C:\Windows\System\sujQfyA.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\nQqRWMV.exe
  C:\Windows\System\nQqRWMV.exe
  2⤵
  - Executes dropped EXE
  PID:5952
- C:\Windows\System\oWWJGcu.exe
  C:\Windows\System\oWWJGcu.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\jsHnRHF.exe
  C:\Windows\System\jsHnRHF.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\cdtumqh.exe
  C:\Windows\System\cdtumqh.exe
  2⤵
  - Executes dropped EXE
  PID:5664
- C:\Windows\System\tIkUYJw.exe
  C:\Windows\System\tIkUYJw.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\hMJmHEI.exe
  C:\Windows\System\hMJmHEI.exe
  2⤵
  - Executes dropped EXE
  PID:3680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ENpzhkW.exe

Path C:\Windows\System\ENpzhkW.exe
Size 8.3MB
SHA256 dee7d8152b2e86bb31524a82c73a1c50b78ef031bfd099ee72301f0eece5e797
MD5 fedd95d949d1fc8f068ab25c8f21cb29
SHA1 4a6b56692d320456c6f5186400f2d9cd74c86932
SHA512 9f4950d4988832191cda95e7bfa1b0e6e0d12139facd13bcb47d5c6250be27f4873917071d15d8d96baefe6bbc38219846aea73500b9b038a5dd6f370ba9038b
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUN:v+D56utgpPF8u/7N
TLSH
T166965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HHfDRAA.exe

Path C:\Windows\System\HHfDRAA.exe
Size 8.3MB
SHA256 3560ee9b64cc8dfad4ab36c83a3f7082733e7bae387ad8a96d15d2cc1f881ef2
MD5 5c823e7d374658738c80562453c1b676
SHA1 31db3473978293a255a53cd70913fdfbd9f505b7
SHA512 4fb4d05d662631c0010b13c64580ace130f61b28a7d6d2fd330940b7e51bfab3d23baa0f51fa3431ed84d5708906734f15f14b7cd8330fcecf574f1c2d304d91
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUt:v+D56utgpPF8u/7t
TLSH
T131965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IFWPmLU.exe

Path C:\Windows\System\IFWPmLU.exe
Size 8.3MB
SHA256 25205bd11757f4fa3127e11c884a1fed54bc1bfc81971269fa97250adfb3b6c7
MD5 e6ea5996409ced803ec9e9d83127108a
SHA1 55bf7eac82abb1934736c0cc93a1d52f45b01f2f
SHA512 38fff1d8e4c08ad94455583935dd2593cf86c0f088b56e746c573e2fd1341f47b6db34078e8318b22e35be540137b485941b5720df5009885bd487d10832197d
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUU:v+D56utgpPF8u/7U
TLSH
T133965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InUAHir.exe

Path C:\Windows\System\InUAHir.exe
Size 8.3MB
SHA256 897c57144b76c6a1be9a89ca54f07ed25aea4e7bf7446614c8f54782cbad6472
MD5 39b831c95f6fd64508fe33ff81cc847a
SHA1 d1d5f295ead4372b2b5f7cffaae6bc7eca70ca55
SHA512 8fbdaee66bc745f17cd6df4e75022ebc7a37703b39240f45c433ef283cfa8986405b82842c7766498ff74136c0dd21f768c81ee30d97105fcbff84cfd0133428
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU8:v+D56utgpPF8u/78
TLSH
T1AD965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JyQmazL.exe

Path C:\Windows\System\JyQmazL.exe
Size 8.3MB
SHA256 2966f9c5717dc40ff08989f15883347fd75b55a728aa6ab9b3c3026a23f5cc6c
MD5 f96208440a0b2178e3dba56ff2cdbc8c
SHA1 c62c888198872640c4d29ca2c072b47fb5d2811b
SHA512 5f18bf77f213d8e77eff93bc73f679f3738eca2753579b0b0534e53c4cedaf790d6cb78375ed572e970102eb3d007b8ebc2cfc74772ae7ced86b58b5ca2b7dae
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUJ:v+D56utgpPF8u/7J
TLSH
T137965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KIzkQKk.exe

Path C:\Windows\System\KIzkQKk.exe
Size 8.3MB
SHA256 f799b5a2b05f6d7c9934fdc972c195bb1f8a33c4474eed80f8477aec8f693298
MD5 52f300789f29c7c58fa6b5033c48db4b
SHA1 cb8fbb7c07bb34a196d0ec03905c66f2bf9f6259
SHA512 f3987820850c9080f9e0ead6724123d7f9590118075214b909b3f48ad19166475494d0985e392938d953590163ba196ebccb1e029d73d07271843b1f043ae38c
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUR:v+D56utgpPF8u/7R
TLSH
T10A965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WKUvQgy.exe

Path C:\Windows\System\WKUvQgy.exe
Size 8.3MB
SHA256 1d3409de474052e4d29e9edbcdd1f2e8f4ccf9fb503471ca6f4a67219aaf5868
MD5 f3604b929ed0e2af79865cadf47314cb
SHA1 feabecd771bf09f864bb111472f074b9078e5370
SHA512 143c4fd8fa69e6b08e6ee311ac670c7cee45f0534be356e3a7746a2529a1100448eaa7bd8f10ad6910012a1d1e61d36cdf54fcea7267213c99f37b0e1a596248
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUd:v+D56utgpPF8u/7d
TLSH
T1C8965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZTmFCnj.exe

Path C:\Windows\System\ZTmFCnj.exe
Size 8.3MB
SHA256 52222fa55117dc595a291ea77a20b6157a916551d03112cf92c52f6ace3db56c
MD5 3a8cce071f63f212c357cbd15e26ee9c
SHA1 a8f80245a45fd569e2c6fbe5f0d54544011ff6c0
SHA512 4664959ccbceea74f3e306ce10497cc760c5904b7aa66bd3ce12061df532f1808bc69fc137f3a428e372acb1df508fbd7f6bd87d2726887ee9de3c585078dca0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUB:v+D56utgpPF8u/7B
TLSH
T1B6965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdtumqh.exe

Path C:\Windows\System\cdtumqh.exe
Size 8.3MB
SHA256 d5ac870036beb5521771f982f1ad19ce3da96a0d7abec8740dc2577e1f313a4a
MD5 f53a411584e2393e12411470a52f9e91
SHA1 34db695185506107134ebe79a92a000294e18467
SHA512 753a5adc5a06f93368639d3b5c95a44bd019f281c1e956f4ce5fb48f6450931c58f88abf8642cea12707cd98436b11904979b39c745c82ac01a8c496658e7b3e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU9:v+D56utgpPF8u/79
TLSH
T1FB965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dwdOIbd.exe

Path C:\Windows\System\dwdOIbd.exe
Size 8.3MB
SHA256 0caaf9ef4e94b5c005ce8c53a66dc2f734cce5783d942c04436cfd6ede8fa718
MD5 85a0c2b636f0cee274a15ee81829b95f
SHA1 2aae8a7fa24dd3d65276c8122d64f0b2956dd23d
SHA512 ca2fc25c2fbabda6be3d1d709ce5df1e8ab15e830e6a4c4d86ed990df360fa1e948479417d9c01898747243ab8ad0043bb76785cc7badb447657f9a0519d71c6
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUm:v+D56utgpPF8u/7m
TLSH
T1E8965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gjbXTcJ.exe

Path C:\Windows\System\gjbXTcJ.exe
Size 8.3MB
SHA256 a911e8e143051ab1201efe1494433bf4a572b97bc6df0b54d2396921cb14df83
MD5 c5f02c0fb171b33ca8db6d5f2a085b45
SHA1 2751faa2886b9fbcffcdc72c6204dee58fe27231
SHA512 e741fa51355a57f21956dca0928892c2b2bbb36d3b8dfed4da27e84458506df8f84434f6d164a97053a8347750953e5e065fa3fbc7133a6a228266bdd163df09
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU9:v+D56utgpPF8u/79
TLSH
T1F9965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hMJmHEI.exe

Path C:\Windows\System\hMJmHEI.exe
Size 8.3MB
SHA256 26a15ae5a2e917f658483c20747ceb88924d1ddbfc6084a9b2c400f1708ec005
MD5 8560a984b6044626d3ec3151e864685d
SHA1 d066fc076d4a51cc36fb4b16bd26b261aa87919d
SHA512 0324e1eba9912d1a5cec0e11729611992b4cd0668ce4ab9b80e20bc1d6f6e4a735ffad0b3fe9f8c30f1cf2f90eae3915adbc53fc23f3815070f45b7ce288ac35
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUu:v+D56utgpPF8u/7u
TLSH
T1DF965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsHnRHF.exe

Path C:\Windows\System\jsHnRHF.exe
Size 8.3MB
SHA256 42ad7c50860b458a8461e8b6f31950be00927bc974bf327df1ab51fe673d946b
MD5 dc0c8f68482cf5b252185134569cb2f9
SHA1 a13cbf0c91b373d84969c2313f600c0cd639698e
SHA512 769b3bdaf77cad7bb64f70f9a9a9d718f5c1aa0356fcb29614293c5a0bdc7d1a5987d9831b21b02f6987de996822a46e37f6e6ab408d1738c7690141f9a834d6
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUY:v+D56utgpPF8u/7Y
TLSH
T17C965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mtRYvPR.exe

Path C:\Windows\System\mtRYvPR.exe
Size 8.3MB
SHA256 db84866241be4cb7f0e244c792df84b89625d7f57458c84dbb67b35e0b43234e
MD5 bb0437738b9be716bcf253959a9c44b4
SHA1 37c33bd110dd71ee98c84cb07d87d8eea8133006
SHA512 8bfcbe96485de866c5f5ad99c4cf3bf1ec1615c7860b3b4919be0e4ed269b47d84a6a96ffef0f807749e6f5846ea0429d6bc0c628877ba7593e51641b460c4e4
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUH:v+D56utgpPF8u/7H
TLSH
T146965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nQqRWMV.exe

Path C:\Windows\System\nQqRWMV.exe
Size 8.3MB
SHA256 1de252172d039c2ea387868c3ef23f75d3b845c55d09b27705bfc445e349038a
MD5 c3392055832edc677a30dca0fd745d17
SHA1 b9de6744098854d674a3e9527dd68318c2b676af
SHA512 8a6e8ebeb046b3c9e3a4b8dcd307100ed7be9cc50f5d300969349c74a728eafc0a00cc461acbffb11c0d81459e2960e29f896bb17ca01b9504eea7130dd9ddb9
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUa:v+D56utgpPF8u/7a
TLSH
T100965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oWWJGcu.exe

Path C:\Windows\System\oWWJGcu.exe
Size 8.3MB
SHA256 9626ce050467f46ef5463a4763fa70f25a2f362c9e2301d529977e87354a3216
MD5 490616eeda463bbda26da6622ef6210d
SHA1 004082b8eb40f3614ee05890d4813b804fd00260
SHA512 4307683e9d10efd4b2e17821eda9b2e2a7d78fa25af6d58b52f9dc703fea26c1a3cf7390f66e128a1d7add2985c6883e3209ede5e3fae43f97519d758b759d76
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUH:v+D56utgpPF8u/7H
TLSH
T169965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sGOzOrO.exe

Path C:\Windows\System\sGOzOrO.exe
Size 8.3MB
SHA256 d38ead00924b376f7b3812b7d38e3f1bf1e2551d15365e8cc5544d89b22aa3ac
MD5 c75ffada08a6d3e3ff5548b3a8e2c83d
SHA1 c70bea0cd6f116eba5c62043dbc68e33e2c90c17
SHA512 fd2e41942f9f8635b82b85a36c3c1f893b3031d5d9e234bde26c1942ad45b0cc09b36c800ce8d90f6bed2d995af77a95458bb9c0054005024ff3b4299ef25749
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU+:v+D56utgpPF8u/7+
TLSH
T1C7965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sujQfyA.exe

Path C:\Windows\System\sujQfyA.exe
Size 8.3MB
SHA256 0a5c2094ac7b7720100416d64b01fe0bcd5975e92534cddee1da0be1c0a7dac6
MD5 684054fd1905a697f2bc80c6bbbdbf02
SHA1 f4c8cec6a4f2229238e08fa51e9401095855a3af
SHA512 ed8764aaf9ad62b7194fb1a948f9dfa3685a00799cf6d644d30330fb0b33b10a66000efbcb85f7f98c544c0a43d396b6085bc1f6c2aadd6345fec5f254b1fa1d
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUO:v+D56utgpPF8u/7O
TLSH
T1EF965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tIkUYJw.exe

Path C:\Windows\System\tIkUYJw.exe
Size 8.3MB
SHA256 996258b4f7d40d07f109c7039cfefbcd8fdd2107339ad1c4b902b40ebfcf0c22
MD5 e5aaf2e6b6f2c89b80727d3d99c29264
SHA1 36c777b31ce8e8b38ee967221b3bda28b03965eb
SHA512 f5a2de56e04a9113744c9fb484f3c9e27ddb458c4529e04665b2977762ad21286e7fe34645700fdd788463859e129665b2be300b9b60576244c192a5ef64cbee
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUu:v+D56utgpPF8u/7u
TLSH
T18F965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uwqdbqW.exe

Path C:\Windows\System\uwqdbqW.exe
Size 8.3MB
SHA256 6f14853411b90dbab42e75baf5ccb8e647df9f4949d1c01d137ea9b1728c3564
MD5 77646a5a981d9c3a063b3fff84eb95f4
SHA1 3c5cfb066251aac0882b2283accd2eab4085be3f
SHA512 91d29461c6241149ca6d2fc3f6bdaacd4d85f62444d5a478dbe9629618acc6b713d2aca27e3f30a8d4cf2a5176a72b5511aa3a1ccddce3501dd4178eceaee1db
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUA:v+D56utgpPF8u/7A
TLSH
T195965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ypSmUby.exe

Path C:\Windows\System\ypSmUby.exe
Size 8.3MB
SHA256 665acb92ba98e53955d234df0e3ef07605a6426af114d1c94a15c195aac235e8
MD5 50dd8713e780a5ebcc320d0f5f66781b
SHA1 12e875fd63d73530420a4fb3c360872e31c29aaa
SHA512 6f514ef7ad9fd280bf3ef7c3fe0bb9430f7a43d79cabf8be6ab840bbc166ccaa91eced2459efb860d4b8f6903feeea4fabe5f0438c145fc609c62b87663c3d66
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUD:v+D56utgpPF8u/7D
TLSH
T100965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1988-144-0x00007FF7E0980000-0x00007FF7E0CD2000-memory.dmp

Download

memory/1988-79-0x00007FF7E0980000-0x00007FF7E0CD2000-memory.dmp

Download

memory/1988-30-0x00007FF7E0980000-0x00007FF7E0CD2000-memory.dmp

Download

memory/2336-126-0x00007FF77AE60000-0x00007FF77B1B2000-memory.dmp

Download

memory/2336-159-0x00007FF77AE60000-0x00007FF77B1B2000-memory.dmp

Download

memory/2336-139-0x00007FF77AE60000-0x00007FF77B1B2000-memory.dmp

Download

memory/2604-66-0x00007FF6458E0000-0x00007FF645C32000-memory.dmp

Download

memory/2604-149-0x00007FF6458E0000-0x00007FF645C32000-memory.dmp

Download

memory/2616-56-0x00007FF622BB0000-0x00007FF622F02000-memory.dmp

Download

memory/2616-148-0x00007FF622BB0000-0x00007FF622F02000-memory.dmp

Download

memory/2616-136-0x00007FF622BB0000-0x00007FF622F02000-memory.dmp

Download

memory/2664-146-0x00007FF7D9C20000-0x00007FF7D9F72000-memory.dmp

Download

memory/2664-43-0x00007FF7D9C20000-0x00007FF7D9F72000-memory.dmp

Download

memory/2664-113-0x00007FF7D9C20000-0x00007FF7D9F72000-memory.dmp

Download

memory/2876-154-0x00007FF748770000-0x00007FF748AC2000-memory.dmp

Download

memory/2876-115-0x00007FF748770000-0x00007FF748AC2000-memory.dmp

Download

memory/2948-156-0x00007FF714DB0000-0x00007FF715102000-memory.dmp

Download

memory/2948-118-0x00007FF714DB0000-0x00007FF715102000-memory.dmp

Download

memory/3680-158-0x00007FF77E060000-0x00007FF77E3B2000-memory.dmp

Download

memory/3680-143-0x00007FF77E060000-0x00007FF77E3B2000-memory.dmp

Download

memory/3680-132-0x00007FF77E060000-0x00007FF77E3B2000-memory.dmp

Download

memory/4116-73-0x00007FF755A20000-0x00007FF755D72000-memory.dmp

Download

memory/4116-150-0x00007FF755A20000-0x00007FF755D72000-memory.dmp

Download

memory/4128-0-0x00007FF6BD8A0000-0x00007FF6BDBF2000-memory.dmp

Download

memory/4128-1-0x000002816BF20000-0x000002816BF30000-memory.dmp

Download

memory/4128-48-0x00007FF6BD8A0000-0x00007FF6BDBF2000-memory.dmp

Download

memory/4320-52-0x00007FF6711B0000-0x00007FF671502000-memory.dmp

Download

memory/4320-7-0x00007FF6711B0000-0x00007FF671502000-memory.dmp

Download

memory/4320-138-0x00007FF6711B0000-0x00007FF671502000-memory.dmp

Download

memory/4456-51-0x00007FF696B70000-0x00007FF696EC2000-memory.dmp

Download

memory/4456-135-0x00007FF696B70000-0x00007FF696EC2000-memory.dmp

Download

memory/4456-147-0x00007FF696B70000-0x00007FF696EC2000-memory.dmp

Download

memory/4528-44-0x00007FF663560000-0x00007FF6638B2000-memory.dmp

Download

memory/4528-145-0x00007FF663560000-0x00007FF6638B2000-memory.dmp

Download

memory/4624-114-0x00007FF760640000-0x00007FF760992000-memory.dmp

Download

memory/4624-151-0x00007FF760640000-0x00007FF760992000-memory.dmp

Download

memory/4652-153-0x00007FF703520000-0x00007FF703872000-memory.dmp

Download

memory/4652-116-0x00007FF703520000-0x00007FF703872000-memory.dmp

Download

memory/4680-140-0x00007FF65BBE0000-0x00007FF65BF32000-memory.dmp

Download

memory/4680-12-0x00007FF65BBE0000-0x00007FF65BF32000-memory.dmp

Download

memory/4680-59-0x00007FF65BBE0000-0x00007FF65BF32000-memory.dmp

Download

memory/4780-157-0x00007FF6496D0000-0x00007FF649A22000-memory.dmp

Download

memory/4780-119-0x00007FF6496D0000-0x00007FF649A22000-memory.dmp

Download

memory/4888-142-0x00007FF7D32E0000-0x00007FF7D3632000-memory.dmp

Download

memory/4888-72-0x00007FF7D32E0000-0x00007FF7D3632000-memory.dmp

Download

memory/4888-24-0x00007FF7D32E0000-0x00007FF7D3632000-memory.dmp

Download

memory/5664-120-0x00007FF6415C0000-0x00007FF641912000-memory.dmp

Download

memory/5664-137-0x00007FF6415C0000-0x00007FF641912000-memory.dmp

Download

memory/5664-160-0x00007FF6415C0000-0x00007FF641912000-memory.dmp

Download

memory/5732-152-0x00007FF6DF670000-0x00007FF6DF9C2000-memory.dmp

Download

memory/5732-121-0x00007FF6DF670000-0x00007FF6DF9C2000-memory.dmp

Download

memory/5952-117-0x00007FF69CF00000-0x00007FF69D252000-memory.dmp

Download

memory/5952-155-0x00007FF69CF00000-0x00007FF69D252000-memory.dmp

Download

memory/6032-63-0x00007FF776CC0000-0x00007FF777012000-memory.dmp

Download

memory/6032-18-0x00007FF776CC0000-0x00007FF777012000-memory.dmp

Download

memory/6032-141-0x00007FF776CC0000-0x00007FF777012000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads