cobaltstrike | 493cc324c149dfd7f3781fe51cb460369e715fbbec046388bfbcb2fdaf055e4c

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample261102-c832csgy3l
SHA256 493cc324c149dfd7f3781fe51cb460369e715fbbec046388bfbcb2fdaf055e4c
MD5 f6e967d997685c6ddffd27313e619428
SHA1 7950a6f031ff4538b80acce54aacf11614ea8fe5
SHA512 61a65cd74e63b18d9fae7dabd41c8839b87b3b5b130cb3073e2fc4f51b641f061bae61ace6cfa1caa227f03fe0ebb20a6abd208f9c42650cb77640faf28193a6
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUp:v+D56utgpPF8u/7p
TLSH
T1C5965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000600000001b85a-5.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c5b8-11.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5bd-17.dat	cobalt_reflective_dll
behavioral2/files/0x00030000000170c6-25.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5be-30.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5bf-37.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5c0-41.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5c2-47.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5c3-56.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5c4-63.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5c5-69.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5c6-75.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5c7-82.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5c8-89.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5c9-96.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5cc-114.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5cd-124.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5cf-134.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ce-131.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5cb-110.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000001c5ca-103.dat	cobalt_reflective_dll

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000600000001b85a-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c5b8-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5bd-17.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00030000000170c6-25.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5be-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5bf-37.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5c0-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5c2-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5c3-56.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5c4-63.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5c5-69.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5c6-75.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5c7-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5c8-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5c9-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5cc-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5cd-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5cf-134.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ce-131.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5cb-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000001c5ca-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4076-0-0x00007FF6AE920000-0x00007FF6AEC72000-memory.dmp	UPX
behavioral2/files/0x000600000001b85a-5.dat	UPX
behavioral2/memory/1132-8-0x00007FF70D2D0000-0x00007FF70D622000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5b8-11.dat	UPX
behavioral2/memory/3760-14-0x00007FF643790000-0x00007FF643AE2000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5bd-17.dat	UPX
behavioral2/memory/5780-18-0x00007FF7E47F0000-0x00007FF7E4B42000-memory.dmp	UPX
behavioral2/memory/5988-24-0x00007FF76A960000-0x00007FF76ACB2000-memory.dmp	UPX
behavioral2/files/0x00030000000170c6-25.dat	UPX
behavioral2/files/0x000c00000001c5be-30.dat	UPX
behavioral2/memory/2576-31-0x00007FF710810000-0x00007FF710B62000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5bf-37.dat	UPX
behavioral2/files/0x000c00000001c5c0-41.dat	UPX
behavioral2/files/0x000c00000001c5c2-47.dat	UPX
behavioral2/memory/3392-55-0x00007FF7C0030000-0x00007FF7C0382000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5c3-56.dat	UPX
behavioral2/files/0x000c00000001c5c4-63.dat	UPX
behavioral2/files/0x000c00000001c5c5-69.dat	UPX
behavioral2/files/0x000c00000001c5c6-75.dat	UPX
behavioral2/files/0x000c00000001c5c7-82.dat	UPX
behavioral2/files/0x000c00000001c5c8-89.dat	UPX
behavioral2/files/0x000c00000001c5c9-96.dat	UPX
behavioral2/files/0x000c00000001c5cc-114.dat	UPX
behavioral2/files/0x000c00000001c5cd-124.dat	UPX
behavioral2/files/0x000c00000001c5cf-134.dat	UPX
behavioral2/memory/4568-136-0x00007FF789C70000-0x00007FF789FC2000-memory.dmp	UPX
behavioral2/memory/2652-135-0x00007FF7E2540000-0x00007FF7E2892000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5ce-131.dat	UPX
behavioral2/memory/3268-130-0x00007FF6DB990000-0x00007FF6DBCE2000-memory.dmp	UPX
behavioral2/memory/3604-129-0x00007FF7CB500000-0x00007FF7CB852000-memory.dmp	UPX
behavioral2/memory/1452-123-0x00007FF6C2D40000-0x00007FF6C3092000-memory.dmp	UPX
behavioral2/memory/3392-122-0x00007FF7C0030000-0x00007FF7C0382000-memory.dmp	UPX
behavioral2/memory/4488-116-0x00007FF654B50000-0x00007FF654EA2000-memory.dmp	UPX
behavioral2/memory/3208-115-0x00007FF639F80000-0x00007FF63A2D2000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5cb-110.dat	UPX
behavioral2/memory/4456-109-0x00007FF6F27B0000-0x00007FF6F2B02000-memory.dmp	UPX
behavioral2/memory/3096-108-0x00007FF6AF7B0000-0x00007FF6AFB02000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5ca-103.dat	UPX
behavioral2/memory/5300-102-0x00007FF79FC30000-0x00007FF79FF82000-memory.dmp	UPX
behavioral2/memory/2336-101-0x00007FF6DF600000-0x00007FF6DF952000-memory.dmp	UPX
behavioral2/memory/760-95-0x00007FF6CD090000-0x00007FF6CD3E2000-memory.dmp	UPX
behavioral2/memory/2576-94-0x00007FF710810000-0x00007FF710B62000-memory.dmp	UPX
behavioral2/memory/5268-88-0x00007FF76F140000-0x00007FF76F492000-memory.dmp	UPX
behavioral2/memory/5988-87-0x00007FF76A960000-0x00007FF76ACB2000-memory.dmp	UPX
behavioral2/memory/4796-81-0x00007FF6222D0000-0x00007FF622622000-memory.dmp	UPX
behavioral2/memory/5780-80-0x00007FF7E47F0000-0x00007FF7E4B42000-memory.dmp	UPX
behavioral2/memory/1544-74-0x00007FF6D9360000-0x00007FF6D96B2000-memory.dmp	UPX
behavioral2/memory/2652-68-0x00007FF7E2540000-0x00007FF7E2892000-memory.dmp	UPX
behavioral2/memory/3604-62-0x00007FF7CB500000-0x00007FF7CB852000-memory.dmp	UPX
behavioral2/memory/1132-61-0x00007FF70D2D0000-0x00007FF70D622000-memory.dmp	UPX
behavioral2/memory/4076-54-0x00007FF6AE920000-0x00007FF6AEC72000-memory.dmp	UPX
behavioral2/memory/3208-48-0x00007FF639F80000-0x00007FF63A2D2000-memory.dmp	UPX
behavioral2/memory/3096-42-0x00007FF6AF7B0000-0x00007FF6AFB02000-memory.dmp	UPX
behavioral2/memory/2336-36-0x00007FF6DF600000-0x00007FF6DF952000-memory.dmp	UPX
behavioral2/memory/1544-139-0x00007FF6D9360000-0x00007FF6D96B2000-memory.dmp	UPX
behavioral2/memory/4796-140-0x00007FF6222D0000-0x00007FF622622000-memory.dmp	UPX
behavioral2/memory/5268-141-0x00007FF76F140000-0x00007FF76F492000-memory.dmp	UPX
behavioral2/memory/760-142-0x00007FF6CD090000-0x00007FF6CD3E2000-memory.dmp	UPX
behavioral2/memory/5300-143-0x00007FF79FC30000-0x00007FF79FF82000-memory.dmp	UPX
behavioral2/memory/4456-144-0x00007FF6F27B0000-0x00007FF6F2B02000-memory.dmp	UPX
behavioral2/memory/4488-145-0x00007FF654B50000-0x00007FF654EA2000-memory.dmp	UPX
behavioral2/memory/1452-146-0x00007FF6C2D40000-0x00007FF6C3092000-memory.dmp	UPX
behavioral2/memory/3268-147-0x00007FF6DB990000-0x00007FF6DBCE2000-memory.dmp	UPX
behavioral2/memory/4568-148-0x00007FF789C70000-0x00007FF789FC2000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4076-0-0x00007FF6AE920000-0x00007FF6AEC72000-memory.dmp	xmrig
behavioral2/files/0x000600000001b85a-5.dat	xmrig
behavioral2/memory/1132-8-0x00007FF70D2D0000-0x00007FF70D622000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c5b8-11.dat	xmrig
behavioral2/memory/3760-14-0x00007FF643790000-0x00007FF643AE2000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5bd-17.dat	xmrig
behavioral2/memory/5780-18-0x00007FF7E47F0000-0x00007FF7E4B42000-memory.dmp	xmrig
behavioral2/memory/5988-24-0x00007FF76A960000-0x00007FF76ACB2000-memory.dmp	xmrig
behavioral2/files/0x00030000000170c6-25.dat	xmrig
behavioral2/files/0x000c00000001c5be-30.dat	xmrig
behavioral2/memory/2576-31-0x00007FF710810000-0x00007FF710B62000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5bf-37.dat	xmrig
behavioral2/files/0x000c00000001c5c0-41.dat	xmrig
behavioral2/files/0x000c00000001c5c2-47.dat	xmrig
behavioral2/memory/3392-55-0x00007FF7C0030000-0x00007FF7C0382000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5c3-56.dat	xmrig
behavioral2/files/0x000c00000001c5c4-63.dat	xmrig
behavioral2/files/0x000c00000001c5c5-69.dat	xmrig
behavioral2/files/0x000c00000001c5c6-75.dat	xmrig
behavioral2/files/0x000c00000001c5c7-82.dat	xmrig
behavioral2/files/0x000c00000001c5c8-89.dat	xmrig
behavioral2/files/0x000c00000001c5c9-96.dat	xmrig
behavioral2/files/0x000c00000001c5cc-114.dat	xmrig
behavioral2/files/0x000c00000001c5cd-124.dat	xmrig
behavioral2/files/0x000c00000001c5cf-134.dat	xmrig
behavioral2/memory/4568-136-0x00007FF789C70000-0x00007FF789FC2000-memory.dmp	xmrig
behavioral2/memory/2652-135-0x00007FF7E2540000-0x00007FF7E2892000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5ce-131.dat	xmrig
behavioral2/memory/3268-130-0x00007FF6DB990000-0x00007FF6DBCE2000-memory.dmp	xmrig
behavioral2/memory/3604-129-0x00007FF7CB500000-0x00007FF7CB852000-memory.dmp	xmrig
behavioral2/memory/1452-123-0x00007FF6C2D40000-0x00007FF6C3092000-memory.dmp	xmrig
behavioral2/memory/3392-122-0x00007FF7C0030000-0x00007FF7C0382000-memory.dmp	xmrig
behavioral2/memory/4488-116-0x00007FF654B50000-0x00007FF654EA2000-memory.dmp	xmrig
behavioral2/memory/3208-115-0x00007FF639F80000-0x00007FF63A2D2000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5cb-110.dat	xmrig
behavioral2/memory/4456-109-0x00007FF6F27B0000-0x00007FF6F2B02000-memory.dmp	xmrig
behavioral2/memory/3096-108-0x00007FF6AF7B0000-0x00007FF6AFB02000-memory.dmp	xmrig
behavioral2/files/0x000c00000001c5ca-103.dat	xmrig
behavioral2/memory/5300-102-0x00007FF79FC30000-0x00007FF79FF82000-memory.dmp	xmrig
behavioral2/memory/2336-101-0x00007FF6DF600000-0x00007FF6DF952000-memory.dmp	xmrig
behavioral2/memory/760-95-0x00007FF6CD090000-0x00007FF6CD3E2000-memory.dmp	xmrig
behavioral2/memory/2576-94-0x00007FF710810000-0x00007FF710B62000-memory.dmp	xmrig
behavioral2/memory/5268-88-0x00007FF76F140000-0x00007FF76F492000-memory.dmp	xmrig
behavioral2/memory/5988-87-0x00007FF76A960000-0x00007FF76ACB2000-memory.dmp	xmrig
behavioral2/memory/4796-81-0x00007FF6222D0000-0x00007FF622622000-memory.dmp	xmrig
behavioral2/memory/5780-80-0x00007FF7E47F0000-0x00007FF7E4B42000-memory.dmp	xmrig
behavioral2/memory/1544-74-0x00007FF6D9360000-0x00007FF6D96B2000-memory.dmp	xmrig
behavioral2/memory/2652-68-0x00007FF7E2540000-0x00007FF7E2892000-memory.dmp	xmrig
behavioral2/memory/3604-62-0x00007FF7CB500000-0x00007FF7CB852000-memory.dmp	xmrig
behavioral2/memory/1132-61-0x00007FF70D2D0000-0x00007FF70D622000-memory.dmp	xmrig
behavioral2/memory/4076-54-0x00007FF6AE920000-0x00007FF6AEC72000-memory.dmp	xmrig
behavioral2/memory/3208-48-0x00007FF639F80000-0x00007FF63A2D2000-memory.dmp	xmrig
behavioral2/memory/3096-42-0x00007FF6AF7B0000-0x00007FF6AFB02000-memory.dmp	xmrig
behavioral2/memory/2336-36-0x00007FF6DF600000-0x00007FF6DF952000-memory.dmp	xmrig
behavioral2/memory/1544-139-0x00007FF6D9360000-0x00007FF6D96B2000-memory.dmp	xmrig
behavioral2/memory/4796-140-0x00007FF6222D0000-0x00007FF622622000-memory.dmp	xmrig
behavioral2/memory/5268-141-0x00007FF76F140000-0x00007FF76F492000-memory.dmp	xmrig
behavioral2/memory/760-142-0x00007FF6CD090000-0x00007FF6CD3E2000-memory.dmp	xmrig
behavioral2/memory/5300-143-0x00007FF79FC30000-0x00007FF79FF82000-memory.dmp	xmrig
behavioral2/memory/4456-144-0x00007FF6F27B0000-0x00007FF6F2B02000-memory.dmp	xmrig
behavioral2/memory/4488-145-0x00007FF654B50000-0x00007FF654EA2000-memory.dmp	xmrig
behavioral2/memory/1452-146-0x00007FF6C2D40000-0x00007FF6C3092000-memory.dmp	xmrig
behavioral2/memory/3268-147-0x00007FF6DB990000-0x00007FF6DBCE2000-memory.dmp	xmrig
behavioral2/memory/4568-148-0x00007FF789C70000-0x00007FF789FC2000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1132	WxQbPdz.exe
3760	fBGqAdI.exe
5780	FZGtqrp.exe
5988	qEfOQLO.exe
2576	qbjtVTv.exe
2336	raqMMks.exe
3096	ZNBZNsK.exe
3208	tJaCazg.exe
3392	pRRrOAb.exe
3604	UNkMuZS.exe
2652	ZRYrTMS.exe
1544	bxoSeEG.exe
4796	xHaHOYx.exe
5268	NXSSDne.exe
760	blczKNm.exe
5300	QmVKMva.exe
4456	lqNAChV.exe
4488	PtxUcmv.exe
1452	TEQgboa.exe
3268	NAdniAB.exe
4568	vBLqIpK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4076-0-0x00007FF6AE920000-0x00007FF6AEC72000-memory.dmp	upx
behavioral2/files/0x000600000001b85a-5.dat	upx
behavioral2/memory/1132-8-0x00007FF70D2D0000-0x00007FF70D622000-memory.dmp	upx
behavioral2/files/0x000d00000001c5b8-11.dat	upx
behavioral2/memory/3760-14-0x00007FF643790000-0x00007FF643AE2000-memory.dmp	upx
behavioral2/files/0x000c00000001c5bd-17.dat	upx
behavioral2/memory/5780-18-0x00007FF7E47F0000-0x00007FF7E4B42000-memory.dmp	upx
behavioral2/memory/5988-24-0x00007FF76A960000-0x00007FF76ACB2000-memory.dmp	upx
behavioral2/files/0x00030000000170c6-25.dat	upx
behavioral2/files/0x000c00000001c5be-30.dat	upx
behavioral2/memory/2576-31-0x00007FF710810000-0x00007FF710B62000-memory.dmp	upx
behavioral2/files/0x000c00000001c5bf-37.dat	upx
behavioral2/files/0x000c00000001c5c0-41.dat	upx
behavioral2/files/0x000c00000001c5c2-47.dat	upx
behavioral2/memory/3392-55-0x00007FF7C0030000-0x00007FF7C0382000-memory.dmp	upx
behavioral2/files/0x000c00000001c5c3-56.dat	upx
behavioral2/files/0x000c00000001c5c4-63.dat	upx
behavioral2/files/0x000c00000001c5c5-69.dat	upx
behavioral2/files/0x000c00000001c5c6-75.dat	upx
behavioral2/files/0x000c00000001c5c7-82.dat	upx
behavioral2/files/0x000c00000001c5c8-89.dat	upx
behavioral2/files/0x000c00000001c5c9-96.dat	upx
behavioral2/files/0x000c00000001c5cc-114.dat	upx
behavioral2/files/0x000c00000001c5cd-124.dat	upx
behavioral2/files/0x000c00000001c5cf-134.dat	upx
behavioral2/memory/4568-136-0x00007FF789C70000-0x00007FF789FC2000-memory.dmp	upx
behavioral2/memory/2652-135-0x00007FF7E2540000-0x00007FF7E2892000-memory.dmp	upx
behavioral2/files/0x000c00000001c5ce-131.dat	upx
behavioral2/memory/3268-130-0x00007FF6DB990000-0x00007FF6DBCE2000-memory.dmp	upx
behavioral2/memory/3604-129-0x00007FF7CB500000-0x00007FF7CB852000-memory.dmp	upx
behavioral2/memory/1452-123-0x00007FF6C2D40000-0x00007FF6C3092000-memory.dmp	upx
behavioral2/memory/3392-122-0x00007FF7C0030000-0x00007FF7C0382000-memory.dmp	upx
behavioral2/memory/4488-116-0x00007FF654B50000-0x00007FF654EA2000-memory.dmp	upx
behavioral2/memory/3208-115-0x00007FF639F80000-0x00007FF63A2D2000-memory.dmp	upx
behavioral2/files/0x000c00000001c5cb-110.dat	upx
behavioral2/memory/4456-109-0x00007FF6F27B0000-0x00007FF6F2B02000-memory.dmp	upx
behavioral2/memory/3096-108-0x00007FF6AF7B0000-0x00007FF6AFB02000-memory.dmp	upx
behavioral2/files/0x000c00000001c5ca-103.dat	upx
behavioral2/memory/5300-102-0x00007FF79FC30000-0x00007FF79FF82000-memory.dmp	upx
behavioral2/memory/2336-101-0x00007FF6DF600000-0x00007FF6DF952000-memory.dmp	upx
behavioral2/memory/760-95-0x00007FF6CD090000-0x00007FF6CD3E2000-memory.dmp	upx
behavioral2/memory/2576-94-0x00007FF710810000-0x00007FF710B62000-memory.dmp	upx
behavioral2/memory/5268-88-0x00007FF76F140000-0x00007FF76F492000-memory.dmp	upx
behavioral2/memory/5988-87-0x00007FF76A960000-0x00007FF76ACB2000-memory.dmp	upx
behavioral2/memory/4796-81-0x00007FF6222D0000-0x00007FF622622000-memory.dmp	upx
behavioral2/memory/5780-80-0x00007FF7E47F0000-0x00007FF7E4B42000-memory.dmp	upx
behavioral2/memory/1544-74-0x00007FF6D9360000-0x00007FF6D96B2000-memory.dmp	upx
behavioral2/memory/2652-68-0x00007FF7E2540000-0x00007FF7E2892000-memory.dmp	upx
behavioral2/memory/3604-62-0x00007FF7CB500000-0x00007FF7CB852000-memory.dmp	upx
behavioral2/memory/1132-61-0x00007FF70D2D0000-0x00007FF70D622000-memory.dmp	upx
behavioral2/memory/4076-54-0x00007FF6AE920000-0x00007FF6AEC72000-memory.dmp	upx
behavioral2/memory/3208-48-0x00007FF639F80000-0x00007FF63A2D2000-memory.dmp	upx
behavioral2/memory/3096-42-0x00007FF6AF7B0000-0x00007FF6AFB02000-memory.dmp	upx
behavioral2/memory/2336-36-0x00007FF6DF600000-0x00007FF6DF952000-memory.dmp	upx
behavioral2/memory/1544-139-0x00007FF6D9360000-0x00007FF6D96B2000-memory.dmp	upx
behavioral2/memory/4796-140-0x00007FF6222D0000-0x00007FF622622000-memory.dmp	upx
behavioral2/memory/5268-141-0x00007FF76F140000-0x00007FF76F492000-memory.dmp	upx
behavioral2/memory/760-142-0x00007FF6CD090000-0x00007FF6CD3E2000-memory.dmp	upx
behavioral2/memory/5300-143-0x00007FF79FC30000-0x00007FF79FF82000-memory.dmp	upx
behavioral2/memory/4456-144-0x00007FF6F27B0000-0x00007FF6F2B02000-memory.dmp	upx
behavioral2/memory/4488-145-0x00007FF654B50000-0x00007FF654EA2000-memory.dmp	upx
behavioral2/memory/1452-146-0x00007FF6C2D40000-0x00007FF6C3092000-memory.dmp	upx
behavioral2/memory/3268-147-0x00007FF6DB990000-0x00007FF6DBCE2000-memory.dmp	upx
behavioral2/memory/4568-148-0x00007FF789C70000-0x00007FF789FC2000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\pRRrOAb.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\lqNAChV.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\tJaCazg.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\UNkMuZS.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\PtxUcmv.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\NAdniAB.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\bxoSeEG.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\blczKNm.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\QmVKMva.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\TEQgboa.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\vBLqIpK.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fBGqAdI.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\raqMMks.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ZNBZNsK.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ZRYrTMS.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\xHaHOYx.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\NXSSDne.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\WxQbPdz.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\FZGtqrp.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\qEfOQLO.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\qbjtVTv.exe	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 1132	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 4076 wrote to memory of 3760	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 4076 wrote to memory of 5780	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 4076 wrote to memory of 5988	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 4076 wrote to memory of 2576	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 4076 wrote to memory of 2336	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 4076 wrote to memory of 3096	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 4076 wrote to memory of 3208	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 4076 wrote to memory of 3392	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 4076 wrote to memory of 3604	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 4076 wrote to memory of 2652	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 4076 wrote to memory of 1544	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 4076 wrote to memory of 4796	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 4076 wrote to memory of 5268	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 4076 wrote to memory of 760	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 4076 wrote to memory of 5300	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 4076 wrote to memory of 4456	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 4076 wrote to memory of 4488	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 4076 wrote to memory of 1452	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 4076 wrote to memory of 3268	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109
PID 4076 wrote to memory of 4568	4076	2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_f6e967d997685c6ddffd27313e619428_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\System\WxQbPdz.exe
  C:\Windows\System\WxQbPdz.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\fBGqAdI.exe
  C:\Windows\System\fBGqAdI.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\FZGtqrp.exe
  C:\Windows\System\FZGtqrp.exe
  2⤵
  - Executes dropped EXE
  PID:5780
- C:\Windows\System\qEfOQLO.exe
  C:\Windows\System\qEfOQLO.exe
  2⤵
  - Executes dropped EXE
  PID:5988
- C:\Windows\System\qbjtVTv.exe
  C:\Windows\System\qbjtVTv.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\raqMMks.exe
  C:\Windows\System\raqMMks.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\ZNBZNsK.exe
  C:\Windows\System\ZNBZNsK.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\tJaCazg.exe
  C:\Windows\System\tJaCazg.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\pRRrOAb.exe
  C:\Windows\System\pRRrOAb.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\UNkMuZS.exe
  C:\Windows\System\UNkMuZS.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\ZRYrTMS.exe
  C:\Windows\System\ZRYrTMS.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\bxoSeEG.exe
  C:\Windows\System\bxoSeEG.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\xHaHOYx.exe
  C:\Windows\System\xHaHOYx.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\NXSSDne.exe
  C:\Windows\System\NXSSDne.exe
  2⤵
  - Executes dropped EXE
  PID:5268
- C:\Windows\System\blczKNm.exe
  C:\Windows\System\blczKNm.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\QmVKMva.exe
  C:\Windows\System\QmVKMva.exe
  2⤵
  - Executes dropped EXE
  PID:5300
- C:\Windows\System\lqNAChV.exe
  C:\Windows\System\lqNAChV.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\PtxUcmv.exe
  C:\Windows\System\PtxUcmv.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\TEQgboa.exe
  C:\Windows\System\TEQgboa.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\NAdniAB.exe
  C:\Windows\System\NAdniAB.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\vBLqIpK.exe
  C:\Windows\System\vBLqIpK.exe
  2⤵
  - Executes dropped EXE
  PID:4568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

FZGtqrp.exe

Path C:\Windows\System\FZGtqrp.exe
Size 8.3MB
SHA256 b1c3e435647164bf5de24a85cd5f1d960a7cf77b11274710265c79075b58b62e
MD5 7905631e7b91753b87562ea793a85d48
SHA1 2d91671bf0d7c635c18c456d75f46efee9a86cde
SHA512 381c89f8aca05f9f1d39a2e8733c942107599533644d14e9f4110c1b1e26172a7e737aff4d98f4cfaa790dcbc12c4ce644a6b8fa3995afb0e5f5ee41659d1fb2
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUu:v+D56utgpPF8u/7u
TLSH
T190965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NAdniAB.exe

Path C:\Windows\System\NAdniAB.exe
Size 8.3MB
SHA256 6379e9879fcf11e0a93d614d4bb96b03e3ed9d17b5318b7c765ec321adbba431
MD5 2bd44e0ed11ed6f80d7bb8d9c58982c4
SHA1 350a61bc2a65cf76052f86219c17391ddcf48cbd
SHA512 3b201a48b98e6078291d7c1b1ff950d83d08ac4008bd81a0bedbb6b4f6568c14559bb4ba2b55c3b9bf9196df4f7b82e74565c758b0d2f58c1771b47634c3a0b6
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUE:v+D56utgpPF8u/7E
TLSH
T163965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NXSSDne.exe

Path C:\Windows\System\NXSSDne.exe
Size 8.3MB
SHA256 48bdb41ec934478f42301c693b34f1a03869c0ebaade7adee2834e7c17c01da8
MD5 64eac10feffdcf01cf6d272e8363530c
SHA1 cd6a46ebe3d44e72ce9071e390f5631beeab0d64
SHA512 75958e0c1289da6582c779f222d91394053ee8d29fe15211b121b1b5ac34433274c3ab9ed4cfe9b3241ffef0a77f429e86559c6935ba88a429e95cf205093ef6
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUr:v+D56utgpPF8u/7r
TLSH
T1F3965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PtxUcmv.exe

Path C:\Windows\System\PtxUcmv.exe
Size 8.3MB
SHA256 4c376dc06e6f022bc812e96ae1d926cd4e6f7ef206f7dc2aa441d1d75838202a
MD5 006526c739225317c4df4240a17db727
SHA1 0f5b9ab7a8a472bc48bd380712d7568931adabd2
SHA512 162986f30faa70f2e792dc3c70abb111aea063a0d0f98e9a3a28faa5d72903049113c0dcb54b31827a661fb777f9c6786432fe3742aa065055c269c83586f79f
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUf:v+D56utgpPF8u/7f
TLSH
T14F965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QmVKMva.exe

Path C:\Windows\System\QmVKMva.exe
Size 8.3MB
SHA256 206aba0959a226c27f21ecdd6a0e0f6ccdf8110b253f4c442224b80ec2223739
MD5 f1a1b61dc3a578ae8c73d0946607e2fa
SHA1 e063e622f630f539145e786646ab2cdf6dfff4dd
SHA512 980289ea9b98b080dd14b46cb4e0171fd3b970cddb778aa1d683392a4e19d15eda289f32634374ac748a039ff9b013258280a6ff10896b359c51461dcc4e4b75
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU2:v+D56utgpPF8u/72
TLSH
T1A1965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TEQgboa.exe

Path C:\Windows\System\TEQgboa.exe
Size 8.3MB
SHA256 14a66e7b7ac64876ed0ad7d027b769d04e15666767bf3a36679647f8b8d78db3
MD5 c357da92e20ba6596a4bed211255d6cb
SHA1 3ca6ff8f32954f3efd32c156bbf158bdcdaf8687
SHA512 f3007a5eda1c0f702a57c392103c2f5ea386e1284f6e8c40a517ae4e99ea2874c5427af86845eeccee63425918e5b89a05549683ab2c8b7f8acbeb9509f18582
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU+:v+D56utgpPF8u/7+
TLSH
T1DC965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UNkMuZS.exe

Path C:\Windows\System\UNkMuZS.exe
Size 8.3MB
SHA256 f284a1adc1fad6213922db23547a4efe55793dc1cf30d0fd746c08df33929065
MD5 bf23e0a3d038baf9344ab651644dce44
SHA1 457ec5cf3e73acb2bb9c2b5b36eb96ed9bd5c62f
SHA512 8de0c6defc4f7878f9c5ef83f9cec953e5e9868b8f1300d8602b4a69bc5e08f6f6848c34f2454400981649817313da91cf336439820700645bddfe595af19884
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUi:v+D56utgpPF8u/7i
TLSH
T19B965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WxQbPdz.exe

Path C:\Windows\System\WxQbPdz.exe
Size 8.3MB
SHA256 84d45677112e4aec7580d8614863354f2a899a8c73b0793c5bc4a0f0298c29f8
MD5 225729b162e696fe3848768c22f2e597
SHA1 1af3899a3073a18c87021bc487ef241805477b74
SHA512 a7d66813167ea0cd391f38c6eaf3ea9f0097a177b285385b20d20aa4fc0e4df66ee200a508ae06f04779ea3734c987443a822b040d881f9b9045b7924d777336
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUA:v+D56utgpPF8u/7A
TLSH
T1B5965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZNBZNsK.exe

Path C:\Windows\System\ZNBZNsK.exe
Size 8.3MB
SHA256 b003a5a18abc9829984e262c90c91bae7c4fa36e3e9173106bbb4a4d4065662e
MD5 5c04273709016ea686966b9d7183dd37
SHA1 3557b9084eab39992bd2debcacba8be92ecfd04f
SHA512 e0fef62f99d24c827b2568dcd43478d723887007a89e0985a4ff3eb99d35a6e7e4036030e2a914da0adea6e0ac7b10e750f24d62627f6975cc40a70da05443d3
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUx:v+D56utgpPF8u/7x
TLSH
T18E965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZRYrTMS.exe

Path C:\Windows\System\ZRYrTMS.exe
Size 8.3MB
SHA256 f272d82ceb9376ca6df08902fedf659c14bd24526ca12379c9ac12ec0f8cab44
MD5 532c4233153a4de05cb047660db5a83f
SHA1 8b5944cae4fa45d8e700704a262b4cb96d223205
SHA512 abcb70b9edca083b795dcc461a304aaa1c450d6d407ed44c35a9d9af7a130467a400e921fa6aa55d7d2934a508e40ba280664b27aa06ac96ae6558a8da1a55aa
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUd:v+D56utgpPF8u/7d
TLSH
T159965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blczKNm.exe

Path C:\Windows\System\blczKNm.exe
Size 8.3MB
SHA256 28ee111bb74bd3d3639b1c11f33ff83e98345441dbfb19c9c1aa9dc1785ffec5
MD5 fb5ae96b970b336776c93b877d793a9a
SHA1 bccd0d04ba7548af97335e232198b23ae62fc2f9
SHA512 2a53af959656e572e90b3b3518e1e334a3b3ce4c5cda306efbad7164d8d0581c1eb934ca5c9c6272cba2741ab5e52bc435451e59b3fa68ab7d461dabc1c2c2f9
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUJ:v+D56utgpPF8u/7J
TLSH
T1DD965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bxoSeEG.exe

Path C:\Windows\System\bxoSeEG.exe
Size 8.3MB
SHA256 575c78a18b281db764e21182e3967799194ceff3f93d5f0b34074dc4b4a4f66a
MD5 124094830cf60910590f10fb0f5c5e43
SHA1 be6f7dce049af33f4a465eaf891e7874e1f11f76
SHA512 18b8b9811e065a209ad8211b9261151ce170e067faccaf165116df4275a44e31526f8cbe72a5e1381f2da3550415de0cd3f270436a4854b05560b9fc24f0743d
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUU:v+D56utgpPF8u/7U
TLSH
T1A5965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fBGqAdI.exe

Path C:\Windows\System\fBGqAdI.exe
Size 8.3MB
SHA256 720529a544a1a13ba727af32c485ad316609eddcd9f7f1352c7c0050434472c8
MD5 622d88a0bd790b11b18aa3d23a83de5c
SHA1 dd09677907fa9db0dfab78870d2230d141f88c04
SHA512 85b13abfbc147ae55686e9600ae00c318d5c101e5a463f922db0f66114ac40e313d64d2da3228165b101ec4624f26004283afb9c200284358075bd0556e0b956
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUL:v+D56utgpPF8u/7L
TLSH
T1C1965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lqNAChV.exe

Path C:\Windows\System\lqNAChV.exe
Size 8.3MB
SHA256 dd40884d35d81852953867c5eb36be0a90614d9addf86a8c19206f82c6cc1f89
MD5 af65244e5a0a55943ce94d8ef0acca38
SHA1 c8b00d4957762a326789e4b269b549bc4c26d022
SHA512 7f5bff4107f8b3fdf9cab80c21ac3efa10ed41b02377329188c5be0e7fc486ea180cdcb29adb47d4d79f3cc5fd5e60a60f507ddb30457319649551d03017c63e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUI:v+D56utgpPF8u/7I
TLSH
T1BE965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pRRrOAb.exe

Path C:\Windows\System\pRRrOAb.exe
Size 8.3MB
SHA256 13519bbc0a7f6c34b5cf740bc94c660efd2c6a1d2cfce2a24e7c7c51164f6711
MD5 4b0e283b2a55cb22ecb94830969102e4
SHA1 4363c4b45808c94668a51e56983b10fae74776b7
SHA512 bdee461f72a0a4066bc2e5a8010052d7bb3907c3a1feaf5c5dd381b5000a88515102e72c4bd77e074382b5da6df8edb86f1983784a9d15088c02e02ac1827974
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUb:v+D56utgpPF8u/7b
TLSH
T164965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qEfOQLO.exe

Path C:\Windows\System\qEfOQLO.exe
Size 8.3MB
SHA256 5d39beecf943fa5c9e9792814101af9d9c2d0ce4776d3dcfe47b57eea642bd15
MD5 07a284fbf921e738c125a682d4de1e07
SHA1 b3c6cc2f000a3e994d216057282a8af37a13cb0b
SHA512 1946720c4cc8f007e00aceb3b581482966cbf04f9d224c9a13da41b4a2e3cbd2dadfc3c00863a413cfb565053a8902d457404a856f9b0e8e8427947ef2dfbc88
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUA:v+D56utgpPF8u/7A
TLSH
T177965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qbjtVTv.exe

Path C:\Windows\System\qbjtVTv.exe
Size 8.3MB
SHA256 27060c5d2cdc163da06c09836b9017f184ff78ce42f875e930562e45151db374
MD5 e87e296ef4f7ab803611f8fca1839229
SHA1 7d83331eb39e0e863ec4bbc17107b091ad69f41c
SHA512 1c03b8b68de95fb3884b359a10eff47754603572906eae9a2f4609eb49a475a4d836b861e3787771ff8ea88d96e1c79f4920e03ff5ba6f2bbe9330841e514cce
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU2:v+D56utgpPF8u/72
TLSH
T149965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

raqMMks.exe

Path C:\Windows\System\raqMMks.exe
Size 8.3MB
SHA256 5ca89335746ac6e747975cf473d7036639296962ac33c3edc75c98e012e22aeb
MD5 ebfdf10ad65f5625c8eb53c6f4cc755e
SHA1 3a3bc7e728cf6a7a139feb8032c5cd358ce25bdb
SHA512 8b09ce718012454abe2f2bb76c73757917380e54b52280c056f3420778cfc6189a5693cacd14917725da19208ce0b94abd263bbb64e3aefe9c8fe0ee85cee0cf
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU2:v+D56utgpPF8u/72
TLSH
T13E965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tJaCazg.exe

Path C:\Windows\System\tJaCazg.exe
Size 8.3MB
SHA256 ad7d4e95776306a89c860e436f7c6c3e4f71a110649f02e96676335e94a63451
MD5 d60322cd92341e660ba3e488353bd23e
SHA1 f43a5ab6b61c40591418f570e92a023d9e5b7a3f
SHA512 88b12d7f1fd715585afcd4852084b3bda0a07f9e97f1b6a743e5c841bf2c9567e5d65a6ff3579df7ee37d0385533b2315f3742b7a0124bfceaf5b01caecff9e1
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU4:v+D56utgpPF8u/74
TLSH
T1BC965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vBLqIpK.exe

Path C:\Windows\System\vBLqIpK.exe
Size 8.3MB
SHA256 db8be1e2bdcc3d2ec4d8a8e8114956ed525cbc53d2c630972d63d6d5309c9a47
MD5 8ca9f3a6d1ca86430d64ed9d36cc93ec
SHA1 43666867ce0dfcfd190b365b8bce3dbd9fcafcf0
SHA512 cc8a2299dc010a6012c92475167e8a77d1f45b7c6b31b448e597648b7bdbae0e279001898c91bcabd1d2e73c2e3e3995355c032823de6843d7301bf35bbf0e73
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUr:v+D56utgpPF8u/7r
TLSH
T195965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xHaHOYx.exe

Path C:\Windows\System\xHaHOYx.exe
Size 8.3MB
SHA256 19cb5c04e4a75bd696ae1d89e653e5a5bce02c042f31087d126bca66e019532d
MD5 2142b5e87b6cf277aee603eafd0af145
SHA1 1c1f6778bda91d831ef7ae56af4561139a5944f8
SHA512 99597b58023d5a229eb9620c7685d09996e2a57534ad49bcfdc4e11788d39c437a48b18328728ce44cc63d71a8976b5f587a672fba193ecca06f38cc083dc6b9
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUg:v+D56utgpPF8u/7g
TLSH
T1D9965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/760-142-0x00007FF6CD090000-0x00007FF6CD3E2000-memory.dmp

Download

memory/760-95-0x00007FF6CD090000-0x00007FF6CD3E2000-memory.dmp

Download

memory/760-167-0x00007FF6CD090000-0x00007FF6CD3E2000-memory.dmp

Download

memory/1132-8-0x00007FF70D2D0000-0x00007FF70D622000-memory.dmp

Download

memory/1132-149-0x00007FF70D2D0000-0x00007FF70D622000-memory.dmp

Download

memory/1132-61-0x00007FF70D2D0000-0x00007FF70D622000-memory.dmp

Download

memory/1452-146-0x00007FF6C2D40000-0x00007FF6C3092000-memory.dmp

Download

memory/1452-123-0x00007FF6C2D40000-0x00007FF6C3092000-memory.dmp

Download

memory/1452-163-0x00007FF6C2D40000-0x00007FF6C3092000-memory.dmp

Download

memory/1544-139-0x00007FF6D9360000-0x00007FF6D96B2000-memory.dmp

Download

memory/1544-74-0x00007FF6D9360000-0x00007FF6D96B2000-memory.dmp

Download

memory/1544-160-0x00007FF6D9360000-0x00007FF6D96B2000-memory.dmp

Download

memory/2336-154-0x00007FF6DF600000-0x00007FF6DF952000-memory.dmp

Download

memory/2336-36-0x00007FF6DF600000-0x00007FF6DF952000-memory.dmp

Download

memory/2336-101-0x00007FF6DF600000-0x00007FF6DF952000-memory.dmp

Download

memory/2576-94-0x00007FF710810000-0x00007FF710B62000-memory.dmp

Download

memory/2576-153-0x00007FF710810000-0x00007FF710B62000-memory.dmp

Download

memory/2576-31-0x00007FF710810000-0x00007FF710B62000-memory.dmp

Download

memory/2652-135-0x00007FF7E2540000-0x00007FF7E2892000-memory.dmp

Download

memory/2652-157-0x00007FF7E2540000-0x00007FF7E2892000-memory.dmp

Download

memory/2652-68-0x00007FF7E2540000-0x00007FF7E2892000-memory.dmp

Download

memory/3096-108-0x00007FF6AF7B0000-0x00007FF6AFB02000-memory.dmp

Download

memory/3096-156-0x00007FF6AF7B0000-0x00007FF6AFB02000-memory.dmp

Download

memory/3096-42-0x00007FF6AF7B0000-0x00007FF6AFB02000-memory.dmp

Download

memory/3208-155-0x00007FF639F80000-0x00007FF63A2D2000-memory.dmp

Download

memory/3208-115-0x00007FF639F80000-0x00007FF63A2D2000-memory.dmp

Download

memory/3208-48-0x00007FF639F80000-0x00007FF63A2D2000-memory.dmp

Download

memory/3268-147-0x00007FF6DB990000-0x00007FF6DBCE2000-memory.dmp

Download

memory/3268-130-0x00007FF6DB990000-0x00007FF6DBCE2000-memory.dmp

Download

memory/3268-169-0x00007FF6DB990000-0x00007FF6DBCE2000-memory.dmp

Download

memory/3392-159-0x00007FF7C0030000-0x00007FF7C0382000-memory.dmp

Download

memory/3392-122-0x00007FF7C0030000-0x00007FF7C0382000-memory.dmp

Download

memory/3392-55-0x00007FF7C0030000-0x00007FF7C0382000-memory.dmp

Download

memory/3604-62-0x00007FF7CB500000-0x00007FF7CB852000-memory.dmp

Download

memory/3604-129-0x00007FF7CB500000-0x00007FF7CB852000-memory.dmp

Download

memory/3604-158-0x00007FF7CB500000-0x00007FF7CB852000-memory.dmp

Download

memory/3760-14-0x00007FF643790000-0x00007FF643AE2000-memory.dmp

Download

memory/3760-150-0x00007FF643790000-0x00007FF643AE2000-memory.dmp

Download

memory/4076-54-0x00007FF6AE920000-0x00007FF6AEC72000-memory.dmp

Download

memory/4076-0-0x00007FF6AE920000-0x00007FF6AEC72000-memory.dmp

Download

memory/4076-1-0x0000010EB1CC0000-0x0000010EB1CD0000-memory.dmp

Download

memory/4456-144-0x00007FF6F27B0000-0x00007FF6F2B02000-memory.dmp

Download

memory/4456-109-0x00007FF6F27B0000-0x00007FF6F2B02000-memory.dmp

Download

memory/4456-166-0x00007FF6F27B0000-0x00007FF6F2B02000-memory.dmp

Download

memory/4488-145-0x00007FF654B50000-0x00007FF654EA2000-memory.dmp

Download

memory/4488-116-0x00007FF654B50000-0x00007FF654EA2000-memory.dmp

Download

memory/4488-164-0x00007FF654B50000-0x00007FF654EA2000-memory.dmp

Download

memory/4568-165-0x00007FF789C70000-0x00007FF789FC2000-memory.dmp

Download

memory/4568-148-0x00007FF789C70000-0x00007FF789FC2000-memory.dmp

Download

memory/4568-136-0x00007FF789C70000-0x00007FF789FC2000-memory.dmp

Download

memory/4796-161-0x00007FF6222D0000-0x00007FF622622000-memory.dmp

Download

memory/4796-81-0x00007FF6222D0000-0x00007FF622622000-memory.dmp

Download

memory/4796-140-0x00007FF6222D0000-0x00007FF622622000-memory.dmp

Download

memory/5268-162-0x00007FF76F140000-0x00007FF76F492000-memory.dmp

Download

memory/5268-88-0x00007FF76F140000-0x00007FF76F492000-memory.dmp

Download

memory/5268-141-0x00007FF76F140000-0x00007FF76F492000-memory.dmp

Download

memory/5300-102-0x00007FF79FC30000-0x00007FF79FF82000-memory.dmp

Download

memory/5300-168-0x00007FF79FC30000-0x00007FF79FF82000-memory.dmp

Download

memory/5300-143-0x00007FF79FC30000-0x00007FF79FF82000-memory.dmp

Download

memory/5780-18-0x00007FF7E47F0000-0x00007FF7E4B42000-memory.dmp

Download

memory/5780-151-0x00007FF7E47F0000-0x00007FF7E4B42000-memory.dmp

Download

memory/5780-80-0x00007FF7E47F0000-0x00007FF7E4B42000-memory.dmp

Download

memory/5988-24-0x00007FF76A960000-0x00007FF76ACB2000-memory.dmp

Download

memory/5988-87-0x00007FF76A960000-0x00007FF76ACB2000-memory.dmp

Download

memory/5988-152-0x00007FF76A960000-0x00007FF76ACB2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads