cobaltstrike | 8d53e5a5f7c8931efdf02304ea0604c6ded15a819fd5ebd04ab530ee26cf2f93

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample261110-1e49bsbd39
SHA256 8d53e5a5f7c8931efdf02304ea0604c6ded15a819fd5ebd04ab530ee26cf2f93
MD5 41e698f2a16df3f3a327f5dece9345a7
SHA1 a4b59ebc0515f6462457ac5049f7216e0a0adcc1
SHA512 6d5bb56b981492f24275c0ea8003847e41eed82d40e9fc88fa1dba45c0dca0cadb407c7fd6e44ed4ed8606cb29ac39ec6a9b0552d016e20cf4171b3f6310a61e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU9:v+D56utgpPF8u/79
TLSH
T1E9965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x0009000000024364-6.dat	cobalt_reflective_dll
behavioral1/files/0x000b0000000243ca-25.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002441d-33.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024423-53.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024425-73.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024424-71.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024422-66.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024421-64.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024420-62.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002441f-40.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002441e-35.dat	cobalt_reflective_dll
behavioral1/files/0x0011000000024365-21.dat	cobalt_reflective_dll
behavioral1/files/0x000600000001686d-13.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001e108-89.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024426-105.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002442b-121.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002442c-118.dat	cobalt_reflective_dll
behavioral1/files/0x000700000002442a-112.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024429-106.dat	cobalt_reflective_dll
behavioral1/files/0x002b00000001b679-114.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024428-101.dat	cobalt_reflective_dll

Custom signature

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral1/files/0x0009000000024364-6.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000b0000000243ca-25.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002441d-33.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024423-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024425-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024424-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024422-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024421-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024420-62.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002441f-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002441e-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0011000000024365-21.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000600000001686d-13.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000500000001e108-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024426-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002442b-121.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002442c-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000700000002442a-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024429-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x002b00000001b679-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000024428-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

Custom signature

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral1/memory/1736-0-0x00007FF78A2A0000-0x00007FF78A5F2000-memory.dmp	UPX
behavioral1/files/0x0009000000024364-6.dat	UPX
behavioral1/files/0x000b0000000243ca-25.dat	UPX
behavioral1/files/0x000700000002441d-33.dat	UPX
behavioral1/files/0x0007000000024423-53.dat	UPX
behavioral1/memory/2860-60-0x00007FF6A0050000-0x00007FF6A03A2000-memory.dmp	UPX
behavioral1/memory/3600-70-0x00007FF6F3200000-0x00007FF6F3552000-memory.dmp	UPX
behavioral1/memory/4108-78-0x00007FF6D1AD0000-0x00007FF6D1E22000-memory.dmp	UPX
behavioral1/memory/2936-80-0x00007FF725BA0000-0x00007FF725EF2000-memory.dmp	UPX
behavioral1/memory/412-79-0x00007FF7D1D50000-0x00007FF7D20A2000-memory.dmp	UPX
behavioral1/memory/3944-77-0x00007FF7DB3F0000-0x00007FF7DB742000-memory.dmp	UPX
behavioral1/memory/2312-76-0x00007FF76BB00000-0x00007FF76BE52000-memory.dmp	UPX
behavioral1/memory/1960-75-0x00007FF7EA770000-0x00007FF7EAAC2000-memory.dmp	UPX
behavioral1/files/0x0007000000024425-73.dat	UPX
behavioral1/files/0x0007000000024424-71.dat	UPX
behavioral1/files/0x0007000000024422-66.dat	UPX
behavioral1/files/0x0007000000024421-64.dat	UPX
behavioral1/files/0x0007000000024420-62.dat	UPX
behavioral1/memory/2268-61-0x00007FF7B05F0000-0x00007FF7B0942000-memory.dmp	UPX
behavioral1/memory/1160-56-0x00007FF70D5A0000-0x00007FF70D8F2000-memory.dmp	UPX
behavioral1/memory/1752-54-0x00007FF69D550000-0x00007FF69D8A2000-memory.dmp	UPX
behavioral1/files/0x000700000002441f-40.dat	UPX
behavioral1/memory/4416-38-0x00007FF6CDCA0000-0x00007FF6CDFF2000-memory.dmp	UPX
behavioral1/files/0x000700000002441e-35.dat	UPX
behavioral1/memory/1064-22-0x00007FF78A3C0000-0x00007FF78A712000-memory.dmp	UPX
behavioral1/files/0x0011000000024365-21.dat	UPX
behavioral1/files/0x000600000001686d-13.dat	UPX
behavioral1/files/0x000500000001e108-89.dat	UPX
behavioral1/files/0x0007000000024426-105.dat	UPX
behavioral1/files/0x000700000002442b-121.dat	UPX
behavioral1/memory/4084-120-0x00007FF7562A0000-0x00007FF7565F2000-memory.dmp	UPX
behavioral1/memory/1564-124-0x00007FF6C8830000-0x00007FF6C8B82000-memory.dmp	UPX
behavioral1/memory/4552-125-0x00007FF6E5930000-0x00007FF6E5C82000-memory.dmp	UPX
behavioral1/memory/4252-127-0x00007FF67E1B0000-0x00007FF67E502000-memory.dmp	UPX
behavioral1/memory/516-126-0x00007FF7DDDD0000-0x00007FF7DE122000-memory.dmp	UPX
behavioral1/memory/32-123-0x00007FF6EAD90000-0x00007FF6EB0E2000-memory.dmp	UPX
behavioral1/files/0x000700000002442c-118.dat	UPX
behavioral1/memory/1984-117-0x00007FF74A840000-0x00007FF74AB92000-memory.dmp	UPX
behavioral1/files/0x000700000002442a-112.dat	UPX
behavioral1/files/0x0007000000024429-106.dat	UPX
behavioral1/files/0x002b00000001b679-114.dat	UPX
behavioral1/files/0x0007000000024428-101.dat	UPX
behavioral1/memory/3988-98-0x00007FF73DB10000-0x00007FF73DE62000-memory.dmp	UPX
behavioral1/memory/1736-128-0x00007FF78A2A0000-0x00007FF78A5F2000-memory.dmp	UPX
behavioral1/memory/1064-129-0x00007FF78A3C0000-0x00007FF78A712000-memory.dmp	UPX
behavioral1/memory/4416-130-0x00007FF6CDCA0000-0x00007FF6CDFF2000-memory.dmp	UPX
behavioral1/memory/3988-131-0x00007FF73DB10000-0x00007FF73DE62000-memory.dmp	UPX
behavioral1/memory/1984-132-0x00007FF74A840000-0x00007FF74AB92000-memory.dmp	UPX
behavioral1/memory/1064-133-0x00007FF78A3C0000-0x00007FF78A712000-memory.dmp	UPX
behavioral1/memory/1752-135-0x00007FF69D550000-0x00007FF69D8A2000-memory.dmp	UPX
behavioral1/memory/4416-134-0x00007FF6CDCA0000-0x00007FF6CDFF2000-memory.dmp	UPX
behavioral1/memory/1160-138-0x00007FF70D5A0000-0x00007FF70D8F2000-memory.dmp	UPX
behavioral1/memory/4108-139-0x00007FF6D1AD0000-0x00007FF6D1E22000-memory.dmp	UPX
behavioral1/memory/2268-137-0x00007FF7B05F0000-0x00007FF7B0942000-memory.dmp	UPX
behavioral1/memory/2860-136-0x00007FF6A0050000-0x00007FF6A03A2000-memory.dmp	UPX
behavioral1/memory/3600-141-0x00007FF6F3200000-0x00007FF6F3552000-memory.dmp	UPX
behavioral1/memory/412-140-0x00007FF7D1D50000-0x00007FF7D20A2000-memory.dmp	UPX
behavioral1/memory/1960-143-0x00007FF7EA770000-0x00007FF7EAAC2000-memory.dmp	UPX
behavioral1/memory/2312-142-0x00007FF76BB00000-0x00007FF76BE52000-memory.dmp	UPX
behavioral1/memory/3944-144-0x00007FF7DB3F0000-0x00007FF7DB742000-memory.dmp	UPX
behavioral1/memory/2936-145-0x00007FF725BA0000-0x00007FF725EF2000-memory.dmp	UPX
behavioral1/memory/4252-146-0x00007FF67E1B0000-0x00007FF67E502000-memory.dmp	UPX
behavioral1/memory/1984-147-0x00007FF74A840000-0x00007FF74AB92000-memory.dmp	UPX
behavioral1/memory/4084-150-0x00007FF7562A0000-0x00007FF7565F2000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/1736-0-0x00007FF78A2A0000-0x00007FF78A5F2000-memory.dmp	xmrig
behavioral1/files/0x0009000000024364-6.dat	xmrig
behavioral1/files/0x000b0000000243ca-25.dat	xmrig
behavioral1/files/0x000700000002441d-33.dat	xmrig
behavioral1/files/0x0007000000024423-53.dat	xmrig
behavioral1/memory/2860-60-0x00007FF6A0050000-0x00007FF6A03A2000-memory.dmp	xmrig
behavioral1/memory/3600-70-0x00007FF6F3200000-0x00007FF6F3552000-memory.dmp	xmrig
behavioral1/memory/4108-78-0x00007FF6D1AD0000-0x00007FF6D1E22000-memory.dmp	xmrig
behavioral1/memory/2936-80-0x00007FF725BA0000-0x00007FF725EF2000-memory.dmp	xmrig
behavioral1/memory/412-79-0x00007FF7D1D50000-0x00007FF7D20A2000-memory.dmp	xmrig
behavioral1/memory/3944-77-0x00007FF7DB3F0000-0x00007FF7DB742000-memory.dmp	xmrig
behavioral1/memory/2312-76-0x00007FF76BB00000-0x00007FF76BE52000-memory.dmp	xmrig
behavioral1/memory/1960-75-0x00007FF7EA770000-0x00007FF7EAAC2000-memory.dmp	xmrig
behavioral1/files/0x0007000000024425-73.dat	xmrig
behavioral1/files/0x0007000000024424-71.dat	xmrig
behavioral1/files/0x0007000000024422-66.dat	xmrig
behavioral1/files/0x0007000000024421-64.dat	xmrig
behavioral1/files/0x0007000000024420-62.dat	xmrig
behavioral1/memory/2268-61-0x00007FF7B05F0000-0x00007FF7B0942000-memory.dmp	xmrig
behavioral1/memory/1160-56-0x00007FF70D5A0000-0x00007FF70D8F2000-memory.dmp	xmrig
behavioral1/memory/1752-54-0x00007FF69D550000-0x00007FF69D8A2000-memory.dmp	xmrig
behavioral1/files/0x000700000002441f-40.dat	xmrig
behavioral1/memory/4416-38-0x00007FF6CDCA0000-0x00007FF6CDFF2000-memory.dmp	xmrig
behavioral1/files/0x000700000002441e-35.dat	xmrig
behavioral1/memory/1064-22-0x00007FF78A3C0000-0x00007FF78A712000-memory.dmp	xmrig
behavioral1/files/0x0011000000024365-21.dat	xmrig
behavioral1/files/0x000600000001686d-13.dat	xmrig
behavioral1/files/0x000500000001e108-89.dat	xmrig
behavioral1/files/0x0007000000024426-105.dat	xmrig
behavioral1/files/0x000700000002442b-121.dat	xmrig
behavioral1/memory/4084-120-0x00007FF7562A0000-0x00007FF7565F2000-memory.dmp	xmrig
behavioral1/memory/1564-124-0x00007FF6C8830000-0x00007FF6C8B82000-memory.dmp	xmrig
behavioral1/memory/4552-125-0x00007FF6E5930000-0x00007FF6E5C82000-memory.dmp	xmrig
behavioral1/memory/4252-127-0x00007FF67E1B0000-0x00007FF67E502000-memory.dmp	xmrig
behavioral1/memory/516-126-0x00007FF7DDDD0000-0x00007FF7DE122000-memory.dmp	xmrig
behavioral1/memory/32-123-0x00007FF6EAD90000-0x00007FF6EB0E2000-memory.dmp	xmrig
behavioral1/files/0x000700000002442c-118.dat	xmrig
behavioral1/memory/1984-117-0x00007FF74A840000-0x00007FF74AB92000-memory.dmp	xmrig
behavioral1/files/0x000700000002442a-112.dat	xmrig
behavioral1/files/0x0007000000024429-106.dat	xmrig
behavioral1/files/0x002b00000001b679-114.dat	xmrig
behavioral1/files/0x0007000000024428-101.dat	xmrig
behavioral1/memory/3988-98-0x00007FF73DB10000-0x00007FF73DE62000-memory.dmp	xmrig
behavioral1/memory/1736-128-0x00007FF78A2A0000-0x00007FF78A5F2000-memory.dmp	xmrig
behavioral1/memory/1064-129-0x00007FF78A3C0000-0x00007FF78A712000-memory.dmp	xmrig
behavioral1/memory/4416-130-0x00007FF6CDCA0000-0x00007FF6CDFF2000-memory.dmp	xmrig
behavioral1/memory/3988-131-0x00007FF73DB10000-0x00007FF73DE62000-memory.dmp	xmrig
behavioral1/memory/1984-132-0x00007FF74A840000-0x00007FF74AB92000-memory.dmp	xmrig
behavioral1/memory/1064-133-0x00007FF78A3C0000-0x00007FF78A712000-memory.dmp	xmrig
behavioral1/memory/1752-135-0x00007FF69D550000-0x00007FF69D8A2000-memory.dmp	xmrig
behavioral1/memory/4416-134-0x00007FF6CDCA0000-0x00007FF6CDFF2000-memory.dmp	xmrig
behavioral1/memory/1160-138-0x00007FF70D5A0000-0x00007FF70D8F2000-memory.dmp	xmrig
behavioral1/memory/4108-139-0x00007FF6D1AD0000-0x00007FF6D1E22000-memory.dmp	xmrig
behavioral1/memory/2268-137-0x00007FF7B05F0000-0x00007FF7B0942000-memory.dmp	xmrig
behavioral1/memory/2860-136-0x00007FF6A0050000-0x00007FF6A03A2000-memory.dmp	xmrig
behavioral1/memory/3600-141-0x00007FF6F3200000-0x00007FF6F3552000-memory.dmp	xmrig
behavioral1/memory/412-140-0x00007FF7D1D50000-0x00007FF7D20A2000-memory.dmp	xmrig
behavioral1/memory/1960-143-0x00007FF7EA770000-0x00007FF7EAAC2000-memory.dmp	xmrig
behavioral1/memory/2312-142-0x00007FF76BB00000-0x00007FF76BE52000-memory.dmp	xmrig
behavioral1/memory/3944-144-0x00007FF7DB3F0000-0x00007FF7DB742000-memory.dmp	xmrig
behavioral1/memory/2936-145-0x00007FF725BA0000-0x00007FF725EF2000-memory.dmp	xmrig
behavioral1/memory/4252-146-0x00007FF67E1B0000-0x00007FF67E502000-memory.dmp	xmrig
behavioral1/memory/1984-147-0x00007FF74A840000-0x00007FF74AB92000-memory.dmp	xmrig
behavioral1/memory/4084-150-0x00007FF7562A0000-0x00007FF7565F2000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1064	JPvWIhL.exe
4416	gduIbgv.exe
1752	hTQaVnD.exe
4108	fBiIOyF.exe
1160	QLRlzxq.exe
2860	kJMjeqZ.exe
2268	MVuNmWX.exe
412	hIAgZIs.exe
3600	QshbsDV.exe
1960	yLZeRdh.exe
2312	nkgXCqv.exe
2936	ouOhDWU.exe
3944	KVYzsaQ.exe
3988	DpaPjlN.exe
516	MMuVytW.exe
1984	btSPgos.exe
4252	UtzIDag.exe
4084	lWKIsEh.exe
32	CZfeEBS.exe
1564	xFQUdPn.exe
4552	FPROyMR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1736-0-0x00007FF78A2A0000-0x00007FF78A5F2000-memory.dmp	upx
behavioral1/files/0x0009000000024364-6.dat	upx
behavioral1/files/0x000b0000000243ca-25.dat	upx
behavioral1/files/0x000700000002441d-33.dat	upx
behavioral1/files/0x0007000000024423-53.dat	upx
behavioral1/memory/2860-60-0x00007FF6A0050000-0x00007FF6A03A2000-memory.dmp	upx
behavioral1/memory/3600-70-0x00007FF6F3200000-0x00007FF6F3552000-memory.dmp	upx
behavioral1/memory/4108-78-0x00007FF6D1AD0000-0x00007FF6D1E22000-memory.dmp	upx
behavioral1/memory/2936-80-0x00007FF725BA0000-0x00007FF725EF2000-memory.dmp	upx
behavioral1/memory/412-79-0x00007FF7D1D50000-0x00007FF7D20A2000-memory.dmp	upx
behavioral1/memory/3944-77-0x00007FF7DB3F0000-0x00007FF7DB742000-memory.dmp	upx
behavioral1/memory/2312-76-0x00007FF76BB00000-0x00007FF76BE52000-memory.dmp	upx
behavioral1/memory/1960-75-0x00007FF7EA770000-0x00007FF7EAAC2000-memory.dmp	upx
behavioral1/files/0x0007000000024425-73.dat	upx
behavioral1/files/0x0007000000024424-71.dat	upx
behavioral1/files/0x0007000000024422-66.dat	upx
behavioral1/files/0x0007000000024421-64.dat	upx
behavioral1/files/0x0007000000024420-62.dat	upx
behavioral1/memory/2268-61-0x00007FF7B05F0000-0x00007FF7B0942000-memory.dmp	upx
behavioral1/memory/1160-56-0x00007FF70D5A0000-0x00007FF70D8F2000-memory.dmp	upx
behavioral1/memory/1752-54-0x00007FF69D550000-0x00007FF69D8A2000-memory.dmp	upx
behavioral1/files/0x000700000002441f-40.dat	upx
behavioral1/memory/4416-38-0x00007FF6CDCA0000-0x00007FF6CDFF2000-memory.dmp	upx
behavioral1/files/0x000700000002441e-35.dat	upx
behavioral1/memory/1064-22-0x00007FF78A3C0000-0x00007FF78A712000-memory.dmp	upx
behavioral1/files/0x0011000000024365-21.dat	upx
behavioral1/files/0x000600000001686d-13.dat	upx
behavioral1/files/0x000500000001e108-89.dat	upx
behavioral1/files/0x0007000000024426-105.dat	upx
behavioral1/files/0x000700000002442b-121.dat	upx
behavioral1/memory/4084-120-0x00007FF7562A0000-0x00007FF7565F2000-memory.dmp	upx
behavioral1/memory/1564-124-0x00007FF6C8830000-0x00007FF6C8B82000-memory.dmp	upx
behavioral1/memory/4552-125-0x00007FF6E5930000-0x00007FF6E5C82000-memory.dmp	upx
behavioral1/memory/4252-127-0x00007FF67E1B0000-0x00007FF67E502000-memory.dmp	upx
behavioral1/memory/516-126-0x00007FF7DDDD0000-0x00007FF7DE122000-memory.dmp	upx
behavioral1/memory/32-123-0x00007FF6EAD90000-0x00007FF6EB0E2000-memory.dmp	upx
behavioral1/files/0x000700000002442c-118.dat	upx
behavioral1/memory/1984-117-0x00007FF74A840000-0x00007FF74AB92000-memory.dmp	upx
behavioral1/files/0x000700000002442a-112.dat	upx
behavioral1/files/0x0007000000024429-106.dat	upx
behavioral1/files/0x002b00000001b679-114.dat	upx
behavioral1/files/0x0007000000024428-101.dat	upx
behavioral1/memory/3988-98-0x00007FF73DB10000-0x00007FF73DE62000-memory.dmp	upx
behavioral1/memory/1736-128-0x00007FF78A2A0000-0x00007FF78A5F2000-memory.dmp	upx
behavioral1/memory/1064-129-0x00007FF78A3C0000-0x00007FF78A712000-memory.dmp	upx
behavioral1/memory/4416-130-0x00007FF6CDCA0000-0x00007FF6CDFF2000-memory.dmp	upx
behavioral1/memory/3988-131-0x00007FF73DB10000-0x00007FF73DE62000-memory.dmp	upx
behavioral1/memory/1984-132-0x00007FF74A840000-0x00007FF74AB92000-memory.dmp	upx
behavioral1/memory/1064-133-0x00007FF78A3C0000-0x00007FF78A712000-memory.dmp	upx
behavioral1/memory/1752-135-0x00007FF69D550000-0x00007FF69D8A2000-memory.dmp	upx
behavioral1/memory/4416-134-0x00007FF6CDCA0000-0x00007FF6CDFF2000-memory.dmp	upx
behavioral1/memory/1160-138-0x00007FF70D5A0000-0x00007FF70D8F2000-memory.dmp	upx
behavioral1/memory/4108-139-0x00007FF6D1AD0000-0x00007FF6D1E22000-memory.dmp	upx
behavioral1/memory/2268-137-0x00007FF7B05F0000-0x00007FF7B0942000-memory.dmp	upx
behavioral1/memory/2860-136-0x00007FF6A0050000-0x00007FF6A03A2000-memory.dmp	upx
behavioral1/memory/3600-141-0x00007FF6F3200000-0x00007FF6F3552000-memory.dmp	upx
behavioral1/memory/412-140-0x00007FF7D1D50000-0x00007FF7D20A2000-memory.dmp	upx
behavioral1/memory/1960-143-0x00007FF7EA770000-0x00007FF7EAAC2000-memory.dmp	upx
behavioral1/memory/2312-142-0x00007FF76BB00000-0x00007FF76BE52000-memory.dmp	upx
behavioral1/memory/3944-144-0x00007FF7DB3F0000-0x00007FF7DB742000-memory.dmp	upx
behavioral1/memory/2936-145-0x00007FF725BA0000-0x00007FF725EF2000-memory.dmp	upx
behavioral1/memory/4252-146-0x00007FF67E1B0000-0x00007FF67E502000-memory.dmp	upx
behavioral1/memory/1984-147-0x00007FF74A840000-0x00007FF74AB92000-memory.dmp	upx
behavioral1/memory/4084-150-0x00007FF7562A0000-0x00007FF7565F2000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\hIAgZIs.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\lWKIsEh.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\xFQUdPn.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\KVYzsaQ.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\DpaPjlN.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\gduIbgv.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\fBiIOyF.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\QLRlzxq.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\QshbsDV.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\yLZeRdh.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\btSPgos.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\JPvWIhL.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\MVuNmWX.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\ouOhDWU.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\CZfeEBS.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\FPROyMR.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\hTQaVnD.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\kJMjeqZ.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\nkgXCqv.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\MMuVytW.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\UtzIDag.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1064	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	84
PID 1736 wrote to memory of 4416	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	85
PID 1736 wrote to memory of 1752	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	86
PID 1736 wrote to memory of 4108	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	87
PID 1736 wrote to memory of 1160	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	88
PID 1736 wrote to memory of 2860	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	89
PID 1736 wrote to memory of 2268	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 1736 wrote to memory of 412	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 1736 wrote to memory of 3600	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 1736 wrote to memory of 1960	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 1736 wrote to memory of 2312	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 1736 wrote to memory of 2936	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 1736 wrote to memory of 3944	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 1736 wrote to memory of 3988	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 1736 wrote to memory of 516	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 1736 wrote to memory of 1984	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 1736 wrote to memory of 4252	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 1736 wrote to memory of 4084	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 1736 wrote to memory of 32	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 1736 wrote to memory of 1564	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 1736 wrote to memory of 4552	1736	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\System\JPvWIhL.exe
  C:\Windows\System\JPvWIhL.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\gduIbgv.exe
  C:\Windows\System\gduIbgv.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\hTQaVnD.exe
  C:\Windows\System\hTQaVnD.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\fBiIOyF.exe
  C:\Windows\System\fBiIOyF.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\QLRlzxq.exe
  C:\Windows\System\QLRlzxq.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\kJMjeqZ.exe
  C:\Windows\System\kJMjeqZ.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\MVuNmWX.exe
  C:\Windows\System\MVuNmWX.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\hIAgZIs.exe
  C:\Windows\System\hIAgZIs.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\QshbsDV.exe
  C:\Windows\System\QshbsDV.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\yLZeRdh.exe
  C:\Windows\System\yLZeRdh.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\nkgXCqv.exe
  C:\Windows\System\nkgXCqv.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\ouOhDWU.exe
  C:\Windows\System\ouOhDWU.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\KVYzsaQ.exe
  C:\Windows\System\KVYzsaQ.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\DpaPjlN.exe
  C:\Windows\System\DpaPjlN.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\MMuVytW.exe
  C:\Windows\System\MMuVytW.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\btSPgos.exe
  C:\Windows\System\btSPgos.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\UtzIDag.exe
  C:\Windows\System\UtzIDag.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\lWKIsEh.exe
  C:\Windows\System\lWKIsEh.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\CZfeEBS.exe
  C:\Windows\System\CZfeEBS.exe
  2⤵
  - Executes dropped EXE
  PID:32
- C:\Windows\System\xFQUdPn.exe
  C:\Windows\System\xFQUdPn.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\FPROyMR.exe
  C:\Windows\System\FPROyMR.exe
  2⤵
  - Executes dropped EXE
  PID:4552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CZfeEBS.exe

Path C:\Windows\System\CZfeEBS.exe
Size 8.3MB
SHA256 ab3e91cfb2df94a1430beb9aec068bf67805cab94bc106f36d6953ae51b52fa2
MD5 9a798cd41ddb40f895aeef9def39b12c
SHA1 77b06ac3c51dfd5775cf403a2f1f6b0b494f6ac3
SHA512 4020f93772357125531110ecdac64fd7237dee0468161b2619941ab032583ff53119052632f3bdaaa8417f0e718d21d5c78c35a184e557b629a4e6a42e709590
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUM:v+D56utgpPF8u/7M
TLSH
T16B965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DpaPjlN.exe

Path C:\Windows\System\DpaPjlN.exe
Size 8.3MB
SHA256 706c7bf9db028d86e906b96982fd3e9b5d1d20a23c9e5c1941d3d83373732b2e
MD5 5cc6fed2f3cfdcaffd69f79295c4f55c
SHA1 5a62d9c11350c2f5c597f08739e9049e721c719a
SHA512 7ece9862c1f86d78a821741a894dd0d2629751671c29b80f57a39393d4a77853057fb580cad547ee48fbe528bbb5252e9beac79ffa22a624be33276b365f7483
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUs:v+D56utgpPF8u/7s
TLSH
T144965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FPROyMR.exe

Path C:\Windows\System\FPROyMR.exe
Size 8.3MB
SHA256 baa100ca1bd69de061804866843c7f657e610bdebfc55101dc71f30af493dcc2
MD5 9c0d9446f527736fd2426c9584df53db
SHA1 e7fccb7d46fea5e30fff0f9d7ffe8afae82e903c
SHA512 39394b184a1a641f978ceb5492a1bcb1edcf23a3efc8c32f3684aaecc3c619f23043b9ec335863d3e6764a0913467a0f48746ce64da75fee1ef2b6c738140baf
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUq:v+D56utgpPF8u/7q
TLSH
T13B965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JPvWIhL.exe

Path C:\Windows\System\JPvWIhL.exe
Size 8.3MB
SHA256 34110720458083bad6326e345708c89bbc011029632b67981871627d42153df1
MD5 2a4ce381406a6bc7b47f092402a2356e
SHA1 df4f11962e16092a891b36b1c5a342e0b374af15
SHA512 fae1ac25828502974e775258e82f2a58e01638ca61f1113c31182df8ebdb038e8eee02aa67d3c8152c8ff65b31dfae215c9f273da01c23dc25e77fcfee0cd396
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUE:v+D56utgpPF8u/7E
TLSH
T167965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KVYzsaQ.exe

Path C:\Windows\System\KVYzsaQ.exe
Size 8.3MB
SHA256 cb6a48f4a3c55ab23588cd12f41c4950e4a83cb1237440c0a5bccaac73ca11bf
MD5 3ce0ce8f9a98cc509f88a78d5618bd7a
SHA1 831c5f67bd1dc8da7bdb6acff827c9173cfef110
SHA512 cd1b3db3ec72f604560f9e806d3bcfcdd9a052faa9d90baa7d7f474022103592b016eb244a4bb44046a65f0646dbd2a97f2ff581d2a3a09caa223745eff8fb04
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUm:v+D56utgpPF8u/7m
TLSH
T188965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MMuVytW.exe

Path C:\Windows\System\MMuVytW.exe
Size 8.3MB
SHA256 4f78c29a2267c712af5c1a103050108fb0c83fb501454e2fddbcb850f3358917
MD5 8b132398d8b2c837b3f56ff7436efb98
SHA1 3f11a9bae8821cdcb9e244a0081a48a435b177a8
SHA512 ce5398ad742216e1f0059322bc5b74b68dcfcb1bf27a8acdcb16d19df52673ddc8cf9335b8de1abf950f3aed8ce90c11343e9444f2608f045a7b8f6c105e3c23
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUb:v+D56utgpPF8u/7b
TLSH
T180965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MVuNmWX.exe

Path C:\Windows\System\MVuNmWX.exe
Size 8.3MB
SHA256 5f8cc9ac072597ca35adcf0902f102d5196aff7e8d61cefc016cce4cb2f8bc65
MD5 b96231da6626545d3e41a6b6fcce9d63
SHA1 ba1e6878c48dcede9f93ae847af441038261967e
SHA512 e5402d6528604fdb6edbb1b3f683eeac3745a6ae42b6254d4702daa8520f2a5b80fbdd726713f3b874f0d0e566f72fe394f8b1aebcf4c75d7a7fa6dd62ce8136
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUC:v+D56utgpPF8u/7C
TLSH
T107965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QLRlzxq.exe

Path C:\Windows\System\QLRlzxq.exe
Size 8.3MB
SHA256 68d10f868b4bc3be95bedbe8a480628f5a8d8789f6af87de03fa6ced371b3024
MD5 288dc010dcefdd080a6aaf63bb3ddb9e
SHA1 97e19301a3f4d29589653c7b11bba9f02ca8a983
SHA512 3caf7c227f39b752a8e657cb2acc0badabde295f283bc89b27c43b660bb48e59eb19d9d2ae1f4f1355c01425b96baeed9fd2f2f819ad1bed56c2e8d89696c10b
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUS:v+D56utgpPF8u/7S
TLSH
T165965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QshbsDV.exe

Path C:\Windows\System\QshbsDV.exe
Size 8.3MB
SHA256 172a9a3c1c4b07bf480784fcbb61aac8203780ec2cde0e6fc927a14904da1624
MD5 0899ff3c183b948e76761ad5d7006f68
SHA1 66766fa214b51ecb58a541ef9483b77511be1bf6
SHA512 74d93a390339201470d7fdbe0eccb8dc69dfea89a5ec34e58c6edae1de5aefd05dcc8e3a9c2d152a3e4ab26dcfe5202c4034e6d3864ad7ecf7bc42210ed5eca0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUq:v+D56utgpPF8u/7q
TLSH
T144965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UtzIDag.exe

Path C:\Windows\System\UtzIDag.exe
Size 8.3MB
SHA256 e90ad3ff197b0ca1d037960fb0b6c37ea0cbc59c17f44c909b6dab811bbd4696
MD5 e90e63b209717c7d2e1df0b4049c2e77
SHA1 aa460bfe3de012afa035f037c06af4c2a070e322
SHA512 5f851a2d87d1fdeff9f956ee65183260cff45c3096f5a2dfc6d6b124f9549811e5437716fd15171ccf8823bfcc8df4aed01d7a34d8f99cf8bd443756ceffec68
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUt:v+D56utgpPF8u/7t
TLSH
T1CD965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

btSPgos.exe

Path C:\Windows\System\btSPgos.exe
Size 8.3MB
SHA256 951b07a0f59d67e50e22ce10cf1006edd1aab06f5a81969c79ab5acb4f113f61
MD5 2780839c48fab17301fa8d4703f474de
SHA1 98290f43f1bc2a61ada93d046155487edc0502b4
SHA512 c111dee9e2dfebdb739ff98abefb15975b8221e78d31c453fca0d5f7453dbb14a003f996c319813e716b2eef7165a5079deae52f90540ec791f25eba871e61e3
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUW:v+D56utgpPF8u/7W
TLSH
T17E965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fBiIOyF.exe

Path C:\Windows\System\fBiIOyF.exe
Size 8.3MB
SHA256 357318e19de830ccc90df4f320d24a52fc21c7384f8fc267bf11730f93b2b20b
MD5 94d4424f4ac4b299ad15b5b7250c05dd
SHA1 e3b9e40c70d12945cec1121b41dd2bd2c2a878ae
SHA512 bc78cfe7431ded7c3a431eaafcfe915f28534c9d04727a65a871521d815281a721fb1dd43fd15477ac332755581034c88d2fb65905f775ec6ddde78885744e86
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUg:v+D56utgpPF8u/7g
TLSH
T168965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gduIbgv.exe

Path C:\Windows\System\gduIbgv.exe
Size 8.3MB
SHA256 e03a1aa2e7890a0d7783c0ca8758863a9e56ec80b278fe84f8a8dba2d628077f
MD5 52a44078e5d186a3baa8ef23874bc849
SHA1 ffae6dde68cf6b5706739fcb75104b2518d43ecc
SHA512 19980bf262c93392faf49f8e85f21fc919c2d0bbfc5438eb795354b550d03e0715d2a764ecef0cc268bdb8c5669d2a106b023de5b7690d821a1f990e076d29cb
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUo:v+D56utgpPF8u/7o
TLSH
T1AB965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hIAgZIs.exe

Path C:\Windows\System\hIAgZIs.exe
Size 8.3MB
SHA256 bf3c4413924827b599ba780b2a125ca971760496d28ee26fcf2cca11efdd6c3f
MD5 31f1ce9bab99077605e169f910f33c20
SHA1 399603e413d8636facda2bf6ce6b549a13e681e1
SHA512 f4f66a39cd6cf1e0b0ba32a427d915b2d6fcc8ae7af1df696d0b82b0f0973cb41be822620af4c0cab006ec37d65c8023963cbd98d86b4b8e218e7572e304d525
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUZ:v+D56utgpPF8u/7Z
TLSH
T1E4965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hTQaVnD.exe

Path C:\Windows\System\hTQaVnD.exe
Size 8.3MB
SHA256 416cd7b9f9ee77a8cfa4d6875658f0082f45aa852851d4b7c46ad763496a8ee5
MD5 db1d2572487c3f5dc55b28d30a97d0fb
SHA1 9f8180a858f3748502b494d2ceb36edc389043a1
SHA512 3540c9de2d6ef79c9253c3623f889528a8dd1b5256b4b4fc972b6e980151a4f0ca511c5991d9820570d53d77ce3bda0410cb58a1b2255b39fb7037ea1e4a8e8e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUt:v+D56utgpPF8u/7t
TLSH
T13A965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kJMjeqZ.exe

Path C:\Windows\System\kJMjeqZ.exe
Size 8.3MB
SHA256 b3422fa9756827669fbcb15189b2b5d0a658be8bb21eef584902940119faafa1
MD5 bdb35ee70481d71af54079c664fb09cc
SHA1 a11f4ed83eb105213b5ad97fe6767427a046af39
SHA512 fd32dee9d7d9b91a69e3df1e3480dc1b50040b7bf2d414f0d496f6df86bcfef65a75886e727289eda7d137a167794a7077b604ec46d6046224a85cd5efee1983
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUY:v+D56utgpPF8u/7Y
TLSH
T157965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lWKIsEh.exe

Path C:\Windows\System\lWKIsEh.exe
Size 8.3MB
SHA256 fc6376767b7371adcfb8d04952df329b27956f4fc93efba9a6de163b033ec8a8
MD5 a7bed9afe68d5c0c4e229bbd18f87330
SHA1 6d6f7244573e8e1ac492a40de348852fa3829e54
SHA512 9d22028b3ace98ff4e151aa6fcaae823d6c0688c7d6f3e871144d842b417cbcd8f2edbb9db01b72711fd939d8002893ad6ef3789bc867e16cb76bf0d6b5c6f97
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUW:v+D56utgpPF8u/7W
TLSH
T169965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkgXCqv.exe

Path C:\Windows\System\nkgXCqv.exe
Size 8.3MB
SHA256 bc6f7d8f87d52a3efff2139e860d110105476f67ebc0afe3ddd10f11cf9aa2c0
MD5 e3261d583fec667f7bb11d1c60179136
SHA1 93d3216257d3f1a5920d382c59a5db1afac7f8ec
SHA512 e1d705f62a3daf8084f645d0123a637ee566fec6329706992c90627620c19910dd01a042307e9cbdc2843be4e43588ed9bf73c07f00897bd5a373a7f4f159d2a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUB:v+D56utgpPF8u/7B
TLSH
T188965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ouOhDWU.exe

Path C:\Windows\System\ouOhDWU.exe
Size 8.3MB
SHA256 c609175a7c606f855a0e18de24364b6999c1c1a2153359f1f4214f768099760f
MD5 afad8223108e6c2eb113337b9e7bfb4d
SHA1 59c81c53a076d201adf6340921a5ca183efd7fcb
SHA512 ef161ff969685c19e0aa7facbc86eeb97abb447dbef31c5f5f3442a306c4390587e95118e4c2c2745ed82b24c2882fb7af38f6951b97315955942db6252c7657
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUK:v+D56utgpPF8u/7K
TLSH
T125965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xFQUdPn.exe

Path C:\Windows\System\xFQUdPn.exe
Size 8.3MB
SHA256 d2ef16a82736a8c8d87ea17e624288da0bb26d35ff645ea5eac20cbbcdda0571
MD5 fb1a560d65962ae0aeaf0e9419e38dd9
SHA1 4b72be1c5cfaf292d6308ee2b639f9f6bb5b94fa
SHA512 2cc455f7e70f203df013e92808a599f06447b517b9212a1f9f9fb2134c755af62f0fb94dec931fd71789357e0535bc582a86f242d6aded20cfea2276e21d362a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUM:v+D56utgpPF8u/7M
TLSH
T172965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yLZeRdh.exe

Path C:\Windows\System\yLZeRdh.exe
Size 8.3MB
SHA256 ce786746cabd3a939a437169195ea8f54ffe69456dcb48f08f65f4d00cc3ecaa
MD5 59df9409b460b846fb70c1b5988ce618
SHA1 f8ef03ebc875358907af8e20bf6ebc19aaea5648
SHA512 dd3a56569fe370c703c27903cea273a0dc84dfb9d7e432524aaa464c4bf9ccc5a029d25ba6d8f3b73a0e9654dff44a243cd70b013313c37325824cba38a377cb
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUS:v+D56utgpPF8u/7S
TLSH
T1C2965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/32-123-0x00007FF6EAD90000-0x00007FF6EB0E2000-memory.dmp

Download

memory/32-149-0x00007FF6EAD90000-0x00007FF6EB0E2000-memory.dmp

Download

memory/412-79-0x00007FF7D1D50000-0x00007FF7D20A2000-memory.dmp

Download

memory/412-140-0x00007FF7D1D50000-0x00007FF7D20A2000-memory.dmp

Download

memory/516-126-0x00007FF7DDDD0000-0x00007FF7DE122000-memory.dmp

Download

memory/516-151-0x00007FF7DDDD0000-0x00007FF7DE122000-memory.dmp

Download

memory/1064-129-0x00007FF78A3C0000-0x00007FF78A712000-memory.dmp

Download

memory/1064-22-0x00007FF78A3C0000-0x00007FF78A712000-memory.dmp

Download

memory/1064-133-0x00007FF78A3C0000-0x00007FF78A712000-memory.dmp

Download

memory/1160-56-0x00007FF70D5A0000-0x00007FF70D8F2000-memory.dmp

Download

memory/1160-138-0x00007FF70D5A0000-0x00007FF70D8F2000-memory.dmp

Download

memory/1564-153-0x00007FF6C8830000-0x00007FF6C8B82000-memory.dmp

Download

memory/1564-124-0x00007FF6C8830000-0x00007FF6C8B82000-memory.dmp

Download

memory/1736-128-0x00007FF78A2A0000-0x00007FF78A5F2000-memory.dmp

Download

memory/1736-1-0x00000174FDD00000-0x00000174FDD10000-memory.dmp

Download

memory/1736-0-0x00007FF78A2A0000-0x00007FF78A5F2000-memory.dmp

Download

memory/1752-135-0x00007FF69D550000-0x00007FF69D8A2000-memory.dmp

Download

memory/1752-54-0x00007FF69D550000-0x00007FF69D8A2000-memory.dmp

Download

memory/1960-143-0x00007FF7EA770000-0x00007FF7EAAC2000-memory.dmp

Download

memory/1960-75-0x00007FF7EA770000-0x00007FF7EAAC2000-memory.dmp

Download

memory/1984-132-0x00007FF74A840000-0x00007FF74AB92000-memory.dmp

Download

memory/1984-117-0x00007FF74A840000-0x00007FF74AB92000-memory.dmp

Download

memory/1984-147-0x00007FF74A840000-0x00007FF74AB92000-memory.dmp

Download

memory/2268-137-0x00007FF7B05F0000-0x00007FF7B0942000-memory.dmp

Download

memory/2268-61-0x00007FF7B05F0000-0x00007FF7B0942000-memory.dmp

Download

memory/2312-76-0x00007FF76BB00000-0x00007FF76BE52000-memory.dmp

Download

memory/2312-142-0x00007FF76BB00000-0x00007FF76BE52000-memory.dmp

Download

memory/2860-136-0x00007FF6A0050000-0x00007FF6A03A2000-memory.dmp

Download

memory/2860-60-0x00007FF6A0050000-0x00007FF6A03A2000-memory.dmp

Download

memory/2936-80-0x00007FF725BA0000-0x00007FF725EF2000-memory.dmp

Download

memory/2936-145-0x00007FF725BA0000-0x00007FF725EF2000-memory.dmp

Download

memory/3600-70-0x00007FF6F3200000-0x00007FF6F3552000-memory.dmp

Download

memory/3600-141-0x00007FF6F3200000-0x00007FF6F3552000-memory.dmp

Download

memory/3944-77-0x00007FF7DB3F0000-0x00007FF7DB742000-memory.dmp

Download

memory/3944-144-0x00007FF7DB3F0000-0x00007FF7DB742000-memory.dmp

Download

memory/3988-148-0x00007FF73DB10000-0x00007FF73DE62000-memory.dmp

Download

memory/3988-131-0x00007FF73DB10000-0x00007FF73DE62000-memory.dmp

Download

memory/3988-98-0x00007FF73DB10000-0x00007FF73DE62000-memory.dmp

Download

memory/4084-120-0x00007FF7562A0000-0x00007FF7565F2000-memory.dmp

Download

memory/4084-150-0x00007FF7562A0000-0x00007FF7565F2000-memory.dmp

Download

memory/4108-78-0x00007FF6D1AD0000-0x00007FF6D1E22000-memory.dmp

Download

memory/4108-139-0x00007FF6D1AD0000-0x00007FF6D1E22000-memory.dmp

Download

memory/4252-146-0x00007FF67E1B0000-0x00007FF67E502000-memory.dmp

Download

memory/4252-127-0x00007FF67E1B0000-0x00007FF67E502000-memory.dmp

Download

memory/4416-134-0x00007FF6CDCA0000-0x00007FF6CDFF2000-memory.dmp

Download

memory/4416-130-0x00007FF6CDCA0000-0x00007FF6CDFF2000-memory.dmp

Download

memory/4416-38-0x00007FF6CDCA0000-0x00007FF6CDFF2000-memory.dmp

Download

memory/4552-152-0x00007FF6E5930000-0x00007FF6E5C82000-memory.dmp

Download

memory/4552-125-0x00007FF6E5930000-0x00007FF6E5C82000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads