cobaltstrike | 8d53e5a5f7c8931efdf02304ea0604c6ded15a819fd5ebd04ab530ee26cf2f93

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Size 8.3MB
Sample261110-1e49bsbd39
SHA256 8d53e5a5f7c8931efdf02304ea0604c6ded15a819fd5ebd04ab530ee26cf2f93
MD5 41e698f2a16df3f3a327f5dece9345a7
SHA1 a4b59ebc0515f6462457ac5049f7216e0a0adcc1
SHA512 6d5bb56b981492f24275c0ea8003847e41eed82d40e9fc88fa1dba45c0dca0cadb407c7fd6e44ed4ed8606cb29ac39ec6a9b0552d016e20cf4171b3f6310a61e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU9:v+D56utgpPF8u/79
TLSH
T1E9965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,ns8.softline.top,ns9.softline.top
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000d00000001b2f6-4.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4ec-9.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4ed-16.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4ee-23.dat	cobalt_reflective_dll
behavioral2/files/0x000e00000001c4e9-29.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4ef-34.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4f0-41.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4f1-47.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4f2-52.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4f3-57.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4f4-62.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4f5-68.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4f6-73.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4f9-82.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4fc-93.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4fd-98.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4fe-103.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4ff-108.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c500-112.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4fb-88.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000001c4f8-78.dat	cobalt_reflective_dll

Custom signature

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001b2f6-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4ec-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4ed-16.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4ee-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000e00000001c4e9-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4ef-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4f0-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4f1-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4f2-52.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4f3-57.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4f4-62.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4f5-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4f6-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4f9-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4fc-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4fd-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4fe-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4ff-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c500-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4fb-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000001c4f8-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

Custom signature

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4712-0-0x00007FF609B70000-0x00007FF609EC2000-memory.dmp	UPX
behavioral2/files/0x000d00000001b2f6-4.dat	UPX
behavioral2/memory/4192-8-0x00007FF7A40B0000-0x00007FF7A4402000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4ec-9.dat	UPX
behavioral2/memory/4200-12-0x00007FF6C7680000-0x00007FF6C79D2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4ed-16.dat	UPX
behavioral2/memory/4508-17-0x00007FF740080000-0x00007FF7403D2000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4ee-23.dat	UPX
behavioral2/memory/2776-24-0x00007FF6D2EB0000-0x00007FF6D3202000-memory.dmp	UPX
behavioral2/files/0x000e00000001c4e9-29.dat	UPX
behavioral2/memory/5224-31-0x00007FF675FF0000-0x00007FF676342000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4ef-34.dat	UPX
behavioral2/files/0x000d00000001c4f0-41.dat	UPX
behavioral2/memory/2604-44-0x00007FF7DE5B0000-0x00007FF7DE902000-memory.dmp	UPX
behavioral2/files/0x000d00000001c4f1-47.dat	UPX
behavioral2/files/0x000d00000001c4f2-52.dat	UPX
behavioral2/files/0x000d00000001c4f3-57.dat	UPX
behavioral2/files/0x000d00000001c4f4-62.dat	UPX
behavioral2/files/0x000d00000001c4f5-68.dat	UPX
behavioral2/files/0x000d00000001c4f6-73.dat	UPX
behavioral2/files/0x000d00000001c4f9-82.dat	UPX
behavioral2/files/0x000d00000001c4fc-93.dat	UPX
behavioral2/files/0x000d00000001c4fd-98.dat	UPX
behavioral2/files/0x000d00000001c4fe-103.dat	UPX
behavioral2/files/0x000d00000001c4ff-108.dat	UPX
behavioral2/files/0x000d00000001c500-112.dat	UPX
behavioral2/files/0x000d00000001c4fb-88.dat	UPX
behavioral2/files/0x000d00000001c4f8-78.dat	UPX
behavioral2/memory/4712-48-0x00007FF609B70000-0x00007FF609EC2000-memory.dmp	UPX
behavioral2/memory/5016-40-0x00007FF73C7E0000-0x00007FF73CB32000-memory.dmp	UPX
behavioral2/memory/5676-114-0x00007FF6E7170000-0x00007FF6E74C2000-memory.dmp	UPX
behavioral2/memory/1940-116-0x00007FF7FF8B0000-0x00007FF7FFC02000-memory.dmp	UPX
behavioral2/memory/2252-117-0x00007FF6123A0000-0x00007FF6126F2000-memory.dmp	UPX
behavioral2/memory/3436-118-0x00007FF6BE610000-0x00007FF6BE962000-memory.dmp	UPX
behavioral2/memory/4300-119-0x00007FF7AF190000-0x00007FF7AF4E2000-memory.dmp	UPX
behavioral2/memory/1620-120-0x00007FF603800000-0x00007FF603B52000-memory.dmp	UPX
behavioral2/memory/5668-121-0x00007FF6A4140000-0x00007FF6A4492000-memory.dmp	UPX
behavioral2/memory/120-122-0x00007FF6EABA0000-0x00007FF6EAEF2000-memory.dmp	UPX
behavioral2/memory/2420-123-0x00007FF61C7A0000-0x00007FF61CAF2000-memory.dmp	UPX
behavioral2/memory/2028-125-0x00007FF700620000-0x00007FF700972000-memory.dmp	UPX
behavioral2/memory/1508-124-0x00007FF7654E0000-0x00007FF765832000-memory.dmp	UPX
behavioral2/memory/1772-129-0x00007FF7CA790000-0x00007FF7CAAE2000-memory.dmp	UPX
behavioral2/memory/4192-128-0x00007FF7A40B0000-0x00007FF7A4402000-memory.dmp	UPX
behavioral2/memory/6092-127-0x00007FF660A30000-0x00007FF660D82000-memory.dmp	UPX
behavioral2/memory/5932-126-0x00007FF741970000-0x00007FF741CC2000-memory.dmp	UPX
behavioral2/memory/4200-130-0x00007FF6C7680000-0x00007FF6C79D2000-memory.dmp	UPX
behavioral2/memory/4508-131-0x00007FF740080000-0x00007FF7403D2000-memory.dmp	UPX
behavioral2/memory/2776-132-0x00007FF6D2EB0000-0x00007FF6D3202000-memory.dmp	UPX
behavioral2/memory/5224-133-0x00007FF675FF0000-0x00007FF676342000-memory.dmp	UPX
behavioral2/memory/2604-134-0x00007FF7DE5B0000-0x00007FF7DE902000-memory.dmp	UPX
behavioral2/memory/5676-135-0x00007FF6E7170000-0x00007FF6E74C2000-memory.dmp	UPX
behavioral2/memory/4192-136-0x00007FF7A40B0000-0x00007FF7A4402000-memory.dmp	UPX
behavioral2/memory/4200-137-0x00007FF6C7680000-0x00007FF6C79D2000-memory.dmp	UPX
behavioral2/memory/4508-138-0x00007FF740080000-0x00007FF7403D2000-memory.dmp	UPX
behavioral2/memory/2776-139-0x00007FF6D2EB0000-0x00007FF6D3202000-memory.dmp	UPX
behavioral2/memory/5224-140-0x00007FF675FF0000-0x00007FF676342000-memory.dmp	UPX
behavioral2/memory/5016-141-0x00007FF73C7E0000-0x00007FF73CB32000-memory.dmp	UPX
behavioral2/memory/2604-142-0x00007FF7DE5B0000-0x00007FF7DE902000-memory.dmp	UPX
behavioral2/memory/1772-143-0x00007FF7CA790000-0x00007FF7CAAE2000-memory.dmp	UPX
behavioral2/memory/1940-144-0x00007FF7FF8B0000-0x00007FF7FFC02000-memory.dmp	UPX
behavioral2/memory/3436-146-0x00007FF6BE610000-0x00007FF6BE962000-memory.dmp	UPX
behavioral2/memory/4300-147-0x00007FF7AF190000-0x00007FF7AF4E2000-memory.dmp	UPX
behavioral2/memory/2252-145-0x00007FF6123A0000-0x00007FF6126F2000-memory.dmp	UPX
behavioral2/memory/1508-150-0x00007FF7654E0000-0x00007FF765832000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4712-0-0x00007FF609B70000-0x00007FF609EC2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001b2f6-4.dat	xmrig
behavioral2/memory/4192-8-0x00007FF7A40B0000-0x00007FF7A4402000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4ec-9.dat	xmrig
behavioral2/memory/4200-12-0x00007FF6C7680000-0x00007FF6C79D2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4ed-16.dat	xmrig
behavioral2/memory/4508-17-0x00007FF740080000-0x00007FF7403D2000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4ee-23.dat	xmrig
behavioral2/memory/2776-24-0x00007FF6D2EB0000-0x00007FF6D3202000-memory.dmp	xmrig
behavioral2/files/0x000e00000001c4e9-29.dat	xmrig
behavioral2/memory/5224-31-0x00007FF675FF0000-0x00007FF676342000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4ef-34.dat	xmrig
behavioral2/files/0x000d00000001c4f0-41.dat	xmrig
behavioral2/memory/2604-44-0x00007FF7DE5B0000-0x00007FF7DE902000-memory.dmp	xmrig
behavioral2/files/0x000d00000001c4f1-47.dat	xmrig
behavioral2/files/0x000d00000001c4f2-52.dat	xmrig
behavioral2/files/0x000d00000001c4f3-57.dat	xmrig
behavioral2/files/0x000d00000001c4f4-62.dat	xmrig
behavioral2/files/0x000d00000001c4f5-68.dat	xmrig
behavioral2/files/0x000d00000001c4f6-73.dat	xmrig
behavioral2/files/0x000d00000001c4f9-82.dat	xmrig
behavioral2/files/0x000d00000001c4fc-93.dat	xmrig
behavioral2/files/0x000d00000001c4fd-98.dat	xmrig
behavioral2/files/0x000d00000001c4fe-103.dat	xmrig
behavioral2/files/0x000d00000001c4ff-108.dat	xmrig
behavioral2/files/0x000d00000001c500-112.dat	xmrig
behavioral2/files/0x000d00000001c4fb-88.dat	xmrig
behavioral2/files/0x000d00000001c4f8-78.dat	xmrig
behavioral2/memory/4712-48-0x00007FF609B70000-0x00007FF609EC2000-memory.dmp	xmrig
behavioral2/memory/5016-40-0x00007FF73C7E0000-0x00007FF73CB32000-memory.dmp	xmrig
behavioral2/memory/5676-114-0x00007FF6E7170000-0x00007FF6E74C2000-memory.dmp	xmrig
behavioral2/memory/1940-116-0x00007FF7FF8B0000-0x00007FF7FFC02000-memory.dmp	xmrig
behavioral2/memory/2252-117-0x00007FF6123A0000-0x00007FF6126F2000-memory.dmp	xmrig
behavioral2/memory/3436-118-0x00007FF6BE610000-0x00007FF6BE962000-memory.dmp	xmrig
behavioral2/memory/4300-119-0x00007FF7AF190000-0x00007FF7AF4E2000-memory.dmp	xmrig
behavioral2/memory/1620-120-0x00007FF603800000-0x00007FF603B52000-memory.dmp	xmrig
behavioral2/memory/5668-121-0x00007FF6A4140000-0x00007FF6A4492000-memory.dmp	xmrig
behavioral2/memory/120-122-0x00007FF6EABA0000-0x00007FF6EAEF2000-memory.dmp	xmrig
behavioral2/memory/2420-123-0x00007FF61C7A0000-0x00007FF61CAF2000-memory.dmp	xmrig
behavioral2/memory/2028-125-0x00007FF700620000-0x00007FF700972000-memory.dmp	xmrig
behavioral2/memory/1508-124-0x00007FF7654E0000-0x00007FF765832000-memory.dmp	xmrig
behavioral2/memory/1772-129-0x00007FF7CA790000-0x00007FF7CAAE2000-memory.dmp	xmrig
behavioral2/memory/4192-128-0x00007FF7A40B0000-0x00007FF7A4402000-memory.dmp	xmrig
behavioral2/memory/6092-127-0x00007FF660A30000-0x00007FF660D82000-memory.dmp	xmrig
behavioral2/memory/5932-126-0x00007FF741970000-0x00007FF741CC2000-memory.dmp	xmrig
behavioral2/memory/4200-130-0x00007FF6C7680000-0x00007FF6C79D2000-memory.dmp	xmrig
behavioral2/memory/4508-131-0x00007FF740080000-0x00007FF7403D2000-memory.dmp	xmrig
behavioral2/memory/2776-132-0x00007FF6D2EB0000-0x00007FF6D3202000-memory.dmp	xmrig
behavioral2/memory/5224-133-0x00007FF675FF0000-0x00007FF676342000-memory.dmp	xmrig
behavioral2/memory/2604-134-0x00007FF7DE5B0000-0x00007FF7DE902000-memory.dmp	xmrig
behavioral2/memory/5676-135-0x00007FF6E7170000-0x00007FF6E74C2000-memory.dmp	xmrig
behavioral2/memory/4192-136-0x00007FF7A40B0000-0x00007FF7A4402000-memory.dmp	xmrig
behavioral2/memory/4200-137-0x00007FF6C7680000-0x00007FF6C79D2000-memory.dmp	xmrig
behavioral2/memory/4508-138-0x00007FF740080000-0x00007FF7403D2000-memory.dmp	xmrig
behavioral2/memory/2776-139-0x00007FF6D2EB0000-0x00007FF6D3202000-memory.dmp	xmrig
behavioral2/memory/5224-140-0x00007FF675FF0000-0x00007FF676342000-memory.dmp	xmrig
behavioral2/memory/5016-141-0x00007FF73C7E0000-0x00007FF73CB32000-memory.dmp	xmrig
behavioral2/memory/2604-142-0x00007FF7DE5B0000-0x00007FF7DE902000-memory.dmp	xmrig
behavioral2/memory/1772-143-0x00007FF7CA790000-0x00007FF7CAAE2000-memory.dmp	xmrig
behavioral2/memory/1940-144-0x00007FF7FF8B0000-0x00007FF7FFC02000-memory.dmp	xmrig
behavioral2/memory/3436-146-0x00007FF6BE610000-0x00007FF6BE962000-memory.dmp	xmrig
behavioral2/memory/4300-147-0x00007FF7AF190000-0x00007FF7AF4E2000-memory.dmp	xmrig
behavioral2/memory/2252-145-0x00007FF6123A0000-0x00007FF6126F2000-memory.dmp	xmrig
behavioral2/memory/1508-150-0x00007FF7654E0000-0x00007FF765832000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4192	WxgzWjZ.exe
4200	CNcYkBL.exe
4508	JecCddY.exe
2776	wIFGuNH.exe
5224	dXxQgLd.exe
5016	BDfnqVW.exe
2604	AxbuGRA.exe
5676	MtBXVhq.exe
1772	YZHrZeV.exe
1940	KViVtut.exe
2252	YnECKGa.exe
3436	gmxnrvK.exe
4300	jDtCcwT.exe
1620	MTEiHGj.exe
5668	AUdDvru.exe
120	TAQgRRv.exe
2420	iDeAvPB.exe
1508	iPVPhrM.exe
2028	DvYUigq.exe
5932	yCwjHBz.exe
6092	rpwmNwo.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4712-0-0x00007FF609B70000-0x00007FF609EC2000-memory.dmp	upx
behavioral2/files/0x000d00000001b2f6-4.dat	upx
behavioral2/memory/4192-8-0x00007FF7A40B0000-0x00007FF7A4402000-memory.dmp	upx
behavioral2/files/0x000d00000001c4ec-9.dat	upx
behavioral2/memory/4200-12-0x00007FF6C7680000-0x00007FF6C79D2000-memory.dmp	upx
behavioral2/files/0x000d00000001c4ed-16.dat	upx
behavioral2/memory/4508-17-0x00007FF740080000-0x00007FF7403D2000-memory.dmp	upx
behavioral2/files/0x000d00000001c4ee-23.dat	upx
behavioral2/memory/2776-24-0x00007FF6D2EB0000-0x00007FF6D3202000-memory.dmp	upx
behavioral2/files/0x000e00000001c4e9-29.dat	upx
behavioral2/memory/5224-31-0x00007FF675FF0000-0x00007FF676342000-memory.dmp	upx
behavioral2/files/0x000d00000001c4ef-34.dat	upx
behavioral2/files/0x000d00000001c4f0-41.dat	upx
behavioral2/memory/2604-44-0x00007FF7DE5B0000-0x00007FF7DE902000-memory.dmp	upx
behavioral2/files/0x000d00000001c4f1-47.dat	upx
behavioral2/files/0x000d00000001c4f2-52.dat	upx
behavioral2/files/0x000d00000001c4f3-57.dat	upx
behavioral2/files/0x000d00000001c4f4-62.dat	upx
behavioral2/files/0x000d00000001c4f5-68.dat	upx
behavioral2/files/0x000d00000001c4f6-73.dat	upx
behavioral2/files/0x000d00000001c4f9-82.dat	upx
behavioral2/files/0x000d00000001c4fc-93.dat	upx
behavioral2/files/0x000d00000001c4fd-98.dat	upx
behavioral2/files/0x000d00000001c4fe-103.dat	upx
behavioral2/files/0x000d00000001c4ff-108.dat	upx
behavioral2/files/0x000d00000001c500-112.dat	upx
behavioral2/files/0x000d00000001c4fb-88.dat	upx
behavioral2/files/0x000d00000001c4f8-78.dat	upx
behavioral2/memory/4712-48-0x00007FF609B70000-0x00007FF609EC2000-memory.dmp	upx
behavioral2/memory/5016-40-0x00007FF73C7E0000-0x00007FF73CB32000-memory.dmp	upx
behavioral2/memory/5676-114-0x00007FF6E7170000-0x00007FF6E74C2000-memory.dmp	upx
behavioral2/memory/1940-116-0x00007FF7FF8B0000-0x00007FF7FFC02000-memory.dmp	upx
behavioral2/memory/2252-117-0x00007FF6123A0000-0x00007FF6126F2000-memory.dmp	upx
behavioral2/memory/3436-118-0x00007FF6BE610000-0x00007FF6BE962000-memory.dmp	upx
behavioral2/memory/4300-119-0x00007FF7AF190000-0x00007FF7AF4E2000-memory.dmp	upx
behavioral2/memory/1620-120-0x00007FF603800000-0x00007FF603B52000-memory.dmp	upx
behavioral2/memory/5668-121-0x00007FF6A4140000-0x00007FF6A4492000-memory.dmp	upx
behavioral2/memory/120-122-0x00007FF6EABA0000-0x00007FF6EAEF2000-memory.dmp	upx
behavioral2/memory/2420-123-0x00007FF61C7A0000-0x00007FF61CAF2000-memory.dmp	upx
behavioral2/memory/2028-125-0x00007FF700620000-0x00007FF700972000-memory.dmp	upx
behavioral2/memory/1508-124-0x00007FF7654E0000-0x00007FF765832000-memory.dmp	upx
behavioral2/memory/1772-129-0x00007FF7CA790000-0x00007FF7CAAE2000-memory.dmp	upx
behavioral2/memory/4192-128-0x00007FF7A40B0000-0x00007FF7A4402000-memory.dmp	upx
behavioral2/memory/6092-127-0x00007FF660A30000-0x00007FF660D82000-memory.dmp	upx
behavioral2/memory/5932-126-0x00007FF741970000-0x00007FF741CC2000-memory.dmp	upx
behavioral2/memory/4200-130-0x00007FF6C7680000-0x00007FF6C79D2000-memory.dmp	upx
behavioral2/memory/4508-131-0x00007FF740080000-0x00007FF7403D2000-memory.dmp	upx
behavioral2/memory/2776-132-0x00007FF6D2EB0000-0x00007FF6D3202000-memory.dmp	upx
behavioral2/memory/5224-133-0x00007FF675FF0000-0x00007FF676342000-memory.dmp	upx
behavioral2/memory/2604-134-0x00007FF7DE5B0000-0x00007FF7DE902000-memory.dmp	upx
behavioral2/memory/5676-135-0x00007FF6E7170000-0x00007FF6E74C2000-memory.dmp	upx
behavioral2/memory/4192-136-0x00007FF7A40B0000-0x00007FF7A4402000-memory.dmp	upx
behavioral2/memory/4200-137-0x00007FF6C7680000-0x00007FF6C79D2000-memory.dmp	upx
behavioral2/memory/4508-138-0x00007FF740080000-0x00007FF7403D2000-memory.dmp	upx
behavioral2/memory/2776-139-0x00007FF6D2EB0000-0x00007FF6D3202000-memory.dmp	upx
behavioral2/memory/5224-140-0x00007FF675FF0000-0x00007FF676342000-memory.dmp	upx
behavioral2/memory/5016-141-0x00007FF73C7E0000-0x00007FF73CB32000-memory.dmp	upx
behavioral2/memory/2604-142-0x00007FF7DE5B0000-0x00007FF7DE902000-memory.dmp	upx
behavioral2/memory/1772-143-0x00007FF7CA790000-0x00007FF7CAAE2000-memory.dmp	upx
behavioral2/memory/1940-144-0x00007FF7FF8B0000-0x00007FF7FFC02000-memory.dmp	upx
behavioral2/memory/3436-146-0x00007FF6BE610000-0x00007FF6BE962000-memory.dmp	upx
behavioral2/memory/4300-147-0x00007FF7AF190000-0x00007FF7AF4E2000-memory.dmp	upx
behavioral2/memory/2252-145-0x00007FF6123A0000-0x00007FF6126F2000-memory.dmp	upx
behavioral2/memory/1508-150-0x00007FF7654E0000-0x00007FF765832000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\CNcYkBL.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\AxbuGRA.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\YZHrZeV.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\jDtCcwT.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\iDeAvPB.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\iPVPhrM.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\rpwmNwo.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\WxgzWjZ.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\JecCddY.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\wIFGuNH.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\BDfnqVW.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\YnECKGa.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\gmxnrvK.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\TAQgRRv.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\dXxQgLd.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\MtBXVhq.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\KViVtut.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\DvYUigq.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\yCwjHBz.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\MTEiHGj.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
File created	C:\Windows\System\AUdDvru.exe	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
Token: SeLockMemoryPrivilege	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4192	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	90
PID 4712 wrote to memory of 4200	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	91
PID 4712 wrote to memory of 4508	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	92
PID 4712 wrote to memory of 2776	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	93
PID 4712 wrote to memory of 5224	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	94
PID 4712 wrote to memory of 5016	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	95
PID 4712 wrote to memory of 2604	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	96
PID 4712 wrote to memory of 5676	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	97
PID 4712 wrote to memory of 1772	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	98
PID 4712 wrote to memory of 1940	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	99
PID 4712 wrote to memory of 2252	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	100
PID 4712 wrote to memory of 3436	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	101
PID 4712 wrote to memory of 4300	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	102
PID 4712 wrote to memory of 1620	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	103
PID 4712 wrote to memory of 5668	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	104
PID 4712 wrote to memory of 120	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	105
PID 4712 wrote to memory of 2420	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	106
PID 4712 wrote to memory of 1508	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	107
PID 4712 wrote to memory of 2028	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	108
PID 4712 wrote to memory of 5932	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	109
PID 4712 wrote to memory of 6092	4712	2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_41e698f2a16df3f3a327f5dece9345a7_amadey_cobalt-strike_coinminer_glassworm_poet-rat_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\System\WxgzWjZ.exe
  C:\Windows\System\WxgzWjZ.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\CNcYkBL.exe
  C:\Windows\System\CNcYkBL.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\JecCddY.exe
  C:\Windows\System\JecCddY.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\wIFGuNH.exe
  C:\Windows\System\wIFGuNH.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\dXxQgLd.exe
  C:\Windows\System\dXxQgLd.exe
  2⤵
  - Executes dropped EXE
  PID:5224
- C:\Windows\System\BDfnqVW.exe
  C:\Windows\System\BDfnqVW.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\AxbuGRA.exe
  C:\Windows\System\AxbuGRA.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\MtBXVhq.exe
  C:\Windows\System\MtBXVhq.exe
  2⤵
  - Executes dropped EXE
  PID:5676
- C:\Windows\System\YZHrZeV.exe
  C:\Windows\System\YZHrZeV.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\KViVtut.exe
  C:\Windows\System\KViVtut.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\YnECKGa.exe
  C:\Windows\System\YnECKGa.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\gmxnrvK.exe
  C:\Windows\System\gmxnrvK.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\jDtCcwT.exe
  C:\Windows\System\jDtCcwT.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\MTEiHGj.exe
  C:\Windows\System\MTEiHGj.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\AUdDvru.exe
  C:\Windows\System\AUdDvru.exe
  2⤵
  - Executes dropped EXE
  PID:5668
- C:\Windows\System\TAQgRRv.exe
  C:\Windows\System\TAQgRRv.exe
  2⤵
  - Executes dropped EXE
  PID:120
- C:\Windows\System\iDeAvPB.exe
  C:\Windows\System\iDeAvPB.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\iPVPhrM.exe
  C:\Windows\System\iPVPhrM.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\DvYUigq.exe
  C:\Windows\System\DvYUigq.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\yCwjHBz.exe
  C:\Windows\System\yCwjHBz.exe
  2⤵
  - Executes dropped EXE
  PID:5932
- C:\Windows\System\rpwmNwo.exe
  C:\Windows\System\rpwmNwo.exe
  2⤵
  - Executes dropped EXE
  PID:6092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AUdDvru.exe

Path C:\Windows\System\AUdDvru.exe
Size 8.3MB
SHA256 df172103fb0168fab9a271501b1b5bd314cb106433f72abc2298e41aa9ac779e
MD5 8cae7112ddd283bd74e701b5394e2093
SHA1 b109122554acb99ea4eccdcca75f8d6b8fd3295c
SHA512 9953f65e9aab0b407b39b15dcbe52ee732a65e4eae12dcc08a4b48906de1f73b0a582e7a2ebbe577c3b4fd124bfb6cfc941da95a74d7ad0bca4be9534a6d81a7
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUW:v+D56utgpPF8u/7W
TLSH
T19C965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AxbuGRA.exe

Path C:\Windows\System\AxbuGRA.exe
Size 8.3MB
SHA256 db6b6c0e8533e4a27fc07bc8eafa64f68bc5219a97fd9ded70f885c88595d34d
MD5 0ef86164fecbed49d53b35232716539d
SHA1 ab46de4f7b4c44d3617b7b956c04be7b6416a643
SHA512 a3f8fbe86f0ad82045aa7a17d8f04d18f0b9fb98cf92c2b68655c9742281cddb1d0bd76310e17f62cb698878a94a7e35c378c142ebad32434fe8bac0f520a522
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUc:v+D56utgpPF8u/7c
TLSH
T13C965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BDfnqVW.exe

Path C:\Windows\System\BDfnqVW.exe
Size 8.3MB
SHA256 7ac8a8f6e6a27e3dbe428c370a4d88e8e5bd236ff680d0d6ab596347d39602a6
MD5 efa48dcc4647139c47c60ec5457858c2
SHA1 7a164dbc802d08c015f68e946362f5448e5cc351
SHA512 bcc7c288f2036bb666820bb53555ffe95fa49d215964d7c4ad14202a95d5c49ab3d67ca7d12d3902c54039081578d97f615a425d4c18b4b6a78127bafe33481a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUa:v+D56utgpPF8u/7a
TLSH
T1D7965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CNcYkBL.exe

Path C:\Windows\System\CNcYkBL.exe
Size 8.3MB
SHA256 bfd0c36a13090677efd11926170c1b712ac285f0c3b3312881b363556452a2bd
MD5 cf8e8c55377049ffa34c70a7f52bf4dd
SHA1 9ac721a322d4ff604571ba6f00832529be86a3a2
SHA512 687906935233ed2d64f8b304008a2fbb77099733a37f34ff09a2f07f46c4f5976d5e5b27b1fc8d71e909b77c63107c889af0eae4d501d3bfe1d7085048cafe5c
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUd:v+D56utgpPF8u/7d
TLSH
T14C965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DvYUigq.exe

Path C:\Windows\System\DvYUigq.exe
Size 8.3MB
SHA256 bed1cdf0a8994825e905128e170e769c41784420ae6a41f367e6d3fbfd5fa833
MD5 3665f65f6539f01b50272b3cf5dc5f84
SHA1 65fe6cfaa3a94ae1ba36bf4cfb88ebb6a531b170
SHA512 8767ba7fbeb19f0b05630a59a8f588776fecd7835c694d620e4ad1a1280c94da0358c0f5c1f4c9095e3260ee3e422f31640ab947f25a7f2db1ab2839507650da
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUF:v+D56utgpPF8u/7F
TLSH
T1C0965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JecCddY.exe

Path C:\Windows\System\JecCddY.exe
Size 8.3MB
SHA256 d621d377b3c126fdadefe3d7adaba507360124b364128269e377fd69ce9375f4
MD5 f3950fea04f3e109b224fbf6316abd15
SHA1 47bc1f0d87f64d92c0c15b2838a1f9871432d178
SHA512 53aade407fce66e231bd3bf9edcdf8844e19b0d3c78e7ae4029ae1046f01ed5a76e9ec44636b859d6c047b7985b33b37f232500e67588f96aad8e04d0ce3d97a
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUn:v+D56utgpPF8u/7n
TLSH
T158965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KViVtut.exe

Path C:\Windows\System\KViVtut.exe
Size 8.3MB
SHA256 30c386e84f39faecba7c84b0bdfcbe3e6cb40095bf34388b437c0b6ea847b6f8
MD5 2b5a8b46cf6e82592af1a6698b3700fb
SHA1 f9d4b80d6bdb2df2f904b2580b2c71838ff07f44
SHA512 b3ca495ed2a6a01af14f60a643891fd50730bbd2d136321769c1e5aed2086320984d7665e640dfeff1c11033f9be7b7e14130df79ec29cef3352d930cd8d0051
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUB:v+D56utgpPF8u/7B
TLSH
T1E8965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MTEiHGj.exe

Path C:\Windows\System\MTEiHGj.exe
Size 8.3MB
SHA256 e3e1d900bbb7dd2e163460e76bf61bd382a1385a1b82b3d370d75b79eca6ba7d
MD5 37318daa098a5861d89d6a155bf626d4
SHA1 43739b267ac41c351cc1968a17102ee6ea561506
SHA512 73c1b396d9abd6b4d75480145a8a72e2a5a39ec151029869193b01a9ff8d476019c82b9006fe0e7d94b458c769beceb26836ed332bff27b478d25e24349ab7ec
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUS:v+D56utgpPF8u/7S
TLSH
T1C8965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MtBXVhq.exe

Path C:\Windows\System\MtBXVhq.exe
Size 8.3MB
SHA256 5a7cb41ac561719c616297e0c378709eabbdbe6ee477b7779b9c8f5b0fcc4f39
MD5 630be9911b3f337a5e81fdc272b22c88
SHA1 80938a64f2b6de38d5dab245c18b2d79cd5a2bcd
SHA512 32e9113b26fc14d8458a66e5eb59b853c7cf486c5282f582235b4de20e395e8bf77ae33a618da93a0493b786df1a9ecccdcaf002edbbafc9df14343cfaab9113
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lU4:v+D56utgpPF8u/74
TLSH
T1E5965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TAQgRRv.exe

Path C:\Windows\System\TAQgRRv.exe
Size 8.3MB
SHA256 a5da3586acf4429eb3003385acefc5bfd1aef9e2d5c761b6f1d2e9782ed7cd01
MD5 4d9e1c3643c1e91f6890324988934e05
SHA1 1b14d010fab44c57c68654337ec524b7a31e60ac
SHA512 22d74b5a1a096833d5e65d069cc611acabe14ae655c867b6d881d757d51a4b6a56b4320f38dde48168751f63003790a154f681edfe37d4f312b862f8d5828984
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUq:v+D56utgpPF8u/7q
TLSH
T170965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WxgzWjZ.exe

Path C:\Windows\System\WxgzWjZ.exe
Size 8.3MB
SHA256 622db67152b97972d452f072d8b36b6850c1faf3aae5f1195e8b63c7a63d9932
MD5 c0ba22013877d7e04f9b4d4585f1a9e0
SHA1 12e6ad88a3fdfa553a81963704a580a230ff9d1d
SHA512 046a2323c35216f68ef1db75e140011e777984bc28a5258d4d2d4f22c262a26f3d80361b0ead20a6e67a23ecfc15847f0c079ec093f4245ff9bd5f06fa42ce69
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUT:v+D56utgpPF8u/7T
TLSH
T164965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YZHrZeV.exe

Path C:\Windows\System\YZHrZeV.exe
Size 8.3MB
SHA256 b6bbee3f649482fd93f85301c170093b73652d6c1381513e1907ba9732549533
MD5 6df8f009fe40c4468a96e3c5bec13411
SHA1 6a976c6441ecaaca6673d9a9baf34d7240208394
SHA512 20925dd921cdedad4d09efe4599d4eb0faf5992ed0d2625b4154f499c5334dc50dafd49c27b282e25e986d070eb8ae21c994a15a463567ea4175d629a3fcb591
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUV:v+D56utgpPF8u/7V
TLSH
T191965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YnECKGa.exe

Path C:\Windows\System\YnECKGa.exe
Size 8.3MB
SHA256 1247fb99819104b435dc7ec1529a323d17e3bdd76f6f13ca055f7bafd3df3a36
MD5 68836f65584a419642d1d52bc7d10fbd
SHA1 fe9adb6dda93bd61aa94a7fe5a60b6c79f980e7a
SHA512 7396be600e0cc76ca30005978721eb331dbd216ed4804828c40b7a45ea2b8111fa90d53809a150f172aa3d68f38ecf1046048cbacd79eafeae7fb87b67aa6e7e
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUc:v+D56utgpPF8u/7c
TLSH
T18D965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dXxQgLd.exe

Path C:\Windows\System\dXxQgLd.exe
Size 8.3MB
SHA256 5abf75d3ae298a1dacf147d59831e500fdf5dbcdb9c321ae7fe1da94c19920dc
MD5 cbebd60b1df9b35ca22d6f47bf7ff2a6
SHA1 d863d1d96e59cdb5f669dbc49374b927f9572581
SHA512 0bfefdb5b56ea5f4a4857905b453b2bbe3a0243dda35e70a6dd515d4c93bda8763e970c9aa6d7fd3c53585860b614b6f10687683e7b2c24247c1bcb470bd5f8c
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUq:v+D56utgpPF8u/7q
TLSH
T17B965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmxnrvK.exe

Path C:\Windows\System\gmxnrvK.exe
Size 8.3MB
SHA256 4ee88076d91ea0a7014fd79b08016a60e6d2e9e673986f71cbe38bc3a3c82dc8
MD5 707409780ced3200fa23fbb30f927b19
SHA1 eceb90b483e28581060e21c5b5a38cb682a5aeec
SHA512 18017b280a18fe67152561d8f9b34ccdc5df1215b9a6478a2ccee57e01d7b4c6b581b20a2ea7237825a1c5f47611936e919a828d5a7c08449d0427adb0104a72
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUi:v+D56utgpPF8u/7i
TLSH
T109965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iDeAvPB.exe

Path C:\Windows\System\iDeAvPB.exe
Size 8.3MB
SHA256 63bc8e154ace2abaa2771279d6356160a62241431b6ba63b6149f1d7204c2251
MD5 aa820a5958cbb5bcb3d029cf842889ab
SHA1 442dd91cf4a85f67cc4317152546c3f099a6f677
SHA512 c2130a458725278a3a7d8accbac9515459c63e831c79648805b1aa8a09f553d09f0e387348117d64f9762f1488592589c4bdf588e36164b6deef3d398620bc04
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUB:v+D56utgpPF8u/7B
TLSH
T19C965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iPVPhrM.exe

Path C:\Windows\System\iPVPhrM.exe
Size 8.3MB
SHA256 cfd4a486cace0760b82b47228ff759387a3a17b248d01bbbfcd24cd8852f9167
MD5 af3da39bca5eb9bc2f9847bd9d3d2241
SHA1 db3b2a715c4ad9f119094e7083fa79cae9f33ecf
SHA512 122d637487912b72c7c473077817f99457f4c79bc4c1f5f59123841957b91a34030d6db3bd51b220fd60d0bc031411cc099229ca4e60e988563ce49d8029a6b0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUn:v+D56utgpPF8u/7n
TLSH
T1A3965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jDtCcwT.exe

Path C:\Windows\System\jDtCcwT.exe
Size 8.3MB
SHA256 d9a2c10feb1fac3cb953544ddaa8fbcb479bdc32f88307ac2f5f649cde0eede6
MD5 0af761fbb5a82417865dd954e3788474
SHA1 0c7abf8cce31166d01b746170680bc93147f1e42
SHA512 86de619d583f68d7fb6d899fb6c28e099e90beb4ce9c573689537c093d4681c70b5ec4b5585eec3634881903f1f4a5652fc5e5249849cecc52726b1fee0ad6b3
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUI:v+D56utgpPF8u/7I
TLSH
T117965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpwmNwo.exe

Path C:\Windows\System\rpwmNwo.exe
Size 8.3MB
SHA256 6fc4b5bab4323d166f52060a4e147a1a1324c983898dd98b8b493abfcfe95e80
MD5 141c252d826254205eea778652ad315f
SHA1 e900701fda4a0d44bf7e80745dba5c014af11791
SHA512 78ae4bf56e68a3aba873f9541e59ebdd78063eb590dd4c8f5f01b596f0d3e8306e29fb35b2aa8b09b3f41362cfd8523432caa7717ec26875a20cac7c0e3f05e0
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUz:v+D56utgpPF8u/7z
TLSH
T160965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wIFGuNH.exe

Path C:\Windows\System\wIFGuNH.exe
Size 8.3MB
SHA256 90dc2f6ee11a300c1f679d70bc46cf1b9f9a22007b3a2a37f58993d89a19a070
MD5 b317c8716e5437e0657d4dda21dd9ba7
SHA1 220300c476b878926e3a8183208ecbb799483663
SHA512 953c21bb8b70192e256183317fff72520324ec2ff06db3ecda4dd6a7853452969e970679ffce660e5a18fed5d90a6df2fb2a33bb5619fb6a4a1f84880fe4d11d
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUu:v+D56utgpPF8u/7u
TLSH
T164965C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yCwjHBz.exe

Path C:\Windows\System\yCwjHBz.exe
Size 8.3MB
SHA256 c5d3242213ed7de8074dfd07ff3e9b37fb3c96c95fd8709833407c437f36910d
MD5 8a5e23bd3ff4884e78403ede84abdf4b
SHA1 8a733c4734e084de7e8a1ebcda7c527732a09d67
SHA512 598214f25a3a4b83a17f3d800c1605f8ed7e6570476b2d1eccbaa91b15f866e0ccd8568e4d772667bcfe053aa1d80d062710fbb4e0bf0a809d1b38ee3f3c801f
SSDEEP 98304:MemTLkNdfE0pZba56utgpPFotBER/mQ32lUB:v+D56utgpPF8u/7B
TLSH
T140965C41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-152-0x00007FF6EABA0000-0x00007FF6EAEF2000-memory.dmp

Download

memory/120-122-0x00007FF6EABA0000-0x00007FF6EAEF2000-memory.dmp

Download

memory/1508-124-0x00007FF7654E0000-0x00007FF765832000-memory.dmp

Download

memory/1508-150-0x00007FF7654E0000-0x00007FF765832000-memory.dmp

Download

memory/1620-148-0x00007FF603800000-0x00007FF603B52000-memory.dmp

Download

memory/1620-120-0x00007FF603800000-0x00007FF603B52000-memory.dmp

Download

memory/1772-143-0x00007FF7CA790000-0x00007FF7CAAE2000-memory.dmp

Download

memory/1772-129-0x00007FF7CA790000-0x00007FF7CAAE2000-memory.dmp

Download

memory/1940-144-0x00007FF7FF8B0000-0x00007FF7FFC02000-memory.dmp

Download

memory/1940-116-0x00007FF7FF8B0000-0x00007FF7FFC02000-memory.dmp

Download

memory/2028-125-0x00007FF700620000-0x00007FF700972000-memory.dmp

Download

memory/2028-149-0x00007FF700620000-0x00007FF700972000-memory.dmp

Download

memory/2252-145-0x00007FF6123A0000-0x00007FF6126F2000-memory.dmp

Download

memory/2252-117-0x00007FF6123A0000-0x00007FF6126F2000-memory.dmp

Download

memory/2420-151-0x00007FF61C7A0000-0x00007FF61CAF2000-memory.dmp

Download

memory/2420-123-0x00007FF61C7A0000-0x00007FF61CAF2000-memory.dmp

Download

memory/2604-44-0x00007FF7DE5B0000-0x00007FF7DE902000-memory.dmp

Download

memory/2604-142-0x00007FF7DE5B0000-0x00007FF7DE902000-memory.dmp

Download

memory/2604-134-0x00007FF7DE5B0000-0x00007FF7DE902000-memory.dmp

Download

memory/2776-24-0x00007FF6D2EB0000-0x00007FF6D3202000-memory.dmp

Download

memory/2776-132-0x00007FF6D2EB0000-0x00007FF6D3202000-memory.dmp

Download

memory/2776-139-0x00007FF6D2EB0000-0x00007FF6D3202000-memory.dmp

Download

memory/3436-118-0x00007FF6BE610000-0x00007FF6BE962000-memory.dmp

Download

memory/3436-146-0x00007FF6BE610000-0x00007FF6BE962000-memory.dmp

Download

memory/4192-8-0x00007FF7A40B0000-0x00007FF7A4402000-memory.dmp

Download

memory/4192-128-0x00007FF7A40B0000-0x00007FF7A4402000-memory.dmp

Download

memory/4192-136-0x00007FF7A40B0000-0x00007FF7A4402000-memory.dmp

Download

memory/4200-137-0x00007FF6C7680000-0x00007FF6C79D2000-memory.dmp

Download

memory/4200-130-0x00007FF6C7680000-0x00007FF6C79D2000-memory.dmp

Download

memory/4200-12-0x00007FF6C7680000-0x00007FF6C79D2000-memory.dmp

Download

memory/4300-119-0x00007FF7AF190000-0x00007FF7AF4E2000-memory.dmp

Download

memory/4300-147-0x00007FF7AF190000-0x00007FF7AF4E2000-memory.dmp

Download

memory/4508-131-0x00007FF740080000-0x00007FF7403D2000-memory.dmp

Download

memory/4508-138-0x00007FF740080000-0x00007FF7403D2000-memory.dmp

Download

memory/4508-17-0x00007FF740080000-0x00007FF7403D2000-memory.dmp

Download

memory/4712-1-0x0000022ACE6C0000-0x0000022ACE6D0000-memory.dmp

Download

memory/4712-0-0x00007FF609B70000-0x00007FF609EC2000-memory.dmp

Download

memory/4712-48-0x00007FF609B70000-0x00007FF609EC2000-memory.dmp

Download

memory/5016-141-0x00007FF73C7E0000-0x00007FF73CB32000-memory.dmp

Download

memory/5016-40-0x00007FF73C7E0000-0x00007FF73CB32000-memory.dmp

Download

memory/5224-133-0x00007FF675FF0000-0x00007FF676342000-memory.dmp

Download

memory/5224-140-0x00007FF675FF0000-0x00007FF676342000-memory.dmp

Download

memory/5224-31-0x00007FF675FF0000-0x00007FF676342000-memory.dmp

Download

memory/5668-121-0x00007FF6A4140000-0x00007FF6A4492000-memory.dmp

Download

memory/5668-153-0x00007FF6A4140000-0x00007FF6A4492000-memory.dmp

Download

memory/5676-114-0x00007FF6E7170000-0x00007FF6E74C2000-memory.dmp

Download

memory/5676-135-0x00007FF6E7170000-0x00007FF6E74C2000-memory.dmp

Download

memory/5676-156-0x00007FF6E7170000-0x00007FF6E74C2000-memory.dmp

Download

memory/5932-126-0x00007FF741970000-0x00007FF741CC2000-memory.dmp

Download

memory/5932-154-0x00007FF741970000-0x00007FF741CC2000-memory.dmp

Download

memory/6092-127-0x00007FF660A30000-0x00007FF660D82000-memory.dmp

Download

memory/6092-155-0x00007FF660A30000-0x00007FF660D82000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads