Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
10-11-2020 07:28
Static task
static1
Behavioral task
behavioral1
Sample
0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe
Resource
win10v20201028
General
-
Target
0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe
-
Size
5.2MB
-
MD5
9ae42d643dd544013933925da423dce6
-
SHA1
0db61613f3c22a3d5c14cbdc07ede2053bfb9556
-
SHA256
0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde
-
SHA512
0d25253b3f10a248d30751707bc5b53179296ddd84b102fae2bab8e56b6c32b50c9ebea820b25765143ee3487c789dbe6631589bf468d5378215e7df14a565ed
Malware Config
Signatures
-
Cobalt Strike reflective loader 42 IoCs
Detects the reflective loader used by Cobalt Strike.
Processes:
resource yara_rule C:\Windows\System\FiAhjCi.exe cobalt_reflective_dll C:\Windows\System\FiAhjCi.exe cobalt_reflective_dll C:\Windows\System\jrisHgE.exe cobalt_reflective_dll C:\Windows\System\jrisHgE.exe cobalt_reflective_dll C:\Windows\System\hPAIjBU.exe cobalt_reflective_dll C:\Windows\System\hPAIjBU.exe cobalt_reflective_dll C:\Windows\System\JSfNOqL.exe cobalt_reflective_dll C:\Windows\System\JSfNOqL.exe cobalt_reflective_dll C:\Windows\System\zMdNRIV.exe cobalt_reflective_dll C:\Windows\System\zMdNRIV.exe cobalt_reflective_dll C:\Windows\System\NEfQfCH.exe cobalt_reflective_dll C:\Windows\System\NEfQfCH.exe cobalt_reflective_dll C:\Windows\System\sbgnqzz.exe cobalt_reflective_dll C:\Windows\System\sbgnqzz.exe cobalt_reflective_dll C:\Windows\System\bfJjYPx.exe cobalt_reflective_dll C:\Windows\System\bfJjYPx.exe cobalt_reflective_dll C:\Windows\System\YPQfiWA.exe cobalt_reflective_dll C:\Windows\System\YPQfiWA.exe cobalt_reflective_dll C:\Windows\System\afHhdbf.exe cobalt_reflective_dll C:\Windows\System\afHhdbf.exe cobalt_reflective_dll C:\Windows\System\lphJQFy.exe cobalt_reflective_dll C:\Windows\System\lphJQFy.exe cobalt_reflective_dll C:\Windows\System\FnslUDY.exe cobalt_reflective_dll C:\Windows\System\FnslUDY.exe cobalt_reflective_dll C:\Windows\System\sZOBqAB.exe cobalt_reflective_dll C:\Windows\System\sZOBqAB.exe cobalt_reflective_dll C:\Windows\System\aiWYdqm.exe cobalt_reflective_dll C:\Windows\System\aiWYdqm.exe cobalt_reflective_dll C:\Windows\System\mMCVdbL.exe cobalt_reflective_dll C:\Windows\System\mMCVdbL.exe cobalt_reflective_dll C:\Windows\System\JmnUiRp.exe cobalt_reflective_dll C:\Windows\System\AUbLHOu.exe cobalt_reflective_dll C:\Windows\System\JmnUiRp.exe cobalt_reflective_dll C:\Windows\System\lezPoNz.exe cobalt_reflective_dll C:\Windows\System\KlYpKxW.exe cobalt_reflective_dll C:\Windows\System\AnBPeXf.exe cobalt_reflective_dll C:\Windows\System\FmDkwYW.exe cobalt_reflective_dll C:\Windows\System\FmDkwYW.exe cobalt_reflective_dll C:\Windows\System\AnBPeXf.exe cobalt_reflective_dll C:\Windows\System\KlYpKxW.exe cobalt_reflective_dll C:\Windows\System\lezPoNz.exe cobalt_reflective_dll C:\Windows\System\AUbLHOu.exe cobalt_reflective_dll -
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Executes dropped EXE 21 IoCs
Processes:
FiAhjCi.exejrisHgE.exehPAIjBU.exeJSfNOqL.exezMdNRIV.exeNEfQfCH.exesbgnqzz.exebfJjYPx.exeYPQfiWA.exeafHhdbf.exelphJQFy.exeFnslUDY.exesZOBqAB.exeaiWYdqm.exemMCVdbL.exeJmnUiRp.exeAUbLHOu.exelezPoNz.exeKlYpKxW.exeAnBPeXf.exeFmDkwYW.exepid process 1896 FiAhjCi.exe 3388 jrisHgE.exe 3888 hPAIjBU.exe 3740 JSfNOqL.exe 2184 zMdNRIV.exe 1816 NEfQfCH.exe 3120 sbgnqzz.exe 3556 bfJjYPx.exe 2816 YPQfiWA.exe 3056 afHhdbf.exe 2612 lphJQFy.exe 3976 FnslUDY.exe 196 sZOBqAB.exe 3936 aiWYdqm.exe 1936 mMCVdbL.exe 2884 JmnUiRp.exe 2164 AUbLHOu.exe 3628 lezPoNz.exe 3780 KlYpKxW.exe 3176 AnBPeXf.exe 2024 FmDkwYW.exe -
Processes:
resource yara_rule C:\Windows\System\FiAhjCi.exe upx C:\Windows\System\FiAhjCi.exe upx C:\Windows\System\jrisHgE.exe upx C:\Windows\System\jrisHgE.exe upx C:\Windows\System\hPAIjBU.exe upx C:\Windows\System\hPAIjBU.exe upx C:\Windows\System\JSfNOqL.exe upx C:\Windows\System\JSfNOqL.exe upx C:\Windows\System\zMdNRIV.exe upx C:\Windows\System\zMdNRIV.exe upx C:\Windows\System\NEfQfCH.exe upx C:\Windows\System\NEfQfCH.exe upx C:\Windows\System\sbgnqzz.exe upx C:\Windows\System\sbgnqzz.exe upx C:\Windows\System\bfJjYPx.exe upx C:\Windows\System\bfJjYPx.exe upx C:\Windows\System\YPQfiWA.exe upx C:\Windows\System\YPQfiWA.exe upx C:\Windows\System\afHhdbf.exe upx C:\Windows\System\afHhdbf.exe upx C:\Windows\System\lphJQFy.exe upx C:\Windows\System\lphJQFy.exe upx C:\Windows\System\FnslUDY.exe upx C:\Windows\System\FnslUDY.exe upx C:\Windows\System\sZOBqAB.exe upx C:\Windows\System\sZOBqAB.exe upx C:\Windows\System\aiWYdqm.exe upx C:\Windows\System\aiWYdqm.exe upx C:\Windows\System\mMCVdbL.exe upx C:\Windows\System\mMCVdbL.exe upx C:\Windows\System\JmnUiRp.exe upx C:\Windows\System\AUbLHOu.exe upx C:\Windows\System\JmnUiRp.exe upx C:\Windows\System\lezPoNz.exe upx C:\Windows\System\KlYpKxW.exe upx C:\Windows\System\AnBPeXf.exe upx C:\Windows\System\FmDkwYW.exe upx C:\Windows\System\FmDkwYW.exe upx C:\Windows\System\AnBPeXf.exe upx C:\Windows\System\KlYpKxW.exe upx C:\Windows\System\lezPoNz.exe upx C:\Windows\System\AUbLHOu.exe upx -
JavaScript code in executable 42 IoCs
Processes:
resource yara_rule C:\Windows\System\FiAhjCi.exe js C:\Windows\System\FiAhjCi.exe js C:\Windows\System\jrisHgE.exe js C:\Windows\System\jrisHgE.exe js C:\Windows\System\hPAIjBU.exe js C:\Windows\System\hPAIjBU.exe js C:\Windows\System\JSfNOqL.exe js C:\Windows\System\JSfNOqL.exe js C:\Windows\System\zMdNRIV.exe js C:\Windows\System\zMdNRIV.exe js C:\Windows\System\NEfQfCH.exe js C:\Windows\System\NEfQfCH.exe js C:\Windows\System\sbgnqzz.exe js C:\Windows\System\sbgnqzz.exe js C:\Windows\System\bfJjYPx.exe js C:\Windows\System\bfJjYPx.exe js C:\Windows\System\YPQfiWA.exe js C:\Windows\System\YPQfiWA.exe js C:\Windows\System\afHhdbf.exe js C:\Windows\System\afHhdbf.exe js C:\Windows\System\lphJQFy.exe js C:\Windows\System\lphJQFy.exe js C:\Windows\System\FnslUDY.exe js C:\Windows\System\FnslUDY.exe js C:\Windows\System\sZOBqAB.exe js C:\Windows\System\sZOBqAB.exe js C:\Windows\System\aiWYdqm.exe js C:\Windows\System\aiWYdqm.exe js C:\Windows\System\mMCVdbL.exe js C:\Windows\System\mMCVdbL.exe js C:\Windows\System\JmnUiRp.exe js C:\Windows\System\AUbLHOu.exe js C:\Windows\System\JmnUiRp.exe js C:\Windows\System\lezPoNz.exe js C:\Windows\System\KlYpKxW.exe js C:\Windows\System\AnBPeXf.exe js C:\Windows\System\FmDkwYW.exe js C:\Windows\System\FmDkwYW.exe js C:\Windows\System\AnBPeXf.exe js C:\Windows\System\KlYpKxW.exe js C:\Windows\System\lezPoNz.exe js C:\Windows\System\AUbLHOu.exe js -
Drops file in Windows directory 21 IoCs
Processes:
0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exedescription ioc process File created C:\Windows\System\jrisHgE.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\lphJQFy.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\FnslUDY.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\aiWYdqm.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\AUbLHOu.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\AnBPeXf.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\hPAIjBU.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\NEfQfCH.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\sbgnqzz.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\afHhdbf.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\lezPoNz.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\FmDkwYW.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\zMdNRIV.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\sZOBqAB.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\FiAhjCi.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\JSfNOqL.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\bfJjYPx.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\YPQfiWA.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\mMCVdbL.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\JmnUiRp.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe File created C:\Windows\System\KlYpKxW.exe 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exedescription pid process Token: SeLockMemoryPrivilege 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe Token: SeLockMemoryPrivilege 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exedescription pid process target process PID 492 wrote to memory of 1896 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe FiAhjCi.exe PID 492 wrote to memory of 1896 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe FiAhjCi.exe PID 492 wrote to memory of 3388 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe jrisHgE.exe PID 492 wrote to memory of 3388 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe jrisHgE.exe PID 492 wrote to memory of 3888 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe hPAIjBU.exe PID 492 wrote to memory of 3888 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe hPAIjBU.exe PID 492 wrote to memory of 3740 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe JSfNOqL.exe PID 492 wrote to memory of 3740 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe JSfNOqL.exe PID 492 wrote to memory of 2184 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe zMdNRIV.exe PID 492 wrote to memory of 2184 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe zMdNRIV.exe PID 492 wrote to memory of 1816 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe NEfQfCH.exe PID 492 wrote to memory of 1816 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe NEfQfCH.exe PID 492 wrote to memory of 3120 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe sbgnqzz.exe PID 492 wrote to memory of 3120 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe sbgnqzz.exe PID 492 wrote to memory of 3556 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe bfJjYPx.exe PID 492 wrote to memory of 3556 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe bfJjYPx.exe PID 492 wrote to memory of 2816 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe YPQfiWA.exe PID 492 wrote to memory of 2816 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe YPQfiWA.exe PID 492 wrote to memory of 3056 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe afHhdbf.exe PID 492 wrote to memory of 3056 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe afHhdbf.exe PID 492 wrote to memory of 2612 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe lphJQFy.exe PID 492 wrote to memory of 2612 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe lphJQFy.exe PID 492 wrote to memory of 3976 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe FnslUDY.exe PID 492 wrote to memory of 3976 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe FnslUDY.exe PID 492 wrote to memory of 196 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe sZOBqAB.exe PID 492 wrote to memory of 196 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe sZOBqAB.exe PID 492 wrote to memory of 3936 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe aiWYdqm.exe PID 492 wrote to memory of 3936 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe aiWYdqm.exe PID 492 wrote to memory of 1936 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe mMCVdbL.exe PID 492 wrote to memory of 1936 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe mMCVdbL.exe PID 492 wrote to memory of 2884 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe JmnUiRp.exe PID 492 wrote to memory of 2884 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe JmnUiRp.exe PID 492 wrote to memory of 2164 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe AUbLHOu.exe PID 492 wrote to memory of 2164 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe AUbLHOu.exe PID 492 wrote to memory of 3628 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe lezPoNz.exe PID 492 wrote to memory of 3628 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe lezPoNz.exe PID 492 wrote to memory of 3780 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe KlYpKxW.exe PID 492 wrote to memory of 3780 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe KlYpKxW.exe PID 492 wrote to memory of 3176 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe AnBPeXf.exe PID 492 wrote to memory of 3176 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe AnBPeXf.exe PID 492 wrote to memory of 2024 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe FmDkwYW.exe PID 492 wrote to memory of 2024 492 0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe FmDkwYW.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe"C:\Users\Admin\AppData\Local\Temp\0e1a67e3f9f273af8df4d73ca9faf02acd963117babed391f9a8caeb5c4e3fde.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\FiAhjCi.exeC:\Windows\System\FiAhjCi.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\jrisHgE.exeC:\Windows\System\jrisHgE.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\hPAIjBU.exeC:\Windows\System\hPAIjBU.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\JSfNOqL.exeC:\Windows\System\JSfNOqL.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\zMdNRIV.exeC:\Windows\System\zMdNRIV.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\NEfQfCH.exeC:\Windows\System\NEfQfCH.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\sbgnqzz.exeC:\Windows\System\sbgnqzz.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\bfJjYPx.exeC:\Windows\System\bfJjYPx.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\YPQfiWA.exeC:\Windows\System\YPQfiWA.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\afHhdbf.exeC:\Windows\System\afHhdbf.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\lphJQFy.exeC:\Windows\System\lphJQFy.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\FnslUDY.exeC:\Windows\System\FnslUDY.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\sZOBqAB.exeC:\Windows\System\sZOBqAB.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\aiWYdqm.exeC:\Windows\System\aiWYdqm.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\mMCVdbL.exeC:\Windows\System\mMCVdbL.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\JmnUiRp.exeC:\Windows\System\JmnUiRp.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\AUbLHOu.exeC:\Windows\System\AUbLHOu.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\lezPoNz.exeC:\Windows\System\lezPoNz.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\KlYpKxW.exeC:\Windows\System\KlYpKxW.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\AnBPeXf.exeC:\Windows\System\AnBPeXf.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\FmDkwYW.exeC:\Windows\System\FmDkwYW.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\System\AUbLHOu.exeMD5
f245916e06c198fc747edd59f26be396
SHA1dcff8dd937b22a46e013d30f423c7dc368f01172
SHA2563cdaaddbaf0528bbfdbfe379e1db6f440e10b1adeb897516c5e166e1c5008d1a
SHA512764a373a4c4981df257756c8de476c64876120213151bf4848a7221b314c3d7aa5dd99ff0b7ac6594ccae88cffe721a2074df87cec2f2e49846436225d70d404
-
C:\Windows\System\AUbLHOu.exeMD5
f245916e06c198fc747edd59f26be396
SHA1dcff8dd937b22a46e013d30f423c7dc368f01172
SHA2563cdaaddbaf0528bbfdbfe379e1db6f440e10b1adeb897516c5e166e1c5008d1a
SHA512764a373a4c4981df257756c8de476c64876120213151bf4848a7221b314c3d7aa5dd99ff0b7ac6594ccae88cffe721a2074df87cec2f2e49846436225d70d404
-
C:\Windows\System\AnBPeXf.exeMD5
7700bc358a55fa8ec4b0b4ee281ada93
SHA18d39673073c3b9db4774e00232a7bed860c7d7e6
SHA2565ee2d49928851c4464f3790cb7b2ff2061e86aa91b0c1af0c4857bd65f5ad040
SHA5121c1bd6074af2a2447faa6f4ed17e31e5d69ffb7db2f874b9bf286538b09612bce317e88320a865975f3d57a0ed9fd09846846335e533df5d8cf80a5124662353
-
C:\Windows\System\AnBPeXf.exeMD5
7700bc358a55fa8ec4b0b4ee281ada93
SHA18d39673073c3b9db4774e00232a7bed860c7d7e6
SHA2565ee2d49928851c4464f3790cb7b2ff2061e86aa91b0c1af0c4857bd65f5ad040
SHA5121c1bd6074af2a2447faa6f4ed17e31e5d69ffb7db2f874b9bf286538b09612bce317e88320a865975f3d57a0ed9fd09846846335e533df5d8cf80a5124662353
-
C:\Windows\System\FiAhjCi.exeMD5
bd0801e118912f6bc322a3a0868f27ae
SHA18d18fea6a7ae21c4cea737d2830df62645c4379c
SHA256b333b136cf4cac3088ce85659a204b463d2476f3752bd7f4187fcc7780b647f6
SHA5125e459cde8c1423366d10a6326350ec31a8168594b6a0763ccd9f247358d1297db0b8ddff4948566fbf30bf31f3ebb2c896e094707fbde04930a844c4bea450ad
-
C:\Windows\System\FiAhjCi.exeMD5
bd0801e118912f6bc322a3a0868f27ae
SHA18d18fea6a7ae21c4cea737d2830df62645c4379c
SHA256b333b136cf4cac3088ce85659a204b463d2476f3752bd7f4187fcc7780b647f6
SHA5125e459cde8c1423366d10a6326350ec31a8168594b6a0763ccd9f247358d1297db0b8ddff4948566fbf30bf31f3ebb2c896e094707fbde04930a844c4bea450ad
-
C:\Windows\System\FmDkwYW.exeMD5
03c52fbaea09054d5fdf4d988e5387b9
SHA1d1854025c65d8d10609c66cfd1c9739b1060ac4c
SHA25670168a68ea6389fedb38ea7dd05b4be07d9a549a5cf85cd3e1a056c5ce085e9f
SHA51230ed08b820d16f24829a1c9d76580462027ce2831c5e1f20ce2aa8e844f0c88e7c0b2046eabee188f031399f22fcde7387f27d4bc48dbcf88251afd568d8765e
-
C:\Windows\System\FmDkwYW.exeMD5
03c52fbaea09054d5fdf4d988e5387b9
SHA1d1854025c65d8d10609c66cfd1c9739b1060ac4c
SHA25670168a68ea6389fedb38ea7dd05b4be07d9a549a5cf85cd3e1a056c5ce085e9f
SHA51230ed08b820d16f24829a1c9d76580462027ce2831c5e1f20ce2aa8e844f0c88e7c0b2046eabee188f031399f22fcde7387f27d4bc48dbcf88251afd568d8765e
-
C:\Windows\System\FnslUDY.exeMD5
0a648bdf3cdd559c4ed7da4ebb1bae64
SHA10111c7cde373a190be7b648fd62a29973729398b
SHA256e9f84feb4b464895690430f193f9812eb3647021197fbfe18663ec70cf19c2b7
SHA512a5184eaadf19ff38ffd7c618dc63eb0fafe86fc71ecb31e55f83a9c78e2ba357104c48d8c49b1cff6f314be67687bb823f8fd3fe5303300a8affbaaf30c59916
-
C:\Windows\System\FnslUDY.exeMD5
0a648bdf3cdd559c4ed7da4ebb1bae64
SHA10111c7cde373a190be7b648fd62a29973729398b
SHA256e9f84feb4b464895690430f193f9812eb3647021197fbfe18663ec70cf19c2b7
SHA512a5184eaadf19ff38ffd7c618dc63eb0fafe86fc71ecb31e55f83a9c78e2ba357104c48d8c49b1cff6f314be67687bb823f8fd3fe5303300a8affbaaf30c59916
-
C:\Windows\System\JSfNOqL.exeMD5
818c0f9f931d9652e467a136affc369e
SHA1209601b465cab65e251ab311515260b6f8daabf7
SHA25668333fc8cf159cf339e3fd873e421342b64106b3f51f17a41af566ebbf8b8870
SHA512c4ce79dc784a2a90e38d6d128ffa55e917ad795fd3d61bc72e1f4ddbf6449dacc1d2ab9c30e83f89e7db55226cad8d707400a87a281eb3788bde55ac3d4f5d7e
-
C:\Windows\System\JSfNOqL.exeMD5
818c0f9f931d9652e467a136affc369e
SHA1209601b465cab65e251ab311515260b6f8daabf7
SHA25668333fc8cf159cf339e3fd873e421342b64106b3f51f17a41af566ebbf8b8870
SHA512c4ce79dc784a2a90e38d6d128ffa55e917ad795fd3d61bc72e1f4ddbf6449dacc1d2ab9c30e83f89e7db55226cad8d707400a87a281eb3788bde55ac3d4f5d7e
-
C:\Windows\System\JmnUiRp.exeMD5
b935b42657fc4cfe01e304730a90a057
SHA111f0ae3d5963eff59d1eb0d931cbb06096a8f09d
SHA256ee5256bd2101b61ceea1a53262893cb283872ef3db8081513eb560210c80e787
SHA512b2a272806f2960da07274131c1a21295bf7602c0760e111c8a1921c648ee5e1ef91a819b51457fc4116a776e57646c75d58993c457a8bd68c17f1a1fef5f278b
-
C:\Windows\System\JmnUiRp.exeMD5
b935b42657fc4cfe01e304730a90a057
SHA111f0ae3d5963eff59d1eb0d931cbb06096a8f09d
SHA256ee5256bd2101b61ceea1a53262893cb283872ef3db8081513eb560210c80e787
SHA512b2a272806f2960da07274131c1a21295bf7602c0760e111c8a1921c648ee5e1ef91a819b51457fc4116a776e57646c75d58993c457a8bd68c17f1a1fef5f278b
-
C:\Windows\System\KlYpKxW.exeMD5
6edb78d0c6f0d802c856bb36c153c305
SHA1f4a99a57f46f78b6a1e08a90cfe5a0720ac511fe
SHA25691fc0b99a1dfe82904e6cc5371578455eb04b634e413b17c834a62e8a733a283
SHA512cd19d759f776442e4e07361394a2743620de7933aec6e811f648dbcb3bf13d2cc777dd33b392710fb7fd7777222a12b835fd08c73de034eeaf8e33964ab3ab98
-
C:\Windows\System\KlYpKxW.exeMD5
6edb78d0c6f0d802c856bb36c153c305
SHA1f4a99a57f46f78b6a1e08a90cfe5a0720ac511fe
SHA25691fc0b99a1dfe82904e6cc5371578455eb04b634e413b17c834a62e8a733a283
SHA512cd19d759f776442e4e07361394a2743620de7933aec6e811f648dbcb3bf13d2cc777dd33b392710fb7fd7777222a12b835fd08c73de034eeaf8e33964ab3ab98
-
C:\Windows\System\NEfQfCH.exeMD5
5a14cd41dea82dd32b4988f53d4e97c7
SHA1928532d9ae4b82f6640477ec714f2a6caa9e25f9
SHA25624fd796d7798c14538324dbac8f241e83261a0a3bb98329c03faa90cafa23e4c
SHA51239732170116105a2025e53492e539e5da3af2cb0cd83b9834c557d22499d981f807f55780ec7024c3c4f76585e6002f7a7d6fb4b9b76d0ee028908d0ed0429bf
-
C:\Windows\System\NEfQfCH.exeMD5
5a14cd41dea82dd32b4988f53d4e97c7
SHA1928532d9ae4b82f6640477ec714f2a6caa9e25f9
SHA25624fd796d7798c14538324dbac8f241e83261a0a3bb98329c03faa90cafa23e4c
SHA51239732170116105a2025e53492e539e5da3af2cb0cd83b9834c557d22499d981f807f55780ec7024c3c4f76585e6002f7a7d6fb4b9b76d0ee028908d0ed0429bf
-
C:\Windows\System\YPQfiWA.exeMD5
1022c3235430c59b8a1f31aa741b02ab
SHA124c4220f6fc790e24b6d661ad5d6ab88af368625
SHA256ad14dff3f26101569429fd124e87bcbafde1f48f8b8a946e48a81a5f6d3dd79c
SHA51207bdf21572c9871bfc5fa462c47405b634edfceffb671588795301cd5d660c3fa1d1b5fe1732cd880a2ad4640d234c45fbbf8a3157473f427588ba31722b6351
-
C:\Windows\System\YPQfiWA.exeMD5
1022c3235430c59b8a1f31aa741b02ab
SHA124c4220f6fc790e24b6d661ad5d6ab88af368625
SHA256ad14dff3f26101569429fd124e87bcbafde1f48f8b8a946e48a81a5f6d3dd79c
SHA51207bdf21572c9871bfc5fa462c47405b634edfceffb671588795301cd5d660c3fa1d1b5fe1732cd880a2ad4640d234c45fbbf8a3157473f427588ba31722b6351
-
C:\Windows\System\afHhdbf.exeMD5
f88bc3056f581a34f6d6bf29f6cffe5c
SHA1a07539ea062d1adec4d520edc1ae4266e9d0d938
SHA2564e3c3afb45d32c72d7de2a46b7bef3b1665a1f378c71c919363742a9b1c36209
SHA51284c9b1f85db24009bb798d8fbac6809cf973e7110b9d63ad1e1009a091440be5f6a8b64dc77cdf65030f9b37ddd3f7483ff021ece5c34331a23391cbb85b4e73
-
C:\Windows\System\afHhdbf.exeMD5
f88bc3056f581a34f6d6bf29f6cffe5c
SHA1a07539ea062d1adec4d520edc1ae4266e9d0d938
SHA2564e3c3afb45d32c72d7de2a46b7bef3b1665a1f378c71c919363742a9b1c36209
SHA51284c9b1f85db24009bb798d8fbac6809cf973e7110b9d63ad1e1009a091440be5f6a8b64dc77cdf65030f9b37ddd3f7483ff021ece5c34331a23391cbb85b4e73
-
C:\Windows\System\aiWYdqm.exeMD5
a081dc8770deb924700558196df388d9
SHA1d6c581bed5602522188fe1838f2de804a689672f
SHA256f52a97d9b3a73095310477066114c2653d645e16d48da333ae7d6fec5ab0d78d
SHA51284e2f81f44fdce345c39540eded5f0396d1f4bbffe0a35a89c8080a2b7286358c6df5170b6cdc67346c083331d7d5861186a26edebd4e1878bdcd88e9ea32b9a
-
C:\Windows\System\aiWYdqm.exeMD5
a081dc8770deb924700558196df388d9
SHA1d6c581bed5602522188fe1838f2de804a689672f
SHA256f52a97d9b3a73095310477066114c2653d645e16d48da333ae7d6fec5ab0d78d
SHA51284e2f81f44fdce345c39540eded5f0396d1f4bbffe0a35a89c8080a2b7286358c6df5170b6cdc67346c083331d7d5861186a26edebd4e1878bdcd88e9ea32b9a
-
C:\Windows\System\bfJjYPx.exeMD5
b8f0133882417e84577a09493000c45b
SHA12893a3f51cb871dabd5b6dabf757b26a81bb975b
SHA256b24cb548e644ea8297d8a6eb4186b878924df3e35fe01c39cdad92a1c208fa6b
SHA51298e8e6556d4b55ed74a7be7dc6458baa67d85edee88127bebec24a7880b923d3deecadb14815ef511a116725eba8b81e2d54037caa6c50fd0561b1c6f005c76e
-
C:\Windows\System\bfJjYPx.exeMD5
b8f0133882417e84577a09493000c45b
SHA12893a3f51cb871dabd5b6dabf757b26a81bb975b
SHA256b24cb548e644ea8297d8a6eb4186b878924df3e35fe01c39cdad92a1c208fa6b
SHA51298e8e6556d4b55ed74a7be7dc6458baa67d85edee88127bebec24a7880b923d3deecadb14815ef511a116725eba8b81e2d54037caa6c50fd0561b1c6f005c76e
-
C:\Windows\System\hPAIjBU.exeMD5
9fff06a1a190c06c01917dee6f524372
SHA195f7026ef154e3995aaa3e10a9ee27bdee72b7b0
SHA256b73867f9b0e973972ec2a786aeffedbf127349f2ec2933fcb9b59e24892c5b8f
SHA512404ec61c8ab78d2ac75160a3ef761382807e8354d902d9f25e9e150aac5e996ff963125bccf40c6b793aa571884be8b10d2abe7f2c7e08721d246565e3198937
-
C:\Windows\System\hPAIjBU.exeMD5
9fff06a1a190c06c01917dee6f524372
SHA195f7026ef154e3995aaa3e10a9ee27bdee72b7b0
SHA256b73867f9b0e973972ec2a786aeffedbf127349f2ec2933fcb9b59e24892c5b8f
SHA512404ec61c8ab78d2ac75160a3ef761382807e8354d902d9f25e9e150aac5e996ff963125bccf40c6b793aa571884be8b10d2abe7f2c7e08721d246565e3198937
-
C:\Windows\System\jrisHgE.exeMD5
273d932a09dc169fea904ae899186d9a
SHA1b1d9206d5411bb23cd2091a05a2dcc14705fa6bb
SHA25650a3e01851477614bacd118c1941d847b38e020a06fbd331bb056fa2de233b82
SHA512efead7135c08748b3076b661dd2a6be3b0795b5ac1c31ee6e9ae6e0928cdf8e8ab8f7c004badcd53038f4babcde51d67ec749eb09b1822aada69d89a03415877
-
C:\Windows\System\jrisHgE.exeMD5
273d932a09dc169fea904ae899186d9a
SHA1b1d9206d5411bb23cd2091a05a2dcc14705fa6bb
SHA25650a3e01851477614bacd118c1941d847b38e020a06fbd331bb056fa2de233b82
SHA512efead7135c08748b3076b661dd2a6be3b0795b5ac1c31ee6e9ae6e0928cdf8e8ab8f7c004badcd53038f4babcde51d67ec749eb09b1822aada69d89a03415877
-
C:\Windows\System\lezPoNz.exeMD5
8d3a6e4e550848ce43a97d6505e1d930
SHA1522015a558e968664b3e901a2ef2bb9ab2f1dfea
SHA25633df1a650b09a37d90954f8db0cd93224df6c5f963869fde52f519ce1adae064
SHA51248346ecb88ec8caecb0b1dedaa97fdd54bca8fa16a53c517dc529395a08a84da23285c367983290b2ec928a558aeba0f8f5ebbee79eb62fe05bbdadec4b76144
-
C:\Windows\System\lezPoNz.exeMD5
8d3a6e4e550848ce43a97d6505e1d930
SHA1522015a558e968664b3e901a2ef2bb9ab2f1dfea
SHA25633df1a650b09a37d90954f8db0cd93224df6c5f963869fde52f519ce1adae064
SHA51248346ecb88ec8caecb0b1dedaa97fdd54bca8fa16a53c517dc529395a08a84da23285c367983290b2ec928a558aeba0f8f5ebbee79eb62fe05bbdadec4b76144
-
C:\Windows\System\lphJQFy.exeMD5
7fd99adb6a0314c784a1d05c06b75411
SHA167947c52afacbdb29c6f6e5f92df015351d27e75
SHA256b376f3c8f3fe3b4eae98bf6a872714cb190dc79aa6cbe99c2b72a60035b1bc86
SHA512beaee609551276ae71cccbdcf06dfff38a23b9b57bd55284fa1c7a5e04a8ef3170ffaf926ae560a4504274ec3850f0e66eb3ae0b50bf5ff997dbb4dd7f696a11
-
C:\Windows\System\lphJQFy.exeMD5
7fd99adb6a0314c784a1d05c06b75411
SHA167947c52afacbdb29c6f6e5f92df015351d27e75
SHA256b376f3c8f3fe3b4eae98bf6a872714cb190dc79aa6cbe99c2b72a60035b1bc86
SHA512beaee609551276ae71cccbdcf06dfff38a23b9b57bd55284fa1c7a5e04a8ef3170ffaf926ae560a4504274ec3850f0e66eb3ae0b50bf5ff997dbb4dd7f696a11
-
C:\Windows\System\mMCVdbL.exeMD5
29f2b9dd386830d6d6a28d7b07285654
SHA1c9566b625699d2cb0d340ff567743970d9a1d48f
SHA2564f002bb96e948b9eb25a22cd00d7b302daede05eae4f25cf778ea32ef8e28d16
SHA5120b2f9fefa46dc8fea2a4a83a00ecb0dfa7c216ae6ef9423da09e4e28dca70c6404aef0468f3f22a27167373133b0cc403fffd973b9747323d82d3cdd9c0b9614
-
C:\Windows\System\mMCVdbL.exeMD5
29f2b9dd386830d6d6a28d7b07285654
SHA1c9566b625699d2cb0d340ff567743970d9a1d48f
SHA2564f002bb96e948b9eb25a22cd00d7b302daede05eae4f25cf778ea32ef8e28d16
SHA5120b2f9fefa46dc8fea2a4a83a00ecb0dfa7c216ae6ef9423da09e4e28dca70c6404aef0468f3f22a27167373133b0cc403fffd973b9747323d82d3cdd9c0b9614
-
C:\Windows\System\sZOBqAB.exeMD5
4826e232851b70b70f92c8e09ffa0a1d
SHA119b5fa17689dc98fe79d8146c03b0b172d486558
SHA2560a663f0861fd4fe9c94f1483fc259915b19ba00e3a4745da28f7186d19d56e02
SHA51233824cfae6bf573e4d4dd14d267ae41e5efd5a5b72db466fb561ed6e8064a6ec01f85f4cba1d23dcde79fb873f99252f1f81676c139591794d863b7e99350252
-
C:\Windows\System\sZOBqAB.exeMD5
4826e232851b70b70f92c8e09ffa0a1d
SHA119b5fa17689dc98fe79d8146c03b0b172d486558
SHA2560a663f0861fd4fe9c94f1483fc259915b19ba00e3a4745da28f7186d19d56e02
SHA51233824cfae6bf573e4d4dd14d267ae41e5efd5a5b72db466fb561ed6e8064a6ec01f85f4cba1d23dcde79fb873f99252f1f81676c139591794d863b7e99350252
-
C:\Windows\System\sbgnqzz.exeMD5
5699e77a7b6bde8120795aa10fd09017
SHA14e3e4f8f0ac6a3f021a289608e8688f641292bd8
SHA256d4290661b25914cbcc4d49b5b2d8cf8a2a65e6f13fe4dbec39257ace4efcbe88
SHA512411f7ee6916d61465dda92894f8cecf684975deceffd4c3545385184d05d639a818dc06af982939693fc03f4509a31ee04d9a3228ae8d9cf933609ab5403a661
-
C:\Windows\System\sbgnqzz.exeMD5
5699e77a7b6bde8120795aa10fd09017
SHA14e3e4f8f0ac6a3f021a289608e8688f641292bd8
SHA256d4290661b25914cbcc4d49b5b2d8cf8a2a65e6f13fe4dbec39257ace4efcbe88
SHA512411f7ee6916d61465dda92894f8cecf684975deceffd4c3545385184d05d639a818dc06af982939693fc03f4509a31ee04d9a3228ae8d9cf933609ab5403a661
-
C:\Windows\System\zMdNRIV.exeMD5
c1cc87acfab58f2fabe5994f1aef81e8
SHA196ef3f0e114a512440b21e240676482fb35611e8
SHA256fb2e1cdaad412dd9d05fd3ce3ddd1cb7940390c2daf2641d4613d7375f9e8cae
SHA5120c95840ddd428bf9e76c8a7c17c93bc7dbbc6618ead7f93b73a65c918cb45b7e7f8de4bce8282ce56e47404dc6ac147a08d544bb9af281e2414b9dff46e33023
-
C:\Windows\System\zMdNRIV.exeMD5
c1cc87acfab58f2fabe5994f1aef81e8
SHA196ef3f0e114a512440b21e240676482fb35611e8
SHA256fb2e1cdaad412dd9d05fd3ce3ddd1cb7940390c2daf2641d4613d7375f9e8cae
SHA5120c95840ddd428bf9e76c8a7c17c93bc7dbbc6618ead7f93b73a65c918cb45b7e7f8de4bce8282ce56e47404dc6ac147a08d544bb9af281e2414b9dff46e33023
-
memory/196-36-0x0000000000000000-mapping.dmp
-
memory/1816-15-0x0000000000000000-mapping.dmp
-
memory/1896-0-0x0000000000000000-mapping.dmp
-
memory/1936-42-0x0000000000000000-mapping.dmp
-
memory/2024-57-0x0000000000000000-mapping.dmp
-
memory/2164-47-0x0000000000000000-mapping.dmp
-
memory/2184-12-0x0000000000000000-mapping.dmp
-
memory/2612-30-0x0000000000000000-mapping.dmp
-
memory/2816-24-0x0000000000000000-mapping.dmp
-
memory/2884-45-0x0000000000000000-mapping.dmp
-
memory/3056-27-0x0000000000000000-mapping.dmp
-
memory/3120-18-0x0000000000000000-mapping.dmp
-
memory/3176-56-0x0000000000000000-mapping.dmp
-
memory/3388-3-0x0000000000000000-mapping.dmp
-
memory/3556-21-0x0000000000000000-mapping.dmp
-
memory/3628-48-0x0000000000000000-mapping.dmp
-
memory/3740-9-0x0000000000000000-mapping.dmp
-
memory/3780-54-0x0000000000000000-mapping.dmp
-
memory/3888-6-0x0000000000000000-mapping.dmp
-
memory/3936-39-0x0000000000000000-mapping.dmp
-
memory/3976-33-0x0000000000000000-mapping.dmp