cobaltstrike | 482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f

Analysis

max time kernel
145s
max time network
166s
platform
windows7_x64
resource
win7v20201028
submitted
10/11/2020, 08:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
Size 5.9MB
Sample201110-gpv2hyzada
SHA256 482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f
MD5 a5635f32f7e2ecb748dddd1fc5940dcc
SHA1 e9dd07680f28f070dca96c8706d1d953be89b422
SHA512 63ebd6c6c27035b82234153e4f3bcef503955fcfcb89002e3dbf528ce5e12ac1a012952f9b52209a421cd81341bb53f36b73bd8059bc4dc576a78e44ae6ccce0
MD5 SHA1 SHA512

Score

10^/10

cobaltstrike backdoor trojan upx

Malware Config

Signatures

Cobalt Strike reflective loader 42 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x00040000000130c9-0.dat	cobalt_reflective_dll
behavioral1/files/0x00040000000130c9-2.dat	cobalt_reflective_dll
behavioral1/files/0x00040000000130ca-3.dat	cobalt_reflective_dll
behavioral1/files/0x00040000000130ca-5.dat	cobalt_reflective_dll
behavioral1/files/0x000d00000000560a-6.dat	cobalt_reflective_dll
behavioral1/files/0x000d00000000560a-8.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130cf-9.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130cf-11.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d0-12.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d0-14.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d1-15.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d1-17.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d2-18.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d2-20.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d3-21.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d3-23.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d4-24.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d4-26.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d5-27.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d5-29.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d6-34.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d7-32.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d6-30.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d7-35.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d8-36.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d8-38.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d9-39.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130d9-41.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130da-42.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130da-44.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130db-45.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130db-47.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130dc-48.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130dd-51.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130dd-53.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130de-54.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130dc-50.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130de-56.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130df-57.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130df-59.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130e0-60.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130e0-62.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Executes dropped EXE 21 IoCs

pid	Process
2032	ZTAbpCH.exe
1288	DbslDSY.exe
1616	prgKjie.exe
668	mCGjZSU.exe
568	BhVOPSQ.exe
968	tKLeEas.exe
1628	yCYsQxg.exe
560	dWMldAu.exe
1864	eDgFJgI.exe
1624	tACYZav.exe
380	XnmtQDu.exe
640	uDsxXMA.exe
1532	rPXVSJZ.exe
1000	fvnFLhZ.exe
852	gNpufQD.exe
1964	QDoNHrl.exe
1152	UKJTxzW.exe
1736	MtGsBfj.exe
916	UDQNTsK.exe
1596	mYFsKlL.exe
828	jEqMnbJ.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00040000000130c9-0.dat	upx
behavioral1/files/0x00040000000130c9-2.dat	upx
behavioral1/files/0x00040000000130ca-3.dat	upx
behavioral1/files/0x00040000000130ca-5.dat	upx
behavioral1/files/0x000d00000000560a-6.dat	upx
behavioral1/files/0x000d00000000560a-8.dat	upx
behavioral1/files/0x00030000000130cf-9.dat	upx
behavioral1/files/0x00030000000130cf-11.dat	upx
behavioral1/files/0x00030000000130d0-12.dat	upx
behavioral1/files/0x00030000000130d0-14.dat	upx
behavioral1/files/0x00030000000130d1-15.dat	upx
behavioral1/files/0x00030000000130d1-17.dat	upx
behavioral1/files/0x00030000000130d2-18.dat	upx
behavioral1/files/0x00030000000130d2-20.dat	upx
behavioral1/files/0x00030000000130d3-21.dat	upx
behavioral1/files/0x00030000000130d3-23.dat	upx
behavioral1/files/0x00030000000130d4-24.dat	upx
behavioral1/files/0x00030000000130d4-26.dat	upx
behavioral1/files/0x00030000000130d5-27.dat	upx
behavioral1/files/0x00030000000130d5-29.dat	upx
behavioral1/files/0x00030000000130d6-34.dat	upx
behavioral1/files/0x00030000000130d7-32.dat	upx
behavioral1/files/0x00030000000130d6-30.dat	upx
behavioral1/files/0x00030000000130d7-35.dat	upx
behavioral1/files/0x00030000000130d8-36.dat	upx
behavioral1/files/0x00030000000130d8-38.dat	upx
behavioral1/files/0x00030000000130d9-39.dat	upx
behavioral1/files/0x00030000000130d9-41.dat	upx
behavioral1/files/0x00030000000130da-42.dat	upx
behavioral1/files/0x00030000000130da-44.dat	upx
behavioral1/files/0x00030000000130db-45.dat	upx
behavioral1/files/0x00030000000130db-47.dat	upx
behavioral1/files/0x00030000000130dc-48.dat	upx
behavioral1/files/0x00030000000130dd-51.dat	upx
behavioral1/files/0x00030000000130dd-53.dat	upx
behavioral1/files/0x00030000000130de-54.dat	upx
behavioral1/files/0x00030000000130dc-50.dat	upx
behavioral1/files/0x00030000000130de-56.dat	upx
behavioral1/files/0x00030000000130df-57.dat	upx
behavioral1/files/0x00030000000130df-59.dat	upx
behavioral1/files/0x00030000000130e0-60.dat	upx
behavioral1/files/0x00030000000130e0-62.dat	upx

Loads dropped DLL 21 IoCs

pid	Process
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe

JavaScript code in executable 42 IoCs

resource	yara_rule
behavioral1/files/0x00040000000130c9-0.dat	js
behavioral1/files/0x00040000000130c9-2.dat	js
behavioral1/files/0x00040000000130ca-3.dat	js
behavioral1/files/0x00040000000130ca-5.dat	js
behavioral1/files/0x000d00000000560a-6.dat	js
behavioral1/files/0x000d00000000560a-8.dat	js
behavioral1/files/0x00030000000130cf-9.dat	js
behavioral1/files/0x00030000000130cf-11.dat	js
behavioral1/files/0x00030000000130d0-12.dat	js
behavioral1/files/0x00030000000130d0-14.dat	js
behavioral1/files/0x00030000000130d1-15.dat	js
behavioral1/files/0x00030000000130d1-17.dat	js
behavioral1/files/0x00030000000130d2-18.dat	js
behavioral1/files/0x00030000000130d2-20.dat	js
behavioral1/files/0x00030000000130d3-21.dat	js
behavioral1/files/0x00030000000130d3-23.dat	js
behavioral1/files/0x00030000000130d4-24.dat	js
behavioral1/files/0x00030000000130d4-26.dat	js
behavioral1/files/0x00030000000130d5-27.dat	js
behavioral1/files/0x00030000000130d5-29.dat	js
behavioral1/files/0x00030000000130d6-34.dat	js
behavioral1/files/0x00030000000130d7-32.dat	js
behavioral1/files/0x00030000000130d6-30.dat	js
behavioral1/files/0x00030000000130d7-35.dat	js
behavioral1/files/0x00030000000130d8-36.dat	js
behavioral1/files/0x00030000000130d8-38.dat	js
behavioral1/files/0x00030000000130d9-39.dat	js
behavioral1/files/0x00030000000130d9-41.dat	js
behavioral1/files/0x00030000000130da-42.dat	js
behavioral1/files/0x00030000000130da-44.dat	js
behavioral1/files/0x00030000000130db-45.dat	js
behavioral1/files/0x00030000000130db-47.dat	js
behavioral1/files/0x00030000000130dc-48.dat	js
behavioral1/files/0x00030000000130dd-51.dat	js
behavioral1/files/0x00030000000130dd-53.dat	js
behavioral1/files/0x00030000000130de-54.dat	js
behavioral1/files/0x00030000000130dc-50.dat	js
behavioral1/files/0x00030000000130de-56.dat	js
behavioral1/files/0x00030000000130df-57.dat	js
behavioral1/files/0x00030000000130df-59.dat	js
behavioral1/files/0x00030000000130e0-60.dat	js
behavioral1/files/0x00030000000130e0-62.dat	js

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\ZTAbpCH.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\tKLeEas.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\yCYsQxg.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\dWMldAu.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\fvnFLhZ.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\eDgFJgI.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\tACYZav.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\gNpufQD.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\jEqMnbJ.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\mCGjZSU.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\XnmtQDu.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\QDoNHrl.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\MtGsBfj.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\mYFsKlL.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\DbslDSY.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\prgKjie.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\BhVOPSQ.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\uDsxXMA.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\rPXVSJZ.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\UKJTxzW.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
File created	C:\Windows\System\UDQNTsK.exe	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
Token: SeLockMemoryPrivilege	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 2032	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	27
PID 1080 wrote to memory of 2032	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	27
PID 1080 wrote to memory of 2032	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	27
PID 1080 wrote to memory of 1288	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	28
PID 1080 wrote to memory of 1288	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	28
PID 1080 wrote to memory of 1288	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	28
PID 1080 wrote to memory of 1616	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	32
PID 1080 wrote to memory of 1616	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	32
PID 1080 wrote to memory of 1616	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	32
PID 1080 wrote to memory of 668	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	33
PID 1080 wrote to memory of 668	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	33
PID 1080 wrote to memory of 668	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	33
PID 1080 wrote to memory of 568	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	34
PID 1080 wrote to memory of 568	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	34
PID 1080 wrote to memory of 568	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	34
PID 1080 wrote to memory of 968	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	35
PID 1080 wrote to memory of 968	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	35
PID 1080 wrote to memory of 968	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	35
PID 1080 wrote to memory of 1628	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	36
PID 1080 wrote to memory of 1628	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	36
PID 1080 wrote to memory of 1628	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	36
PID 1080 wrote to memory of 560	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	37
PID 1080 wrote to memory of 560	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	37
PID 1080 wrote to memory of 560	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	37
PID 1080 wrote to memory of 1864	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	38
PID 1080 wrote to memory of 1864	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	38
PID 1080 wrote to memory of 1864	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	38
PID 1080 wrote to memory of 1624	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	39
PID 1080 wrote to memory of 1624	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	39
PID 1080 wrote to memory of 1624	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	39
PID 1080 wrote to memory of 380	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	40
PID 1080 wrote to memory of 380	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	40
PID 1080 wrote to memory of 380	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	40
PID 1080 wrote to memory of 640	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	41
PID 1080 wrote to memory of 640	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	41
PID 1080 wrote to memory of 640	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	41
PID 1080 wrote to memory of 1532	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	42
PID 1080 wrote to memory of 1532	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	42
PID 1080 wrote to memory of 1532	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	42
PID 1080 wrote to memory of 1000	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	43
PID 1080 wrote to memory of 1000	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	43
PID 1080 wrote to memory of 1000	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	43
PID 1080 wrote to memory of 852	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	44
PID 1080 wrote to memory of 852	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	44
PID 1080 wrote to memory of 852	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	44
PID 1080 wrote to memory of 1964	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	45
PID 1080 wrote to memory of 1964	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	45
PID 1080 wrote to memory of 1964	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	45
PID 1080 wrote to memory of 1152	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	46
PID 1080 wrote to memory of 1152	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	46
PID 1080 wrote to memory of 1152	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	46
PID 1080 wrote to memory of 1736	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	47
PID 1080 wrote to memory of 1736	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	47
PID 1080 wrote to memory of 1736	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	47
PID 1080 wrote to memory of 916	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	48
PID 1080 wrote to memory of 916	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	48
PID 1080 wrote to memory of 916	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	48
PID 1080 wrote to memory of 1596	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	49
PID 1080 wrote to memory of 1596	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	49
PID 1080 wrote to memory of 1596	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	49
PID 1080 wrote to memory of 828	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	50
PID 1080 wrote to memory of 828	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	50
PID 1080 wrote to memory of 828	1080	482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe	50

C:\Users\Admin\AppData\Local\Temp\482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe
"C:\Users\Admin\AppData\Local\Temp\482261bcb11550aa50a1aa006c400a54133fd1ec9610ff002e61649fb60fa88f.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\System\ZTAbpCH.exe
  C:\Windows\System\ZTAbpCH.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\DbslDSY.exe
  C:\Windows\System\DbslDSY.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\prgKjie.exe
  C:\Windows\System\prgKjie.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\mCGjZSU.exe
  C:\Windows\System\mCGjZSU.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\BhVOPSQ.exe
  C:\Windows\System\BhVOPSQ.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\tKLeEas.exe
  C:\Windows\System\tKLeEas.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\yCYsQxg.exe
  C:\Windows\System\yCYsQxg.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\dWMldAu.exe
  C:\Windows\System\dWMldAu.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\eDgFJgI.exe
  C:\Windows\System\eDgFJgI.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\tACYZav.exe
  C:\Windows\System\tACYZav.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\XnmtQDu.exe
  C:\Windows\System\XnmtQDu.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\uDsxXMA.exe
  C:\Windows\System\uDsxXMA.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\rPXVSJZ.exe
  C:\Windows\System\rPXVSJZ.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\fvnFLhZ.exe
  C:\Windows\System\fvnFLhZ.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\gNpufQD.exe
  C:\Windows\System\gNpufQD.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\QDoNHrl.exe
  C:\Windows\System\QDoNHrl.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\UKJTxzW.exe
  C:\Windows\System\UKJTxzW.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\MtGsBfj.exe
  C:\Windows\System\MtGsBfj.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\UDQNTsK.exe
  C:\Windows\System\UDQNTsK.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\mYFsKlL.exe
  C:\Windows\System\mYFsKlL.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\jEqMnbJ.exe
  C:\Windows\System\jEqMnbJ.exe
  2⤵
  - Executes dropped EXE
  PID:828

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads