Analysis
-
max time kernel
137s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
10-11-2020 07:28
Static task
static1
Behavioral task
behavioral1
Sample
1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe
Resource
win10v20201028
General
-
Target
1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe
-
Size
5.2MB
-
MD5
343fab52a4b0e58925719e6451903093
-
SHA1
845fe3f231d26295dbda9feaa6a48d29e504aac1
-
SHA256
1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92
-
SHA512
5ae92127ee496819c7d36ffb8cf5f17a840cee010dc7c90958ddc60e072ed8f8476623b4bdd0bfd0823fd5540695f35f80efee65c4096bbade18013c6af8c303
Malware Config
Signatures
-
Cobalt Strike reflective loader 42 IoCs
Detects the reflective loader used by Cobalt Strike.
Processes:
resource yara_rule C:\Windows\System\QlUyHgf.exe cobalt_reflective_dll C:\Windows\System\QlUyHgf.exe cobalt_reflective_dll C:\Windows\System\uIDJKZU.exe cobalt_reflective_dll C:\Windows\System\uIDJKZU.exe cobalt_reflective_dll C:\Windows\System\xsdmjBN.exe cobalt_reflective_dll C:\Windows\System\xsdmjBN.exe cobalt_reflective_dll C:\Windows\System\CnIddfZ.exe cobalt_reflective_dll C:\Windows\System\CnIddfZ.exe cobalt_reflective_dll C:\Windows\System\dWtTXSZ.exe cobalt_reflective_dll C:\Windows\System\dWtTXSZ.exe cobalt_reflective_dll C:\Windows\System\cxHsroL.exe cobalt_reflective_dll C:\Windows\System\cxHsroL.exe cobalt_reflective_dll C:\Windows\System\RvEHTQY.exe cobalt_reflective_dll C:\Windows\System\RvEHTQY.exe cobalt_reflective_dll C:\Windows\System\gEAITNN.exe cobalt_reflective_dll C:\Windows\System\tDEkiKS.exe cobalt_reflective_dll C:\Windows\System\gEAITNN.exe cobalt_reflective_dll C:\Windows\System\rUPhixO.exe cobalt_reflective_dll C:\Windows\System\KAuWePo.exe cobalt_reflective_dll C:\Windows\System\KAuWePo.exe cobalt_reflective_dll C:\Windows\System\OwxXIar.exe cobalt_reflective_dll C:\Windows\System\rUPhixO.exe cobalt_reflective_dll C:\Windows\System\pldWHRX.exe cobalt_reflective_dll C:\Windows\System\OwxXIar.exe cobalt_reflective_dll C:\Windows\System\tDEkiKS.exe cobalt_reflective_dll C:\Windows\System\IkgwSEE.exe cobalt_reflective_dll C:\Windows\System\pldWHRX.exe cobalt_reflective_dll C:\Windows\System\IkgwSEE.exe cobalt_reflective_dll C:\Windows\System\JQWBGpD.exe cobalt_reflective_dll C:\Windows\System\JQWBGpD.exe cobalt_reflective_dll C:\Windows\System\sDHwYjv.exe cobalt_reflective_dll C:\Windows\System\sDHwYjv.exe cobalt_reflective_dll C:\Windows\System\jESjvWc.exe cobalt_reflective_dll C:\Windows\System\pYrlPFz.exe cobalt_reflective_dll C:\Windows\System\KOwjOwa.exe cobalt_reflective_dll C:\Windows\System\sjnfjfo.exe cobalt_reflective_dll C:\Windows\System\pYrlPFz.exe cobalt_reflective_dll C:\Windows\System\sjnfjfo.exe cobalt_reflective_dll C:\Windows\System\KOwjOwa.exe cobalt_reflective_dll C:\Windows\System\jESjvWc.exe cobalt_reflective_dll C:\Windows\System\RmQIZCs.exe cobalt_reflective_dll C:\Windows\System\RmQIZCs.exe cobalt_reflective_dll -
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Executes dropped EXE 21 IoCs
Processes:
QlUyHgf.exeuIDJKZU.exexsdmjBN.exeCnIddfZ.exedWtTXSZ.execxHsroL.exeRvEHTQY.exegEAITNN.exetDEkiKS.exerUPhixO.exeKAuWePo.exeOwxXIar.exepldWHRX.exeIkgwSEE.exeRmQIZCs.exeJQWBGpD.exesDHwYjv.exejESjvWc.exepYrlPFz.exeKOwjOwa.exesjnfjfo.exepid process 1552 QlUyHgf.exe 1684 uIDJKZU.exe 1920 xsdmjBN.exe 2064 CnIddfZ.exe 2224 dWtTXSZ.exe 3652 cxHsroL.exe 3740 RvEHTQY.exe 4004 gEAITNN.exe 4036 tDEkiKS.exe 312 rUPhixO.exe 200 KAuWePo.exe 756 OwxXIar.exe 3908 pldWHRX.exe 1268 IkgwSEE.exe 2600 RmQIZCs.exe 1320 JQWBGpD.exe 2400 sDHwYjv.exe 4076 jESjvWc.exe 4056 pYrlPFz.exe 3460 KOwjOwa.exe 3196 sjnfjfo.exe -
Processes:
resource yara_rule C:\Windows\System\QlUyHgf.exe upx C:\Windows\System\QlUyHgf.exe upx C:\Windows\System\uIDJKZU.exe upx C:\Windows\System\uIDJKZU.exe upx C:\Windows\System\xsdmjBN.exe upx C:\Windows\System\xsdmjBN.exe upx C:\Windows\System\CnIddfZ.exe upx C:\Windows\System\CnIddfZ.exe upx C:\Windows\System\dWtTXSZ.exe upx C:\Windows\System\dWtTXSZ.exe upx C:\Windows\System\cxHsroL.exe upx C:\Windows\System\cxHsroL.exe upx C:\Windows\System\RvEHTQY.exe upx C:\Windows\System\RvEHTQY.exe upx C:\Windows\System\gEAITNN.exe upx C:\Windows\System\tDEkiKS.exe upx C:\Windows\System\gEAITNN.exe upx C:\Windows\System\rUPhixO.exe upx C:\Windows\System\KAuWePo.exe upx C:\Windows\System\KAuWePo.exe upx C:\Windows\System\OwxXIar.exe upx C:\Windows\System\rUPhixO.exe upx C:\Windows\System\pldWHRX.exe upx C:\Windows\System\OwxXIar.exe upx C:\Windows\System\tDEkiKS.exe upx C:\Windows\System\IkgwSEE.exe upx C:\Windows\System\pldWHRX.exe upx C:\Windows\System\IkgwSEE.exe upx C:\Windows\System\JQWBGpD.exe upx C:\Windows\System\JQWBGpD.exe upx C:\Windows\System\sDHwYjv.exe upx C:\Windows\System\sDHwYjv.exe upx C:\Windows\System\jESjvWc.exe upx C:\Windows\System\pYrlPFz.exe upx C:\Windows\System\KOwjOwa.exe upx C:\Windows\System\sjnfjfo.exe upx C:\Windows\System\pYrlPFz.exe upx C:\Windows\System\sjnfjfo.exe upx C:\Windows\System\KOwjOwa.exe upx C:\Windows\System\jESjvWc.exe upx C:\Windows\System\RmQIZCs.exe upx C:\Windows\System\RmQIZCs.exe upx -
JavaScript code in executable 42 IoCs
Processes:
resource yara_rule C:\Windows\System\QlUyHgf.exe js C:\Windows\System\QlUyHgf.exe js C:\Windows\System\uIDJKZU.exe js C:\Windows\System\uIDJKZU.exe js C:\Windows\System\xsdmjBN.exe js C:\Windows\System\xsdmjBN.exe js C:\Windows\System\CnIddfZ.exe js C:\Windows\System\CnIddfZ.exe js C:\Windows\System\dWtTXSZ.exe js C:\Windows\System\dWtTXSZ.exe js C:\Windows\System\cxHsroL.exe js C:\Windows\System\cxHsroL.exe js C:\Windows\System\RvEHTQY.exe js C:\Windows\System\RvEHTQY.exe js C:\Windows\System\gEAITNN.exe js C:\Windows\System\tDEkiKS.exe js C:\Windows\System\gEAITNN.exe js C:\Windows\System\rUPhixO.exe js C:\Windows\System\KAuWePo.exe js C:\Windows\System\KAuWePo.exe js C:\Windows\System\OwxXIar.exe js C:\Windows\System\rUPhixO.exe js C:\Windows\System\pldWHRX.exe js C:\Windows\System\OwxXIar.exe js C:\Windows\System\tDEkiKS.exe js C:\Windows\System\IkgwSEE.exe js C:\Windows\System\pldWHRX.exe js C:\Windows\System\IkgwSEE.exe js C:\Windows\System\JQWBGpD.exe js C:\Windows\System\JQWBGpD.exe js C:\Windows\System\sDHwYjv.exe js C:\Windows\System\sDHwYjv.exe js C:\Windows\System\jESjvWc.exe js C:\Windows\System\pYrlPFz.exe js C:\Windows\System\KOwjOwa.exe js C:\Windows\System\sjnfjfo.exe js C:\Windows\System\pYrlPFz.exe js C:\Windows\System\sjnfjfo.exe js C:\Windows\System\KOwjOwa.exe js C:\Windows\System\jESjvWc.exe js C:\Windows\System\RmQIZCs.exe js C:\Windows\System\RmQIZCs.exe js -
Drops file in Windows directory 21 IoCs
Processes:
1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exedescription ioc process File created C:\Windows\System\xsdmjBN.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\KAuWePo.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\JQWBGpD.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\sDHwYjv.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\pYrlPFz.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\KOwjOwa.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\QlUyHgf.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\uIDJKZU.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\CnIddfZ.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\tDEkiKS.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\jESjvWc.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\RvEHTQY.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\rUPhixO.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\pldWHRX.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\IkgwSEE.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\dWtTXSZ.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\cxHsroL.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\gEAITNN.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\OwxXIar.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\RmQIZCs.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe File created C:\Windows\System\sjnfjfo.exe 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exedescription pid process Token: SeLockMemoryPrivilege 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe Token: SeLockMemoryPrivilege 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exedescription pid process target process PID 3980 wrote to memory of 1552 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe QlUyHgf.exe PID 3980 wrote to memory of 1552 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe QlUyHgf.exe PID 3980 wrote to memory of 1684 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe uIDJKZU.exe PID 3980 wrote to memory of 1684 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe uIDJKZU.exe PID 3980 wrote to memory of 1920 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe xsdmjBN.exe PID 3980 wrote to memory of 1920 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe xsdmjBN.exe PID 3980 wrote to memory of 2064 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe CnIddfZ.exe PID 3980 wrote to memory of 2064 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe CnIddfZ.exe PID 3980 wrote to memory of 2224 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe dWtTXSZ.exe PID 3980 wrote to memory of 2224 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe dWtTXSZ.exe PID 3980 wrote to memory of 3652 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe cxHsroL.exe PID 3980 wrote to memory of 3652 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe cxHsroL.exe PID 3980 wrote to memory of 3740 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe RvEHTQY.exe PID 3980 wrote to memory of 3740 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe RvEHTQY.exe PID 3980 wrote to memory of 4004 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe gEAITNN.exe PID 3980 wrote to memory of 4004 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe gEAITNN.exe PID 3980 wrote to memory of 4036 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe tDEkiKS.exe PID 3980 wrote to memory of 4036 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe tDEkiKS.exe PID 3980 wrote to memory of 312 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe rUPhixO.exe PID 3980 wrote to memory of 312 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe rUPhixO.exe PID 3980 wrote to memory of 200 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe KAuWePo.exe PID 3980 wrote to memory of 200 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe KAuWePo.exe PID 3980 wrote to memory of 756 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe OwxXIar.exe PID 3980 wrote to memory of 756 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe OwxXIar.exe PID 3980 wrote to memory of 3908 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe pldWHRX.exe PID 3980 wrote to memory of 3908 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe pldWHRX.exe PID 3980 wrote to memory of 1268 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe IkgwSEE.exe PID 3980 wrote to memory of 1268 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe IkgwSEE.exe PID 3980 wrote to memory of 2600 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe RmQIZCs.exe PID 3980 wrote to memory of 2600 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe RmQIZCs.exe PID 3980 wrote to memory of 1320 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe JQWBGpD.exe PID 3980 wrote to memory of 1320 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe JQWBGpD.exe PID 3980 wrote to memory of 2400 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe sDHwYjv.exe PID 3980 wrote to memory of 2400 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe sDHwYjv.exe PID 3980 wrote to memory of 4076 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe jESjvWc.exe PID 3980 wrote to memory of 4076 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe jESjvWc.exe PID 3980 wrote to memory of 4056 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe pYrlPFz.exe PID 3980 wrote to memory of 4056 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe pYrlPFz.exe PID 3980 wrote to memory of 3460 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe KOwjOwa.exe PID 3980 wrote to memory of 3460 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe KOwjOwa.exe PID 3980 wrote to memory of 3196 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe sjnfjfo.exe PID 3980 wrote to memory of 3196 3980 1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe sjnfjfo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe"C:\Users\Admin\AppData\Local\Temp\1b7773d4ecc31379d1232d053dcde99c3fccd42a696770b126fb7cf110d5dd92.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QlUyHgf.exeC:\Windows\System\QlUyHgf.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\uIDJKZU.exeC:\Windows\System\uIDJKZU.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\xsdmjBN.exeC:\Windows\System\xsdmjBN.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\CnIddfZ.exeC:\Windows\System\CnIddfZ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\dWtTXSZ.exeC:\Windows\System\dWtTXSZ.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\cxHsroL.exeC:\Windows\System\cxHsroL.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\RvEHTQY.exeC:\Windows\System\RvEHTQY.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\gEAITNN.exeC:\Windows\System\gEAITNN.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\tDEkiKS.exeC:\Windows\System\tDEkiKS.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\rUPhixO.exeC:\Windows\System\rUPhixO.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\KAuWePo.exeC:\Windows\System\KAuWePo.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\OwxXIar.exeC:\Windows\System\OwxXIar.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\pldWHRX.exeC:\Windows\System\pldWHRX.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\IkgwSEE.exeC:\Windows\System\IkgwSEE.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\RmQIZCs.exeC:\Windows\System\RmQIZCs.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\JQWBGpD.exeC:\Windows\System\JQWBGpD.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\sDHwYjv.exeC:\Windows\System\sDHwYjv.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\jESjvWc.exeC:\Windows\System\jESjvWc.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\pYrlPFz.exeC:\Windows\System\pYrlPFz.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\KOwjOwa.exeC:\Windows\System\KOwjOwa.exe2⤵
- Executes dropped EXE
-
C:\Windows\System\sjnfjfo.exeC:\Windows\System\sjnfjfo.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\System\CnIddfZ.exeMD5
4327391bcac340ca46fcdf50e4fab037
SHA19aae590123e5ffb350926ad4e2c892c35998e68d
SHA256a82f32ae2afcb8ce9b41b4759a7c8ddb3b6155b91c1fbefbb14516c313ba6025
SHA512ae98d49f66ec2011023c2265e6d78c73fd27a245380b410491516994359b01f3b2b8bd208d32378f5d94e6c42d6d4eaa7961ff8b7cf6e09ac62fecad62a0afec
-
C:\Windows\System\CnIddfZ.exeMD5
4327391bcac340ca46fcdf50e4fab037
SHA19aae590123e5ffb350926ad4e2c892c35998e68d
SHA256a82f32ae2afcb8ce9b41b4759a7c8ddb3b6155b91c1fbefbb14516c313ba6025
SHA512ae98d49f66ec2011023c2265e6d78c73fd27a245380b410491516994359b01f3b2b8bd208d32378f5d94e6c42d6d4eaa7961ff8b7cf6e09ac62fecad62a0afec
-
C:\Windows\System\IkgwSEE.exeMD5
cac5272f32c0affbb3d4dbab51b24528
SHA1fbbe5483956e4a29068e6dbacb6c5b03cb93c044
SHA256e16be0dbc65b28b4be0fa50f3eb59f0ea9d0f069d374b1a1889fa09a0718f05f
SHA5128d00eba06c66604b502b270b90e46f7d33f4c0dbc9b4d5ce26a766b4cc1b2604a0d7a4b8a2c20e97e51bf71b8d1bed8ab03dc1fb18833d0c7e8b39afa88afa3a
-
C:\Windows\System\IkgwSEE.exeMD5
cac5272f32c0affbb3d4dbab51b24528
SHA1fbbe5483956e4a29068e6dbacb6c5b03cb93c044
SHA256e16be0dbc65b28b4be0fa50f3eb59f0ea9d0f069d374b1a1889fa09a0718f05f
SHA5128d00eba06c66604b502b270b90e46f7d33f4c0dbc9b4d5ce26a766b4cc1b2604a0d7a4b8a2c20e97e51bf71b8d1bed8ab03dc1fb18833d0c7e8b39afa88afa3a
-
C:\Windows\System\JQWBGpD.exeMD5
c19f1886ca405bc103cf510108d8acf2
SHA1ec5b0f90e94c9f04776320457ca2e6d8002e0219
SHA2567f4a23cbb238670dd7d80bcc8c6d067177357bafad226ba68d1c9a78b9636bee
SHA51218cdd5bdfb94a98abc1644932c8c3397b54f2fd10e22fc059d7d7cfe294ec3a9bca07ed1ccdc6e025f7ee449d306f61ebf1f2899462cfd4e263a495073f285b0
-
C:\Windows\System\JQWBGpD.exeMD5
c19f1886ca405bc103cf510108d8acf2
SHA1ec5b0f90e94c9f04776320457ca2e6d8002e0219
SHA2567f4a23cbb238670dd7d80bcc8c6d067177357bafad226ba68d1c9a78b9636bee
SHA51218cdd5bdfb94a98abc1644932c8c3397b54f2fd10e22fc059d7d7cfe294ec3a9bca07ed1ccdc6e025f7ee449d306f61ebf1f2899462cfd4e263a495073f285b0
-
C:\Windows\System\KAuWePo.exeMD5
ad63c08d80b6e45bda3e188b39ba0810
SHA120fbdd5a970e832f8ed6c770e887a728054897c3
SHA2560debfa37ec75dfd584c0881565533f8a0338c81fc6f732ce6689b5acf93fe061
SHA512d2b579d60f76837eb320a8108d196bed64ea26e3b7e3141080fdff6f8758ffc81286f5b1aa9989cd87e69d56edfd69e8e5b097cf2ddbc881668558a0fd5a8792
-
C:\Windows\System\KAuWePo.exeMD5
ad63c08d80b6e45bda3e188b39ba0810
SHA120fbdd5a970e832f8ed6c770e887a728054897c3
SHA2560debfa37ec75dfd584c0881565533f8a0338c81fc6f732ce6689b5acf93fe061
SHA512d2b579d60f76837eb320a8108d196bed64ea26e3b7e3141080fdff6f8758ffc81286f5b1aa9989cd87e69d56edfd69e8e5b097cf2ddbc881668558a0fd5a8792
-
C:\Windows\System\KOwjOwa.exeMD5
37c438fb03efb36329f2ff0a05dc5107
SHA11583d6cf5bd94b9644fd6b30638b513035209cee
SHA2569db0a670f7e5f2cea25116be90d6b8523d474e4382619bc16ce34f54a4a5ce54
SHA512cf6ef62bf09ca88ec99326dbb003810105fb76bb584de7a12b757e5daaa669b0268c71be2e59317cd0dec1bc25be0568d4e708ee76fe7dd25ec7f40a465bd993
-
C:\Windows\System\KOwjOwa.exeMD5
37c438fb03efb36329f2ff0a05dc5107
SHA11583d6cf5bd94b9644fd6b30638b513035209cee
SHA2569db0a670f7e5f2cea25116be90d6b8523d474e4382619bc16ce34f54a4a5ce54
SHA512cf6ef62bf09ca88ec99326dbb003810105fb76bb584de7a12b757e5daaa669b0268c71be2e59317cd0dec1bc25be0568d4e708ee76fe7dd25ec7f40a465bd993
-
C:\Windows\System\OwxXIar.exeMD5
12f6f926bc45519ad9999b880a2a514f
SHA1b7c11b31a642405d63d98f5e3a1d6f459a7a80ac
SHA2566d65bc83df0ff126a64b0c1d4337f15ccedae0bee7c7d95a8c4ee7f86229b7df
SHA51254641043f3e201e654149ab3b3ebbd46cfb2bc4934d5c1e52a3e82016adb66aa9a4e2126d19c45ab9ef56ca97958de7bbaf849b29f3236aa6dfbe15defc886d6
-
C:\Windows\System\OwxXIar.exeMD5
12f6f926bc45519ad9999b880a2a514f
SHA1b7c11b31a642405d63d98f5e3a1d6f459a7a80ac
SHA2566d65bc83df0ff126a64b0c1d4337f15ccedae0bee7c7d95a8c4ee7f86229b7df
SHA51254641043f3e201e654149ab3b3ebbd46cfb2bc4934d5c1e52a3e82016adb66aa9a4e2126d19c45ab9ef56ca97958de7bbaf849b29f3236aa6dfbe15defc886d6
-
C:\Windows\System\QlUyHgf.exeMD5
4ec35bac7a8aa704c6914ac3a084648e
SHA1a1f653a4c31d9f0a0c26ec0c1fec8d553901a26b
SHA2569ef4523b557c320bbc73d536ee305523da23cdeb89cc278c259d07b365c5d65a
SHA512a2c2ecb13ca72f9598b33861f868a145128771132ba13bfc92ed32cfe5082be03ef7acfdd91516c1177a3eef22f0ab6ea86007784cb8f8cb55ff1530c7cb9c5c
-
C:\Windows\System\QlUyHgf.exeMD5
4ec35bac7a8aa704c6914ac3a084648e
SHA1a1f653a4c31d9f0a0c26ec0c1fec8d553901a26b
SHA2569ef4523b557c320bbc73d536ee305523da23cdeb89cc278c259d07b365c5d65a
SHA512a2c2ecb13ca72f9598b33861f868a145128771132ba13bfc92ed32cfe5082be03ef7acfdd91516c1177a3eef22f0ab6ea86007784cb8f8cb55ff1530c7cb9c5c
-
C:\Windows\System\RmQIZCs.exeMD5
58f13cca4f381f34a037382b26f5b919
SHA11b198e214b6f226324983391e9c509b11dcc7011
SHA256034175d01b86e629af5ed0174bf6e2a3fa4c2e87571cf2d2bb272e31894cafb6
SHA5126824faa68953ad6315fae91f8e4669efbe8017274f5c5597a2e8b506755bcce2fa33ed267eca2311ca01e9610355126accaebdf4b099e3ea3cf05f3834008f03
-
C:\Windows\System\RmQIZCs.exeMD5
58f13cca4f381f34a037382b26f5b919
SHA11b198e214b6f226324983391e9c509b11dcc7011
SHA256034175d01b86e629af5ed0174bf6e2a3fa4c2e87571cf2d2bb272e31894cafb6
SHA5126824faa68953ad6315fae91f8e4669efbe8017274f5c5597a2e8b506755bcce2fa33ed267eca2311ca01e9610355126accaebdf4b099e3ea3cf05f3834008f03
-
C:\Windows\System\RvEHTQY.exeMD5
43900141a6312e022239c06f48910be3
SHA18e78993dc50ab71528d5f657fce2464c19afc1dd
SHA256f77090b225e1a106b4d7903211c3d3bbba1c0019af877859c6a7d5130e2bf640
SHA5122ffa16f72210f3665fd19d568e263517da9ee04449c74bce03ee752ac8f3e1519ef86cf203b76cae2e36ef7a9dc1c50a7cf811fc0c5cdc701625ff4b2f9f1144
-
C:\Windows\System\RvEHTQY.exeMD5
43900141a6312e022239c06f48910be3
SHA18e78993dc50ab71528d5f657fce2464c19afc1dd
SHA256f77090b225e1a106b4d7903211c3d3bbba1c0019af877859c6a7d5130e2bf640
SHA5122ffa16f72210f3665fd19d568e263517da9ee04449c74bce03ee752ac8f3e1519ef86cf203b76cae2e36ef7a9dc1c50a7cf811fc0c5cdc701625ff4b2f9f1144
-
C:\Windows\System\cxHsroL.exeMD5
248a94f1323e4ba59df30dc1b7d558f4
SHA17ada470772615927ff4a127ded598df0f9db83e4
SHA256fb00aa1ab3c35cafafc48a3f499e4c1103a68702489d7363ca945733cb75d6f7
SHA51214065734a5d9087c5a3740f45bbcc319bb30e97d8e5675d8e4f94b8cb8030a12323273b3dd7a0b83df34b63e5155bc340093aa041cb2f46a63084c9375ff52e3
-
C:\Windows\System\cxHsroL.exeMD5
248a94f1323e4ba59df30dc1b7d558f4
SHA17ada470772615927ff4a127ded598df0f9db83e4
SHA256fb00aa1ab3c35cafafc48a3f499e4c1103a68702489d7363ca945733cb75d6f7
SHA51214065734a5d9087c5a3740f45bbcc319bb30e97d8e5675d8e4f94b8cb8030a12323273b3dd7a0b83df34b63e5155bc340093aa041cb2f46a63084c9375ff52e3
-
C:\Windows\System\dWtTXSZ.exeMD5
5b5ab4131abc2825482247354692c490
SHA11bc9828db49f5498e7f6a2b023b0f42a46e50310
SHA25603a971d09393c8d0f565e45502eefd8e45522f7274d3c7d1f815f5b00e6c549b
SHA512161d0ef60415bc6384313047f711f4d8a3d1a1d6bdef87a1836a9743df68548b78741824d718deea0a0df561cb9cdae1b9ae973aff96e2a60e8b56c95b26a73e
-
C:\Windows\System\dWtTXSZ.exeMD5
5b5ab4131abc2825482247354692c490
SHA11bc9828db49f5498e7f6a2b023b0f42a46e50310
SHA25603a971d09393c8d0f565e45502eefd8e45522f7274d3c7d1f815f5b00e6c549b
SHA512161d0ef60415bc6384313047f711f4d8a3d1a1d6bdef87a1836a9743df68548b78741824d718deea0a0df561cb9cdae1b9ae973aff96e2a60e8b56c95b26a73e
-
C:\Windows\System\gEAITNN.exeMD5
ab9419b9f21520a667cb2fe58cd9064b
SHA1c28567f71598d7f22c817a3c7dd51c54d11409f7
SHA256d7800e7ba1e5537d7eb1d9aa09d262904fc34d32514e19c2eca1073da2c2e133
SHA5127d481b07571e140825af834a8cd1de1a5f75b56c0523ed0372880291ac4ddad49700f32770c5e27e28d2875d0498799f4796a871e5faceee7798ada4becb415d
-
C:\Windows\System\gEAITNN.exeMD5
ab9419b9f21520a667cb2fe58cd9064b
SHA1c28567f71598d7f22c817a3c7dd51c54d11409f7
SHA256d7800e7ba1e5537d7eb1d9aa09d262904fc34d32514e19c2eca1073da2c2e133
SHA5127d481b07571e140825af834a8cd1de1a5f75b56c0523ed0372880291ac4ddad49700f32770c5e27e28d2875d0498799f4796a871e5faceee7798ada4becb415d
-
C:\Windows\System\jESjvWc.exeMD5
e49f2e3f39fafb05ee2819ec724e1f6b
SHA105be7bfffb9ab0c9af613083665cccd81b91cb0e
SHA25671346553eb65584955ad61843518c5b01082466d3da20b08a7dee3c8e9d8f472
SHA5129abdc7aaa217c004201d77c69e977ca2445ab7dfdb440712d9e80a170af0b4293ec1950aca3371835c8c5db57401dde267da3aad9b1f367b474fa8eaabd41d49
-
C:\Windows\System\jESjvWc.exeMD5
e49f2e3f39fafb05ee2819ec724e1f6b
SHA105be7bfffb9ab0c9af613083665cccd81b91cb0e
SHA25671346553eb65584955ad61843518c5b01082466d3da20b08a7dee3c8e9d8f472
SHA5129abdc7aaa217c004201d77c69e977ca2445ab7dfdb440712d9e80a170af0b4293ec1950aca3371835c8c5db57401dde267da3aad9b1f367b474fa8eaabd41d49
-
C:\Windows\System\pYrlPFz.exeMD5
4e0eb030bac480230fe2258c1de3bf90
SHA1dad402984237d1009a63342ed9b88c50185789d5
SHA256d1555aa82c5e724b662582e37e36649e65477d8ee98d45283a3e16c339927067
SHA5128b8866bae4e0808deecf6ca15f5747f4ed4fc290cbd9b5567dbb20fefc978785b335158bba5a08d18347b9702ab79f7729f747686d4ffe0427bb2b8f293353b6
-
C:\Windows\System\pYrlPFz.exeMD5
4e0eb030bac480230fe2258c1de3bf90
SHA1dad402984237d1009a63342ed9b88c50185789d5
SHA256d1555aa82c5e724b662582e37e36649e65477d8ee98d45283a3e16c339927067
SHA5128b8866bae4e0808deecf6ca15f5747f4ed4fc290cbd9b5567dbb20fefc978785b335158bba5a08d18347b9702ab79f7729f747686d4ffe0427bb2b8f293353b6
-
C:\Windows\System\pldWHRX.exeMD5
23cca384fcd7e15db45457ee6a52121f
SHA1fb0b964c32b29b2dd738db1a78cc7bebdceee48f
SHA256504a18d464f0d2bce48602e9306254be617b44a2e295aba47f5530a1d173ad19
SHA5129eef5d1e9e7b7b3dfda44de5e4553c6fd534e0ea67cd6b756a5c2e5a165ba0f4fa6fce559cf0dcdb22a6087486ebb0bef04634968840caa327d68f0b36dacc07
-
C:\Windows\System\pldWHRX.exeMD5
23cca384fcd7e15db45457ee6a52121f
SHA1fb0b964c32b29b2dd738db1a78cc7bebdceee48f
SHA256504a18d464f0d2bce48602e9306254be617b44a2e295aba47f5530a1d173ad19
SHA5129eef5d1e9e7b7b3dfda44de5e4553c6fd534e0ea67cd6b756a5c2e5a165ba0f4fa6fce559cf0dcdb22a6087486ebb0bef04634968840caa327d68f0b36dacc07
-
C:\Windows\System\rUPhixO.exeMD5
5a6d9d125f16127a247194847f0fb183
SHA1a1ec40200dd4417c1eea105161082d0c9beb56f9
SHA25671abe179c3017ab25dd846eb540bf0625261f68cbb629efd49c8e6344d0ecdc1
SHA5120a3e97ea98b852d2dd6e16f7add47d12c8cb26b18f49dda69c0c0cd4890f8ddd21e69fb408a473e5a2444b90077fc723e8692d61c8e1e4360026cd7508c9b25d
-
C:\Windows\System\rUPhixO.exeMD5
5a6d9d125f16127a247194847f0fb183
SHA1a1ec40200dd4417c1eea105161082d0c9beb56f9
SHA25671abe179c3017ab25dd846eb540bf0625261f68cbb629efd49c8e6344d0ecdc1
SHA5120a3e97ea98b852d2dd6e16f7add47d12c8cb26b18f49dda69c0c0cd4890f8ddd21e69fb408a473e5a2444b90077fc723e8692d61c8e1e4360026cd7508c9b25d
-
C:\Windows\System\sDHwYjv.exeMD5
95496e070936407473d2f4260d52afdd
SHA1ba0cc9aea2b4ae850ab59db73e4b41135223b130
SHA256c415de121e36c6538b0560e2cb40f502d188404d6acba410d185781d8bf9b4bb
SHA5128d93ac95d120ebff6ed49e364599144fda252730014d06f7ea0445a80d3e899cbe9fed5e381140e4e9b7e172143fc81857f3a68d84d9e89c0a9262c5b71dc29c
-
C:\Windows\System\sDHwYjv.exeMD5
95496e070936407473d2f4260d52afdd
SHA1ba0cc9aea2b4ae850ab59db73e4b41135223b130
SHA256c415de121e36c6538b0560e2cb40f502d188404d6acba410d185781d8bf9b4bb
SHA5128d93ac95d120ebff6ed49e364599144fda252730014d06f7ea0445a80d3e899cbe9fed5e381140e4e9b7e172143fc81857f3a68d84d9e89c0a9262c5b71dc29c
-
C:\Windows\System\sjnfjfo.exeMD5
b2c2fff7a3096fd411a1c61d754ef4e0
SHA1a9ebfeb4d556d8a932b85c9e606c1ce4a3a31d7c
SHA256ee76e116818f714189becbc37e87ce8509f6710497cf701552177bd07d38854b
SHA512cefe2d9f26a8acb5b631cc58871456314e982dd8ef015d26ee0517ebf13d8ced58b4bff8caee1273024ced564a454ba8966fce807f4060a7330d6649d1ad1c06
-
C:\Windows\System\sjnfjfo.exeMD5
b2c2fff7a3096fd411a1c61d754ef4e0
SHA1a9ebfeb4d556d8a932b85c9e606c1ce4a3a31d7c
SHA256ee76e116818f714189becbc37e87ce8509f6710497cf701552177bd07d38854b
SHA512cefe2d9f26a8acb5b631cc58871456314e982dd8ef015d26ee0517ebf13d8ced58b4bff8caee1273024ced564a454ba8966fce807f4060a7330d6649d1ad1c06
-
C:\Windows\System\tDEkiKS.exeMD5
8074a5bcb939b68414e845f69b72760e
SHA141b7c351230cb0a113ac56835614f56d0346c428
SHA256885a1a2a59e36b6a980d9396876cd0ca6fcdd1f06b99e633b5a190f6cc33f5ac
SHA5122292ac8456320918a9643f48c422225e52bcab4b049fd0d722ff945d5dcbb1426546416b55f0d7970a1fcee5d0f53bf1c3d56160953567dc2780e2065cb53657
-
C:\Windows\System\tDEkiKS.exeMD5
8074a5bcb939b68414e845f69b72760e
SHA141b7c351230cb0a113ac56835614f56d0346c428
SHA256885a1a2a59e36b6a980d9396876cd0ca6fcdd1f06b99e633b5a190f6cc33f5ac
SHA5122292ac8456320918a9643f48c422225e52bcab4b049fd0d722ff945d5dcbb1426546416b55f0d7970a1fcee5d0f53bf1c3d56160953567dc2780e2065cb53657
-
C:\Windows\System\uIDJKZU.exeMD5
08bab974bb976bbc938ed02602074fec
SHA15bfd3a7f71b3a4c3e14d4a95229bcca9fa30b935
SHA256b2751a01318439037baa81c75c9a2135688afae093e7ba42229459adac1cb4c7
SHA51282631604ba78cd78955bd4cc0cd78244beca0d77c34312afe59a7c0b355c5af6d9313b3bbce625e0fca3be60ab05c288850a0a5881637ba6f4b32d616dff646a
-
C:\Windows\System\uIDJKZU.exeMD5
08bab974bb976bbc938ed02602074fec
SHA15bfd3a7f71b3a4c3e14d4a95229bcca9fa30b935
SHA256b2751a01318439037baa81c75c9a2135688afae093e7ba42229459adac1cb4c7
SHA51282631604ba78cd78955bd4cc0cd78244beca0d77c34312afe59a7c0b355c5af6d9313b3bbce625e0fca3be60ab05c288850a0a5881637ba6f4b32d616dff646a
-
C:\Windows\System\xsdmjBN.exeMD5
f1097e56c5e334e5e3956141c9e43855
SHA14f549c0e318121d5c5d8f0d182e86971200cf93f
SHA25611a98dc472d48c2fac0892d0d6f807a1bfaa121514441c6484a76a75990c991a
SHA512ccf9ba93e395c6dcb02fc26c18df4bbf9f50bf66262abe55731b18d1d0ba80dc8a8e08b7c86e95f0fca6b37f1d79ab7f1db33f2b128581e2d7beb642d135f04e
-
C:\Windows\System\xsdmjBN.exeMD5
f1097e56c5e334e5e3956141c9e43855
SHA14f549c0e318121d5c5d8f0d182e86971200cf93f
SHA25611a98dc472d48c2fac0892d0d6f807a1bfaa121514441c6484a76a75990c991a
SHA512ccf9ba93e395c6dcb02fc26c18df4bbf9f50bf66262abe55731b18d1d0ba80dc8a8e08b7c86e95f0fca6b37f1d79ab7f1db33f2b128581e2d7beb642d135f04e
-
memory/200-28-0x0000000000000000-mapping.dmp
-
memory/312-26-0x0000000000000000-mapping.dmp
-
memory/756-31-0x0000000000000000-mapping.dmp
-
memory/1268-37-0x0000000000000000-mapping.dmp
-
memory/1320-44-0x0000000000000000-mapping.dmp
-
memory/1552-0-0x0000000000000000-mapping.dmp
-
memory/1684-3-0x0000000000000000-mapping.dmp
-
memory/1920-6-0x0000000000000000-mapping.dmp
-
memory/2064-7-0x0000000000000000-mapping.dmp
-
memory/2224-10-0x0000000000000000-mapping.dmp
-
memory/2400-46-0x0000000000000000-mapping.dmp
-
memory/2600-42-0x0000000000000000-mapping.dmp
-
memory/3196-58-0x0000000000000000-mapping.dmp
-
memory/3460-56-0x0000000000000000-mapping.dmp
-
memory/3652-15-0x0000000000000000-mapping.dmp
-
memory/3740-17-0x0000000000000000-mapping.dmp
-
memory/3908-34-0x0000000000000000-mapping.dmp
-
memory/4004-20-0x0000000000000000-mapping.dmp
-
memory/4036-22-0x0000000000000000-mapping.dmp
-
memory/4056-52-0x0000000000000000-mapping.dmp
-
memory/4076-50-0x0000000000000000-mapping.dmp