cobaltstrike | 357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d

Analysis

max time kernel
145s
max time network
148s
platform
windows10_x64
resource
win10v20201028
submitted
10-11-2020 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
Size

5.2MB
MD5

cc8b5c07edc55011fbe2b6fe2920df26
SHA1

9f28ae239df5c36e938062fb72d042ef1635c825
SHA256

357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d
SHA512

ffa7d57ad4848a840a6c0a189dc05ab0f94463fa8fe913e801302f101ecbcc5e3f97cecb76576c66dff6d3ceaeeff84b1ad217d24b4c3d766d53a29903f78207

Score

10^/10

cobaltstrike backdoor trojan upx

Malware Config

Signatures

Cobalt Strike reflective loader 42 IoCs

Detects the reflective loader used by Cobalt Strike.

Processes:

resource	yara_rule
C:\Windows\System\vsNulrb.exe	cobalt_reflective_dll
C:\Windows\System\vsNulrb.exe	cobalt_reflective_dll
C:\Windows\System\iTGJvdO.exe	cobalt_reflective_dll
C:\Windows\System\iTGJvdO.exe	cobalt_reflective_dll
C:\Windows\System\lmxqGJp.exe	cobalt_reflective_dll
C:\Windows\System\lmxqGJp.exe	cobalt_reflective_dll
C:\Windows\System\vIyDPTA.exe	cobalt_reflective_dll
C:\Windows\System\vIyDPTA.exe	cobalt_reflective_dll
C:\Windows\System\jGGKiqf.exe	cobalt_reflective_dll
C:\Windows\System\jGGKiqf.exe	cobalt_reflective_dll
C:\Windows\System\yAVckQs.exe	cobalt_reflective_dll
C:\Windows\System\yAVckQs.exe	cobalt_reflective_dll
C:\Windows\System\iPgiSrC.exe	cobalt_reflective_dll
C:\Windows\System\iPgiSrC.exe	cobalt_reflective_dll
C:\Windows\System\GbVfByv.exe	cobalt_reflective_dll
C:\Windows\System\GbVfByv.exe	cobalt_reflective_dll
C:\Windows\System\lSSGsBs.exe	cobalt_reflective_dll
C:\Windows\System\lSSGsBs.exe	cobalt_reflective_dll
C:\Windows\System\rmBifpO.exe	cobalt_reflective_dll
C:\Windows\System\rmBifpO.exe	cobalt_reflective_dll
C:\Windows\System\UQgaGtJ.exe	cobalt_reflective_dll
C:\Windows\System\UQgaGtJ.exe	cobalt_reflective_dll
C:\Windows\System\xekmEcc.exe	cobalt_reflective_dll
C:\Windows\System\xekmEcc.exe	cobalt_reflective_dll
C:\Windows\System\wQYDGzM.exe	cobalt_reflective_dll
C:\Windows\System\wQYDGzM.exe	cobalt_reflective_dll
C:\Windows\System\NyqhShd.exe	cobalt_reflective_dll
C:\Windows\System\NyqhShd.exe	cobalt_reflective_dll
C:\Windows\System\CbnQwmt.exe	cobalt_reflective_dll
C:\Windows\System\wInwCgt.exe	cobalt_reflective_dll
C:\Windows\System\wInwCgt.exe	cobalt_reflective_dll
C:\Windows\System\PTZTODV.exe	cobalt_reflective_dll
C:\Windows\System\CbnQwmt.exe	cobalt_reflective_dll
C:\Windows\System\PTZTODV.exe	cobalt_reflective_dll
C:\Windows\System\LrLNhZX.exe	cobalt_reflective_dll
C:\Windows\System\LrLNhZX.exe	cobalt_reflective_dll
C:\Windows\System\KingwZC.exe	cobalt_reflective_dll
C:\Windows\System\KAxPFbV.exe	cobalt_reflective_dll
C:\Windows\System\KAxPFbV.exe	cobalt_reflective_dll
C:\Windows\System\SlWMsFH.exe	cobalt_reflective_dll
C:\Windows\System\KingwZC.exe	cobalt_reflective_dll
C:\Windows\System\SlWMsFH.exe	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Executes dropped EXE 21 IoCs

Processes:

vsNulrb.exeiTGJvdO.exelmxqGJp.exevIyDPTA.exejGGKiqf.exeyAVckQs.exeiPgiSrC.exeGbVfByv.exelSSGsBs.exermBifpO.exeUQgaGtJ.exexekmEcc.exewQYDGzM.exeNyqhShd.exeCbnQwmt.exewInwCgt.exePTZTODV.exeLrLNhZX.exeKingwZC.exeKAxPFbV.exeSlWMsFH.exe

pid	process
4052	vsNulrb.exe
3684	iTGJvdO.exe
3176	lmxqGJp.exe
3528	vIyDPTA.exe
3820	jGGKiqf.exe
2960	yAVckQs.exe
3188	iPgiSrC.exe
2856	GbVfByv.exe
196	lSSGsBs.exe
3308	rmBifpO.exe
3812	UQgaGtJ.exe
3792	xekmEcc.exe
2704	wQYDGzM.exe
3380	NyqhShd.exe
2124	CbnQwmt.exe
3864	wInwCgt.exe
2344	PTZTODV.exe
420	LrLNhZX.exe
180	KingwZC.exe
248	KAxPFbV.exe
736	SlWMsFH.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\System\vsNulrb.exe	upx
C:\Windows\System\vsNulrb.exe	upx
C:\Windows\System\iTGJvdO.exe	upx
C:\Windows\System\iTGJvdO.exe	upx
C:\Windows\System\lmxqGJp.exe	upx
C:\Windows\System\lmxqGJp.exe	upx
C:\Windows\System\vIyDPTA.exe	upx
C:\Windows\System\vIyDPTA.exe	upx
C:\Windows\System\jGGKiqf.exe	upx
C:\Windows\System\jGGKiqf.exe	upx
C:\Windows\System\yAVckQs.exe	upx
C:\Windows\System\yAVckQs.exe	upx
C:\Windows\System\iPgiSrC.exe	upx
C:\Windows\System\iPgiSrC.exe	upx
C:\Windows\System\GbVfByv.exe	upx
C:\Windows\System\GbVfByv.exe	upx
C:\Windows\System\lSSGsBs.exe	upx
C:\Windows\System\lSSGsBs.exe	upx
C:\Windows\System\rmBifpO.exe	upx
C:\Windows\System\rmBifpO.exe	upx
C:\Windows\System\UQgaGtJ.exe	upx
C:\Windows\System\UQgaGtJ.exe	upx
C:\Windows\System\xekmEcc.exe	upx
C:\Windows\System\xekmEcc.exe	upx
C:\Windows\System\wQYDGzM.exe	upx
C:\Windows\System\wQYDGzM.exe	upx
C:\Windows\System\NyqhShd.exe	upx
C:\Windows\System\NyqhShd.exe	upx
C:\Windows\System\CbnQwmt.exe	upx
C:\Windows\System\wInwCgt.exe	upx
C:\Windows\System\wInwCgt.exe	upx
C:\Windows\System\PTZTODV.exe	upx
C:\Windows\System\CbnQwmt.exe	upx
C:\Windows\System\PTZTODV.exe	upx
C:\Windows\System\LrLNhZX.exe	upx
C:\Windows\System\LrLNhZX.exe	upx
C:\Windows\System\KingwZC.exe	upx
C:\Windows\System\KAxPFbV.exe	upx
C:\Windows\System\KAxPFbV.exe	upx
C:\Windows\System\SlWMsFH.exe	upx
C:\Windows\System\KingwZC.exe	upx
C:\Windows\System\SlWMsFH.exe	upx

JavaScript code in executable 42 IoCs

Processes:

resource	yara_rule
C:\Windows\System\vsNulrb.exe	js
C:\Windows\System\vsNulrb.exe	js
C:\Windows\System\iTGJvdO.exe	js
C:\Windows\System\iTGJvdO.exe	js
C:\Windows\System\lmxqGJp.exe	js
C:\Windows\System\lmxqGJp.exe	js
C:\Windows\System\vIyDPTA.exe	js
C:\Windows\System\vIyDPTA.exe	js
C:\Windows\System\jGGKiqf.exe	js
C:\Windows\System\jGGKiqf.exe	js
C:\Windows\System\yAVckQs.exe	js
C:\Windows\System\yAVckQs.exe	js
C:\Windows\System\iPgiSrC.exe	js
C:\Windows\System\iPgiSrC.exe	js
C:\Windows\System\GbVfByv.exe	js
C:\Windows\System\GbVfByv.exe	js
C:\Windows\System\lSSGsBs.exe	js
C:\Windows\System\lSSGsBs.exe	js
C:\Windows\System\rmBifpO.exe	js
C:\Windows\System\rmBifpO.exe	js
C:\Windows\System\UQgaGtJ.exe	js
C:\Windows\System\UQgaGtJ.exe	js
C:\Windows\System\xekmEcc.exe	js
C:\Windows\System\xekmEcc.exe	js
C:\Windows\System\wQYDGzM.exe	js
C:\Windows\System\wQYDGzM.exe	js
C:\Windows\System\NyqhShd.exe	js
C:\Windows\System\NyqhShd.exe	js
C:\Windows\System\CbnQwmt.exe	js
C:\Windows\System\wInwCgt.exe	js
C:\Windows\System\wInwCgt.exe	js
C:\Windows\System\PTZTODV.exe	js
C:\Windows\System\CbnQwmt.exe	js
C:\Windows\System\PTZTODV.exe	js
C:\Windows\System\LrLNhZX.exe	js
C:\Windows\System\LrLNhZX.exe	js
C:\Windows\System\KingwZC.exe	js
C:\Windows\System\KAxPFbV.exe	js
C:\Windows\System\KAxPFbV.exe	js
C:\Windows\System\SlWMsFH.exe	js
C:\Windows\System\KingwZC.exe	js
C:\Windows\System\SlWMsFH.exe	js

Drops file in Windows directory 21 IoCs

Processes:

357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe

description	ioc	process
File created	C:\Windows\System\KingwZC.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\lmxqGJp.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\iPgiSrC.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\xekmEcc.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\GbVfByv.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\lSSGsBs.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\rmBifpO.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\CbnQwmt.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\vsNulrb.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\iTGJvdO.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\yAVckQs.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\wInwCgt.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\PTZTODV.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\vIyDPTA.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\UQgaGtJ.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\NyqhShd.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\KAxPFbV.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\SlWMsFH.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\jGGKiqf.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\wQYDGzM.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
File created	C:\Windows\System\LrLNhZX.exe	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe

description	pid	process
Token: SeLockMemoryPrivilege	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
Token: SeLockMemoryPrivilege	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe

description	pid	process	target process
PID 576 wrote to memory of 4052	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	vsNulrb.exe
PID 576 wrote to memory of 4052	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	vsNulrb.exe
PID 576 wrote to memory of 3684	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	iTGJvdO.exe
PID 576 wrote to memory of 3684	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	iTGJvdO.exe
PID 576 wrote to memory of 3176	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	lmxqGJp.exe
PID 576 wrote to memory of 3176	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	lmxqGJp.exe
PID 576 wrote to memory of 3528	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	vIyDPTA.exe
PID 576 wrote to memory of 3528	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	vIyDPTA.exe
PID 576 wrote to memory of 3820	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	jGGKiqf.exe
PID 576 wrote to memory of 3820	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	jGGKiqf.exe
PID 576 wrote to memory of 2960	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	yAVckQs.exe
PID 576 wrote to memory of 2960	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	yAVckQs.exe
PID 576 wrote to memory of 3188	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	iPgiSrC.exe
PID 576 wrote to memory of 3188	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	iPgiSrC.exe
PID 576 wrote to memory of 2856	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	GbVfByv.exe
PID 576 wrote to memory of 2856	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	GbVfByv.exe
PID 576 wrote to memory of 196	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	lSSGsBs.exe
PID 576 wrote to memory of 196	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	lSSGsBs.exe
PID 576 wrote to memory of 3308	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	rmBifpO.exe
PID 576 wrote to memory of 3308	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	rmBifpO.exe
PID 576 wrote to memory of 3812	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	UQgaGtJ.exe
PID 576 wrote to memory of 3812	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	UQgaGtJ.exe
PID 576 wrote to memory of 3792	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	xekmEcc.exe
PID 576 wrote to memory of 3792	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	xekmEcc.exe
PID 576 wrote to memory of 2704	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	wQYDGzM.exe
PID 576 wrote to memory of 2704	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	wQYDGzM.exe
PID 576 wrote to memory of 3380	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	NyqhShd.exe
PID 576 wrote to memory of 3380	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	NyqhShd.exe
PID 576 wrote to memory of 2124	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	CbnQwmt.exe
PID 576 wrote to memory of 2124	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	CbnQwmt.exe
PID 576 wrote to memory of 3864	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	wInwCgt.exe
PID 576 wrote to memory of 3864	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	wInwCgt.exe
PID 576 wrote to memory of 2344	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	PTZTODV.exe
PID 576 wrote to memory of 2344	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	PTZTODV.exe
PID 576 wrote to memory of 420	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	LrLNhZX.exe
PID 576 wrote to memory of 420	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	LrLNhZX.exe
PID 576 wrote to memory of 180	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	KingwZC.exe
PID 576 wrote to memory of 180	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	KingwZC.exe
PID 576 wrote to memory of 248	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	KAxPFbV.exe
PID 576 wrote to memory of 248	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	KAxPFbV.exe
PID 576 wrote to memory of 736	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	SlWMsFH.exe
PID 576 wrote to memory of 736	576	357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe	SlWMsFH.exe

C:\Users\Admin\AppData\Local\Temp\357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe
"C:\Users\Admin\AppData\Local\Temp\357cf9b030eb6d8d48798fef447c99f01d6410124971dabd20261565903f1c5d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\System\vsNulrb.exe
C:\Windows\System\vsNulrb.exe
2⤵
- Executes dropped EXE
PID:4052

C:\Windows\System\iTGJvdO.exe
C:\Windows\System\iTGJvdO.exe
2⤵
- Executes dropped EXE
PID:3684

C:\Windows\System\lmxqGJp.exe
C:\Windows\System\lmxqGJp.exe
2⤵
- Executes dropped EXE
PID:3176

C:\Windows\System\vIyDPTA.exe
C:\Windows\System\vIyDPTA.exe
2⤵
- Executes dropped EXE
PID:3528

C:\Windows\System\jGGKiqf.exe
C:\Windows\System\jGGKiqf.exe
2⤵
- Executes dropped EXE
PID:3820

C:\Windows\System\yAVckQs.exe
C:\Windows\System\yAVckQs.exe
2⤵
- Executes dropped EXE
PID:2960

C:\Windows\System\iPgiSrC.exe
C:\Windows\System\iPgiSrC.exe
2⤵
- Executes dropped EXE
PID:3188

C:\Windows\System\GbVfByv.exe
C:\Windows\System\GbVfByv.exe
2⤵
- Executes dropped EXE
PID:2856

C:\Windows\System\lSSGsBs.exe
C:\Windows\System\lSSGsBs.exe
2⤵
- Executes dropped EXE
PID:196

C:\Windows\System\rmBifpO.exe
C:\Windows\System\rmBifpO.exe
2⤵
- Executes dropped EXE
PID:3308

C:\Windows\System\UQgaGtJ.exe
C:\Windows\System\UQgaGtJ.exe
2⤵
- Executes dropped EXE
PID:3812

C:\Windows\System\xekmEcc.exe
C:\Windows\System\xekmEcc.exe
2⤵
- Executes dropped EXE
PID:3792

C:\Windows\System\wQYDGzM.exe
C:\Windows\System\wQYDGzM.exe
2⤵
- Executes dropped EXE
PID:2704

C:\Windows\System\NyqhShd.exe
C:\Windows\System\NyqhShd.exe
2⤵
- Executes dropped EXE
PID:3380

C:\Windows\System\CbnQwmt.exe
C:\Windows\System\CbnQwmt.exe
2⤵
- Executes dropped EXE
PID:2124

C:\Windows\System\wInwCgt.exe
C:\Windows\System\wInwCgt.exe
2⤵
- Executes dropped EXE
PID:3864

C:\Windows\System\PTZTODV.exe
C:\Windows\System\PTZTODV.exe
2⤵
- Executes dropped EXE
PID:2344

C:\Windows\System\LrLNhZX.exe
C:\Windows\System\LrLNhZX.exe
2⤵
- Executes dropped EXE
PID:420

C:\Windows\System\KingwZC.exe
C:\Windows\System\KingwZC.exe
2⤵
- Executes dropped EXE
PID:180

C:\Windows\System\KAxPFbV.exe
C:\Windows\System\KAxPFbV.exe
2⤵
- Executes dropped EXE
PID:248

C:\Windows\System\SlWMsFH.exe
C:\Windows\System\SlWMsFH.exe
2⤵
- Executes dropped EXE
PID:736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CbnQwmt.exe
MD5
c91d7a8c61083f5a588c963fa8f4ad9b

SHA1
866c430aaef42ea004cf201251fe3707df8d910c

SHA256
208475755a7397bddec54d2e5506d34ebbd5d3254218784f2b3ca691464c4066

SHA512
7c69f55afe323fb1de943d6b0d394f9c484608abfd9653722b74f612558665e1b07d5644168760b70ede6e60207bba4795af50f204dff6e6a456a1843d8d7470

Download Submit
C:\Windows\System\CbnQwmt.exe
MD5
c91d7a8c61083f5a588c963fa8f4ad9b

SHA1
866c430aaef42ea004cf201251fe3707df8d910c

SHA256
208475755a7397bddec54d2e5506d34ebbd5d3254218784f2b3ca691464c4066

SHA512
7c69f55afe323fb1de943d6b0d394f9c484608abfd9653722b74f612558665e1b07d5644168760b70ede6e60207bba4795af50f204dff6e6a456a1843d8d7470

Download Submit
C:\Windows\System\GbVfByv.exe
MD5
79abeab5c6f78f93657a21b7cefb6606

SHA1
a145f7960b5f54633983c29f4ebe50f1443e3364

SHA256
a71fa98afaab5bbe01a1030e2c03dc171ff8d1125e4566cc364730e7f1cf1dce

SHA512
fad46ceba4331b4926a92ec36bd232740e8fabb0ffe77c4d9644991cd5e1d6534ef965dbf0794530f93e0dffc0960410e693dda9d14a87d2cd7c085c2881ae81

Download Submit
C:\Windows\System\GbVfByv.exe
MD5
79abeab5c6f78f93657a21b7cefb6606

SHA1
a145f7960b5f54633983c29f4ebe50f1443e3364

SHA256
a71fa98afaab5bbe01a1030e2c03dc171ff8d1125e4566cc364730e7f1cf1dce

SHA512
fad46ceba4331b4926a92ec36bd232740e8fabb0ffe77c4d9644991cd5e1d6534ef965dbf0794530f93e0dffc0960410e693dda9d14a87d2cd7c085c2881ae81

Download Submit
C:\Windows\System\KAxPFbV.exe
MD5
f13f1f8ead8c69c1752951d1f16dc74f

SHA1
51ba6f3cb7091472d54a20f1de22b227d5fce965

SHA256
2297dfda6b10d147a74675c94dfae29bace7bb22995a16dad8bace6495ab88d7

SHA512
7d00efecccafb88d7392e34b892c753a9cb519fe98236071bcc58d8286eeb198bc82ef8503c07384d71e62cefa052645d5c31090567a8af169be886fe191c5ce

Download Submit
C:\Windows\System\KAxPFbV.exe
MD5
f13f1f8ead8c69c1752951d1f16dc74f

SHA1
51ba6f3cb7091472d54a20f1de22b227d5fce965

SHA256
2297dfda6b10d147a74675c94dfae29bace7bb22995a16dad8bace6495ab88d7

SHA512
7d00efecccafb88d7392e34b892c753a9cb519fe98236071bcc58d8286eeb198bc82ef8503c07384d71e62cefa052645d5c31090567a8af169be886fe191c5ce

Download Submit
C:\Windows\System\KingwZC.exe
MD5
f760fe2dcb248a71c550bfee5b74cd66

SHA1
294fe6f7ec92fb2264fb5acec32a8b4352cd8f0d

SHA256
97ad0af0763e13cb9df26afb050a0de1b660e82651095c323eed3d0866ca33a4

SHA512
8275573e9f8caa80e79f082f91363459dbccdaadfdbec4c00a9b1e2f4419fb97bd9093f414e765154163359bef8e394170156a254812beddbdd9439bc8f57cea

Download Submit
C:\Windows\System\KingwZC.exe
MD5
f760fe2dcb248a71c550bfee5b74cd66

SHA1
294fe6f7ec92fb2264fb5acec32a8b4352cd8f0d

SHA256
97ad0af0763e13cb9df26afb050a0de1b660e82651095c323eed3d0866ca33a4

SHA512
8275573e9f8caa80e79f082f91363459dbccdaadfdbec4c00a9b1e2f4419fb97bd9093f414e765154163359bef8e394170156a254812beddbdd9439bc8f57cea

Download Submit
C:\Windows\System\LrLNhZX.exe
MD5
71ca81e04aa23cd70faf22e2a5712137

SHA1
5992416cb33ba3aed43478c7d2a117a36219e8d8

SHA256
2f94628859eec351d13386edb6522c33d471647338fc7753241e817a48975e1b

SHA512
65dafe25b434d4c6aa9984dc4f508a0485ed29f93068a49cf218237458510ffe19cf0d30ea573e924530f15ca61fa02827ace3046bc1a6b6a022bd7317d774e2

Download Submit
C:\Windows\System\LrLNhZX.exe
MD5
71ca81e04aa23cd70faf22e2a5712137

SHA1
5992416cb33ba3aed43478c7d2a117a36219e8d8

SHA256
2f94628859eec351d13386edb6522c33d471647338fc7753241e817a48975e1b

SHA512
65dafe25b434d4c6aa9984dc4f508a0485ed29f93068a49cf218237458510ffe19cf0d30ea573e924530f15ca61fa02827ace3046bc1a6b6a022bd7317d774e2

Download Submit
C:\Windows\System\NyqhShd.exe
MD5
ab446a085ed2269032751b534a7cdf0d

SHA1
30d3982f1ecd87525a8dda7b66c7f5e7a0f071fe

SHA256
dae26bf73caa49ebce1bbdcd4991efc017dd7b207ee97005245f210e2e2707d3

SHA512
23d669b5b25d84aa9144e1a4df360bd7dd47428cb6219e9ddc91790451d7cb145751bf2a978d1d9bfcc0803fce724b4b8a01c82a3821891a39a03631bae3fe26

Download Submit
C:\Windows\System\NyqhShd.exe
MD5
ab446a085ed2269032751b534a7cdf0d

SHA1
30d3982f1ecd87525a8dda7b66c7f5e7a0f071fe

SHA256
dae26bf73caa49ebce1bbdcd4991efc017dd7b207ee97005245f210e2e2707d3

SHA512
23d669b5b25d84aa9144e1a4df360bd7dd47428cb6219e9ddc91790451d7cb145751bf2a978d1d9bfcc0803fce724b4b8a01c82a3821891a39a03631bae3fe26

Download Submit
C:\Windows\System\PTZTODV.exe
MD5
fd0059bf2a87b40a11ed75ad78848d02

SHA1
6ceeee38af6e2fe2857ad231acf0c31a252dd3c1

SHA256
88cad04841d9ec3ecd54a6c73bcb73a4367a3c72ca555a5e9fac27db904ce689

SHA512
ee2372e6e457545fbe950744aa4f93a5ef8368ffdb29fab4013828a7009a41788e139e45b42cecc5656e15e31a5b0de3a5adbd59b4dad5f6e44eb40c360f61ab

Download Submit
C:\Windows\System\PTZTODV.exe
MD5
fd0059bf2a87b40a11ed75ad78848d02

SHA1
6ceeee38af6e2fe2857ad231acf0c31a252dd3c1

SHA256
88cad04841d9ec3ecd54a6c73bcb73a4367a3c72ca555a5e9fac27db904ce689

SHA512
ee2372e6e457545fbe950744aa4f93a5ef8368ffdb29fab4013828a7009a41788e139e45b42cecc5656e15e31a5b0de3a5adbd59b4dad5f6e44eb40c360f61ab

Download Submit
C:\Windows\System\SlWMsFH.exe
MD5
0fed1f1d03d45db72f6c4adf76330f49

SHA1
06007ee471e307e49ec1d564e57b378d7af9a6e8

SHA256
2270f82da87d2cc42fc69d99f3c4d675a8f9e6011b52950481d0b93514206f71

SHA512
7f864236769a2b5672e46904d76a70b4b706bee245a7b32f1bd3a9e6b1c6289e581d2aa794fef5eef4e63b4243e03cefc20560773ff9c2c40230f91d956db08e

Download Submit
C:\Windows\System\SlWMsFH.exe
MD5
0fed1f1d03d45db72f6c4adf76330f49

SHA1
06007ee471e307e49ec1d564e57b378d7af9a6e8

SHA256
2270f82da87d2cc42fc69d99f3c4d675a8f9e6011b52950481d0b93514206f71

SHA512
7f864236769a2b5672e46904d76a70b4b706bee245a7b32f1bd3a9e6b1c6289e581d2aa794fef5eef4e63b4243e03cefc20560773ff9c2c40230f91d956db08e

Download Submit
C:\Windows\System\UQgaGtJ.exe
MD5
b1ccdce76f12aaf9cc841fa689ff69e5

SHA1
293ed1abecb61a89aebf1e3d3eb7e03da2a5b4a4

SHA256
3ab6b43f9d4a81f529235a0840a2a6bedc05e250fe32ff18928e4cf6c1c964dc

SHA512
9c584b7d929250f413f5a9fd21b412a36c926fd889f227ddb76947c6f9a076ac03b401c4a07cf3b72e5b0d8603552a9428e0b28f83b974a8c5dd6fc05e832dc7

Download Submit
C:\Windows\System\UQgaGtJ.exe
MD5
b1ccdce76f12aaf9cc841fa689ff69e5

SHA1
293ed1abecb61a89aebf1e3d3eb7e03da2a5b4a4

SHA256
3ab6b43f9d4a81f529235a0840a2a6bedc05e250fe32ff18928e4cf6c1c964dc

SHA512
9c584b7d929250f413f5a9fd21b412a36c926fd889f227ddb76947c6f9a076ac03b401c4a07cf3b72e5b0d8603552a9428e0b28f83b974a8c5dd6fc05e832dc7

Download Submit
C:\Windows\System\iPgiSrC.exe
MD5
2858080ef965f3297961f9296604da56

SHA1
286d598ec749527995ab26bb0856e80ee2b41daf

SHA256
c1af76bc5b9dcdf4bd19c1a2b793c2b6f6f24d62b2af7298c722768f2346a9bf

SHA512
8351df6ee92ef3f0344de7bcf6edf1410f7d1045a23eb32240cf783a98cc536816c45218002278a3038a53b7aed5bd01414c893afa40614256ce5c107017f151

Download Submit
C:\Windows\System\iPgiSrC.exe
MD5
2858080ef965f3297961f9296604da56

SHA1
286d598ec749527995ab26bb0856e80ee2b41daf

SHA256
c1af76bc5b9dcdf4bd19c1a2b793c2b6f6f24d62b2af7298c722768f2346a9bf

SHA512
8351df6ee92ef3f0344de7bcf6edf1410f7d1045a23eb32240cf783a98cc536816c45218002278a3038a53b7aed5bd01414c893afa40614256ce5c107017f151

Download Submit
C:\Windows\System\iTGJvdO.exe
MD5
dea508ebb784d4db90553049b36051a6

SHA1
5b3242e06c8974f153c3255c85ac43cdc715373e

SHA256
3d450da66fa03690128af39efedc0d0d417f63f125bc3dba9816883a909be09c

SHA512
72d772c72236fb1ba98409da761b27be45f163c1f651481eb79d6ae98e4598f0097926a6fa247dae67d56ff6bbc573bbdc7f1a983415f0683ccd4881f497a604

Download Submit
C:\Windows\System\iTGJvdO.exe
MD5
dea508ebb784d4db90553049b36051a6

SHA1
5b3242e06c8974f153c3255c85ac43cdc715373e

SHA256
3d450da66fa03690128af39efedc0d0d417f63f125bc3dba9816883a909be09c

SHA512
72d772c72236fb1ba98409da761b27be45f163c1f651481eb79d6ae98e4598f0097926a6fa247dae67d56ff6bbc573bbdc7f1a983415f0683ccd4881f497a604

Download Submit
C:\Windows\System\jGGKiqf.exe
MD5
f4e527da8d507ca393c8d353cf52acab

SHA1
9bd426219e2a688bc73382d41d5bb0f394740ec5

SHA256
8dee0ee7f62e71c65f93c9bdac5a5a38d3cdb43f531019e2c7f0f127934b1304

SHA512
80da150ecc8507d12e304d9ceee537da16362d34f3299bbbee4cd1de2aa4b819bb1ee5b6249849b9498ce2da1284c9760fd1e1276f01deb19832728eb6ba4d67

Download Submit
C:\Windows\System\jGGKiqf.exe
MD5
f4e527da8d507ca393c8d353cf52acab

SHA1
9bd426219e2a688bc73382d41d5bb0f394740ec5

SHA256
8dee0ee7f62e71c65f93c9bdac5a5a38d3cdb43f531019e2c7f0f127934b1304

SHA512
80da150ecc8507d12e304d9ceee537da16362d34f3299bbbee4cd1de2aa4b819bb1ee5b6249849b9498ce2da1284c9760fd1e1276f01deb19832728eb6ba4d67

Download Submit
C:\Windows\System\lSSGsBs.exe
MD5
7212f4feea3fd9d773ff411073a3c7ec

SHA1
f05b214bbc6bc9c54201ac475b8c0276bc7859ca

SHA256
a9d5c8699818cf7ed4a3e216ea70076596c3f806425247b55162d15f8ad99bcd

SHA512
35ef0987097d82f882e92fa9439f6468f5a9afca7c4c01ce2d0e76449f175a19c50d2b44217d5dde2f6faef982c2e59d2c5d60ca30c8fb8baa3f98ccc24bfb58

Download Submit
C:\Windows\System\lSSGsBs.exe
MD5
7212f4feea3fd9d773ff411073a3c7ec

SHA1
f05b214bbc6bc9c54201ac475b8c0276bc7859ca

SHA256
a9d5c8699818cf7ed4a3e216ea70076596c3f806425247b55162d15f8ad99bcd

SHA512
35ef0987097d82f882e92fa9439f6468f5a9afca7c4c01ce2d0e76449f175a19c50d2b44217d5dde2f6faef982c2e59d2c5d60ca30c8fb8baa3f98ccc24bfb58

Download Submit
C:\Windows\System\lmxqGJp.exe
MD5
15f4a47e9ee04fe05eeac33e36753fda

SHA1
ba3fd289cc6e24b528ce8c723e51a79f7cd8b9ad

SHA256
906957d5fa90791f825718834f2326000794e4ce09f2621ba8319c115064758d

SHA512
7612d2f2d826b5623e9bf6234e04ec9f1f0722696ef4938ebb548227b44861df65318edfddea302994a4a552be39d938fba8e46538ac18186eb314bdc30e7acf

Download Submit
C:\Windows\System\lmxqGJp.exe
MD5
15f4a47e9ee04fe05eeac33e36753fda

SHA1
ba3fd289cc6e24b528ce8c723e51a79f7cd8b9ad

SHA256
906957d5fa90791f825718834f2326000794e4ce09f2621ba8319c115064758d

SHA512
7612d2f2d826b5623e9bf6234e04ec9f1f0722696ef4938ebb548227b44861df65318edfddea302994a4a552be39d938fba8e46538ac18186eb314bdc30e7acf

Download Submit
C:\Windows\System\rmBifpO.exe
MD5
23645dfb414b2928b772c13a135f05b2

SHA1
2bbe2ad25737244f46ec3c8a50f368ae1d85aa0c

SHA256
31cf84c04707ef58ab919418e322088177f9c957a8ade9e558aeaf4f1964f0a2

SHA512
98ac13a18b5c7230ea9ee8328e7f2e06848f1bbc40940ddb92b251c935624349d9841b4887ed3e2637b222bf12a328d00d3cbfd3dee30e3999ab7c3b57b48ea5

Download Submit
C:\Windows\System\rmBifpO.exe
MD5
23645dfb414b2928b772c13a135f05b2

SHA1
2bbe2ad25737244f46ec3c8a50f368ae1d85aa0c

SHA256
31cf84c04707ef58ab919418e322088177f9c957a8ade9e558aeaf4f1964f0a2

SHA512
98ac13a18b5c7230ea9ee8328e7f2e06848f1bbc40940ddb92b251c935624349d9841b4887ed3e2637b222bf12a328d00d3cbfd3dee30e3999ab7c3b57b48ea5

Download Submit
C:\Windows\System\vIyDPTA.exe
MD5
1abadbe1f559064773f86d70731c4e35

SHA1
dfdd71eeb8ed069a3a15486bdf4752a9fa55c21f

SHA256
44f9175711b3b26650ac5e5b085eb7124f00d0429669def23bf2d6f6c08d67b4

SHA512
8438556c026cf2caf662765a8afed14fb97ee5315d2ff3248426e5b593afaf4d07645894c970cf8c68260a2319fe13bb0cc3b78212f01aa88eb439004ef3623e

Download Submit
C:\Windows\System\vIyDPTA.exe
MD5
1abadbe1f559064773f86d70731c4e35

SHA1
dfdd71eeb8ed069a3a15486bdf4752a9fa55c21f

SHA256
44f9175711b3b26650ac5e5b085eb7124f00d0429669def23bf2d6f6c08d67b4

SHA512
8438556c026cf2caf662765a8afed14fb97ee5315d2ff3248426e5b593afaf4d07645894c970cf8c68260a2319fe13bb0cc3b78212f01aa88eb439004ef3623e

Download Submit
C:\Windows\System\vsNulrb.exe
MD5
b94f6a957f9abcce2515277932ee26c3

SHA1
53d4123649143122cdee5e64821bd54d306e4a66

SHA256
6d3d8ec07bf8c40f562f64c263515b305b2ace78a67056ce81c541d439caaec6

SHA512
77cc704dbd5ce9307ecac219cf83cc7b454d88345ddeb855bb04ad095b534f7b85d950370f4f709169f9807b32d452dd95b75bea37bdc8e2a00def4daf1727f9

Download Submit
C:\Windows\System\vsNulrb.exe
MD5
b94f6a957f9abcce2515277932ee26c3

SHA1
53d4123649143122cdee5e64821bd54d306e4a66

SHA256
6d3d8ec07bf8c40f562f64c263515b305b2ace78a67056ce81c541d439caaec6

SHA512
77cc704dbd5ce9307ecac219cf83cc7b454d88345ddeb855bb04ad095b534f7b85d950370f4f709169f9807b32d452dd95b75bea37bdc8e2a00def4daf1727f9

Download Submit
C:\Windows\System\wInwCgt.exe
MD5
b9db5ad8f50732e448be4a0de88f0f3a

SHA1
bdefd9306b421166372b30bb49a26acecee78a63

SHA256
e4f43663040e9437801f0811a4baf872e40b02e181733527a5c844871e332f37

SHA512
a37b86687c91861623dab6bed56081438662e0a61526802ae3581712ef3cfe662c2c7fd9deead1ce87d589cd6d881f2cf320871e53f40ade3aa5d0837a676990

Download Submit
C:\Windows\System\wInwCgt.exe
MD5
b9db5ad8f50732e448be4a0de88f0f3a

SHA1
bdefd9306b421166372b30bb49a26acecee78a63

SHA256
e4f43663040e9437801f0811a4baf872e40b02e181733527a5c844871e332f37

SHA512
a37b86687c91861623dab6bed56081438662e0a61526802ae3581712ef3cfe662c2c7fd9deead1ce87d589cd6d881f2cf320871e53f40ade3aa5d0837a676990

Download Submit
C:\Windows\System\wQYDGzM.exe
MD5
2f23c367281860d441453eb0377ef8a5

SHA1
8d83d374a4c0a55460268d4acbabd6f12961bc81

SHA256
96d5070ac1b8ee2be8c24424ee7584fda963e3a290dcedaea1db4c33616eefb6

SHA512
69839c889d0acfb0b2ef325a0a2dcc648116cc2b0ea6492cccfd8651844e30544e64fd70635f61fae810a2b1a57b57e3521b92c311a9b6f80a7252c02602702f

Download Submit
C:\Windows\System\wQYDGzM.exe
MD5
2f23c367281860d441453eb0377ef8a5

SHA1
8d83d374a4c0a55460268d4acbabd6f12961bc81

SHA256
96d5070ac1b8ee2be8c24424ee7584fda963e3a290dcedaea1db4c33616eefb6

SHA512
69839c889d0acfb0b2ef325a0a2dcc648116cc2b0ea6492cccfd8651844e30544e64fd70635f61fae810a2b1a57b57e3521b92c311a9b6f80a7252c02602702f

Download Submit
C:\Windows\System\xekmEcc.exe
MD5
2ac9aaa60117e80f18a37be70095497a

SHA1
49c6949f48ba4a086b94de37d5c52166b4d34cc2

SHA256
1d271cd90f03928ef046ed86caeeb14c75f6388273030624e44f3269aef81138

SHA512
56db884f5531c766f47cccace55cb4c90b9dd6d4bafb53aec05479bca597be80ee941d33f652f96573e015b1403cc2a8e444b1a6c8ed6eb60cf2a270c6439b34

Download Submit
C:\Windows\System\xekmEcc.exe
MD5
2ac9aaa60117e80f18a37be70095497a

SHA1
49c6949f48ba4a086b94de37d5c52166b4d34cc2

SHA256
1d271cd90f03928ef046ed86caeeb14c75f6388273030624e44f3269aef81138

SHA512
56db884f5531c766f47cccace55cb4c90b9dd6d4bafb53aec05479bca597be80ee941d33f652f96573e015b1403cc2a8e444b1a6c8ed6eb60cf2a270c6439b34

Download Submit
C:\Windows\System\yAVckQs.exe
MD5
009a5a21daed2b834006e26fee51a446

SHA1
89fabdc14176a327da014d9f169af328a179d7b7

SHA256
b5a2c340ed88f07b5521483af124d6788029f89087d89031af912b9bfb369632

SHA512
6f7bbbdefc3ee336663a914387fca4725d9287a7d8334e2b94f72556a94887d72bd010c7405256e0e8b1b578c5198b72a6f3252a805b4a6a8ae50ea31b616ca5

Download Submit
C:\Windows\System\yAVckQs.exe
MD5
009a5a21daed2b834006e26fee51a446

SHA1
89fabdc14176a327da014d9f169af328a179d7b7

SHA256
b5a2c340ed88f07b5521483af124d6788029f89087d89031af912b9bfb369632

SHA512
6f7bbbdefc3ee336663a914387fca4725d9287a7d8334e2b94f72556a94887d72bd010c7405256e0e8b1b578c5198b72a6f3252a805b4a6a8ae50ea31b616ca5

Download Submit
memory/180-54-0x0000000000000000-mapping.dmp

Download
memory/196-24-0x0000000000000000-mapping.dmp

Download
memory/248-57-0x0000000000000000-mapping.dmp

Download
memory/420-50-0x0000000000000000-mapping.dmp

Download
memory/736-60-0x0000000000000000-mapping.dmp

Download
memory/2124-42-0x0000000000000000-mapping.dmp

Download
memory/2344-47-0x0000000000000000-mapping.dmp

Download
memory/2704-36-0x0000000000000000-mapping.dmp

Download
memory/2856-21-0x0000000000000000-mapping.dmp

Download
memory/2960-15-0x0000000000000000-mapping.dmp

Download
memory/3176-6-0x0000000000000000-mapping.dmp

Download
memory/3188-18-0x0000000000000000-mapping.dmp

Download
memory/3308-27-0x0000000000000000-mapping.dmp

Download
memory/3380-38-0x0000000000000000-mapping.dmp

Download
memory/3528-9-0x0000000000000000-mapping.dmp

Download
memory/3684-3-0x0000000000000000-mapping.dmp

Download
memory/3792-33-0x0000000000000000-mapping.dmp

Download
memory/3812-29-0x0000000000000000-mapping.dmp

Download
memory/3820-12-0x0000000000000000-mapping.dmp

Download
memory/3864-44-0x0000000000000000-mapping.dmp

Download
memory/4052-0-0x0000000000000000-mapping.dmp

Download