cobaltstrike | b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d

Analysis

max time kernel
142s
max time network
144s
platform
windows10_x64
resource
win10v20201028
submitted
10-11-2020 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
Size

5.2MB
MD5

be8835554720aaa3d9b3077f33f0d706
SHA1

a29f516f091cfcb81a9c7ae45658f469dae7d84b
SHA256

b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d
SHA512

78cdf82b46ec14c64553fc5423cc952a0f89f661dcab66c1aa27e44e5086f30f93642ca0bd809b355470352b7aa0a509b7fb262a5d5fc801a6c2bce7e730fbdf

Score

10^/10

cobaltstrike backdoor trojan upx

Malware Config

Signatures

Cobalt Strike reflective loader 42 IoCs

Detects the reflective loader used by Cobalt Strike.

Processes:

resource	yara_rule
C:\Windows\System\MybjrgL.exe	cobalt_reflective_dll
C:\Windows\System\MybjrgL.exe	cobalt_reflective_dll
C:\Windows\System\SyAZttR.exe	cobalt_reflective_dll
C:\Windows\System\SyAZttR.exe	cobalt_reflective_dll
C:\Windows\System\YUysXel.exe	cobalt_reflective_dll
C:\Windows\System\YUysXel.exe	cobalt_reflective_dll
C:\Windows\System\QZNegFx.exe	cobalt_reflective_dll
C:\Windows\System\deJUsps.exe	cobalt_reflective_dll
C:\Windows\System\QZNegFx.exe	cobalt_reflective_dll
C:\Windows\System\deJUsps.exe	cobalt_reflective_dll
C:\Windows\System\owEdoEp.exe	cobalt_reflective_dll
C:\Windows\System\owEdoEp.exe	cobalt_reflective_dll
C:\Windows\System\AXsNOpL.exe	cobalt_reflective_dll
C:\Windows\System\ymdywOG.exe	cobalt_reflective_dll
C:\Windows\System\AXsNOpL.exe	cobalt_reflective_dll
C:\Windows\System\ymdywOG.exe	cobalt_reflective_dll
C:\Windows\System\hhHnaHn.exe	cobalt_reflective_dll
C:\Windows\System\zQkknPE.exe	cobalt_reflective_dll
C:\Windows\System\zQkknPE.exe	cobalt_reflective_dll
C:\Windows\System\HSZygod.exe	cobalt_reflective_dll
C:\Windows\System\VKewDcq.exe	cobalt_reflective_dll
C:\Windows\System\MyjsCPO.exe	cobalt_reflective_dll
C:\Windows\System\MyjsCPO.exe	cobalt_reflective_dll
C:\Windows\System\OpDjhow.exe	cobalt_reflective_dll
C:\Windows\System\VKewDcq.exe	cobalt_reflective_dll
C:\Windows\System\PTDdbnk.exe	cobalt_reflective_dll
C:\Windows\System\PTDdbnk.exe	cobalt_reflective_dll
C:\Windows\System\qKCjVyE.exe	cobalt_reflective_dll
C:\Windows\System\OpDjhow.exe	cobalt_reflective_dll
C:\Windows\System\qKCjVyE.exe	cobalt_reflective_dll
C:\Windows\System\wvovbQU.exe	cobalt_reflective_dll
C:\Windows\System\wvovbQU.exe	cobalt_reflective_dll
C:\Windows\System\RoGPCqw.exe	cobalt_reflective_dll
C:\Windows\System\rzoNJZg.exe	cobalt_reflective_dll
C:\Windows\System\xODbeFT.exe	cobalt_reflective_dll
C:\Windows\System\RoGPCqw.exe	cobalt_reflective_dll
C:\Windows\System\xODbeFT.exe	cobalt_reflective_dll
C:\Windows\System\rzoNJZg.exe	cobalt_reflective_dll
C:\Windows\System\HSZygod.exe	cobalt_reflective_dll
C:\Windows\System\hFgHLlo.exe	cobalt_reflective_dll
C:\Windows\System\hFgHLlo.exe	cobalt_reflective_dll
C:\Windows\System\hhHnaHn.exe	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Executes dropped EXE 21 IoCs

Processes:

MybjrgL.exeSyAZttR.exeYUysXel.exeQZNegFx.exedeJUsps.exeowEdoEp.exeAXsNOpL.exeymdywOG.exehhHnaHn.exehFgHLlo.exezQkknPE.exeHSZygod.exeVKewDcq.exeMyjsCPO.exeOpDjhow.exePTDdbnk.exeqKCjVyE.exewvovbQU.exeRoGPCqw.exerzoNJZg.exexODbeFT.exe

pid	process
3368	MybjrgL.exe
3268	SyAZttR.exe
2292	YUysXel.exe
652	QZNegFx.exe
1128	deJUsps.exe
1152	owEdoEp.exe
372	AXsNOpL.exe
196	ymdywOG.exe
304	hhHnaHn.exe
3524	hFgHLlo.exe
3532	zQkknPE.exe
308	HSZygod.exe
1864	VKewDcq.exe
3680	MyjsCPO.exe
808	OpDjhow.exe
728	PTDdbnk.exe
1044	qKCjVyE.exe
2100	wvovbQU.exe
4024	RoGPCqw.exe
3960	rzoNJZg.exe
1732	xODbeFT.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\System\MybjrgL.exe	upx
C:\Windows\System\MybjrgL.exe	upx
C:\Windows\System\SyAZttR.exe	upx
C:\Windows\System\SyAZttR.exe	upx
C:\Windows\System\YUysXel.exe	upx
C:\Windows\System\YUysXel.exe	upx
C:\Windows\System\QZNegFx.exe	upx
C:\Windows\System\deJUsps.exe	upx
C:\Windows\System\QZNegFx.exe	upx
C:\Windows\System\deJUsps.exe	upx
C:\Windows\System\owEdoEp.exe	upx
C:\Windows\System\owEdoEp.exe	upx
C:\Windows\System\AXsNOpL.exe	upx
C:\Windows\System\ymdywOG.exe	upx
C:\Windows\System\AXsNOpL.exe	upx
C:\Windows\System\ymdywOG.exe	upx
C:\Windows\System\hhHnaHn.exe	upx
C:\Windows\System\zQkknPE.exe	upx
C:\Windows\System\zQkknPE.exe	upx
C:\Windows\System\HSZygod.exe	upx
C:\Windows\System\VKewDcq.exe	upx
C:\Windows\System\MyjsCPO.exe	upx
C:\Windows\System\MyjsCPO.exe	upx
C:\Windows\System\OpDjhow.exe	upx
C:\Windows\System\VKewDcq.exe	upx
C:\Windows\System\PTDdbnk.exe	upx
C:\Windows\System\PTDdbnk.exe	upx
C:\Windows\System\qKCjVyE.exe	upx
C:\Windows\System\OpDjhow.exe	upx
C:\Windows\System\qKCjVyE.exe	upx
C:\Windows\System\wvovbQU.exe	upx
C:\Windows\System\wvovbQU.exe	upx
C:\Windows\System\RoGPCqw.exe	upx
C:\Windows\System\rzoNJZg.exe	upx
C:\Windows\System\xODbeFT.exe	upx
C:\Windows\System\RoGPCqw.exe	upx
C:\Windows\System\xODbeFT.exe	upx
C:\Windows\System\rzoNJZg.exe	upx
C:\Windows\System\HSZygod.exe	upx
C:\Windows\System\hFgHLlo.exe	upx
C:\Windows\System\hFgHLlo.exe	upx
C:\Windows\System\hhHnaHn.exe	upx

JavaScript code in executable 42 IoCs

Processes:

resource	yara_rule
C:\Windows\System\MybjrgL.exe	js
C:\Windows\System\MybjrgL.exe	js
C:\Windows\System\SyAZttR.exe	js
C:\Windows\System\SyAZttR.exe	js
C:\Windows\System\YUysXel.exe	js
C:\Windows\System\YUysXel.exe	js
C:\Windows\System\QZNegFx.exe	js
C:\Windows\System\deJUsps.exe	js
C:\Windows\System\QZNegFx.exe	js
C:\Windows\System\deJUsps.exe	js
C:\Windows\System\owEdoEp.exe	js
C:\Windows\System\owEdoEp.exe	js
C:\Windows\System\AXsNOpL.exe	js
C:\Windows\System\ymdywOG.exe	js
C:\Windows\System\AXsNOpL.exe	js
C:\Windows\System\ymdywOG.exe	js
C:\Windows\System\hhHnaHn.exe	js
C:\Windows\System\zQkknPE.exe	js
C:\Windows\System\zQkknPE.exe	js
C:\Windows\System\HSZygod.exe	js
C:\Windows\System\VKewDcq.exe	js
C:\Windows\System\MyjsCPO.exe	js
C:\Windows\System\MyjsCPO.exe	js
C:\Windows\System\OpDjhow.exe	js
C:\Windows\System\VKewDcq.exe	js
C:\Windows\System\PTDdbnk.exe	js
C:\Windows\System\PTDdbnk.exe	js
C:\Windows\System\qKCjVyE.exe	js
C:\Windows\System\OpDjhow.exe	js
C:\Windows\System\qKCjVyE.exe	js
C:\Windows\System\wvovbQU.exe	js
C:\Windows\System\wvovbQU.exe	js
C:\Windows\System\RoGPCqw.exe	js
C:\Windows\System\rzoNJZg.exe	js
C:\Windows\System\xODbeFT.exe	js
C:\Windows\System\RoGPCqw.exe	js
C:\Windows\System\xODbeFT.exe	js
C:\Windows\System\rzoNJZg.exe	js
C:\Windows\System\HSZygod.exe	js
C:\Windows\System\hFgHLlo.exe	js
C:\Windows\System\hFgHLlo.exe	js
C:\Windows\System\hhHnaHn.exe	js

Drops file in Windows directory 21 IoCs

Processes:

b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe

description	ioc	process
File created	C:\Windows\System\OpDjhow.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\MybjrgL.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\QZNegFx.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\owEdoEp.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\AXsNOpL.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\ymdywOG.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\hhHnaHn.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\VKewDcq.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\RoGPCqw.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\YUysXel.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\wvovbQU.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\rzoNJZg.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\xODbeFT.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\deJUsps.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\hFgHLlo.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\HSZygod.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\qKCjVyE.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\SyAZttR.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\zQkknPE.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\MyjsCPO.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
File created	C:\Windows\System\PTDdbnk.exe	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe

description	pid	process
Token: SeLockMemoryPrivilege	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
Token: SeLockMemoryPrivilege	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe

description	pid	process	target process
PID 1304 wrote to memory of 3368	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	MybjrgL.exe
PID 1304 wrote to memory of 3368	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	MybjrgL.exe
PID 1304 wrote to memory of 3268	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	SyAZttR.exe
PID 1304 wrote to memory of 3268	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	SyAZttR.exe
PID 1304 wrote to memory of 2292	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	YUysXel.exe
PID 1304 wrote to memory of 2292	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	YUysXel.exe
PID 1304 wrote to memory of 652	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	QZNegFx.exe
PID 1304 wrote to memory of 652	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	QZNegFx.exe
PID 1304 wrote to memory of 1128	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	deJUsps.exe
PID 1304 wrote to memory of 1128	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	deJUsps.exe
PID 1304 wrote to memory of 1152	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	owEdoEp.exe
PID 1304 wrote to memory of 1152	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	owEdoEp.exe
PID 1304 wrote to memory of 372	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	AXsNOpL.exe
PID 1304 wrote to memory of 372	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	AXsNOpL.exe
PID 1304 wrote to memory of 196	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	ymdywOG.exe
PID 1304 wrote to memory of 196	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	ymdywOG.exe
PID 1304 wrote to memory of 304	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	hhHnaHn.exe
PID 1304 wrote to memory of 304	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	hhHnaHn.exe
PID 1304 wrote to memory of 3524	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	hFgHLlo.exe
PID 1304 wrote to memory of 3524	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	hFgHLlo.exe
PID 1304 wrote to memory of 3532	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	zQkknPE.exe
PID 1304 wrote to memory of 3532	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	zQkknPE.exe
PID 1304 wrote to memory of 308	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	HSZygod.exe
PID 1304 wrote to memory of 308	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	HSZygod.exe
PID 1304 wrote to memory of 1864	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	VKewDcq.exe
PID 1304 wrote to memory of 1864	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	VKewDcq.exe
PID 1304 wrote to memory of 3680	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	MyjsCPO.exe
PID 1304 wrote to memory of 3680	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	MyjsCPO.exe
PID 1304 wrote to memory of 808	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	OpDjhow.exe
PID 1304 wrote to memory of 808	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	OpDjhow.exe
PID 1304 wrote to memory of 728	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	PTDdbnk.exe
PID 1304 wrote to memory of 728	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	PTDdbnk.exe
PID 1304 wrote to memory of 1044	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	qKCjVyE.exe
PID 1304 wrote to memory of 1044	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	qKCjVyE.exe
PID 1304 wrote to memory of 2100	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	wvovbQU.exe
PID 1304 wrote to memory of 2100	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	wvovbQU.exe
PID 1304 wrote to memory of 4024	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	RoGPCqw.exe
PID 1304 wrote to memory of 4024	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	RoGPCqw.exe
PID 1304 wrote to memory of 3960	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	rzoNJZg.exe
PID 1304 wrote to memory of 3960	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	rzoNJZg.exe
PID 1304 wrote to memory of 1732	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	xODbeFT.exe
PID 1304 wrote to memory of 1732	1304	b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe	xODbeFT.exe

C:\Users\Admin\AppData\Local\Temp\b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe
"C:\Users\Admin\AppData\Local\Temp\b4a23ad68a5379e0db12226567fa494df10555b71c6097d68984bf354355745d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\System\MybjrgL.exe
C:\Windows\System\MybjrgL.exe
2⤵
- Executes dropped EXE
PID:3368

C:\Windows\System\SyAZttR.exe
C:\Windows\System\SyAZttR.exe
2⤵
- Executes dropped EXE
PID:3268

C:\Windows\System\YUysXel.exe
C:\Windows\System\YUysXel.exe
2⤵
- Executes dropped EXE
PID:2292

C:\Windows\System\QZNegFx.exe
C:\Windows\System\QZNegFx.exe
2⤵
- Executes dropped EXE
PID:652

C:\Windows\System\deJUsps.exe
C:\Windows\System\deJUsps.exe
2⤵
- Executes dropped EXE
PID:1128

C:\Windows\System\owEdoEp.exe
C:\Windows\System\owEdoEp.exe
2⤵
- Executes dropped EXE
PID:1152

C:\Windows\System\AXsNOpL.exe
C:\Windows\System\AXsNOpL.exe
2⤵
- Executes dropped EXE
PID:372

C:\Windows\System\ymdywOG.exe
C:\Windows\System\ymdywOG.exe
2⤵
- Executes dropped EXE
PID:196

C:\Windows\System\hhHnaHn.exe
C:\Windows\System\hhHnaHn.exe
2⤵
- Executes dropped EXE
PID:304

C:\Windows\System\hFgHLlo.exe
C:\Windows\System\hFgHLlo.exe
2⤵
- Executes dropped EXE
PID:3524

C:\Windows\System\zQkknPE.exe
C:\Windows\System\zQkknPE.exe
2⤵
- Executes dropped EXE
PID:3532

C:\Windows\System\HSZygod.exe
C:\Windows\System\HSZygod.exe
2⤵
- Executes dropped EXE
PID:308

C:\Windows\System\VKewDcq.exe
C:\Windows\System\VKewDcq.exe
2⤵
- Executes dropped EXE
PID:1864

C:\Windows\System\MyjsCPO.exe
C:\Windows\System\MyjsCPO.exe
2⤵
- Executes dropped EXE
PID:3680

C:\Windows\System\OpDjhow.exe
C:\Windows\System\OpDjhow.exe
2⤵
- Executes dropped EXE
PID:808

C:\Windows\System\PTDdbnk.exe
C:\Windows\System\PTDdbnk.exe
2⤵
- Executes dropped EXE
PID:728

C:\Windows\System\qKCjVyE.exe
C:\Windows\System\qKCjVyE.exe
2⤵
- Executes dropped EXE
PID:1044

C:\Windows\System\wvovbQU.exe
C:\Windows\System\wvovbQU.exe
2⤵
- Executes dropped EXE
PID:2100

C:\Windows\System\RoGPCqw.exe
C:\Windows\System\RoGPCqw.exe
2⤵
- Executes dropped EXE
PID:4024

C:\Windows\System\rzoNJZg.exe
C:\Windows\System\rzoNJZg.exe
2⤵
- Executes dropped EXE
PID:3960

C:\Windows\System\xODbeFT.exe
C:\Windows\System\xODbeFT.exe
2⤵
- Executes dropped EXE
PID:1732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AXsNOpL.exe
MD5
5f17e380e4f71d7969d133aedb13b043

SHA1
3b18db2e57f2360f31a752d15276d27e542eab34

SHA256
484ea4045f1bec74012f98b09573011070f434cf792239509ab722ea4379337a

SHA512
87c87fa08571bd896d0938e6f1ea9319841b7a9159598bf8d0d9387fe43fca1988378ae4dbb0d675b9d32a81000f826d307184fc5256daa9497f40c60e29dad7

Download Submit
C:\Windows\System\AXsNOpL.exe
MD5
5f17e380e4f71d7969d133aedb13b043

SHA1
3b18db2e57f2360f31a752d15276d27e542eab34

SHA256
484ea4045f1bec74012f98b09573011070f434cf792239509ab722ea4379337a

SHA512
87c87fa08571bd896d0938e6f1ea9319841b7a9159598bf8d0d9387fe43fca1988378ae4dbb0d675b9d32a81000f826d307184fc5256daa9497f40c60e29dad7

Download Submit
C:\Windows\System\HSZygod.exe
MD5
affff50a6783b1e228a92e29bea55ca3

SHA1
5c2bfe22b7a096507372ea0e6e94941fbf890f5e

SHA256
bfff4027cd86511a55da19d837bbb893110224da6ba859f38c46ce29bd5f8dfd

SHA512
d8299c0de34f698e8257157b14d5b47947076d3078d62d050d068a86395488ae75590355dc11e36ceb40c50bed253b782b9ba8bde6861229cd50bf748a3edfa4

Download Submit
C:\Windows\System\HSZygod.exe
MD5
affff50a6783b1e228a92e29bea55ca3

SHA1
5c2bfe22b7a096507372ea0e6e94941fbf890f5e

SHA256
bfff4027cd86511a55da19d837bbb893110224da6ba859f38c46ce29bd5f8dfd

SHA512
d8299c0de34f698e8257157b14d5b47947076d3078d62d050d068a86395488ae75590355dc11e36ceb40c50bed253b782b9ba8bde6861229cd50bf748a3edfa4

Download Submit
C:\Windows\System\MybjrgL.exe
MD5
2fbb85debca7c48b007a74859290d394

SHA1
78a453797e068c42a07d1872b2543579ab57d08d

SHA256
c6c5f8dc5cf465cb5c7ec4feb53bdc3b488d6c3bd0a914a201951142ff39bdd6

SHA512
3a92d0ec465da2fb8d47f929e45e46b0d42c4dcfdd721b4b55b0d23dc8f070970226a5d22db0a9095837a9c2484f4845379aaa2bc4a31e2bc44ad52f8338ac55

Download Submit
C:\Windows\System\MybjrgL.exe
MD5
2fbb85debca7c48b007a74859290d394

SHA1
78a453797e068c42a07d1872b2543579ab57d08d

SHA256
c6c5f8dc5cf465cb5c7ec4feb53bdc3b488d6c3bd0a914a201951142ff39bdd6

SHA512
3a92d0ec465da2fb8d47f929e45e46b0d42c4dcfdd721b4b55b0d23dc8f070970226a5d22db0a9095837a9c2484f4845379aaa2bc4a31e2bc44ad52f8338ac55

Download Submit
C:\Windows\System\MyjsCPO.exe
MD5
4b0acce36f54d2d7b4f5621005d7dc2d

SHA1
5825a2468c5ab8cd819cc80a620b1b77bfcf7703

SHA256
952781423f0e2c2e9771cb02e392b76dbff84074193d1cd484dcc86c257ccae4

SHA512
358fb4ce94c054cb3ad12631269e9171298a1beb9224d3cfa76f3db3948a10bc39ef87fc08e0604c1548131174cd346b4c0aa737148ce4d47ac85c008f97a3d8

Download Submit
C:\Windows\System\MyjsCPO.exe
MD5
4b0acce36f54d2d7b4f5621005d7dc2d

SHA1
5825a2468c5ab8cd819cc80a620b1b77bfcf7703

SHA256
952781423f0e2c2e9771cb02e392b76dbff84074193d1cd484dcc86c257ccae4

SHA512
358fb4ce94c054cb3ad12631269e9171298a1beb9224d3cfa76f3db3948a10bc39ef87fc08e0604c1548131174cd346b4c0aa737148ce4d47ac85c008f97a3d8

Download Submit
C:\Windows\System\OpDjhow.exe
MD5
78940d3c1b5eb5992ea9471463763471

SHA1
8b84d1658027ddcffca166b14c700242c994da06

SHA256
a79b43983d1a1acf6b26e59ae26d770f2ece3bf8473a74d50dd4abeeb66cc341

SHA512
2b56cce9102e52a234a2b490a2b38ad2fa4c32a7724e3a75e1655a9aba19a95b82981bd4dda3d9758cc88110adac3c1e92e997067587306e115f66e000e78c77

Download Submit
C:\Windows\System\OpDjhow.exe
MD5
78940d3c1b5eb5992ea9471463763471

SHA1
8b84d1658027ddcffca166b14c700242c994da06

SHA256
a79b43983d1a1acf6b26e59ae26d770f2ece3bf8473a74d50dd4abeeb66cc341

SHA512
2b56cce9102e52a234a2b490a2b38ad2fa4c32a7724e3a75e1655a9aba19a95b82981bd4dda3d9758cc88110adac3c1e92e997067587306e115f66e000e78c77

Download Submit
C:\Windows\System\PTDdbnk.exe
MD5
b46c839af38c157054ae7a16323f5bcd

SHA1
16869f09cec5f79e655c708235e4dc35ad8a3afa

SHA256
c78f9f124842767114a143e01eece8ba776b43e0fb9eae1a11a490d37d3bb9f4

SHA512
c11e9226f73f905b11f8bcf7c6a64737e27469c9b177ebe4090363e66cae4b01b6f55299ddc4515530b923d16ed4b7689ca0ba6e28cc45964ff19597762012a0

Download Submit
C:\Windows\System\PTDdbnk.exe
MD5
b46c839af38c157054ae7a16323f5bcd

SHA1
16869f09cec5f79e655c708235e4dc35ad8a3afa

SHA256
c78f9f124842767114a143e01eece8ba776b43e0fb9eae1a11a490d37d3bb9f4

SHA512
c11e9226f73f905b11f8bcf7c6a64737e27469c9b177ebe4090363e66cae4b01b6f55299ddc4515530b923d16ed4b7689ca0ba6e28cc45964ff19597762012a0

Download Submit
C:\Windows\System\QZNegFx.exe
MD5
85d15794a0dac5f4f7fdcbbfcd84552a

SHA1
9ed1dc5236bd2a3b3243783dcf11ed6323f37aeb

SHA256
fa6d86c12b89cf4fd88a356d0adcc51adc8e29166c77f92504121676a77e8ba2

SHA512
ddfcdf434e02bf6769a47a32bbe041e2345d38606179d3191631a39d79bbb0740781a497510cb0e7e139cdff55123b7bb32d260de3646d09ce2503befb647e94

Download Submit
C:\Windows\System\QZNegFx.exe
MD5
85d15794a0dac5f4f7fdcbbfcd84552a

SHA1
9ed1dc5236bd2a3b3243783dcf11ed6323f37aeb

SHA256
fa6d86c12b89cf4fd88a356d0adcc51adc8e29166c77f92504121676a77e8ba2

SHA512
ddfcdf434e02bf6769a47a32bbe041e2345d38606179d3191631a39d79bbb0740781a497510cb0e7e139cdff55123b7bb32d260de3646d09ce2503befb647e94

Download Submit
C:\Windows\System\RoGPCqw.exe
MD5
a4a81e2db3e78d44850e773b3cc1d35f

SHA1
7df531ce4b15b30f29e4a2d37580526b57586fca

SHA256
a476f116c48cc1c2a5da06ec77e0001e77aee30cf3e050164c692593504159e6

SHA512
1ef1f747f8de2069850b0b545f667d6b8bcf7715c31960a8ba21920501a9b94c3c9cf4c651d50dfd94bb21a01c29f351bbbfc68217dcf4ade83f1eb3349a1030

Download Submit
C:\Windows\System\RoGPCqw.exe
MD5
a4a81e2db3e78d44850e773b3cc1d35f

SHA1
7df531ce4b15b30f29e4a2d37580526b57586fca

SHA256
a476f116c48cc1c2a5da06ec77e0001e77aee30cf3e050164c692593504159e6

SHA512
1ef1f747f8de2069850b0b545f667d6b8bcf7715c31960a8ba21920501a9b94c3c9cf4c651d50dfd94bb21a01c29f351bbbfc68217dcf4ade83f1eb3349a1030

Download Submit
C:\Windows\System\SyAZttR.exe
MD5
add3f678a94dca8ee22684944140696d

SHA1
f0b3613705bb8ae259f43c92601a54b80430b285

SHA256
052ca2547eaf22b30632f0f2786b1e5aefc76dd73e326acbfd93f4d0f1583be4

SHA512
d01da76d2b1597db60edefe9ff0c9826a7a0ac805dec749526a30c7eff73dd0d574645f3a9bc12a5bac89fc1daaaf381139d5a355942a5eac1ab20e58a211800

Download Submit
C:\Windows\System\SyAZttR.exe
MD5
add3f678a94dca8ee22684944140696d

SHA1
f0b3613705bb8ae259f43c92601a54b80430b285

SHA256
052ca2547eaf22b30632f0f2786b1e5aefc76dd73e326acbfd93f4d0f1583be4

SHA512
d01da76d2b1597db60edefe9ff0c9826a7a0ac805dec749526a30c7eff73dd0d574645f3a9bc12a5bac89fc1daaaf381139d5a355942a5eac1ab20e58a211800

Download Submit
C:\Windows\System\VKewDcq.exe
MD5
49131ada0fb5b8a236a811e62aeec298

SHA1
fc9890e39076a15ad5499e79ba595b0d7ece7700

SHA256
d8e85483db20f79718623a539c1735b5100b87ec45ac7eadeca0bcab1b1ec980

SHA512
157e8ecb2e8604a49a9a0a72b1f1d97c421482828840074476a30f6336f59d4af7ebc0eac196252aa281003a7cbdef5257f072db45a7da63b155a923f0819777

Download Submit
C:\Windows\System\VKewDcq.exe
MD5
49131ada0fb5b8a236a811e62aeec298

SHA1
fc9890e39076a15ad5499e79ba595b0d7ece7700

SHA256
d8e85483db20f79718623a539c1735b5100b87ec45ac7eadeca0bcab1b1ec980

SHA512
157e8ecb2e8604a49a9a0a72b1f1d97c421482828840074476a30f6336f59d4af7ebc0eac196252aa281003a7cbdef5257f072db45a7da63b155a923f0819777

Download Submit
C:\Windows\System\YUysXel.exe
MD5
e6526b8336ab15db242604d3b5e7db04

SHA1
29e454a7686ea6bb664e4d2290dfd46bc6413d45

SHA256
70a72e8cf4feb559df12862bf957a0f6b6f7edff46bde8895353f02369776780

SHA512
d73ad1a2a91231d74d4cbc145c92178a41337f75bd5d62350dd64f41f421e65c4224b9ec44907c0e87a81a264c0ff17360e64a0e04cbfc82bcaee8d1a6ee47d2

Download Submit
C:\Windows\System\YUysXel.exe
MD5
e6526b8336ab15db242604d3b5e7db04

SHA1
29e454a7686ea6bb664e4d2290dfd46bc6413d45

SHA256
70a72e8cf4feb559df12862bf957a0f6b6f7edff46bde8895353f02369776780

SHA512
d73ad1a2a91231d74d4cbc145c92178a41337f75bd5d62350dd64f41f421e65c4224b9ec44907c0e87a81a264c0ff17360e64a0e04cbfc82bcaee8d1a6ee47d2

Download Submit
C:\Windows\System\deJUsps.exe
MD5
41d6fe75bc9505756183ae9759cb3a33

SHA1
1161baf6eba3a5d214a60895d4b26ad98c4a372c

SHA256
096494ca71ed26f38599b6949a8ade371093e04dcd8d55cb9b4f63c37cab8492

SHA512
f5cd55969fa6aa5c8450bc621e36d81534d7857851609aed5988170869ab570628deb214e583f80dfa7256ac8e86c7f6c7d082f3fc6b78955eb5e7ab7705b865

Download Submit
C:\Windows\System\deJUsps.exe
MD5
41d6fe75bc9505756183ae9759cb3a33

SHA1
1161baf6eba3a5d214a60895d4b26ad98c4a372c

SHA256
096494ca71ed26f38599b6949a8ade371093e04dcd8d55cb9b4f63c37cab8492

SHA512
f5cd55969fa6aa5c8450bc621e36d81534d7857851609aed5988170869ab570628deb214e583f80dfa7256ac8e86c7f6c7d082f3fc6b78955eb5e7ab7705b865

Download Submit
C:\Windows\System\hFgHLlo.exe
MD5
18d5cf9e1fb190862d6246c3fd2da3c7

SHA1
be18d6fc5602644456955680e171f03dd818f288

SHA256
ad03b02fae217793b0a7f5b433184aaeaac63b38680c61e932c3612d414f7c14

SHA512
cd2298c71993590c74e398b8e9ac450bf6a592fe3e682499713876107f85e757d9b3fe1e2b4fc8bdd8adffe9e8fdcb844d11c296ce1db6f502f4d5b4b5666496

Download Submit
C:\Windows\System\hFgHLlo.exe
MD5
18d5cf9e1fb190862d6246c3fd2da3c7

SHA1
be18d6fc5602644456955680e171f03dd818f288

SHA256
ad03b02fae217793b0a7f5b433184aaeaac63b38680c61e932c3612d414f7c14

SHA512
cd2298c71993590c74e398b8e9ac450bf6a592fe3e682499713876107f85e757d9b3fe1e2b4fc8bdd8adffe9e8fdcb844d11c296ce1db6f502f4d5b4b5666496

Download Submit
C:\Windows\System\hhHnaHn.exe
MD5
688b75b137363bd5ab6c4b9eac6c33f2

SHA1
d44a1d798b8d08e6b27f30cc4324bae787a477a2

SHA256
9f1bb9e3d542d0b2e7cbfb4284cdcffc6f91feb23f59bf508ce35e53cc7a370d

SHA512
279537bbb3db31e8d4c23d62499a533373f8187c778a6a53e0c22b3c528b84e108475a79d5eb1a5f550b84c4522797fd34be8556673f8607526620c9c76ea1f8

Download Submit
C:\Windows\System\hhHnaHn.exe
MD5
688b75b137363bd5ab6c4b9eac6c33f2

SHA1
d44a1d798b8d08e6b27f30cc4324bae787a477a2

SHA256
9f1bb9e3d542d0b2e7cbfb4284cdcffc6f91feb23f59bf508ce35e53cc7a370d

SHA512
279537bbb3db31e8d4c23d62499a533373f8187c778a6a53e0c22b3c528b84e108475a79d5eb1a5f550b84c4522797fd34be8556673f8607526620c9c76ea1f8

Download Submit
C:\Windows\System\owEdoEp.exe
MD5
8b213b8df7e3bc052a468ef7d087d09e

SHA1
5aa0a0b4a8d97a9ef07532976799b51f3d150e43

SHA256
74a460dffd2dccf65bc2b5040045172ac7e227df0f5990ff060dd5a06fec5da5

SHA512
bdfe4671c43d924c11fa20d43f004d94ae222eca4a7821d8ccceba05d9f7adaac1b4cf36500362eb3ac02cde63c394cfb6d5d656f5c7c4f545498fcd96fd0eec

Download Submit
C:\Windows\System\owEdoEp.exe
MD5
8b213b8df7e3bc052a468ef7d087d09e

SHA1
5aa0a0b4a8d97a9ef07532976799b51f3d150e43

SHA256
74a460dffd2dccf65bc2b5040045172ac7e227df0f5990ff060dd5a06fec5da5

SHA512
bdfe4671c43d924c11fa20d43f004d94ae222eca4a7821d8ccceba05d9f7adaac1b4cf36500362eb3ac02cde63c394cfb6d5d656f5c7c4f545498fcd96fd0eec

Download Submit
C:\Windows\System\qKCjVyE.exe
MD5
f8ff0985a22a562bbc3a3ba83b10dc7d

SHA1
41e0a17f20e8fc0f386ab937aacc17656e296545

SHA256
c1cfd31cf2eeb5f328deb8f437eb5363f8cb60078d42d8b36bb3a78132546ed0

SHA512
62a6f85d8c78a36b92fe452a4ec3733288954f01ec73a0eae019ffc9331daa7a2e078fd09ef25893e14c8ddf60a7c6ea5beecbf500c70eecc164fdd3911ee4fd

Download Submit
C:\Windows\System\qKCjVyE.exe
MD5
f8ff0985a22a562bbc3a3ba83b10dc7d

SHA1
41e0a17f20e8fc0f386ab937aacc17656e296545

SHA256
c1cfd31cf2eeb5f328deb8f437eb5363f8cb60078d42d8b36bb3a78132546ed0

SHA512
62a6f85d8c78a36b92fe452a4ec3733288954f01ec73a0eae019ffc9331daa7a2e078fd09ef25893e14c8ddf60a7c6ea5beecbf500c70eecc164fdd3911ee4fd

Download Submit
C:\Windows\System\rzoNJZg.exe
MD5
b82e1957fe3714292468e95927180e46

SHA1
87f51e0d7b61f75e499703cefd6e03e735d0eea6

SHA256
d14925b38dcc5530dbf40368847705c958146fa414fa8700be840eae1c5ad411

SHA512
f49707eff5602f8ba350c6634878a0c48971ff71299aa8001a08ced085a6c2101ec67606f22781a6468f786c0eb6998b765813f3bc4cc46ce012abbdb8866173

Download Submit
C:\Windows\System\rzoNJZg.exe
MD5
b82e1957fe3714292468e95927180e46

SHA1
87f51e0d7b61f75e499703cefd6e03e735d0eea6

SHA256
d14925b38dcc5530dbf40368847705c958146fa414fa8700be840eae1c5ad411

SHA512
f49707eff5602f8ba350c6634878a0c48971ff71299aa8001a08ced085a6c2101ec67606f22781a6468f786c0eb6998b765813f3bc4cc46ce012abbdb8866173

Download Submit
C:\Windows\System\wvovbQU.exe
MD5
5d03884131973c948a9b832c7e7d50df

SHA1
7ba23bd4ab5d3b1b216fd2507deb732eb9adf605

SHA256
fecd31b8575b48f07ed678b1c1f25ae1aca0ef4b0641e966a87fcc52f9e4cbd1

SHA512
3351560a66de25e5a3e3c4464317453c8901dcabe7b3bb0a6a04a14b2dc6b627614130b41a7eda680f446ba2a0bfbe55d1b44c431589c044ca5cbeb997712c2c

Download Submit
C:\Windows\System\wvovbQU.exe
MD5
5d03884131973c948a9b832c7e7d50df

SHA1
7ba23bd4ab5d3b1b216fd2507deb732eb9adf605

SHA256
fecd31b8575b48f07ed678b1c1f25ae1aca0ef4b0641e966a87fcc52f9e4cbd1

SHA512
3351560a66de25e5a3e3c4464317453c8901dcabe7b3bb0a6a04a14b2dc6b627614130b41a7eda680f446ba2a0bfbe55d1b44c431589c044ca5cbeb997712c2c

Download Submit
C:\Windows\System\xODbeFT.exe
MD5
4e3a8efc866dbece798ccb59d529b9f9

SHA1
248be369c285f57f3406ed50dd6b29a64eb6c70c

SHA256
f4e8851fcfb6536dc074fa55224f88837a30d9cd163d70bf2925e8aef5c75a7c

SHA512
b68cd24214b0a3f6ace97f2c134887e6813a2dbeacc04c30643eb9a4f548b1f86df84c1067cce924eccb29349e6544f1873955081769d14d4c36444f1a3d4a40

Download Submit
C:\Windows\System\xODbeFT.exe
MD5
4e3a8efc866dbece798ccb59d529b9f9

SHA1
248be369c285f57f3406ed50dd6b29a64eb6c70c

SHA256
f4e8851fcfb6536dc074fa55224f88837a30d9cd163d70bf2925e8aef5c75a7c

SHA512
b68cd24214b0a3f6ace97f2c134887e6813a2dbeacc04c30643eb9a4f548b1f86df84c1067cce924eccb29349e6544f1873955081769d14d4c36444f1a3d4a40

Download Submit
C:\Windows\System\ymdywOG.exe
MD5
b330ca71217d923a15a833b16cd12676

SHA1
99b69feccc452143695620bd17b5bb10bce0f05b

SHA256
5409290729921856d166969c3bbcb2e9589f076084324c04edcec29c27b17d59

SHA512
4ebd6828aa9a49c7143fa6747078112465e4aca0fdfc24bd189db997be03a939d34d0422da09cf770b4bf2b9031c4743a6cc90a50048cec591359f1538191a2f

Download Submit
C:\Windows\System\ymdywOG.exe
MD5
b330ca71217d923a15a833b16cd12676

SHA1
99b69feccc452143695620bd17b5bb10bce0f05b

SHA256
5409290729921856d166969c3bbcb2e9589f076084324c04edcec29c27b17d59

SHA512
4ebd6828aa9a49c7143fa6747078112465e4aca0fdfc24bd189db997be03a939d34d0422da09cf770b4bf2b9031c4743a6cc90a50048cec591359f1538191a2f

Download Submit
C:\Windows\System\zQkknPE.exe
MD5
66100129df40063578a9f619bba634a9

SHA1
86e44cdcf157836ae09431de27d137e9d72a13e7

SHA256
781f5563ca22555bde3fa7559ad16f1e921e42d72b9dfa068a2b9ccfee57a5b0

SHA512
a138c5297bbb2063ff1d65a0ecf55eaa69209ba1f736e50d7fd278623735d06278e1d6ab78fdf6efd7e145bd9e2b02e99c728c7a3f94edf99440a808a69faa42

Download Submit
C:\Windows\System\zQkknPE.exe
MD5
66100129df40063578a9f619bba634a9

SHA1
86e44cdcf157836ae09431de27d137e9d72a13e7

SHA256
781f5563ca22555bde3fa7559ad16f1e921e42d72b9dfa068a2b9ccfee57a5b0

SHA512
a138c5297bbb2063ff1d65a0ecf55eaa69209ba1f736e50d7fd278623735d06278e1d6ab78fdf6efd7e145bd9e2b02e99c728c7a3f94edf99440a808a69faa42

Download Submit
memory/196-19-0x0000000000000000-mapping.dmp

Download
memory/304-24-0x0000000000000000-mapping.dmp

Download
memory/308-33-0x0000000000000000-mapping.dmp

Download
memory/372-18-0x0000000000000000-mapping.dmp

Download
memory/652-9-0x0000000000000000-mapping.dmp

Download
memory/728-44-0x0000000000000000-mapping.dmp

Download
memory/808-41-0x0000000000000000-mapping.dmp

Download
memory/1044-46-0x0000000000000000-mapping.dmp

Download
memory/1128-12-0x0000000000000000-mapping.dmp

Download
memory/1152-14-0x0000000000000000-mapping.dmp

Download
memory/1732-59-0x0000000000000000-mapping.dmp

Download
memory/1864-35-0x0000000000000000-mapping.dmp

Download
memory/2100-50-0x0000000000000000-mapping.dmp

Download
memory/2292-5-0x0000000000000000-mapping.dmp

Download
memory/3268-3-0x0000000000000000-mapping.dmp

Download
memory/3368-0-0x0000000000000000-mapping.dmp

Download
memory/3524-26-0x0000000000000000-mapping.dmp

Download
memory/3532-29-0x0000000000000000-mapping.dmp

Download
memory/3680-37-0x0000000000000000-mapping.dmp

Download
memory/3960-55-0x0000000000000000-mapping.dmp

Download
memory/4024-52-0x0000000000000000-mapping.dmp

Download