cobaltstrike | a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7v20201028
submitted
10/11/2020, 08:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
Size 5.9MB
Sample201110-vrp35jrg6e
SHA256 a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb
MD5 e4ce9cbaa19d1d395667c6e5473a3d1d
SHA1 66fb6f3848e7377e23724969408fea64f0e4df9f
SHA512 0903fb6024064997b8c88cd2ea4455be7932abe5f412868b5f9b6a98c06c831cf04d9134ff7b3ffdd1d074e5571ade02ba3c483659e132d0db50ae7bc2e7e851
MD5 SHA1 SHA512

Score

10^/10

cobaltstrike backdoor trojan upx

Malware Config

Signatures

Cobalt Strike reflective loader 42 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x00040000000130ef-0.dat	cobalt_reflective_dll
behavioral1/files/0x00040000000130f0-3.dat	cobalt_reflective_dll
behavioral1/files/0x00040000000130ef-2.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130f4-9.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000130f3-8.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130f5-11.dat	cobalt_reflective_dll
behavioral1/files/0x00040000000130f0-6.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000130f3-5.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130f6-16.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130f6-14.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130f8-20.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130fa-31.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130fe-41.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130ff-44.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130fd-43.dat	cobalt_reflective_dll
behavioral1/files/0x0003000000013100-45.dat	cobalt_reflective_dll
behavioral1/files/0x0003000000013102-51.dat	cobalt_reflective_dll
behavioral1/files/0x0003000000013101-50.dat	cobalt_reflective_dll
behavioral1/files/0x0003000000013100-48.dat	cobalt_reflective_dll
behavioral1/files/0x0003000000013101-47.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130ff-40.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130fe-38.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130fb-37.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130fc-35.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130fd-34.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130fc-32.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130fb-29.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130f9-27.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130fa-26.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130f7-25.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130f8-23.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130f9-22.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130f7-18.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130f5-17.dat	cobalt_reflective_dll
behavioral1/files/0x00030000000130f4-13.dat	cobalt_reflective_dll
behavioral1/files/0x0003000000013102-53.dat	cobalt_reflective_dll
behavioral1/files/0x0003000000013104-57.dat	cobalt_reflective_dll
behavioral1/files/0x0003000000013103-56.dat	cobalt_reflective_dll
behavioral1/files/0x0003000000013103-54.dat	cobalt_reflective_dll
behavioral1/files/0x0003000000013104-59.dat	cobalt_reflective_dll
behavioral1/files/0x0003000000013105-60.dat	cobalt_reflective_dll
behavioral1/files/0x0003000000013105-62.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Executes dropped EXE 21 IoCs

pid	Process
1988	LNgEVch.exe
1292	LbqAlzx.exe
840	Wnpfxvn.exe
320	QoqUyqh.exe
1508	GtTtrdQ.exe
1052	nJhGZjm.exe
568	ZNrZTBQ.exe
1368	CZOzawH.exe
1800	errRGfr.exe
1720	gnpTuUl.exe
1700	TgPCzKl.exe
1780	MmpBuFN.exe
1424	gsmNhsV.exe
1620	wcMtqSv.exe
604	NwlOclU.exe
912	DPWEegb.exe
1716	QJhYWxx.exe
280	LPSbSas.exe
1484	DTSXrBL.exe
1648	lAcHNVL.exe
552	iPzqoHl.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00040000000130ef-0.dat	upx
behavioral1/files/0x00040000000130f0-3.dat	upx
behavioral1/files/0x00040000000130ef-2.dat	upx
behavioral1/files/0x00030000000130f4-9.dat	upx
behavioral1/files/0x00050000000130f3-8.dat	upx
behavioral1/files/0x00030000000130f5-11.dat	upx
behavioral1/files/0x00040000000130f0-6.dat	upx
behavioral1/files/0x00050000000130f3-5.dat	upx
behavioral1/files/0x00030000000130f6-16.dat	upx
behavioral1/files/0x00030000000130f6-14.dat	upx
behavioral1/files/0x00030000000130f8-20.dat	upx
behavioral1/files/0x00030000000130fa-31.dat	upx
behavioral1/files/0x00030000000130fe-41.dat	upx
behavioral1/files/0x00030000000130ff-44.dat	upx
behavioral1/files/0x00030000000130fd-43.dat	upx
behavioral1/files/0x0003000000013100-45.dat	upx
behavioral1/files/0x0003000000013102-51.dat	upx
behavioral1/files/0x0003000000013101-50.dat	upx
behavioral1/files/0x0003000000013100-48.dat	upx
behavioral1/files/0x0003000000013101-47.dat	upx
behavioral1/files/0x00030000000130ff-40.dat	upx
behavioral1/files/0x00030000000130fe-38.dat	upx
behavioral1/files/0x00030000000130fb-37.dat	upx
behavioral1/files/0x00030000000130fc-35.dat	upx
behavioral1/files/0x00030000000130fd-34.dat	upx
behavioral1/files/0x00030000000130fc-32.dat	upx
behavioral1/files/0x00030000000130fb-29.dat	upx
behavioral1/files/0x00030000000130f9-27.dat	upx
behavioral1/files/0x00030000000130fa-26.dat	upx
behavioral1/files/0x00030000000130f7-25.dat	upx
behavioral1/files/0x00030000000130f8-23.dat	upx
behavioral1/files/0x00030000000130f9-22.dat	upx
behavioral1/files/0x00030000000130f7-18.dat	upx
behavioral1/files/0x00030000000130f5-17.dat	upx
behavioral1/files/0x00030000000130f4-13.dat	upx
behavioral1/files/0x0003000000013102-53.dat	upx
behavioral1/files/0x0003000000013104-57.dat	upx
behavioral1/files/0x0003000000013103-56.dat	upx
behavioral1/files/0x0003000000013103-54.dat	upx
behavioral1/files/0x0003000000013104-59.dat	upx
behavioral1/files/0x0003000000013105-60.dat	upx
behavioral1/files/0x0003000000013105-62.dat	upx

Loads dropped DLL 21 IoCs

pid	Process
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe

JavaScript code in executable 42 IoCs

resource	yara_rule
behavioral1/files/0x00040000000130ef-0.dat	js
behavioral1/files/0x00040000000130f0-3.dat	js
behavioral1/files/0x00040000000130ef-2.dat	js
behavioral1/files/0x00030000000130f4-9.dat	js
behavioral1/files/0x00050000000130f3-8.dat	js
behavioral1/files/0x00030000000130f5-11.dat	js
behavioral1/files/0x00040000000130f0-6.dat	js
behavioral1/files/0x00050000000130f3-5.dat	js
behavioral1/files/0x00030000000130f6-16.dat	js
behavioral1/files/0x00030000000130f6-14.dat	js
behavioral1/files/0x00030000000130f8-20.dat	js
behavioral1/files/0x00030000000130fa-31.dat	js
behavioral1/files/0x00030000000130fe-41.dat	js
behavioral1/files/0x00030000000130ff-44.dat	js
behavioral1/files/0x00030000000130fd-43.dat	js
behavioral1/files/0x0003000000013100-45.dat	js
behavioral1/files/0x0003000000013102-51.dat	js
behavioral1/files/0x0003000000013101-50.dat	js
behavioral1/files/0x0003000000013100-48.dat	js
behavioral1/files/0x0003000000013101-47.dat	js
behavioral1/files/0x00030000000130ff-40.dat	js
behavioral1/files/0x00030000000130fe-38.dat	js
behavioral1/files/0x00030000000130fb-37.dat	js
behavioral1/files/0x00030000000130fc-35.dat	js
behavioral1/files/0x00030000000130fd-34.dat	js
behavioral1/files/0x00030000000130fc-32.dat	js
behavioral1/files/0x00030000000130fb-29.dat	js
behavioral1/files/0x00030000000130f9-27.dat	js
behavioral1/files/0x00030000000130fa-26.dat	js
behavioral1/files/0x00030000000130f7-25.dat	js
behavioral1/files/0x00030000000130f8-23.dat	js
behavioral1/files/0x00030000000130f9-22.dat	js
behavioral1/files/0x00030000000130f7-18.dat	js
behavioral1/files/0x00030000000130f5-17.dat	js
behavioral1/files/0x00030000000130f4-13.dat	js
behavioral1/files/0x0003000000013102-53.dat	js
behavioral1/files/0x0003000000013104-57.dat	js
behavioral1/files/0x0003000000013103-56.dat	js
behavioral1/files/0x0003000000013103-54.dat	js
behavioral1/files/0x0003000000013104-59.dat	js
behavioral1/files/0x0003000000013105-60.dat	js
behavioral1/files/0x0003000000013105-62.dat	js

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\wcMtqSv.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\DPWEegb.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\LPSbSas.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\ZNrZTBQ.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\MmpBuFN.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\TgPCzKl.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\gnpTuUl.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\gsmNhsV.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\QJhYWxx.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\Wnpfxvn.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\nJhGZjm.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\errRGfr.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\NwlOclU.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\lAcHNVL.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\LNgEVch.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\QoqUyqh.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\CZOzawH.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\iPzqoHl.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\LbqAlzx.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\GtTtrdQ.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
File created	C:\Windows\System\DTSXrBL.exe	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
Token: SeLockMemoryPrivilege	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1988	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	27
PID 1816 wrote to memory of 1988	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	27
PID 1816 wrote to memory of 1988	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	27
PID 1816 wrote to memory of 1292	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	28
PID 1816 wrote to memory of 1292	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	28
PID 1816 wrote to memory of 1292	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	28
PID 1816 wrote to memory of 840	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	29
PID 1816 wrote to memory of 840	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	29
PID 1816 wrote to memory of 840	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	29
PID 1816 wrote to memory of 320	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	30
PID 1816 wrote to memory of 320	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	30
PID 1816 wrote to memory of 320	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	30
PID 1816 wrote to memory of 1052	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	31
PID 1816 wrote to memory of 1052	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	31
PID 1816 wrote to memory of 1052	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	31
PID 1816 wrote to memory of 1508	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	32
PID 1816 wrote to memory of 1508	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	32
PID 1816 wrote to memory of 1508	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	32
PID 1816 wrote to memory of 1368	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	33
PID 1816 wrote to memory of 1368	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	33
PID 1816 wrote to memory of 1368	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	33
PID 1816 wrote to memory of 568	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	34
PID 1816 wrote to memory of 568	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	34
PID 1816 wrote to memory of 568	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	34
PID 1816 wrote to memory of 1800	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	35
PID 1816 wrote to memory of 1800	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	35
PID 1816 wrote to memory of 1800	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	35
PID 1816 wrote to memory of 1720	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	36
PID 1816 wrote to memory of 1720	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	36
PID 1816 wrote to memory of 1720	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	36
PID 1816 wrote to memory of 1780	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	37
PID 1816 wrote to memory of 1780	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	37
PID 1816 wrote to memory of 1780	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	37
PID 1816 wrote to memory of 1700	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	38
PID 1816 wrote to memory of 1700	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	38
PID 1816 wrote to memory of 1700	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	38
PID 1816 wrote to memory of 1620	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	39
PID 1816 wrote to memory of 1620	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	39
PID 1816 wrote to memory of 1620	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	39
PID 1816 wrote to memory of 1424	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	40
PID 1816 wrote to memory of 1424	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	40
PID 1816 wrote to memory of 1424	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	40
PID 1816 wrote to memory of 604	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	41
PID 1816 wrote to memory of 604	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	41
PID 1816 wrote to memory of 604	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	41
PID 1816 wrote to memory of 912	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	42
PID 1816 wrote to memory of 912	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	42
PID 1816 wrote to memory of 912	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	42
PID 1816 wrote to memory of 1716	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	43
PID 1816 wrote to memory of 1716	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	43
PID 1816 wrote to memory of 1716	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	43
PID 1816 wrote to memory of 280	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	44
PID 1816 wrote to memory of 280	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	44
PID 1816 wrote to memory of 280	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	44
PID 1816 wrote to memory of 1484	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	45
PID 1816 wrote to memory of 1484	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	45
PID 1816 wrote to memory of 1484	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	45
PID 1816 wrote to memory of 1648	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	46
PID 1816 wrote to memory of 1648	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	46
PID 1816 wrote to memory of 1648	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	46
PID 1816 wrote to memory of 552	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	47
PID 1816 wrote to memory of 552	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	47
PID 1816 wrote to memory of 552	1816	a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe	47

C:\Users\Admin\AppData\Local\Temp\a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe
"C:\Users\Admin\AppData\Local\Temp\a2e2b9c58537f3211cf4a643b93c3526002709eabdee27f0cbbfb9fc1ed63acb.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\System\LNgEVch.exe
  C:\Windows\System\LNgEVch.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\LbqAlzx.exe
  C:\Windows\System\LbqAlzx.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\Wnpfxvn.exe
  C:\Windows\System\Wnpfxvn.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\QoqUyqh.exe
  C:\Windows\System\QoqUyqh.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\nJhGZjm.exe
  C:\Windows\System\nJhGZjm.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\GtTtrdQ.exe
  C:\Windows\System\GtTtrdQ.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\CZOzawH.exe
  C:\Windows\System\CZOzawH.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\ZNrZTBQ.exe
  C:\Windows\System\ZNrZTBQ.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\errRGfr.exe
  C:\Windows\System\errRGfr.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\gnpTuUl.exe
  C:\Windows\System\gnpTuUl.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\MmpBuFN.exe
  C:\Windows\System\MmpBuFN.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\TgPCzKl.exe
  C:\Windows\System\TgPCzKl.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\wcMtqSv.exe
  C:\Windows\System\wcMtqSv.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\gsmNhsV.exe
  C:\Windows\System\gsmNhsV.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\NwlOclU.exe
  C:\Windows\System\NwlOclU.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\DPWEegb.exe
  C:\Windows\System\DPWEegb.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\QJhYWxx.exe
  C:\Windows\System\QJhYWxx.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\LPSbSas.exe
  C:\Windows\System\LPSbSas.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\DTSXrBL.exe
  C:\Windows\System\DTSXrBL.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\lAcHNVL.exe
  C:\Windows\System\lAcHNVL.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\iPzqoHl.exe
  C:\Windows\System\iPzqoHl.exe
  2⤵
  - Executes dropped EXE
  PID:552

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads