Analysis
-
max time kernel
140s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
09/01/2024, 06:42
Behavioral task
behavioral1
Sample
2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe
Resource
win7-20231129-en
General
-
Target
2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
6eb8256a80606d7baaad352f11b6b667
-
SHA1
6f70760716395cd1ccb21a5bdd0593e481d8f1aa
-
SHA256
b9671e0fd26205896114e00ec6650b3437f76ff5f285ac405ac58bc8d87ca6cc
-
SHA512
936edca7db76fdf9743d629c74a81054727150f0a7ea6def0603bf2c98f61f14fcb78f51f3f684344bb6efdb57fcb95951b4c241230bacb22e8aab77b54ed26d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lM:RWWBibf56utgpPFotBER/mQ32lUY
Malware Config
Signatures
-
XMRig Miner payload 38 IoCs
resource yara_rule behavioral2/memory/3936-117-0x00007FF649590000-0x00007FF6498E1000-memory.dmp xmrig behavioral2/memory/5056-123-0x00007FF7EF350000-0x00007FF7EF6A1000-memory.dmp xmrig behavioral2/memory/2612-120-0x00007FF6DFB50000-0x00007FF6DFEA1000-memory.dmp xmrig behavioral2/memory/2580-124-0x00007FF7BD210000-0x00007FF7BD561000-memory.dmp xmrig behavioral2/memory/4780-125-0x00007FF62F9C0000-0x00007FF62FD11000-memory.dmp xmrig behavioral2/memory/4276-127-0x00007FF71E880000-0x00007FF71EBD1000-memory.dmp xmrig behavioral2/memory/1204-129-0x00007FF782E90000-0x00007FF7831E1000-memory.dmp xmrig behavioral2/memory/5116-128-0x00007FF633FB0000-0x00007FF634301000-memory.dmp xmrig behavioral2/memory/1648-126-0x00007FF679EE0000-0x00007FF67A231000-memory.dmp xmrig behavioral2/memory/2888-108-0x00007FF687570000-0x00007FF6878C1000-memory.dmp xmrig behavioral2/memory/1204-8-0x00007FF782E90000-0x00007FF7831E1000-memory.dmp xmrig behavioral2/memory/2612-133-0x00007FF6DFB50000-0x00007FF6DFEA1000-memory.dmp xmrig behavioral2/memory/2884-137-0x00007FF72B480000-0x00007FF72B7D1000-memory.dmp xmrig behavioral2/memory/2040-142-0x00007FF724CF0000-0x00007FF725041000-memory.dmp xmrig behavioral2/memory/3428-143-0x00007FF75F6A0000-0x00007FF75F9F1000-memory.dmp xmrig behavioral2/memory/3200-141-0x00007FF74E0C0000-0x00007FF74E411000-memory.dmp xmrig behavioral2/memory/4472-140-0x00007FF739AA0000-0x00007FF739DF1000-memory.dmp xmrig behavioral2/memory/2612-155-0x00007FF6DFB50000-0x00007FF6DFEA1000-memory.dmp xmrig behavioral2/memory/1420-218-0x00007FF69DFB0000-0x00007FF69E301000-memory.dmp xmrig behavioral2/memory/4604-220-0x00007FF73CEA0000-0x00007FF73D1F1000-memory.dmp xmrig behavioral2/memory/2884-222-0x00007FF72B480000-0x00007FF72B7D1000-memory.dmp xmrig behavioral2/memory/3176-224-0x00007FF6CCBA0000-0x00007FF6CCEF1000-memory.dmp xmrig behavioral2/memory/4716-226-0x00007FF6BA2D0000-0x00007FF6BA621000-memory.dmp xmrig behavioral2/memory/4472-228-0x00007FF739AA0000-0x00007FF739DF1000-memory.dmp xmrig behavioral2/memory/3200-230-0x00007FF74E0C0000-0x00007FF74E411000-memory.dmp xmrig behavioral2/memory/2040-233-0x00007FF724CF0000-0x00007FF725041000-memory.dmp xmrig behavioral2/memory/4964-234-0x00007FF6C31C0000-0x00007FF6C3511000-memory.dmp xmrig behavioral2/memory/2388-239-0x00007FF7A5670000-0x00007FF7A59C1000-memory.dmp xmrig behavioral2/memory/3936-246-0x00007FF649590000-0x00007FF6498E1000-memory.dmp xmrig behavioral2/memory/5116-250-0x00007FF633FB0000-0x00007FF634301000-memory.dmp xmrig behavioral2/memory/5056-252-0x00007FF7EF350000-0x00007FF7EF6A1000-memory.dmp xmrig behavioral2/memory/2580-255-0x00007FF7BD210000-0x00007FF7BD561000-memory.dmp xmrig behavioral2/memory/4780-256-0x00007FF62F9C0000-0x00007FF62FD11000-memory.dmp xmrig behavioral2/memory/4276-248-0x00007FF71E880000-0x00007FF71EBD1000-memory.dmp xmrig behavioral2/memory/1648-245-0x00007FF679EE0000-0x00007FF67A231000-memory.dmp xmrig behavioral2/memory/2888-243-0x00007FF687570000-0x00007FF6878C1000-memory.dmp xmrig behavioral2/memory/3056-240-0x00007FF63C4A0000-0x00007FF63C7F1000-memory.dmp xmrig behavioral2/memory/3428-238-0x00007FF75F6A0000-0x00007FF75F9F1000-memory.dmp xmrig -
Executes dropped EXE 21 IoCs
pid Process 1204 OcOCYep.exe 1420 tnDaqyN.exe 4604 fHERPIL.exe 2884 KwUzSrE.exe 3176 Chysstw.exe 4716 ueuqOob.exe 4472 pmWuzqG.exe 3200 PVImEGS.exe 2040 KKiidYM.exe 3428 FvQRosz.exe 4964 OOoJCBO.exe 2388 VUxdGvE.exe 3056 HVdpYHF.exe 2888 cLTxivg.exe 3936 DzwhdbV.exe 1648 TgIRJYs.exe 4276 fFmGvRs.exe 5116 NwZarxD.exe 5056 jsYjToZ.exe 2580 HWCZnyf.exe 4780 HmPSnvk.exe -
resource yara_rule behavioral2/memory/2612-0-0x00007FF6DFB50000-0x00007FF6DFEA1000-memory.dmp upx behavioral2/files/0x0006000000023227-115.dat upx behavioral2/memory/3936-117-0x00007FF649590000-0x00007FF6498E1000-memory.dmp upx behavioral2/memory/5056-123-0x00007FF7EF350000-0x00007FF7EF6A1000-memory.dmp upx behavioral2/memory/2612-120-0x00007FF6DFB50000-0x00007FF6DFEA1000-memory.dmp upx behavioral2/memory/2580-124-0x00007FF7BD210000-0x00007FF7BD561000-memory.dmp upx behavioral2/files/0x0006000000023227-119.dat upx behavioral2/memory/4780-125-0x00007FF62F9C0000-0x00007FF62FD11000-memory.dmp upx behavioral2/memory/4276-127-0x00007FF71E880000-0x00007FF71EBD1000-memory.dmp upx behavioral2/memory/1204-129-0x00007FF782E90000-0x00007FF7831E1000-memory.dmp upx behavioral2/memory/5116-128-0x00007FF633FB0000-0x00007FF634301000-memory.dmp upx behavioral2/memory/1648-126-0x00007FF679EE0000-0x00007FF67A231000-memory.dmp upx behavioral2/files/0x0006000000023226-118.dat upx behavioral2/files/0x0006000000023225-114.dat upx behavioral2/files/0x0006000000023226-113.dat upx behavioral2/memory/2888-108-0x00007FF687570000-0x00007FF6878C1000-memory.dmp upx behavioral2/files/0x0006000000023224-105.dat upx behavioral2/memory/4604-20-0x00007FF73CEA0000-0x00007FF73D1F1000-memory.dmp upx behavioral2/memory/1420-14-0x00007FF69DFB0000-0x00007FF69E301000-memory.dmp upx behavioral2/memory/1204-8-0x00007FF782E90000-0x00007FF7831E1000-memory.dmp upx behavioral2/memory/2612-133-0x00007FF6DFB50000-0x00007FF6DFEA1000-memory.dmp upx behavioral2/memory/2884-137-0x00007FF72B480000-0x00007FF72B7D1000-memory.dmp upx behavioral2/memory/2040-142-0x00007FF724CF0000-0x00007FF725041000-memory.dmp upx behavioral2/memory/3428-143-0x00007FF75F6A0000-0x00007FF75F9F1000-memory.dmp upx behavioral2/memory/3200-141-0x00007FF74E0C0000-0x00007FF74E411000-memory.dmp upx behavioral2/memory/4472-140-0x00007FF739AA0000-0x00007FF739DF1000-memory.dmp upx behavioral2/memory/2612-155-0x00007FF6DFB50000-0x00007FF6DFEA1000-memory.dmp upx behavioral2/memory/1420-218-0x00007FF69DFB0000-0x00007FF69E301000-memory.dmp upx behavioral2/memory/4604-220-0x00007FF73CEA0000-0x00007FF73D1F1000-memory.dmp upx behavioral2/memory/2884-222-0x00007FF72B480000-0x00007FF72B7D1000-memory.dmp upx behavioral2/memory/3176-224-0x00007FF6CCBA0000-0x00007FF6CCEF1000-memory.dmp upx behavioral2/memory/4716-226-0x00007FF6BA2D0000-0x00007FF6BA621000-memory.dmp upx behavioral2/memory/4472-228-0x00007FF739AA0000-0x00007FF739DF1000-memory.dmp upx behavioral2/memory/3200-230-0x00007FF74E0C0000-0x00007FF74E411000-memory.dmp upx behavioral2/memory/2040-233-0x00007FF724CF0000-0x00007FF725041000-memory.dmp upx behavioral2/memory/4964-234-0x00007FF6C31C0000-0x00007FF6C3511000-memory.dmp upx behavioral2/memory/2388-239-0x00007FF7A5670000-0x00007FF7A59C1000-memory.dmp upx behavioral2/memory/3936-246-0x00007FF649590000-0x00007FF6498E1000-memory.dmp upx behavioral2/memory/5116-250-0x00007FF633FB0000-0x00007FF634301000-memory.dmp upx behavioral2/memory/5056-252-0x00007FF7EF350000-0x00007FF7EF6A1000-memory.dmp upx behavioral2/memory/2580-255-0x00007FF7BD210000-0x00007FF7BD561000-memory.dmp upx behavioral2/memory/4780-256-0x00007FF62F9C0000-0x00007FF62FD11000-memory.dmp upx behavioral2/memory/4276-248-0x00007FF71E880000-0x00007FF71EBD1000-memory.dmp upx behavioral2/memory/1648-245-0x00007FF679EE0000-0x00007FF67A231000-memory.dmp upx behavioral2/memory/2888-243-0x00007FF687570000-0x00007FF6878C1000-memory.dmp upx behavioral2/memory/3056-240-0x00007FF63C4A0000-0x00007FF63C7F1000-memory.dmp upx behavioral2/memory/3428-238-0x00007FF75F6A0000-0x00007FF75F9F1000-memory.dmp upx -
Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\System\tnDaqyN.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\FvQRosz.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\HmPSnvk.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\OcOCYep.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\Chysstw.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\pmWuzqG.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\PVImEGS.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\KKiidYM.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\cLTxivg.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\fFmGvRs.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\KwUzSrE.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\ueuqOob.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\HVdpYHF.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\TgIRJYs.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\HWCZnyf.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\fHERPIL.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\OOoJCBO.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\VUxdGvE.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\DzwhdbV.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\NwZarxD.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\jsYjToZ.exe 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe Token: SeLockMemoryPrivilege 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2612 wrote to memory of 1204 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 16 PID 2612 wrote to memory of 1204 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 16 PID 2612 wrote to memory of 1420 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 17 PID 2612 wrote to memory of 1420 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 17 PID 2612 wrote to memory of 4604 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 18 PID 2612 wrote to memory of 4604 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 18 PID 2612 wrote to memory of 2884 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 19 PID 2612 wrote to memory of 2884 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 19 PID 2612 wrote to memory of 3176 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 40 PID 2612 wrote to memory of 3176 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 40 PID 2612 wrote to memory of 4716 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 20 PID 2612 wrote to memory of 4716 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 20 PID 2612 wrote to memory of 4472 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 39 PID 2612 wrote to memory of 4472 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 39 PID 2612 wrote to memory of 3200 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 38 PID 2612 wrote to memory of 3200 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 38 PID 2612 wrote to memory of 2040 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 21 PID 2612 wrote to memory of 2040 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 21 PID 2612 wrote to memory of 3428 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 37 PID 2612 wrote to memory of 3428 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 37 PID 2612 wrote to memory of 4964 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 36 PID 2612 wrote to memory of 4964 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 36 PID 2612 wrote to memory of 2388 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 35 PID 2612 wrote to memory of 2388 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 35 PID 2612 wrote to memory of 3056 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 34 PID 2612 wrote to memory of 3056 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 34 PID 2612 wrote to memory of 2888 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 22 PID 2612 wrote to memory of 2888 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 22 PID 2612 wrote to memory of 3936 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 32 PID 2612 wrote to memory of 3936 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 32 PID 2612 wrote to memory of 1648 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 31 PID 2612 wrote to memory of 1648 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 31 PID 2612 wrote to memory of 4276 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 30 PID 2612 wrote to memory of 4276 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 30 PID 2612 wrote to memory of 5116 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 29 PID 2612 wrote to memory of 5116 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 29 PID 2612 wrote to memory of 5056 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 23 PID 2612 wrote to memory of 5056 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 23 PID 2612 wrote to memory of 2580 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 28 PID 2612 wrote to memory of 2580 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 28 PID 2612 wrote to memory of 4780 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 24 PID 2612 wrote to memory of 4780 2612 2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe 24
Processes
-
C:\Windows\System\OcOCYep.exeC:\Windows\System\OcOCYep.exe1⤵
- Executes dropped EXE
PID:1204
-
C:\Windows\System\tnDaqyN.exeC:\Windows\System\tnDaqyN.exe1⤵
- Executes dropped EXE
PID:1420
-
C:\Windows\System\fHERPIL.exeC:\Windows\System\fHERPIL.exe1⤵
- Executes dropped EXE
PID:4604
-
C:\Windows\System\KwUzSrE.exeC:\Windows\System\KwUzSrE.exe1⤵
- Executes dropped EXE
PID:2884
-
C:\Windows\System\ueuqOob.exeC:\Windows\System\ueuqOob.exe1⤵
- Executes dropped EXE
PID:4716
-
C:\Windows\System\KKiidYM.exeC:\Windows\System\KKiidYM.exe1⤵
- Executes dropped EXE
PID:2040
-
C:\Windows\System\cLTxivg.exeC:\Windows\System\cLTxivg.exe1⤵
- Executes dropped EXE
PID:2888
-
C:\Windows\System\jsYjToZ.exeC:\Windows\System\jsYjToZ.exe1⤵
- Executes dropped EXE
PID:5056
-
C:\Windows\System\HmPSnvk.exeC:\Windows\System\HmPSnvk.exe1⤵
- Executes dropped EXE
PID:4780
-
C:\Windows\System\HWCZnyf.exeC:\Windows\System\HWCZnyf.exe1⤵
- Executes dropped EXE
PID:2580
-
C:\Windows\System\NwZarxD.exeC:\Windows\System\NwZarxD.exe1⤵
- Executes dropped EXE
PID:5116
-
C:\Windows\System\fFmGvRs.exeC:\Windows\System\fFmGvRs.exe1⤵
- Executes dropped EXE
PID:4276
-
C:\Windows\System\TgIRJYs.exeC:\Windows\System\TgIRJYs.exe1⤵
- Executes dropped EXE
PID:1648
-
C:\Windows\System\DzwhdbV.exeC:\Windows\System\DzwhdbV.exe1⤵
- Executes dropped EXE
PID:3936
-
C:\Windows\System\HVdpYHF.exeC:\Windows\System\HVdpYHF.exe1⤵
- Executes dropped EXE
PID:3056
-
C:\Windows\System\VUxdGvE.exeC:\Windows\System\VUxdGvE.exe1⤵
- Executes dropped EXE
PID:2388
-
C:\Windows\System\OOoJCBO.exeC:\Windows\System\OOoJCBO.exe1⤵
- Executes dropped EXE
PID:4964
-
C:\Windows\System\FvQRosz.exeC:\Windows\System\FvQRosz.exe1⤵
- Executes dropped EXE
PID:3428
-
C:\Windows\System\PVImEGS.exeC:\Windows\System\PVImEGS.exe1⤵
- Executes dropped EXE
PID:3200
-
C:\Windows\System\pmWuzqG.exeC:\Windows\System\pmWuzqG.exe1⤵
- Executes dropped EXE
PID:4472
-
C:\Windows\System\Chysstw.exeC:\Windows\System\Chysstw.exe1⤵
- Executes dropped EXE
PID:3176
-
C:\Users\Admin\AppData\Local\Temp\2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-08_6eb8256a80606d7baaad352f11b6b667_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.8MB
MD5c074e8340d5b9e17ddc02169c5b4661e
SHA155ca66120c91a09e6b345030b00475ab5edfec6f
SHA256a088a10148e4bc35ef62919eb366d1c0ecbfa1bfcc5c400f69217d6d53630c7f
SHA512500613710f26eb7e4cb8a17d36faec64b3b0144b574550ba2210d7425ef9344f80e058c818952d73ed31ad4ddcbf20ba1095d904f8c287c552710ef30dd5a715
-
Filesize
3.6MB
MD5ce5097fb2f3b586c3ea08e1c571fedce
SHA1ddeaae0dc17356fdad65c4ad6b13cf50f2c35ef1
SHA256fccd11bf65a78fb3ef0ae972014ca29ece30f2f5e24193147b2dcb89b06d8121
SHA5129433ec83d1a700da48e0adf796807e815235daad59899cd16bc5d45d4f1834fcfb98d709443f9827b8f0173fcf6912dfc3b2acbeac2b0b9a2489a840e1895c59
-
Filesize
3.4MB
MD51c87b9a71ced9d27470709308e26ed5d
SHA1a9251ad50b393692c932c5f89a984bf724d9a1cd
SHA25696c450813a50bfaaa118109077b3408374981a18126a269784bd1633280ce402
SHA512e27dd48f332adbb32cf18e37d7d01fa6e98607ce424512492d6c9bbb4343d294719b4da4a7d6a1fb3eabd3cee6fe07e15a0bc0ac6ad7a27cdd7634f9e63d6123
-
Filesize
4.1MB
MD5518cbf579e8f67c8dabff23ba34c52f8
SHA1edf4c0a0e9adad31640eda9233acd5b63b70db95
SHA2560e8ac9b3ab5b7ed9a331fb33209df325f0645d7d40bd4f5663ea06fea5ca179a
SHA5125ee9af93f02491272136bb92807c08034a6901d898eb1df1686456187e37b26273bc100fddf436aaf597cf8b5d5d4394a085d9a6158222f7518183378c8d8ed9
-
Filesize
2.2MB
MD5b4aa95aa07d0476c8e1e42ea0c1ae073
SHA149b2178e23a7926203db1b86f3494cbcacb1700e
SHA25623c064907e87b735197f482cfeeba0fbd43d6f4a85d9074f4768c09bc74657eb
SHA51297cb8ca5c7a83c24ad58f19a0abc8d67d95b700e1796624b0843c35c588781ecbe4b74fbfc148bf991f7bad3316df30aa3a0540ca9d6beba33eaa7f26866c0d5
-
Filesize
3.3MB
MD51b8ae3bf37a812fe38c701513fe051f8
SHA1f609678d3a1f5e66a284db0b5a02d6fb3abfd52e
SHA256a0e719454e53c820552a7f987d8c488d90c41b83e9aa4e449147d253dbc410d3
SHA5129fd35da73b8867e4b9460cf3b79ebdbe23097bb9218d0bc36cc9c5d563c91acc60c4ebad53d6c5f808557815c8391a9966f421be098046d7bb115ae682528c14