cobaltstrike | b9422d53d99a46c7c62ca0c620a989fad8b5459b7828f6cb6f2f5476a8652051

Analysis

max time kernel
148s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21-02-2024 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-21_ccc76ba43bddb09074eacf2a02637523_cobalt-strike_cobaltstrike.exe
Size

6.0MB
MD5

ccc76ba43bddb09074eacf2a02637523
SHA1

c3c54e72795b43105ff739967c41fa7218446f2c
SHA256

b9422d53d99a46c7c62ca0c620a989fad8b5459b7828f6cb6f2f5476a8652051
SHA512

6adb099ca1cb2c6bf8396dfca1d5a1297dbaf7c466b8cc08f909c6b6268214a78c4a8ce643de9ab9f87d9cfc44d42c019a1bc2365a4f7726697e16e8e4995772
SSDEEP

98304:EniLf9FdfE0pZB156utgpPFotBER/mQ32lUN:eOl56utgpPF8u/7N

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 10 IoCs

Detects the reflective loader used by Cobalt Strike.

Processes:

resource	yara_rule
\Windows\system\HLyDzVT.exe	cobalt_reflective_dll
C:\Windows\system\HLyDzVT.exe	cobalt_reflective_dll
\Windows\system\URErsJz.exe	cobalt_reflective_dll
C:\Windows\system\URErsJz.exe	cobalt_reflective_dll
\Windows\system\WDwIfip.exe	cobalt_reflective_dll
C:\Windows\system\WDwIfip.exe	cobalt_reflective_dll
C:\Windows\system\WDwIfip.exe	cobalt_reflective_dll
C:\Windows\system\DYcQzcU.exe	cobalt_reflective_dll
\Windows\system\JwAdKhv.exe	cobalt_reflective_dll
C:\Windows\system\dJhkOsb.exe	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 10 IoCs

Processes:

resource	yara_rule
\Windows\system\HLyDzVT.exe	INDICATOR_SUSPICIOUS_ReflectiveLoader
C:\Windows\system\HLyDzVT.exe	INDICATOR_SUSPICIOUS_ReflectiveLoader
\Windows\system\URErsJz.exe	INDICATOR_SUSPICIOUS_ReflectiveLoader
C:\Windows\system\URErsJz.exe	INDICATOR_SUSPICIOUS_ReflectiveLoader
\Windows\system\WDwIfip.exe	INDICATOR_SUSPICIOUS_ReflectiveLoader
C:\Windows\system\WDwIfip.exe	INDICATOR_SUSPICIOUS_ReflectiveLoader
C:\Windows\system\WDwIfip.exe	INDICATOR_SUSPICIOUS_ReflectiveLoader
C:\Windows\system\DYcQzcU.exe	INDICATOR_SUSPICIOUS_ReflectiveLoader
\Windows\system\JwAdKhv.exe	INDICATOR_SUSPICIOUS_ReflectiveLoader
C:\Windows\system\dJhkOsb.exe	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 23 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2332-0-0x000000013F5A0000-0x000000013F8F4000-memory.dmp	UPX
\Windows\system\HLyDzVT.exe	UPX
C:\Windows\system\HLyDzVT.exe	UPX
\Windows\system\URErsJz.exe	UPX
C:\Windows\system\URErsJz.exe	UPX
\Windows\system\WDwIfip.exe	UPX
C:\Windows\system\WDwIfip.exe	UPX
behavioral1/memory/2052-19-0x000000013FFA0000-0x00000001402F4000-memory.dmp	UPX
behavioral1/memory/2692-20-0x000000013F940000-0x000000013FC94000-memory.dmp	UPX
behavioral1/memory/2796-22-0x000000013F190000-0x000000013F4E4000-memory.dmp	UPX
C:\Windows\system\WDwIfip.exe	UPX
C:\Windows\system\DYcQzcU.exe	UPX
\Windows\system\JwAdKhv.exe	UPX
C:\Windows\system\dJhkOsb.exe	UPX
behavioral1/memory/2832-205-0x000000013FA10000-0x000000013FD64000-memory.dmp	UPX
behavioral1/memory/2636-403-0x000000013FAA0000-0x000000013FDF4000-memory.dmp	UPX
behavioral1/memory/1964-457-0x000000013F260000-0x000000013F5B4000-memory.dmp	UPX
behavioral1/memory/2540-559-0x000000013F540000-0x000000013F894000-memory.dmp	UPX
behavioral1/memory/2868-3527-0x000000013F0B0000-0x000000013F404000-memory.dmp	UPX
behavioral1/memory/348-3537-0x000000013F7C0000-0x000000013FB14000-memory.dmp	UPX
behavioral1/memory/3312-3541-0x000000013F4E0000-0x000000013F834000-memory.dmp	UPX
behavioral1/memory/2328-3558-0x000000013F520000-0x000000013F874000-memory.dmp	UPX
behavioral1/memory/2284-3605-0x000000013FF70000-0x00000001402C4000-memory.dmp	UPX

XMRig Miner payload 25 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2332-0-0x000000013F5A0000-0x000000013F8F4000-memory.dmp	xmrig
\Windows\system\HLyDzVT.exe	xmrig
C:\Windows\system\HLyDzVT.exe	xmrig
\Windows\system\URErsJz.exe	xmrig
C:\Windows\system\URErsJz.exe	xmrig
\Windows\system\WDwIfip.exe	xmrig
C:\Windows\system\WDwIfip.exe	xmrig
behavioral1/memory/2052-19-0x000000013FFA0000-0x00000001402F4000-memory.dmp	xmrig
behavioral1/memory/2692-20-0x000000013F940000-0x000000013FC94000-memory.dmp	xmrig
behavioral1/memory/2332-21-0x000000013F190000-0x000000013F4E4000-memory.dmp	xmrig
behavioral1/memory/2796-22-0x000000013F190000-0x000000013F4E4000-memory.dmp	xmrig
behavioral1/memory/2332-23-0x000000013F940000-0x000000013FC94000-memory.dmp	xmrig
C:\Windows\system\WDwIfip.exe	xmrig
C:\Windows\system\DYcQzcU.exe	xmrig
\Windows\system\JwAdKhv.exe	xmrig
C:\Windows\system\dJhkOsb.exe	xmrig
behavioral1/memory/2832-205-0x000000013FA10000-0x000000013FD64000-memory.dmp	xmrig
behavioral1/memory/2636-403-0x000000013FAA0000-0x000000013FDF4000-memory.dmp	xmrig
behavioral1/memory/1964-457-0x000000013F260000-0x000000013F5B4000-memory.dmp	xmrig
behavioral1/memory/2540-559-0x000000013F540000-0x000000013F894000-memory.dmp	xmrig
behavioral1/memory/2868-3527-0x000000013F0B0000-0x000000013F404000-memory.dmp	xmrig
behavioral1/memory/348-3537-0x000000013F7C0000-0x000000013FB14000-memory.dmp	xmrig
behavioral1/memory/3312-3541-0x000000013F4E0000-0x000000013F834000-memory.dmp	xmrig
behavioral1/memory/2328-3558-0x000000013F520000-0x000000013F874000-memory.dmp	xmrig
behavioral1/memory/2284-3605-0x000000013FF70000-0x00000001402C4000-memory.dmp	xmrig

Loads dropped DLL 1 IoCs

Processes:

2024-02-21_ccc76ba43bddb09074eacf2a02637523_cobalt-strike_cobaltstrike.exe

pid process

2332 2024-02-21_ccc76ba43bddb09074eacf2a02637523_cobalt-strike_cobaltstrike.exe

pid	process
2332	2024-02-21_ccc76ba43bddb09074eacf2a02637523_cobalt-strike_cobaltstrike.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2332-0-0x000000013F5A0000-0x000000013F8F4000-memory.dmp	upx
\Windows\system\HLyDzVT.exe	upx
C:\Windows\system\HLyDzVT.exe	upx
\Windows\system\URErsJz.exe	upx
C:\Windows\system\URErsJz.exe	upx
\Windows\system\WDwIfip.exe	upx
C:\Windows\system\WDwIfip.exe	upx
behavioral1/memory/2052-19-0x000000013FFA0000-0x00000001402F4000-memory.dmp	upx
behavioral1/memory/2692-20-0x000000013F940000-0x000000013FC94000-memory.dmp	upx
behavioral1/memory/2796-22-0x000000013F190000-0x000000013F4E4000-memory.dmp	upx
C:\Windows\system\WDwIfip.exe	upx
C:\Windows\system\DYcQzcU.exe	upx
\Windows\system\JwAdKhv.exe	upx
C:\Windows\system\dJhkOsb.exe	upx
behavioral1/memory/2832-205-0x000000013FA10000-0x000000013FD64000-memory.dmp	upx
behavioral1/memory/2636-403-0x000000013FAA0000-0x000000013FDF4000-memory.dmp	upx
behavioral1/memory/1964-457-0x000000013F260000-0x000000013F5B4000-memory.dmp	upx
behavioral1/memory/2540-559-0x000000013F540000-0x000000013F894000-memory.dmp	upx
behavioral1/memory/2868-3527-0x000000013F0B0000-0x000000013F404000-memory.dmp	upx
behavioral1/memory/348-3537-0x000000013F7C0000-0x000000013FB14000-memory.dmp	upx
behavioral1/memory/3312-3541-0x000000013F4E0000-0x000000013F834000-memory.dmp	upx
behavioral1/memory/2328-3558-0x000000013F520000-0x000000013F874000-memory.dmp	upx
behavioral1/memory/2284-3605-0x000000013FF70000-0x00000001402C4000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

Processes:

2024-02-21_ccc76ba43bddb09074eacf2a02637523_cobalt-strike_cobaltstrike.exe

description ioc process

File created C:\Windows\System\HLyDzVT.exe 2024-02-21_ccc76ba43bddb09074eacf2a02637523_cobalt-strike_cobaltstrike.exe

description	ioc	process
File created	C:\Windows\System\HLyDzVT.exe	2024-02-21_ccc76ba43bddb09074eacf2a02637523_cobalt-strike_cobaltstrike.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-21_ccc76ba43bddb09074eacf2a02637523_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-21_ccc76ba43bddb09074eacf2a02637523_cobalt-strike_cobaltstrike.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2332

C:\Windows\System\HLyDzVT.exe
C:\Windows\System\HLyDzVT.exe
2⤵
PID:2052

C:\Windows\System\URErsJz.exe
C:\Windows\System\URErsJz.exe
2⤵
PID:2692

C:\Windows\System\WDwIfip.exe
C:\Windows\System\WDwIfip.exe
2⤵
PID:2796

C:\Windows\System\WoKyWEO.exe
C:\Windows\System\WoKyWEO.exe
2⤵
PID:2576

C:\Windows\System\xSHKvdn.exe
C:\Windows\System\xSHKvdn.exe
2⤵
PID:2460

C:\Windows\System\uTSzdpL.exe
C:\Windows\System\uTSzdpL.exe
2⤵
PID:1256

C:\Windows\System\CrUycaS.exe
C:\Windows\System\CrUycaS.exe
2⤵
PID:792

C:\Windows\System\oGoCwnG.exe
C:\Windows\System\oGoCwnG.exe
2⤵
PID:2336

C:\Windows\System\ZqOocva.exe
C:\Windows\System\ZqOocva.exe
2⤵
PID:2804

C:\Windows\System\EkxIgOO.exe
C:\Windows\System\EkxIgOO.exe
2⤵
PID:1852

C:\Windows\System\UWoYvJH.exe
C:\Windows\System\UWoYvJH.exe
2⤵
PID:3128

C:\Windows\System\BhjVEEb.exe
C:\Windows\System\BhjVEEb.exe
2⤵
PID:3924

C:\Windows\System\PidmCoH.exe
C:\Windows\System\PidmCoH.exe
2⤵
PID:1724

C:\Windows\System\uECbtIU.exe
C:\Windows\System\uECbtIU.exe
2⤵
PID:3832

C:\Windows\System\VhtHnEM.exe
C:\Windows\System\VhtHnEM.exe
2⤵
PID:5452

C:\Windows\System\owldOAF.exe
C:\Windows\System\owldOAF.exe
2⤵
PID:5416

C:\Windows\System\cuOlKAE.exe
C:\Windows\System\cuOlKAE.exe
2⤵
PID:6428

C:\Windows\System\FaooyyK.exe
C:\Windows\System\FaooyyK.exe
2⤵
PID:5200

C:\Windows\System\QKRbXHZ.exe
C:\Windows\System\QKRbXHZ.exe
2⤵
PID:7436

C:\Windows\System\YHqGJWv.exe
C:\Windows\System\YHqGJWv.exe
2⤵
PID:6288

C:\Windows\System\RGdkiGG.exe
C:\Windows\System\RGdkiGG.exe
2⤵
PID:8204

C:\Windows\System\xRlIwVz.exe
C:\Windows\System\xRlIwVz.exe
2⤵
PID:7096

C:\Windows\System\zKGeWMP.exe
C:\Windows\System\zKGeWMP.exe
2⤵
PID:7332

C:\Windows\System\ldmDJvm.exe
C:\Windows\System\ldmDJvm.exe
2⤵
PID:9648

C:\Windows\System\ZkmFVUH.exe
C:\Windows\System\ZkmFVUH.exe
2⤵
PID:9064

C:\Windows\System\nFzVtIk.exe
C:\Windows\System\nFzVtIk.exe
2⤵
PID:11096

C:\Windows\System\pcfYXDi.exe
C:\Windows\System\pcfYXDi.exe
2⤵
PID:11168

C:\Windows\System\quHYhRE.exe
C:\Windows\System\quHYhRE.exe
2⤵
PID:9464

C:\Windows\System\llpksNK.exe
C:\Windows\System\llpksNK.exe
2⤵
PID:9628

C:\Windows\System\LmLABqD.exe
C:\Windows\System\LmLABqD.exe
2⤵
PID:10072

C:\Windows\System\JqDKrae.exe
C:\Windows\System\JqDKrae.exe
2⤵
PID:11712

C:\Windows\System\msKGbXD.exe
C:\Windows\System\msKGbXD.exe
2⤵
PID:13208

C:\Windows\System\czpFZde.exe
C:\Windows\System\czpFZde.exe
2⤵
PID:13620

C:\Windows\System\DebqDWx.exe
C:\Windows\System\DebqDWx.exe
2⤵
PID:14212

C:\Windows\System\YhRnhJQ.exe
C:\Windows\System\YhRnhJQ.exe
2⤵
PID:11920

C:\Windows\System\QWwtJpg.exe
C:\Windows\System\QWwtJpg.exe
2⤵
PID:13376

C:\Windows\System\jmJJUjS.exe
C:\Windows\System\jmJJUjS.exe
2⤵
PID:14656

C:\Windows\System\kOlEjRE.exe
C:\Windows\System\kOlEjRE.exe
2⤵
PID:14016

C:\Windows\System\hfWDeWb.exe
C:\Windows\System\hfWDeWb.exe
2⤵
PID:15372

C:\Windows\System\riVJqoL.exe
C:\Windows\System\riVJqoL.exe
2⤵
PID:15548

C:\Windows\System\BJqzbbP.exe
C:\Windows\System\BJqzbbP.exe
2⤵
PID:15532

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DYcQzcU.exe
Filesize
448KB

MD5
5c2a382865e19c1521bff5d023c62539

SHA1
5c99f0fdc7119a4ee326b86881f994c2e7c570db

SHA256
acfee9515da61e21c9462f002bbd1ab3d22fd7a9703efa9a068ed848fccb44e6

SHA512
8a09f23e33cf31299e48087eb91e6201411c5b7dec8b3d5afd74509250b6ff0272513b0236c2c46773061300a7bfe7107aa34c8cf6276717a67a3bc2912453b6

Download Submit
C:\Windows\system\HLyDzVT.exe
Filesize
3.4MB

MD5
329e0a148550eeaed887f81acc27860e

SHA1
79b4e09b9c579b7a768691bff6a69269e0075956

SHA256
8b1db2fe1a680abd14c70209a793214f5922731229225ba8b307aaea64af792a

SHA512
db6636edcd0cbc95801e280fec990e50d760c640b6688da30542f79837a9ffe2557a6564b3a051214c3a93efc9e4c06fd0832f622f28d9c8636a7b6b11c321ed

Download Submit
C:\Windows\system\URErsJz.exe
Filesize
1.8MB

MD5
7b63b1b0ed6e5b9481f93293a7925339

SHA1
db0cd74a118a6738a9cd95bb0ddf53e05abaf68d

SHA256
31354c831a977d4ae3dd0235ebb4c973189910e6cbc276ef7e6af8f4f9bc7527

SHA512
1817f64636a02cc915ba43a78d0fc6e48b984d5ef7b0b29a5556c72b5d402f455fbfcd5afe2745ebbc8568e7f136c9e85fc9c5c5f87fa0874318812a47836b96

Download Submit
C:\Windows\system\WDwIfip.exe
Filesize
1.5MB

MD5
586d214580d30367e05913f7e0e3c52b

SHA1
0d98b00dc8e43a3da81b3cf9815080b91904b2e2

SHA256
a1bafdf4145d3e5c55148d0adec80459caa5723057afa20825d42e788c8d032f

SHA512
d5a82919a8b838018614ae41b17a0a2a880f11665dd524a3a3da7f2e57ac4eaad7a752ed1beb215d8edfce8519a38c043c54b496c7f95b1633b948c5f7eaaea2

Download Submit
C:\Windows\system\WDwIfip.exe
Filesize
1.1MB

MD5
a00302c49598c75d656b3dce7d69263c

SHA1
909ac3b0d7472551aa6d350d8125b90f6382c435

SHA256
a8936f3358c0a82517d85b5e1c113c5b9f66dcf10eacf4801c5b2c3a3c2296cf

SHA512
ab820beb4a11ebb957e0ce6a3879920041f8b95d5bfb967b616926f4303e0b6350611fa44113252c41560818bca5d4de9716ade82129eca7c048bb138e680771

Download Submit
C:\Windows\system\dJhkOsb.exe
Filesize
1024KB

MD5
e18887b6629234c4fbd5c11d5797bb20

SHA1
1424366313fe6bc49368a49baa57414b24a7f1ad

SHA256
664d68b3dfede3398bcd13b3ed07e387f1c13a52d4f71f5eff507089df47bb28

SHA512
f98aa3c91d60d735cfc375c953892d175c5e423595b1fa20759edb8d243a5800b7398fa93cc077256910815d31c2d16e52a1222570991d8e84c220c41304dc7a

Download Submit
\Windows\system\HLyDzVT.exe
Filesize
2.6MB

MD5
35396f63faa0c22d6233270cd3b57b99

SHA1
9d7bd2e208f2d1e43699d2aabe6fa0c9ebb268be

SHA256
8d23917f6eda868bb8aa11169c25cfe348947b1a3324f64d2b1990633553d922

SHA512
71ce0c02b5586803881122cb8434b6055877583c4b8490ea249405583bd0a383557d3061398a52e9808da31469b42cf412eee5bcaaefe04d9e7252ddfd06b6ec

Download Submit
\Windows\system\JwAdKhv.exe
Filesize
704KB

MD5
a0c50bda38724e5025560ed7d96dcb0c

SHA1
4c8c9797829b74299e87cfaca4edc676cfdcaf67

SHA256
dffcecb0264764715bb8aa6083c877dd92ddf4efed97e83a8119fc6193eafa42

SHA512
2b0be094d6957fdb8c50f8ab1086257589ecead78682b341a22635fb582af1ecbb61b5e39918b0a3f9541a521155ffe7f9e3133b1d61b589cab4b66078a758df

Download Submit
\Windows\system\URErsJz.exe
Filesize
1.6MB

MD5
23f7ea5b42b776eb5f9c585a277f3567

SHA1
614cb89431812f6f7668a1a409243d2fddc32a74

SHA256
7e7aed8d870b1aef96f791603d27f253f9ed7c3d627324f488fbe5c709a06763

SHA512
6abae928e6461182bdc66dc2d0e08c2d7f10e37b05717871b94962f159af88c0f7185b2cb19d6a988de1cbb7c8057fbfaa0e474db3b1c97fff74c71d139894e1

Download Submit
\Windows\system\WDwIfip.exe
Filesize
2.1MB

MD5
6928a9d017ec2068384f01084cf4a14f

SHA1
7a4f7ad81790e1e39f97e5df690c624095c1a535

SHA256
d8dcf9059e10ee71dbe2414632afaa32379c617c04c3669d098c4043a6a64656

SHA512
b37c935b320dcf6b0f6c117394796be47c0788738b7544fbc2680dd9bbbf268bbc88bff8f8762f624a8b077192abc4f5719f1f985d64ed1d2b448f38204465d7

Download Submit
memory/348-3537-0x000000013F7C0000-0x000000013FB14000-memory.dmp

Filesize
3.3MB

Download
memory/1964-457-0x000000013F260000-0x000000013F5B4000-memory.dmp

Filesize
3.3MB

Download
memory/2052-19-0x000000013FFA0000-0x00000001402F4000-memory.dmp

Filesize
3.3MB

Download
memory/2284-3605-0x000000013FF70000-0x00000001402C4000-memory.dmp

Filesize
3.3MB

Download
memory/2328-3558-0x000000013F520000-0x000000013F874000-memory.dmp

Filesize
3.3MB

Download
memory/2332-325-0x0000000002450000-0x00000000027A4000-memory.dmp

Filesize
3.3MB

Download
memory/2332-300-0x000000013FFD0000-0x0000000140324000-memory.dmp

Filesize
3.3MB

Download
memory/2332-326-0x000000013F020000-0x000000013F374000-memory.dmp

Filesize
3.3MB

Download
memory/2332-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2332-197-0x0000000002450000-0x00000000027A4000-memory.dmp

Filesize
3.3MB

Download
memory/2332-23-0x000000013F940000-0x000000013FC94000-memory.dmp

Filesize
3.3MB

Download
memory/2332-242-0x0000000002450000-0x00000000027A4000-memory.dmp

Filesize
3.3MB

Download
memory/2332-11-0x000000013FFA0000-0x00000001402F4000-memory.dmp

Filesize
3.3MB

Download
memory/2332-341-0x000000013FEB0000-0x0000000140204000-memory.dmp

Filesize
3.3MB

Download
memory/2332-323-0x0000000002450000-0x00000000027A4000-memory.dmp

Filesize
3.3MB

Download
memory/2332-21-0x000000013F190000-0x000000013F4E4000-memory.dmp

Filesize
3.3MB

Download
memory/2332-0-0x000000013F5A0000-0x000000013F8F4000-memory.dmp

Filesize
3.3MB

Download
memory/2332-318-0x0000000002450000-0x00000000027A4000-memory.dmp

Filesize
3.3MB

Download
memory/2332-392-0x000000013FF60000-0x00000001402B4000-memory.dmp

Filesize
3.3MB

Download
memory/2332-29-0x000000013FBE0000-0x000000013FF34000-memory.dmp

Filesize
3.3MB

Download
memory/2540-559-0x000000013F540000-0x000000013F894000-memory.dmp

Filesize
3.3MB

Download
memory/2636-403-0x000000013FAA0000-0x000000013FDF4000-memory.dmp

Filesize
3.3MB

Download
memory/2692-20-0x000000013F940000-0x000000013FC94000-memory.dmp

Filesize
3.3MB

Download
memory/2796-22-0x000000013F190000-0x000000013F4E4000-memory.dmp

Filesize
3.3MB

Download
memory/2832-205-0x000000013FA10000-0x000000013FD64000-memory.dmp

Filesize
3.3MB

Download
memory/2868-3527-0x000000013F0B0000-0x000000013F404000-memory.dmp

Filesize
3.3MB

Download
memory/3312-3541-0x000000013F4E0000-0x000000013F834000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads