cobaltstrike | 35a6f937c8a4e0ac1c8df8adbd2bfec235c3593de9828f32c1778e872f5ccc10

Analysis

max time kernel
136s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/03/2024, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240325-cftbfsfh7w
SHA256 35a6f937c8a4e0ac1c8df8adbd2bfec235c3593de9828f32c1778e872f5ccc10
MD5 ddd3bbe9fbcb3cb57245c22b1d4f87a0
SHA1 bcd083c4f308c29acef5e1a4b53d879b011ee0c8
SHA512 e9cecf28c84494bdf6e8af6527788973431936725301e5f65515d07aafd60c8a088cc88b886d73b93a873206922283fce01fa50fb32c81884407e6b46091ea1e
SSDEEP 98304:demTLkNdfE0pZ3656utgpPFotBER/mQ32lUq:E+v56utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 43 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x000f000000012248-3.dat	cobalt_reflective_dll
behavioral1/files/0x000f000000012248-5.dat	cobalt_reflective_dll
behavioral1/files/0x0036000000014817-12.dat	cobalt_reflective_dll
behavioral1/files/0x000d0000000144e9-19.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000015136-32.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000015362-34.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000015362-28.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000015023-20.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000015136-25.dat	cobalt_reflective_dll
behavioral1/files/0x0036000000014817-18.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000015023-15.dat	cobalt_reflective_dll
behavioral1/files/0x000a0000000153cf-38.dat	cobalt_reflective_dll
behavioral1/files/0x000a0000000153cf-42.dat	cobalt_reflective_dll
behavioral1/files/0x00090000000155e3-53.dat	cobalt_reflective_dll
behavioral1/files/0x00090000000155e3-49.dat	cobalt_reflective_dll
behavioral1/files/0x0036000000014817-10.dat	cobalt_reflective_dll
behavioral1/files/0x000d0000000144e9-8.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000015cc1-59.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015d06-79.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015cec-78.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015cf7-84.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015cdb-81.dat	cobalt_reflective_dll
behavioral1/files/0x0036000000014983-77.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015d06-74.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015d5d-89.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015d6e-96.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015f1b-105.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015d5d-95.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015d6e-92.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015cec-67.dat	cobalt_reflective_dll
behavioral1/files/0x0036000000014983-61.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015f1b-109.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000160f8-120.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000160f8-125.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016277-129.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016056-127.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016277-123.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015f9e-116.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016056-115.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015f9e-112.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015cf7-71.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015cdb-64.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000015cc1-56.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 43 IoCs

resource	yara_rule
behavioral1/files/0x000f000000012248-3.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000f000000012248-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0036000000014817-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000d0000000144e9-19.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000015136-32.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000015362-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000015362-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000015023-20.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000015136-25.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0036000000014817-18.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000015023-15.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000a0000000153cf-38.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000a0000000153cf-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00090000000155e3-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00090000000155e3-49.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0036000000014817-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000d0000000144e9-8.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0008000000015cc1-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015d06-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015cec-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015cf7-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015cdb-81.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0036000000014983-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015d06-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015d5d-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015d6e-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015f1b-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015d5d-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015d6e-92.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015cec-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0036000000014983-61.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015f1b-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00060000000160f8-120.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00060000000160f8-125.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000016277-129.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000016056-127.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000016277-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015f9e-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000016056-115.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015f9e-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015cf7-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015cdb-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0008000000015cc1-56.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral1/memory/2164-0-0x000000013FB10000-0x000000013FE64000-memory.dmp	UPX
behavioral1/files/0x000f000000012248-3.dat	UPX
behavioral1/files/0x000f000000012248-5.dat	UPX
behavioral1/files/0x0036000000014817-12.dat	UPX
behavioral1/files/0x000d0000000144e9-19.dat	UPX
behavioral1/memory/2896-24-0x000000013F050000-0x000000013F3A4000-memory.dmp	UPX
behavioral1/files/0x0007000000015136-32.dat	UPX
behavioral1/files/0x0007000000015362-34.dat	UPX
behavioral1/files/0x0007000000015362-28.dat	UPX
behavioral1/files/0x0007000000015023-20.dat	UPX
behavioral1/files/0x0007000000015136-25.dat	UPX
behavioral1/memory/2620-36-0x000000013FDF0000-0x0000000140144000-memory.dmp	UPX
behavioral1/memory/2956-37-0x000000013FD70000-0x00000001400C4000-memory.dmp	UPX
behavioral1/files/0x0036000000014817-18.dat	UPX
behavioral1/files/0x0007000000015023-15.dat	UPX
behavioral1/files/0x000a0000000153cf-38.dat	UPX
behavioral1/files/0x000a0000000153cf-42.dat	UPX
behavioral1/memory/2644-40-0x000000013FE40000-0x0000000140194000-memory.dmp	UPX
behavioral1/memory/2740-44-0x000000013FE60000-0x00000001401B4000-memory.dmp	UPX
behavioral1/memory/2456-46-0x000000013F750000-0x000000013FAA4000-memory.dmp	UPX
behavioral1/memory/2500-45-0x000000013F860000-0x000000013FBB4000-memory.dmp	UPX
behavioral1/files/0x00090000000155e3-53.dat	UPX
behavioral1/memory/2296-55-0x000000013FEB0000-0x0000000140204000-memory.dmp	UPX
behavioral1/files/0x00090000000155e3-49.dat	UPX
behavioral1/files/0x0036000000014817-10.dat	UPX
behavioral1/files/0x000d0000000144e9-8.dat	UPX
behavioral1/files/0x0008000000015cc1-59.dat	UPX
behavioral1/files/0x0006000000015d06-79.dat	UPX
behavioral1/files/0x0006000000015cec-78.dat	UPX
behavioral1/files/0x0006000000015cf7-84.dat	UPX
behavioral1/files/0x0006000000015cdb-81.dat	UPX
behavioral1/files/0x0036000000014983-77.dat	UPX
behavioral1/files/0x0006000000015d06-74.dat	UPX
behavioral1/memory/2384-70-0x000000013F2E0000-0x000000013F634000-memory.dmp	UPX
behavioral1/files/0x0006000000015d5d-89.dat	UPX
behavioral1/files/0x0006000000015d6e-96.dat	UPX
behavioral1/memory/2444-100-0x000000013FAF0000-0x000000013FE44000-memory.dmp	UPX
behavioral1/memory/2308-101-0x000000013F550000-0x000000013F8A4000-memory.dmp	UPX
behavioral1/memory/2252-102-0x000000013F8F0000-0x000000013FC44000-memory.dmp	UPX
behavioral1/files/0x0006000000015f1b-105.dat	UPX
behavioral1/memory/2124-104-0x000000013FFB0000-0x0000000140304000-memory.dmp	UPX
behavioral1/memory/2824-103-0x000000013F7F0000-0x000000013FB44000-memory.dmp	UPX
behavioral1/files/0x0006000000015d5d-95.dat	UPX
behavioral1/files/0x0006000000015d6e-92.dat	UPX
behavioral1/files/0x0006000000015cec-67.dat	UPX
behavioral1/files/0x0036000000014983-61.dat	UPX
behavioral1/files/0x0006000000015f1b-109.dat	UPX
behavioral1/memory/772-108-0x000000013FE90000-0x00000001401E4000-memory.dmp	UPX
behavioral1/memory/2128-111-0x000000013F3D0000-0x000000013F724000-memory.dmp	UPX
behavioral1/files/0x00060000000160f8-120.dat	UPX
behavioral1/files/0x00060000000160f8-125.dat	UPX
behavioral1/memory/2680-132-0x000000013FCE0000-0x0000000140034000-memory.dmp	UPX
behavioral1/memory/2080-135-0x000000013FD30000-0x0000000140084000-memory.dmp	UPX
behavioral1/memory/820-140-0x000000013F630000-0x000000013F984000-memory.dmp	UPX
behavioral1/memory/1584-139-0x000000013F390000-0x000000013F6E4000-memory.dmp	UPX
behavioral1/memory/2044-134-0x000000013F8F0000-0x000000013FC44000-memory.dmp	UPX
behavioral1/files/0x0006000000016277-129.dat	UPX
behavioral1/files/0x0006000000016056-127.dat	UPX
behavioral1/files/0x0006000000016277-123.dat	UPX
behavioral1/files/0x0006000000015f9e-116.dat	UPX
behavioral1/files/0x0006000000016056-115.dat	UPX
behavioral1/files/0x0006000000015f9e-112.dat	UPX
behavioral1/files/0x0006000000015cf7-71.dat	UPX
behavioral1/files/0x0006000000015cdb-64.dat	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2164-0-0x000000013FB10000-0x000000013FE64000-memory.dmp	xmrig
behavioral1/files/0x000f000000012248-3.dat	xmrig
behavioral1/files/0x000f000000012248-5.dat	xmrig
behavioral1/files/0x0036000000014817-12.dat	xmrig
behavioral1/files/0x000d0000000144e9-19.dat	xmrig
behavioral1/memory/2896-24-0x000000013F050000-0x000000013F3A4000-memory.dmp	xmrig
behavioral1/files/0x0007000000015136-32.dat	xmrig
behavioral1/files/0x0007000000015362-34.dat	xmrig
behavioral1/files/0x0007000000015362-28.dat	xmrig
behavioral1/files/0x0007000000015023-20.dat	xmrig
behavioral1/files/0x0007000000015136-25.dat	xmrig
behavioral1/memory/2620-36-0x000000013FDF0000-0x0000000140144000-memory.dmp	xmrig
behavioral1/memory/2956-37-0x000000013FD70000-0x00000001400C4000-memory.dmp	xmrig
behavioral1/files/0x0036000000014817-18.dat	xmrig
behavioral1/files/0x0007000000015023-15.dat	xmrig
behavioral1/files/0x000a0000000153cf-38.dat	xmrig
behavioral1/files/0x000a0000000153cf-42.dat	xmrig
behavioral1/memory/2644-40-0x000000013FE40000-0x0000000140194000-memory.dmp	xmrig
behavioral1/memory/2740-44-0x000000013FE60000-0x00000001401B4000-memory.dmp	xmrig
behavioral1/memory/2456-46-0x000000013F750000-0x000000013FAA4000-memory.dmp	xmrig
behavioral1/memory/2500-45-0x000000013F860000-0x000000013FBB4000-memory.dmp	xmrig
behavioral1/files/0x00090000000155e3-53.dat	xmrig
behavioral1/memory/2296-55-0x000000013FEB0000-0x0000000140204000-memory.dmp	xmrig
behavioral1/files/0x00090000000155e3-49.dat	xmrig
behavioral1/files/0x0036000000014817-10.dat	xmrig
behavioral1/files/0x000d0000000144e9-8.dat	xmrig
behavioral1/files/0x0008000000015cc1-59.dat	xmrig
behavioral1/files/0x0006000000015d06-79.dat	xmrig
behavioral1/files/0x0006000000015cec-78.dat	xmrig
behavioral1/files/0x0006000000015cf7-84.dat	xmrig
behavioral1/files/0x0006000000015cdb-81.dat	xmrig
behavioral1/files/0x0036000000014983-77.dat	xmrig
behavioral1/files/0x0006000000015d06-74.dat	xmrig
behavioral1/memory/2384-70-0x000000013F2E0000-0x000000013F634000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d5d-89.dat	xmrig
behavioral1/files/0x0006000000015d6e-96.dat	xmrig
behavioral1/memory/2444-100-0x000000013FAF0000-0x000000013FE44000-memory.dmp	xmrig
behavioral1/memory/2308-101-0x000000013F550000-0x000000013F8A4000-memory.dmp	xmrig
behavioral1/memory/2252-102-0x000000013F8F0000-0x000000013FC44000-memory.dmp	xmrig
behavioral1/files/0x0006000000015f1b-105.dat	xmrig
behavioral1/memory/2124-104-0x000000013FFB0000-0x0000000140304000-memory.dmp	xmrig
behavioral1/memory/2824-103-0x000000013F7F0000-0x000000013FB44000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d5d-95.dat	xmrig
behavioral1/files/0x0006000000015d6e-92.dat	xmrig
behavioral1/files/0x0006000000015cec-67.dat	xmrig
behavioral1/files/0x0036000000014983-61.dat	xmrig
behavioral1/files/0x0006000000015f1b-109.dat	xmrig
behavioral1/memory/772-108-0x000000013FE90000-0x00000001401E4000-memory.dmp	xmrig
behavioral1/memory/2128-111-0x000000013F3D0000-0x000000013F724000-memory.dmp	xmrig
behavioral1/files/0x00060000000160f8-120.dat	xmrig
behavioral1/files/0x00060000000160f8-125.dat	xmrig
behavioral1/memory/2680-132-0x000000013FCE0000-0x0000000140034000-memory.dmp	xmrig
behavioral1/memory/2080-135-0x000000013FD30000-0x0000000140084000-memory.dmp	xmrig
behavioral1/memory/2164-136-0x000000013FEB0000-0x0000000140204000-memory.dmp	xmrig
behavioral1/memory/820-140-0x000000013F630000-0x000000013F984000-memory.dmp	xmrig
behavioral1/memory/1584-139-0x000000013F390000-0x000000013F6E4000-memory.dmp	xmrig
behavioral1/memory/2044-134-0x000000013F8F0000-0x000000013FC44000-memory.dmp	xmrig
behavioral1/files/0x0006000000016277-129.dat	xmrig
behavioral1/files/0x0006000000016056-127.dat	xmrig
behavioral1/files/0x0006000000016277-123.dat	xmrig
behavioral1/files/0x0006000000015f9e-116.dat	xmrig
behavioral1/files/0x0006000000016056-115.dat	xmrig
behavioral1/files/0x0006000000015f9e-112.dat	xmrig
behavioral1/files/0x0006000000015cf7-71.dat	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2896	JVVrfBl.exe
2620	wOPbeLQ.exe
2956	JPLnmdf.exe
2644	MMCtkpd.exe
2740	wsxymPC.exe
2500	RUDBeUS.exe
2456	fsHYHsT.exe
2296	GfRoIXP.exe
2384	fppPePa.exe
2444	ERHyicC.exe
2308	PxiflyW.exe
2252	CySsUGG.exe
2824	HLgfxtH.exe
2124	XCZKhWf.exe
772	IOZmKiH.exe
2128	PmrAnEE.exe
1584	LyneglO.exe
2680	FSVjFyJ.exe
2044	ZaceWrV.exe
2080	HBikoSu.exe
820	bCQULIP.exe

Loads dropped DLL 21 IoCs

pid	Process
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2164-0-0x000000013FB10000-0x000000013FE64000-memory.dmp	upx
behavioral1/files/0x000f000000012248-3.dat	upx
behavioral1/files/0x000f000000012248-5.dat	upx
behavioral1/files/0x0036000000014817-12.dat	upx
behavioral1/files/0x000d0000000144e9-19.dat	upx
behavioral1/memory/2896-24-0x000000013F050000-0x000000013F3A4000-memory.dmp	upx
behavioral1/files/0x0007000000015136-32.dat	upx
behavioral1/files/0x0007000000015362-34.dat	upx
behavioral1/memory/2164-29-0x00000000023B0000-0x0000000002704000-memory.dmp	upx
behavioral1/files/0x0007000000015362-28.dat	upx
behavioral1/files/0x0007000000015023-20.dat	upx
behavioral1/files/0x0007000000015136-25.dat	upx
behavioral1/memory/2620-36-0x000000013FDF0000-0x0000000140144000-memory.dmp	upx
behavioral1/memory/2956-37-0x000000013FD70000-0x00000001400C4000-memory.dmp	upx
behavioral1/files/0x0036000000014817-18.dat	upx
behavioral1/files/0x0007000000015023-15.dat	upx
behavioral1/files/0x000a0000000153cf-38.dat	upx
behavioral1/files/0x000a0000000153cf-42.dat	upx
behavioral1/memory/2644-40-0x000000013FE40000-0x0000000140194000-memory.dmp	upx
behavioral1/memory/2740-44-0x000000013FE60000-0x00000001401B4000-memory.dmp	upx
behavioral1/memory/2456-46-0x000000013F750000-0x000000013FAA4000-memory.dmp	upx
behavioral1/memory/2500-45-0x000000013F860000-0x000000013FBB4000-memory.dmp	upx
behavioral1/files/0x00090000000155e3-53.dat	upx
behavioral1/memory/2296-55-0x000000013FEB0000-0x0000000140204000-memory.dmp	upx
behavioral1/files/0x00090000000155e3-49.dat	upx
behavioral1/files/0x0036000000014817-10.dat	upx
behavioral1/files/0x000d0000000144e9-8.dat	upx
behavioral1/files/0x0008000000015cc1-59.dat	upx
behavioral1/files/0x0006000000015d06-79.dat	upx
behavioral1/files/0x0006000000015cec-78.dat	upx
behavioral1/files/0x0006000000015cf7-84.dat	upx
behavioral1/files/0x0006000000015cdb-81.dat	upx
behavioral1/files/0x0036000000014983-77.dat	upx
behavioral1/files/0x0006000000015d06-74.dat	upx
behavioral1/memory/2384-70-0x000000013F2E0000-0x000000013F634000-memory.dmp	upx
behavioral1/files/0x0006000000015d5d-89.dat	upx
behavioral1/files/0x0006000000015d6e-96.dat	upx
behavioral1/memory/2444-100-0x000000013FAF0000-0x000000013FE44000-memory.dmp	upx
behavioral1/memory/2308-101-0x000000013F550000-0x000000013F8A4000-memory.dmp	upx
behavioral1/memory/2252-102-0x000000013F8F0000-0x000000013FC44000-memory.dmp	upx
behavioral1/files/0x0006000000015f1b-105.dat	upx
behavioral1/memory/2124-104-0x000000013FFB0000-0x0000000140304000-memory.dmp	upx
behavioral1/memory/2824-103-0x000000013F7F0000-0x000000013FB44000-memory.dmp	upx
behavioral1/files/0x0006000000015d5d-95.dat	upx
behavioral1/files/0x0006000000015d6e-92.dat	upx
behavioral1/files/0x0006000000015cec-67.dat	upx
behavioral1/files/0x0036000000014983-61.dat	upx
behavioral1/files/0x0006000000015f1b-109.dat	upx
behavioral1/memory/772-108-0x000000013FE90000-0x00000001401E4000-memory.dmp	upx
behavioral1/memory/2128-111-0x000000013F3D0000-0x000000013F724000-memory.dmp	upx
behavioral1/files/0x00060000000160f8-120.dat	upx
behavioral1/files/0x00060000000160f8-125.dat	upx
behavioral1/memory/2680-132-0x000000013FCE0000-0x0000000140034000-memory.dmp	upx
behavioral1/memory/2080-135-0x000000013FD30000-0x0000000140084000-memory.dmp	upx
behavioral1/memory/820-140-0x000000013F630000-0x000000013F984000-memory.dmp	upx
behavioral1/memory/1584-139-0x000000013F390000-0x000000013F6E4000-memory.dmp	upx
behavioral1/memory/2044-134-0x000000013F8F0000-0x000000013FC44000-memory.dmp	upx
behavioral1/files/0x0006000000016277-129.dat	upx
behavioral1/files/0x0006000000016056-127.dat	upx
behavioral1/files/0x0006000000016277-123.dat	upx
behavioral1/files/0x0006000000015f9e-116.dat	upx
behavioral1/files/0x0006000000016056-115.dat	upx
behavioral1/files/0x0006000000015f9e-112.dat	upx
behavioral1/files/0x0006000000015cf7-71.dat	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\RUDBeUS.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ERHyicC.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XCZKhWf.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IOZmKiH.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bCQULIP.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MMCtkpd.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wsxymPC.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fsHYHsT.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PmrAnEE.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LyneglO.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JVVrfBl.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wOPbeLQ.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fppPePa.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HLgfxtH.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PxiflyW.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CySsUGG.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FSVjFyJ.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JPLnmdf.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GfRoIXP.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HBikoSu.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZaceWrV.exe	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2896	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	29
PID 2164 wrote to memory of 2896	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	29
PID 2164 wrote to memory of 2896	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	29
PID 2164 wrote to memory of 2956	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	30
PID 2164 wrote to memory of 2956	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	30
PID 2164 wrote to memory of 2956	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	30
PID 2164 wrote to memory of 2620	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	31
PID 2164 wrote to memory of 2620	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	31
PID 2164 wrote to memory of 2620	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	31
PID 2164 wrote to memory of 2644	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	32
PID 2164 wrote to memory of 2644	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	32
PID 2164 wrote to memory of 2644	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	32
PID 2164 wrote to memory of 2740	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	33
PID 2164 wrote to memory of 2740	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	33
PID 2164 wrote to memory of 2740	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	33
PID 2164 wrote to memory of 2500	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	34
PID 2164 wrote to memory of 2500	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	34
PID 2164 wrote to memory of 2500	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	34
PID 2164 wrote to memory of 2456	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	35
PID 2164 wrote to memory of 2456	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	35
PID 2164 wrote to memory of 2456	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	35
PID 2164 wrote to memory of 2296	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	36
PID 2164 wrote to memory of 2296	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	36
PID 2164 wrote to memory of 2296	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	36
PID 2164 wrote to memory of 2384	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	37
PID 2164 wrote to memory of 2384	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	37
PID 2164 wrote to memory of 2384	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	37
PID 2164 wrote to memory of 2444	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	38
PID 2164 wrote to memory of 2444	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	38
PID 2164 wrote to memory of 2444	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	38
PID 2164 wrote to memory of 2824	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	39
PID 2164 wrote to memory of 2824	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	39
PID 2164 wrote to memory of 2824	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	39
PID 2164 wrote to memory of 2308	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	40
PID 2164 wrote to memory of 2308	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	40
PID 2164 wrote to memory of 2308	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	40
PID 2164 wrote to memory of 2124	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	41
PID 2164 wrote to memory of 2124	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	41
PID 2164 wrote to memory of 2124	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	41
PID 2164 wrote to memory of 2252	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	42
PID 2164 wrote to memory of 2252	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	42
PID 2164 wrote to memory of 2252	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	42
PID 2164 wrote to memory of 772	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	43
PID 2164 wrote to memory of 772	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	43
PID 2164 wrote to memory of 772	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	43
PID 2164 wrote to memory of 2128	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	44
PID 2164 wrote to memory of 2128	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	44
PID 2164 wrote to memory of 2128	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	44
PID 2164 wrote to memory of 1584	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	45
PID 2164 wrote to memory of 1584	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	45
PID 2164 wrote to memory of 1584	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	45
PID 2164 wrote to memory of 2680	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	46
PID 2164 wrote to memory of 2680	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	46
PID 2164 wrote to memory of 2680	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	46
PID 2164 wrote to memory of 2080	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	47
PID 2164 wrote to memory of 2080	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	47
PID 2164 wrote to memory of 2080	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	47
PID 2164 wrote to memory of 2044	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	48
PID 2164 wrote to memory of 2044	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	48
PID 2164 wrote to memory of 2044	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	48
PID 2164 wrote to memory of 820	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	49
PID 2164 wrote to memory of 820	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	49
PID 2164 wrote to memory of 820	2164	2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe	49

C:\Users\Admin\AppData\Local\Temp\2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-25_ddd3bbe9fbcb3cb57245c22b1d4f87a0_cobalt-strike_cobaltstrike.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\System\JVVrfBl.exe
  C:\Windows\System\JVVrfBl.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\JPLnmdf.exe
  C:\Windows\System\JPLnmdf.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\wOPbeLQ.exe
  C:\Windows\System\wOPbeLQ.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\MMCtkpd.exe
  C:\Windows\System\MMCtkpd.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\wsxymPC.exe
  C:\Windows\System\wsxymPC.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\RUDBeUS.exe
  C:\Windows\System\RUDBeUS.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\fsHYHsT.exe
  C:\Windows\System\fsHYHsT.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\GfRoIXP.exe
  C:\Windows\System\GfRoIXP.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\fppPePa.exe
  C:\Windows\System\fppPePa.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\ERHyicC.exe
  C:\Windows\System\ERHyicC.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\HLgfxtH.exe
  C:\Windows\System\HLgfxtH.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\PxiflyW.exe
  C:\Windows\System\PxiflyW.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\XCZKhWf.exe
  C:\Windows\System\XCZKhWf.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\CySsUGG.exe
  C:\Windows\System\CySsUGG.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\IOZmKiH.exe
  C:\Windows\System\IOZmKiH.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\PmrAnEE.exe
  C:\Windows\System\PmrAnEE.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\LyneglO.exe
  C:\Windows\System\LyneglO.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\FSVjFyJ.exe
  C:\Windows\System\FSVjFyJ.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\HBikoSu.exe
  C:\Windows\System\HBikoSu.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\ZaceWrV.exe
  C:\Windows\System\ZaceWrV.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\bCQULIP.exe
  C:\Windows\System\bCQULIP.exe
  2⤵
  - Executes dropped EXE
  PID:820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CySsUGG.exe

Path C:\Windows\system\CySsUGG.exe
Size 743KB
SHA256 dc05c1221f8a64161eab4a1a0ec9c1f1cb64a9b299d21db4202ed437be9d461e
MD5 cc2134989e76a6be3a85d2ff611e6015
SHA1 e2bb189502d041f290dd9c623fe08bebe5040176
SHA512 6104334a216b3781217f239147f0f06678fed4247b12c93f4227c30b8cfbecde8e2d0a01096097d93bbe20f177b1a6a4fb090aab5896387fdfa6d7dcaffce61d
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOpsxT8TvSLz9LbH8VwlS:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2ix
MD5 SHA1 SHA512 SSDEEP

Submit Download

ERHyicC.exe

Path C:\Windows\system\ERHyicC.exe
Size 606KB
SHA256 d9ee521c1bbf4e0e1a06d3562073530418864df852e9b7d13cd8179c7fd7675a
MD5 c32641d9cf488ed6347813be80de57a5
SHA1 a9ae63b5008fa162b01bcefae1de1395bf4033c3
SHA512 3a35dbc8fa2d6ce98a8a0b0234e23cc31ce1f804504dd45374ab8ed3f5eab4f138c95f2360bb3e2f7a718528f4056a9b444dcffa5ab3b84795d636f404cc3f9c
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOpsxT8TvSLz9LbHy:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2ih
MD5 SHA1 SHA512 SSDEEP

Submit Download

FSVjFyJ.exe

Path C:\Windows\system\FSVjFyJ.exe
Size 641KB
SHA256 f131763e4fe12927a802599b40a2845a35fe2a67bf86ffb0768767e196ed8670
MD5 1be6f0cce9ff379b38d94486dd3b8bd6
SHA1 24f33d7c0ea4c01d4bdb559ed2f573ae427c5b79
SHA512 cc95f7ca560848a3f885b3642bc1d6235cf8c42aa787893933e9e687dea7fd1a6947d5cea9ae5cddd088cdc0b17bfbb43e2781ab25ed16ae274069ffe117658c
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOpsxT8TvSLz9LbH8VwJ:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2iw
MD5 SHA1 SHA512 SSDEEP

Submit Download

GfRoIXP.exe

Path C:\Windows\system\GfRoIXP.exe
Size 95KB
SHA256 7cbefe196d9a74d6060e0bec54480942457f8a060fc6746ead02a6e815e3ae0e
MD5 858f9d8964561082cae6b93a6bd9e539
SHA1 ec29f87a10554456ea9080f35af7e11a029fe111
SHA512 547374ab1e160f21193b73c4469f9baa7a076d6e73caccaa5cd436cd234f16e622276f0b822fbb033c5fe360a7709a41d5773d4440e2855e4299b216f8dae2b3
SSDEEP 1536:LfiGtEX8xy+rJwoPJHRQJ2ubzrehQDegYL63XLVwTq0Eyr39MX4AE1sE2qD06uQQ:POKLJMvb/JDebwb+TfEENMX4AbE21TQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

HBikoSu.exe

Path C:\Windows\system\HBikoSu.exe
Size 775KB
SHA256 899cc190fc1b5fb9648f37d9b4643e04800aa6faa82da24425d7d176ac8d03e8
MD5 1ebc3b018ed6410e959df7d8bee3fa09
SHA1 8ed46965c7e8f77b408437b703a0cfc52e1f2d7c
SHA512 3139bd7b47add27de6dfd58da90cbca65b5fc887fb42ff0c02569c2cf23bfb5525f4fe5a29672bf1b0246a08e42774eeb4c1d6d1dca06b4747d0e216475c78bc
SSDEEP 24576:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbMwlK:dezaTF8FcNkNdfE0pZ9oztQwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

HLgfxtH.exe

Path C:\Windows\system\HLgfxtH.exe
Size 652KB
SHA256 6b5ec7c4b2663670e091cbfe308b2bedf483fc46c218b389b1053c35293839cc
MD5 6584b0a06b1cddd73f921d3ae3059382
SHA1 71d124dc888c9c33e3be45348d294b32eb2fa554
SHA512 cca38ea2b0af0d7050d3fdbd09d6b83225be8d8d820d79800421e8f114e2a30a6abf21f5eff08f0eb1d2c3291f41e59d50bd955c0948429ae69cd2cf05eaec25
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOpsxT8TvSLz9LbH8VwlU:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2iV
MD5 SHA1 SHA512 SSDEEP

Submit Download

IOZmKiH.exe

Path C:\Windows\system\IOZmKiH.exe
Size 524KB
SHA256 17aade55cf9847c1d01ee9b1c3b1c4e7ce59d6d79d3572ae13847ecb78e583b8
MD5 d874d9a79a48e6972329dcac3a0bf738
SHA1 75acf172e4b83e15fa0d9c25639d13e471bb2cfb
SHA512 05ff9f915f79578f7e24d5f75a44b516852d42c7412fc3d7dc775ca4d59bde27c22a88cf74a2dca2fc796acc6b5a17a72c9f53c0e60db2ee58efd243f5b47618
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOpsxh:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2h
MD5 SHA1 SHA512 SSDEEP

Submit Download

JPLnmdf.exe

Path C:\Windows\system\JPLnmdf.exe
Size 524KB
SHA256 e1dcb76c8f3684165261b8902392438868992dc1f9179ad902f6bdd4b27ed7c8
MD5 a0b5c6606517b98ca4e98a7200e09bc8
SHA1 628db7646a4b7de75bcde04122283262093e115e
SHA512 69f15cfd29600b224dd65351ae5d68652e51119d487c179b972ca2c3436b20ceb303a290bc1c2bc71a9a04e8fa745263821c9acfb10518102ed155d1f34c567f
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOpsxd:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2d
MD5 SHA1 SHA512 SSDEEP

Submit Download

JVVrfBl.exe

Path C:\Windows\system\JVVrfBl.exe
Size 1.2MB
SHA256 2065fcebbe8504ee7c117f6c72289bcf49d0dd1727114903acac502b1619f1d1
MD5 9bbfd34cfcd83e2671ef7e75aec00685
SHA1 58c64f45af9abb3db4d56ed6c10beaedea260e73
SHA512 463f3566f61036ef92577a1738d3553481afd1598cdba8b9893dd6fe26365cd8d15ec8fa80d50cf88c3c5e828da96c4595128a322778fb6e0fb064868fceaddb
SSDEEP 24576:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbMwlKjp0dBF672l6i2NcB:dezaTF8FcNkNdfE0pZ9oztQwI656q
MD5 SHA1 SHA512 SSDEEP

Submit Download

LyneglO.exe

Path C:\Windows\system\LyneglO.exe
Size 64KB
SHA256 9f1d9169173a62be2ed3a27bfbcde292774615c8428aa1723a19185177112fca
MD5 5e383651b4ad8adf73f8cfb02c16b98e
SHA1 47176fcb459dbc31bc538c7e96995706ae8d9e83
SHA512 398155bd2bbffd32b60f6e65c6ef525aa97b0b8d8859f7acc74dd9a370ef6a5cf76452e7076a8daba6fc7c3b2d8a53434725c739d6cedc55557d8c3510485678
SSDEEP 1536:LfiGtEX8xy+rJwoPJHRQJ2ubzrehQDegYL63XLVwTq0Eyr39MX4AE1sEN:POKLJMvb/JDebwb+TfEENMX4AbEN
MD5 SHA1 SHA512 SSDEEP

Submit Download

MMCtkpd.exe

Path C:\Windows\system\MMCtkpd.exe
Size 621KB
SHA256 8d1b5b5f61a5d3b400840543b374e8f738030c3cbe832622b7bc746b894ec290
MD5 994623fbb346954c4614d84ccb23d819
SHA1 2c4e739ed579aa2c4af0edc311b33f3ad646ca0e
SHA512 7c7ea4aa8c987db89cd64282b141093ff367db370992b2934c71bf9e3b1b0ec792d3eae70a46e12c85baacddef8c9d723b15f3e0f751e2e44a54600d9130cab7
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOpsxT8TvSLz9LbHs:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2iN
MD5 SHA1 SHA512 SSDEEP

Submit Download

PmrAnEE.exe

Path C:\Windows\system\PmrAnEE.exe
Size 436KB
SHA256 b67fe456c3c5cc27e5094636f2c57badb478b5e7b59a9f683cc1af70c01045e6
MD5 46e1edb49e18634479eaa8328c877cfa
SHA1 7e04c7c33ce5a1f5883693a4d7521e7cb2d20e2f
SHA512 00ce422ebc12ffe90c48539f1032054da59079a73afbec77cf5bd830e2a3dd857eff5cefb0a99c1e1bb6f56ae32a3d5a1f743adf6c9c38ac369a97b2b47a6adc
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOpX:dezaTnG99Q8FcNrpyNdfE0bLBgDOpX
MD5 SHA1 SHA512 SSDEEP

Submit Download

PxiflyW.exe

Path C:\Windows\system\PxiflyW.exe
Size 620KB
SHA256 98f8e4895a70f0e0bd8a0e9aa97bac537b66d90b6cbb24cea8870df3bc9ba6d2
MD5 bb309b5405cb9101d833aa757da93c0d
SHA1 83b1727695c7e9d0ddf505968a857be4e9473ddb
SHA512 80ef59813299325b0d3a50ee28962ac1f2c359d73d416a43309af8f01fc2411dcb269f26c9166953eab0eba3fddf40bcf989998079b9c94a58bf3af5410735ce
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOpsxT8TvSLz9LbH:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2i2
MD5 SHA1 SHA512 SSDEEP

Submit Download

RUDBeUS.exe

Path C:\Windows\system\RUDBeUS.exe
Size 383KB
SHA256 4f4599ccfe4f158ae3c56545067fb571e675b78316987d139491de24cde7a3ce
MD5 03594183b364ba23bda8811c9c1ae0c5
SHA1 6c4f5b32ab467c1e471ba1d059cb1083ce7e762b
SHA512 1326727a8375a5c37c7a47b26aa2dee6ccd97673a6ea62072be2bdc79f5534376d01101a4552943793488cc19b6084d8839f9edbf48a16bb37b2a898c33c9048
SSDEEP 6144:WKLEbRDeMaTfEENMX4Abf1TQ8FcukSupybiBU0nFEDNKOyZMDyCDJzA9eBPpjwb5:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNC
MD5 SHA1 SHA512 SSDEEP

Submit Download

XCZKhWf.exe

Path C:\Windows\system\XCZKhWf.exe
Size 877KB
SHA256 5c18ff55bbcc0abdc23c66290564c6dc66604dd55a422a3f764ad4200ead3df7
MD5 0ca54cb39eb7236e0327ca4b255ea01b
SHA1 912e3939e27f57e85c39799b2197377465b7d2f2
SHA512 6976b76c63a8ee088406efab709d5f43f0311c59de7dd5b03e54c35374d58c0180498f4286f994399221ac75398b185b30e2c24c5c3689ffa7938fa6531bae78
SSDEEP 24576:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbMwlK:dezaTF8FcNkNdfE0pZ9oztQwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZaceWrV.exe

Path C:\Windows\system\ZaceWrV.exe
Size 750KB
SHA256 6f258373f9ce3b9c01aefc4bf50275d414b5337e73549f276f43e473d6f09397
MD5 a743bd066f4b023287433374877fb226
SHA1 086071fb506179e9d5220eb3c2c049214ff6761b
SHA512 93331e188b8583ed17bf7d73b47d3baf9c54d6620b0f587efcf87935dc01a87566ae978c2fa43023be92d32b76d01f27b121d1409bd1d3fca8a9dc60ed1c172f
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOpsxT8TvSLz9LbH8VwlS:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2ix
MD5 SHA1 SHA512 SSDEEP

Submit Download

bCQULIP.exe

Path C:\Windows\system\bCQULIP.exe
Size 522KB
SHA256 2f38c6754162da5c94c611529802babece6463f05764bc605fd9e2ffe0551307
MD5 54fb50dd9176c51fa60137910abbd56c
SHA1 c654d811431ed22d42a38efda299df3bda59c5cf
SHA512 0015ffe6ad814f1eacf695df506866fdae88dc946b768572846287c33c7eae478779c25e3589065e4afa2e3cbfced6f444ab8ce806b60afb8a33283154a6fdc5
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOpsf:dezaTnG99Q8FcNrpyNdfE0bLBgDOpo
MD5 SHA1 SHA512 SSDEEP

Submit Download

fppPePa.exe

Path C:\Windows\system\fppPePa.exe
Size 645KB
SHA256 5ca83b7ac7b0079a22c8bf114040f10a9133008c32e21a8847c7bb3f0e830ee7
MD5 5c8fd01366c472d8f0acacf5965050da
SHA1 8b790519caa6cd40cc17a869be390578e366a33a
SHA512 792200c025315a40ffd69859e2723f7c0f213e2c465afbc8427b6c124f1bb8076dd487c39ff717e0929c8394348c4f089eaa9a2bf399da4e276ec974d319895c
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOpsxT8TvSLz9LbH8Vwx:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2i6
MD5 SHA1 SHA512 SSDEEP

Submit Download

fsHYHsT.exe

Path C:\Windows\system\fsHYHsT.exe
Size 228KB
SHA256 6c0e574f050081872acb439d6a5e5178862542711d99a318f581d9a9c0120701
MD5 0485980ca52cd44fd55c68b14f357c53
SHA1 29a68b51a5de4201f381d71dd5bd1efa0b744c25
SHA512 43ddc1f7a62e740252b4227795b5a387c56eb2e18e924443640bce891596985afa3fe8c00ea86c85eb825e2122aa40ba84af8d77260adccaf99f1bfe218bb2ff
SSDEEP 6144:WKLEbRDeMaTfEENMX4Abf1TQ8FcukSupybiBU0nFEDNK9:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNq
MD5 SHA1 SHA512 SSDEEP

Submit Download

wOPbeLQ.exe

Path C:\Windows\system\wOPbeLQ.exe
Size 520KB
SHA256 bbffcbc37e8841823e9fc9a1fffa68d1f31aa455ff6efdac34fee8a0c68e16da
MD5 a9a0d40b051b09e2c02ed739f5955694
SHA1 1faadef2fa13e2ab61b478979fb002fd6872d8ed
SHA512 3ba889728636b2eb1b9e69e959aa1f9dbf033b380e70c8f420cf6fe4d3b83d0e52a7ca261a620b1e96fe24a04d7ede48d63c052cf7ed3c7ae3a0ea41bb2c7a69
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOpsY:dezaTnG99Q8FcNrpyNdfE0bLBgDOpf
MD5 SHA1 SHA512 SSDEEP

Submit Download

wOPbeLQ.exe

Path C:\Windows\system\wOPbeLQ.exe
Size 442KB
SHA256 0b7c4b8068fe3a3172dc8cf8fd8598e5743273aeb3fc7b8b75e8ddff2bc93ff0
MD5 fb2c20988ea048a9ee49a106d4255b5c
SHA1 70c3676cc8548dd1d157a8c0ea3b3de4d7b2ba5f
SHA512 a10dad1d95a8970f60fe6509b9df4793aa1b1fd3cf3e7d33a5fd286cc8cd90f658a38cec5373029072a1f08ffd94572c74e9361356dc536f20b47bd5e8cfd274
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOpS:dezaTnG99Q8FcNrpyNdfE0bLBgDOpS
MD5 SHA1 SHA512 SSDEEP

Submit Download

wsxymPC.exe

Path C:\Windows\system\wsxymPC.exe
Size 487KB
SHA256 afe342237903d66fcd4322129e8b825be67ba1f9b33dfe6c5fb3c32c76cf2322
MD5 3241ddcc5c3295fb036e814aa2dc351c
SHA1 e36c35ff5f51b709f0a7be8523abab85a7ba7a1c
SHA512 ac561ef32b4fe67316f76d3a05424dacc29882e497440cc783a966b4d2eeb48857b7b2b71b33a7aad6da6479c64d87cccfc41f123c405e59c0ab671d9cf753ec
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOps9:dezaTnG99Q8FcNrpyNdfE0bLBgDOpa
MD5 SHA1 SHA512 SSDEEP

Submit Download

CySsUGG.exe

Path \Windows\system\CySsUGG.exe
Size 498KB
SHA256 34d9730f7cc283968503eac493424fae8136222cf24788f5e1516ec5b047e838
MD5 61d67fd5bb06ba6ce03908fcb734d455
SHA1 63baf4b3c9d59ea248ed144ff8799338fb1335f5
SHA512 a6714b0ccc60e16693eaf3e0225e47636cc17cd46f148ad8fb5ad327fbb3751abd66d36e98565dea8c7511928bfaf9850ba1103bbc9f29f285fab8e041c5913c
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOps1:dezaTnG99Q8FcNrpyNdfE0bLBgDOpK
MD5 SHA1 SHA512 SSDEEP

Submit Download

ERHyicC.exe

Path \Windows\system\ERHyicC.exe
Size 639KB
SHA256 f1533e3d10835be22a4a33e6099748c30edb119099d9d65c39fb72bb19445fcd
MD5 6f30c1b54436bd11d5a00efd91be5d05
SHA1 17fad08c91020f09b79c975c3b6af740e5730151
SHA512 f2f68e16a5093558cdddcc89ecdf3e054be47da02cc90b44dc7a29b301df7957b6a10300ca3a10d2f581d5a8fb4541304b878fffc371812b51e4d5e1370d334e
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOpsxT8TvSLz9LbH8Vww:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2i/
MD5 SHA1 SHA512 SSDEEP

Submit Download

FSVjFyJ.exe

Path \Windows\system\FSVjFyJ.exe
Size 1.0MB
SHA256 fed696220d32102e5eeca764130be6468c9239122635e41efe447450415893fb
MD5 1e9f0ea4f1ac980c0b2c4066cf2d1b46
SHA1 0fa58f3c4dbd05aecdb2bc0e752c8acef28aaef2
SHA512 5a5109a0e5ed722c5bad27162b377b7c42163c237b2f65fd2bee008ecc63a858157a5f016d0ac5df776e044ed85003df112c84b740e5530c0e85ad1a44ecc2e1
SSDEEP 24576:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbMwlKjp0dBF672F:dezaTF8FcNkNdfE0pZ9oztQwI6x
MD5 SHA1 SHA512 SSDEEP

Submit Download

GfRoIXP.exe

Path \Windows\system\GfRoIXP.exe
Size 165KB
SHA256 88d39ab312452778e965d67543ca618cd0f51596a27fe852a415a4a32d1c9089
MD5 0bb30a835f778fc2464a3b2825798ba0
SHA1 81e089762c91e8c2e3d37fe936fdc2c04f74fe82
SHA512 bb0b478497e6e35a690ed3e10969a64785f215548d767f55ef92b84147513b4787c6dd6e2121c31e4774c6088e5eb97bf6adbe7efb363b20dbf76b38f1bfbea3
SSDEEP 3072:POKLJMvb/JDebwb+TfEENMX4AbE21TQfkFcIpkYJmz9o9KbybiBUk7nn3:WKLEbRDeMaTfEENMX4Abf1TQ8FcukSu7
MD5 SHA1 SHA512 SSDEEP

Submit Download

HBikoSu.exe

Path \Windows\system\HBikoSu.exe
Size 787KB
SHA256 8b2b274a9ec25cb37db81051804a71b4b59ebf4980d931fe4b1dfe690517184b
MD5 d2154b41ab4b4770e181921dea24015c
SHA1 bea06e25753113fefd56741b9016255e6de64eb8
SHA512 2c61c5a05e288ac650ac9e9a222fdd7649c124b0181d6dbdcf6cba48edb693c25f2b1882833453bce26843a16edea9c4ac59afcd64e6d5f7f92d8f672d558e70
SSDEEP 24576:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbMwlK:dezaTF8FcNkNdfE0pZ9oztQwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

HLgfxtH.exe

Path \Windows\system\HLgfxtH.exe
Size 1.5MB
SHA256 40bb2c96d0b2ea79569ac5d8ffbe58805c7db01649dd0c9cfcfc309bd1b030a3
MD5 fda1de2a720aec6375035267ffa5562c
SHA1 0374d2dc88fbb87c1749aa507996310fc73e9026
SHA512 32112687b727b7d4bbf6612ffd4325d9291270a76bfc0b1d9e9044c4c1a270eb7d64263ed62b75102f082601021963a59d0ba3ec25617714142407c755a59537
SSDEEP 24576:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbMwlKjp0dBF672l6i2Ncb2ygupgg:dezaTF8FcNkNdfE0pZ9oztQwI656uL3B
MD5 SHA1 SHA512 SSDEEP

Submit Download

IOZmKiH.exe

Path \Windows\system\IOZmKiH.exe
Size 777KB
SHA256 525674bcf66b3f9722b64eee94c8082bda0a7cda78161d778b0452fa49f57f50
MD5 3b39dac2fd8c04f73c5ad4355352c8bc
SHA1 8283fd3f6c1509c980453d7f3362b46bfb46733e
SHA512 47f005e2cfe476f8c1bbe4869d9aa144681d39d9e840f4649d6c2f5477cb728c5ab95764f5b169e9c768a2c788b4350e284801d02c3d482334be8e3f0214e77b
SSDEEP 24576:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbMwlK:dezaTF8FcNkNdfE0pZ9oztQwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

JPLnmdf.exe

Path \Windows\system\JPLnmdf.exe
Size 875KB
SHA256 3e44516d9f636aacbade305c50c86f29036853b78c2de70c6b341add543dd9b7
MD5 8f36db7ea79b5941d408b78cad423601
SHA1 38745560ed31ec3eaf45078e9836f81aea4706de
SHA512 407bb877af02bf8e24008570c05fb3878a3410f8f568b6868907c57731294cecff7aa00fdbc814e5c580eba3b12626fd0dc48c1a926ec3e7c30fedf89ab7baf0
SSDEEP 24576:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbMwlK:dezaTF8FcNkNdfE0pZ9oztQwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

JVVrfBl.exe

Path \Windows\system\JVVrfBl.exe
Size 1.5MB
SHA256 04651b8d983351199de54d5ad9c0ca303ef3bb09352594bb7d7267ffc640888f
MD5 eb21078ed677a9a1ab69b6d541e3275d
SHA1 84d0646561d9f587496f9d88357813c85a836967
SHA512 f6bcb215bc4b8ee47d06fe17223d20e98ed45dc71b7eeb28c9a934169b2b7d028136a4d20afabe7df55b340dea5de42db96060d189c0b776262a0ab5af3ce861
SSDEEP 49152:dezaTF8FcNkNdfE0pZ9oztQwI656uL3pgrCEl:demTLkNdfE0pZ3656utgJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

LyneglO.exe

Path \Windows\system\LyneglO.exe
Size 169KB
SHA256 d14d7b3b74143b72df05fb94ce37edfa704e217901aa7ac9e80ef9f56d233a8d
MD5 86974b0066bab81e38bd069bc77fc856
SHA1 9eff08e848be497559f0b4ec6d407a1cf194730e
SHA512 9de76bca5a89522f985f81fdc9f20c5729b6aaabfb5f3805d4b02bcf7e8f454c82eb4cf799db6e3f862ae34b701d2f3aa3e6fa6bcf39a7935246351985062cd3
SSDEEP 3072:POKLJMvb/JDebwb+TfEENMX4AbE21TQfkFcIpkYJmz9o9KbybiBUk7nnDT:WKLEbRDeMaTfEENMX4Abf1TQ8FcukSuT
MD5 SHA1 SHA512 SSDEEP

Submit Download

MMCtkpd.exe

Path \Windows\system\MMCtkpd.exe
Size 379KB
SHA256 56ac2690c464004174795b21fddea41352ae2bace4b44ca96c1a557a6bf36505
MD5 35ba54c9cea54e0531a8d82612487408
SHA1 b122236d0063532a9870c710d3e0f1e538b27aad
SHA512 60806bacfbcdb85d5d8442e12d474e266b017cf5e2d46b9bd4b08b19a3f0b221e058a3fbc54ff3ae8a5850b6901abc85666a8129ddeea09f482e1a76eb84233a
SSDEEP 6144:WKLEbRDeMaTfEENMX4Abf1TQ8FcukSupybiBU0nFEDNKOyZMDyCDJzA9eBPpjt:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

PmrAnEE.exe

Path \Windows\system\PmrAnEE.exe
Size 412KB
SHA256 bde3068a93f5a00a502a265ef2aa496c173070b2c15be99116be6c50f67e8b99
MD5 2ce49625a64e9ee19d92e063c42893d0
SHA1 9a20dd468ee701aed8183c26af0da39268eaa2e2
SHA512 521d0f5e64aaa230e21f1c06401ec11f57bf140e7a0f3aee7609cc24e4e2db3aac93b94aeab39162e2d2ec8e1ee34fc15a2d6324c47ab7deb877ab43e3485703
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLt:dezaTnG99Q8FcNrpyNdfE0bLt
MD5 SHA1 SHA512 SSDEEP

Submit Download

PxiflyW.exe

Path \Windows\system\PxiflyW.exe
Size 689KB
SHA256 8d31279af5aa362c294363c8648050f64d763a1f2f1b0402b4a67b63483d8fe4
MD5 e2219ce44ff4692765a03f309c56de02
SHA1 17e5772a13acd2f0f4212df4b7770ff14ed2d2c8
SHA512 9772e915cb118acb990959516cf49509927a3b68bb4444fabd0a071a11d775546152872c61c48aa23e1beb9e91d32d5f67f79dd4c45087076d43aee2224a1a8a
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOpsxT8TvSLz9LbH8Vwl0:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2iX
MD5 SHA1 SHA512 SSDEEP

Submit Download

RUDBeUS.exe

Path \Windows\system\RUDBeUS.exe
Size 383KB
SHA256 84b9198c406940c3f67056d2056a7e1dc3f81e60122b6e1a537bbee1c0fbaf73
MD5 f937c031caf3854aec33626930f437f7
SHA1 6edee831075e1bacf8c645f978a0890ce676c383
SHA512 9f9961206742e89e1374acde351b08668f623e4b2213bf8baa97025e7d042ed575455d797fd3a4782a4d2597902d6492c52d201c4c9876337f221640637bafe3
SSDEEP 6144:WKLEbRDeMaTfEENMX4Abf1TQ8FcukSupybiBU0nFEDNKOyZMDyCDJzA9eBPpjwbw:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDN3
MD5 SHA1 SHA512 SSDEEP

Submit Download

XCZKhWf.exe

Path \Windows\system\XCZKhWf.exe
Size 1.4MB
SHA256 61c846f9ffa5547a009d86555cf81eb8ef5c81cc090b84a6e68508e0bc069bf9
MD5 7bca94588b1eda5a9fa457413237a217
SHA1 6d5eaad0dc57e44be3c9a4fa808fd7732ff426a5
SHA512 789a472e52b6d0f1e0f896fcf31ff1475d4a8bfee1e84db42cbd732f433e71f21c4302865091e9a1181d2a12bdb12306ce85eb1fb291b070a578ac832197685b
SSDEEP 24576:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbMwlKjp0dBF672l6i2Ncb2ygupg3:dezaTF8FcNkNdfE0pZ9oztQwI656uL3I
MD5 SHA1 SHA512 SSDEEP

Submit Download

bCQULIP.exe

Path \Windows\system\bCQULIP.exe
Size 525KB
SHA256 79919bc45cd1757c87f737465b75deabc189aee1d484ec135618de94f9111f04
MD5 cf2ea96a32722a13cac9124f0a872086
SHA1 0a2e00e469d9e1d0e6c8750167503bafcd11903c
SHA512 bcdf833cd0ba60aa54dff097ea562d581235420d61461bb12befbe3971dc6049a31910fb5360a3bdf24439dbb48b10351b909431b10a486874ed9f63c61f62fe
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOpsx3:dezaTnG99Q8FcNrpyNdfE0bLBgDOp23
MD5 SHA1 SHA512 SSDEEP

Submit Download

fppPePa.exe

Path \Windows\system\fppPePa.exe
Size 1.1MB
SHA256 0d059d6a6dac386eebc2b7e2590f58825c981276f30e46ad27dafba6dbfaf4f9
MD5 c922bef7155ee85695160aa49c434c4f
SHA1 ca1f7a4dee5b2a071361960e8600b551612a5164
SHA512 109e9dc5f2c0b7920ed0de2c9fd7aec8389c465007776df6fef647a6debd9b5a7b0c44480adb5d7904f52aad625d29a1da14ac61840649791e06c3ebd5a6f30e
SSDEEP 24576:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbMwlKjp0dBF6720:dezaTF8FcNkNdfE0pZ9oztQwI6w
MD5 SHA1 SHA512 SSDEEP

Submit Download

fsHYHsT.exe

Path \Windows\system\fsHYHsT.exe
Size 317KB
SHA256 18ca43e3822ab85ba4d9722af4e8f2ebf696c9e16bb00dd2a045a8c4942455af
MD5 93f5b20f3667858ac21e42138e780e01
SHA1 5cf890ed78ea2e1740da0a04d5a0b72705294772
SHA512 2a3227a2f58ba78f0689ecd9c4233657470e4bbe992d914638f69064553c7ea8a09e8f06f1e04e1072859d9f547e0f5d5e6499b94d7dca1ce26eb5cf0f11a8b1
SSDEEP 6144:WKLEbRDeMaTfEENMX4Abf1TQ8FcukSupybiBU0nFEDNKOyZMDK:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNu
MD5 SHA1 SHA512 SSDEEP

Submit Download

wOPbeLQ.exe

Path \Windows\system\wOPbeLQ.exe
Size 961KB
SHA256 6f5967650a86eaf2d8067038882aec4121ec617e24a3a47fc23f15053aa46322
MD5 861d09b8c424df0ebfdb0b14f5f87297
SHA1 db54d308ec084dc0f43870c7c51b45eef52bd45b
SHA512 b5241bb75d2c8575500d409c0e9eac3632a379f54463f327cef61348642a58b9bfc3092d9f4a9ef0644c1dd0405a5f3323e26f5d618cd32fadd2886ab649ef98
SSDEEP 24576:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbMwlKjH:dezaTF8FcNkNdfE0pZ9oztQwIz
MD5 SHA1 SHA512 SSDEEP

Submit Download

wsxymPC.exe

Path \Windows\system\wsxymPC.exe
Size 643KB
SHA256 e90533ad60bafef560b25bacab61e5e283673c9346cd4a2e739b64a9f8ac2013
MD5 95f957255a942f03b96b117ef9679a79
SHA1 67eb62a82608991fc2b836666fe1381c9d71d5b8
SHA512 bc87c24245371ab3b7c0d73de36698fd8a974739772e90a2a1d8ac76dc4c1dff2032146d93845f65f7750abc1553ed9e3d64a437e6c07b10baea0f977057c2a9
SSDEEP 12288:WKQbRDeMaT8ENMX4AbfFQ8FcNrpPEDNW3cfxpY0bLBgDOpsxT8TvSLz9LbH8Vwt:dezaTnG99Q8FcNrpyNdfE0bLBgDOp2ie
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/772-108-0x000000013FE90000-0x00000001401E4000-memory.dmp

Download

memory/820-140-0x000000013F630000-0x000000013F984000-memory.dmp

Download

memory/820-163-0x000000013F630000-0x000000013F984000-memory.dmp

Download

memory/1584-159-0x000000013F390000-0x000000013F6E4000-memory.dmp

Download

memory/1584-139-0x000000013F390000-0x000000013F6E4000-memory.dmp

Download

memory/2044-134-0x000000013F8F0000-0x000000013FC44000-memory.dmp

Download

memory/2044-160-0x000000013F8F0000-0x000000013FC44000-memory.dmp

Download

memory/2080-135-0x000000013FD30000-0x0000000140084000-memory.dmp

Download

memory/2080-162-0x000000013FD30000-0x0000000140084000-memory.dmp

Download

memory/2124-104-0x000000013FFB0000-0x0000000140304000-memory.dmp

Download

memory/2124-157-0x000000013FFB0000-0x0000000140304000-memory.dmp

Download

memory/2128-111-0x000000013F3D0000-0x000000013F724000-memory.dmp

Download

memory/2128-158-0x000000013F3D0000-0x000000013F724000-memory.dmp

Download

memory/2164-11-0x000000013F050000-0x000000013F3A4000-memory.dmp

Download

memory/2164-52-0x000000013F750000-0x000000013FAA4000-memory.dmp

Download

memory/2164-0-0x000000013FB10000-0x000000013FE64000-memory.dmp

Download

memory/2164-97-0x00000000023B0000-0x0000000002704000-memory.dmp

Download

memory/2164-131-0x00000000023B0000-0x0000000002704000-memory.dmp

Download

memory/2164-29-0x00000000023B0000-0x0000000002704000-memory.dmp

Download

memory/2164-88-0x000000013FFB0000-0x0000000140304000-memory.dmp

Download

memory/2164-136-0x000000013FEB0000-0x0000000140204000-memory.dmp

Download

memory/2164-137-0x000000013F2E0000-0x000000013F634000-memory.dmp

Download

memory/2164-138-0x000000013FE90000-0x00000001401E4000-memory.dmp

Download

memory/2164-1-0x0000000000080000-0x0000000000090000-memory.dmp

Download

memory/2164-87-0x000000013F550000-0x000000013F8A4000-memory.dmp

Download

memory/2164-48-0x00000000023B0000-0x0000000002704000-memory.dmp

Download

memory/2164-133-0x000000013F630000-0x000000013F984000-memory.dmp

Download

memory/2164-47-0x00000000023B0000-0x0000000002704000-memory.dmp

Download

memory/2164-141-0x000000013FB10000-0x000000013FE64000-memory.dmp

Download

memory/2252-154-0x000000013F8F0000-0x000000013FC44000-memory.dmp

Download

memory/2252-102-0x000000013F8F0000-0x000000013FC44000-memory.dmp

Download

memory/2296-55-0x000000013FEB0000-0x0000000140204000-memory.dmp

Download

memory/2296-151-0x000000013FEB0000-0x0000000140204000-memory.dmp

Download

memory/2296-142-0x000000013FEB0000-0x0000000140204000-memory.dmp

Download

memory/2308-153-0x000000013F550000-0x000000013F8A4000-memory.dmp

Download

memory/2308-101-0x000000013F550000-0x000000013F8A4000-memory.dmp

Download

memory/2384-70-0x000000013F2E0000-0x000000013F634000-memory.dmp

Download

memory/2384-143-0x000000013F2E0000-0x000000013F634000-memory.dmp

Download

memory/2384-152-0x000000013F2E0000-0x000000013F634000-memory.dmp

Download

memory/2444-155-0x000000013FAF0000-0x000000013FE44000-memory.dmp

Download

memory/2444-100-0x000000013FAF0000-0x000000013FE44000-memory.dmp

Download

memory/2456-46-0x000000013F750000-0x000000013FAA4000-memory.dmp

Download

memory/2456-150-0x000000013F750000-0x000000013FAA4000-memory.dmp

Download

memory/2500-149-0x000000013F860000-0x000000013FBB4000-memory.dmp

Download

memory/2500-45-0x000000013F860000-0x000000013FBB4000-memory.dmp

Download

memory/2620-147-0x000000013FDF0000-0x0000000140144000-memory.dmp

Download

memory/2620-36-0x000000013FDF0000-0x0000000140144000-memory.dmp

Download

memory/2644-40-0x000000013FE40000-0x0000000140194000-memory.dmp

Download

memory/2644-145-0x000000013FE40000-0x0000000140194000-memory.dmp

Download

memory/2680-132-0x000000013FCE0000-0x0000000140034000-memory.dmp

Download

memory/2680-161-0x000000013FCE0000-0x0000000140034000-memory.dmp

Download

memory/2740-44-0x000000013FE60000-0x00000001401B4000-memory.dmp

Download

memory/2740-148-0x000000013FE60000-0x00000001401B4000-memory.dmp

Download

memory/2824-103-0x000000013F7F0000-0x000000013FB44000-memory.dmp

Download

memory/2824-156-0x000000013F7F0000-0x000000013FB44000-memory.dmp

Download

memory/2896-144-0x000000013F050000-0x000000013F3A4000-memory.dmp

Download

memory/2896-24-0x000000013F050000-0x000000013F3A4000-memory.dmp

Download

memory/2956-37-0x000000013FD70000-0x00000001400C4000-memory.dmp

Download

memory/2956-146-0x000000013FD70000-0x00000001400C4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads