cobaltstrike | ea5d21cbfc480e93ee72f0f14792230db0a0380c0235eb82f1bf8f97bd96b9aa

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 19:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
Size 5.2MB
Sample240522-x3vs1sde5s
SHA256 ea5d21cbfc480e93ee72f0f14792230db0a0380c0235eb82f1bf8f97bd96b9aa
MD5 89bb0a8945c30a2a7e5f8c748f68bc54
SHA1 bc47b98c30b725d61b03b976c54e324647d20c65
SHA512 242c4942f0220b44e31890187bc621c3dccd883c4037f21a195ccc6d86e9d8f6bd60f2a5dc6118c77d82785c7ce1ee5e52ab728081a71a5330ee96e62dfa346e
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lw:RWWBibf56utgpPFotBER/mQ32lUM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00080000000235e6-5.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235eb-14.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235ed-30.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235ee-31.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235f2-57.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235f5-66.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235f4-65.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235f3-64.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235f0-58.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235ef-49.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235f1-41.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235ec-23.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235ea-21.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235f6-84.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235fb-115.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235fc-123.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235fa-119.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235f9-104.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235f8-102.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235f7-100.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000235e7-98.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 44 IoCs

miner

resource	yara_rule
behavioral2/memory/4912-63-0x00007FF6EA170000-0x00007FF6EA4C1000-memory.dmp	xmrig
behavioral2/memory/4044-34-0x00007FF70F540000-0x00007FF70F891000-memory.dmp	xmrig
behavioral2/memory/3728-95-0x00007FF682220000-0x00007FF682571000-memory.dmp	xmrig
behavioral2/memory/2404-127-0x00007FF721B50000-0x00007FF721EA1000-memory.dmp	xmrig
behavioral2/memory/2468-126-0x00007FF79D2C0000-0x00007FF79D611000-memory.dmp	xmrig
behavioral2/memory/1796-118-0x00007FF7D89A0000-0x00007FF7D8CF1000-memory.dmp	xmrig
behavioral2/memory/4692-117-0x00007FF734480000-0x00007FF7347D1000-memory.dmp	xmrig
behavioral2/memory/2452-114-0x00007FF766610000-0x00007FF766961000-memory.dmp	xmrig
behavioral2/memory/1248-109-0x00007FF799480000-0x00007FF7997D1000-memory.dmp	xmrig
behavioral2/memory/2596-91-0x00007FF676580000-0x00007FF6768D1000-memory.dmp	xmrig
behavioral2/memory/1080-81-0x00007FF7D39B0000-0x00007FF7D3D01000-memory.dmp	xmrig
behavioral2/memory/4836-80-0x00007FF642900000-0x00007FF642C51000-memory.dmp	xmrig
behavioral2/memory/3848-130-0x00007FF65DCA0000-0x00007FF65DFF1000-memory.dmp	xmrig
behavioral2/memory/760-134-0x00007FF7A24F0000-0x00007FF7A2841000-memory.dmp	xmrig
behavioral2/memory/4312-135-0x00007FF649250000-0x00007FF6495A1000-memory.dmp	xmrig
behavioral2/memory/824-141-0x00007FF7791C0000-0x00007FF779511000-memory.dmp	xmrig
behavioral2/memory/4380-147-0x00007FF76F650000-0x00007FF76F9A1000-memory.dmp	xmrig
behavioral2/memory/664-143-0x00007FF6C83D0000-0x00007FF6C8721000-memory.dmp	xmrig
behavioral2/memory/3356-140-0x00007FF6C5BA0000-0x00007FF6C5EF1000-memory.dmp	xmrig
behavioral2/memory/3672-132-0x00007FF648A30000-0x00007FF648D81000-memory.dmp	xmrig
behavioral2/memory/4808-129-0x00007FF7E4B70000-0x00007FF7E4EC1000-memory.dmp	xmrig
behavioral2/memory/3856-128-0x00007FF7FE610000-0x00007FF7FE961000-memory.dmp	xmrig
behavioral2/memory/3856-150-0x00007FF7FE610000-0x00007FF7FE961000-memory.dmp	xmrig
behavioral2/memory/4808-208-0x00007FF7E4B70000-0x00007FF7E4EC1000-memory.dmp	xmrig
behavioral2/memory/4044-210-0x00007FF70F540000-0x00007FF70F891000-memory.dmp	xmrig
behavioral2/memory/3672-212-0x00007FF648A30000-0x00007FF648D81000-memory.dmp	xmrig
behavioral2/memory/3848-214-0x00007FF65DCA0000-0x00007FF65DFF1000-memory.dmp	xmrig
behavioral2/memory/4836-216-0x00007FF642900000-0x00007FF642C51000-memory.dmp	xmrig
behavioral2/memory/4312-218-0x00007FF649250000-0x00007FF6495A1000-memory.dmp	xmrig
behavioral2/memory/2596-222-0x00007FF676580000-0x00007FF6768D1000-memory.dmp	xmrig
behavioral2/memory/4912-221-0x00007FF6EA170000-0x00007FF6EA4C1000-memory.dmp	xmrig
behavioral2/memory/760-226-0x00007FF7A24F0000-0x00007FF7A2841000-memory.dmp	xmrig
behavioral2/memory/1080-225-0x00007FF7D39B0000-0x00007FF7D3D01000-memory.dmp	xmrig
behavioral2/memory/3728-230-0x00007FF682220000-0x00007FF682571000-memory.dmp	xmrig
behavioral2/memory/3356-229-0x00007FF6C5BA0000-0x00007FF6C5EF1000-memory.dmp	xmrig
behavioral2/memory/824-232-0x00007FF7791C0000-0x00007FF779511000-memory.dmp	xmrig
behavioral2/memory/4692-239-0x00007FF734480000-0x00007FF7347D1000-memory.dmp	xmrig
behavioral2/memory/1248-242-0x00007FF799480000-0x00007FF7997D1000-memory.dmp	xmrig
behavioral2/memory/2452-240-0x00007FF766610000-0x00007FF766961000-memory.dmp	xmrig
behavioral2/memory/664-236-0x00007FF6C83D0000-0x00007FF6C8721000-memory.dmp	xmrig
behavioral2/memory/1796-235-0x00007FF7D89A0000-0x00007FF7D8CF1000-memory.dmp	xmrig
behavioral2/memory/2468-245-0x00007FF79D2C0000-0x00007FF79D611000-memory.dmp	xmrig
behavioral2/memory/2404-246-0x00007FF721B50000-0x00007FF721EA1000-memory.dmp	xmrig
behavioral2/memory/4380-248-0x00007FF76F650000-0x00007FF76F9A1000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4808	tdFtyEQ.exe
3848	HITYKSm.exe
4044	DkgFByb.exe
3672	usFVRfh.exe
4836	QGpCoRB.exe
760	uLVdQEy.exe
4312	cRHxMFv.exe
1080	yYjnmMO.exe
4912	LwrFufj.exe
2596	mSSDfiY.exe
3728	xITUJPM.exe
3356	SpJkuot.exe
824	ggrtGAG.exe
4692	dLyzVXg.exe
664	TfiiOXk.exe
1796	oeaJczD.exe
1248	LbImLLu.exe
2452	ODsnpAG.exe
4380	zAnIdit.exe
2404	oivoLcB.exe
2468	TnZoXWc.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3856-0-0x00007FF7FE610000-0x00007FF7FE961000-memory.dmp	upx
behavioral2/files/0x00080000000235e6-5.dat	upx
behavioral2/memory/4808-11-0x00007FF7E4B70000-0x00007FF7E4EC1000-memory.dmp	upx
behavioral2/files/0x00070000000235eb-14.dat	upx
behavioral2/files/0x00070000000235ed-30.dat	upx
behavioral2/files/0x00070000000235ee-31.dat	upx
behavioral2/files/0x00070000000235f2-57.dat	upx
behavioral2/memory/3356-67-0x00007FF6C5BA0000-0x00007FF6C5EF1000-memory.dmp	upx
behavioral2/files/0x00070000000235f5-66.dat	upx
behavioral2/files/0x00070000000235f4-65.dat	upx
behavioral2/files/0x00070000000235f3-64.dat	upx
behavioral2/memory/4912-63-0x00007FF6EA170000-0x00007FF6EA4C1000-memory.dmp	upx
behavioral2/memory/4312-60-0x00007FF649250000-0x00007FF6495A1000-memory.dmp	upx
behavioral2/files/0x00070000000235f0-58.dat	upx
behavioral2/files/0x00070000000235ef-49.dat	upx
behavioral2/memory/760-42-0x00007FF7A24F0000-0x00007FF7A2841000-memory.dmp	upx
behavioral2/files/0x00070000000235f1-41.dat	upx
behavioral2/memory/4044-34-0x00007FF70F540000-0x00007FF70F891000-memory.dmp	upx
behavioral2/memory/3672-27-0x00007FF648A30000-0x00007FF648D81000-memory.dmp	upx
behavioral2/files/0x00070000000235ec-23.dat	upx
behavioral2/files/0x00070000000235ea-21.dat	upx
behavioral2/memory/3848-18-0x00007FF65DCA0000-0x00007FF65DFF1000-memory.dmp	upx
behavioral2/files/0x00070000000235f6-84.dat	upx
behavioral2/memory/3728-95-0x00007FF682220000-0x00007FF682571000-memory.dmp	upx
behavioral2/memory/664-107-0x00007FF6C83D0000-0x00007FF6C8721000-memory.dmp	upx
behavioral2/files/0x00070000000235fb-115.dat	upx
behavioral2/files/0x00070000000235fc-123.dat	upx
behavioral2/memory/2404-127-0x00007FF721B50000-0x00007FF721EA1000-memory.dmp	upx
behavioral2/memory/2468-126-0x00007FF79D2C0000-0x00007FF79D611000-memory.dmp	upx
behavioral2/memory/4380-125-0x00007FF76F650000-0x00007FF76F9A1000-memory.dmp	upx
behavioral2/files/0x00070000000235fa-119.dat	upx
behavioral2/memory/1796-118-0x00007FF7D89A0000-0x00007FF7D8CF1000-memory.dmp	upx
behavioral2/memory/4692-117-0x00007FF734480000-0x00007FF7347D1000-memory.dmp	upx
behavioral2/memory/2452-114-0x00007FF766610000-0x00007FF766961000-memory.dmp	upx
behavioral2/memory/1248-109-0x00007FF799480000-0x00007FF7997D1000-memory.dmp	upx
behavioral2/files/0x00070000000235f9-104.dat	upx
behavioral2/files/0x00070000000235f8-102.dat	upx
behavioral2/files/0x00070000000235f7-100.dat	upx
behavioral2/files/0x00080000000235e7-98.dat	upx
behavioral2/memory/2596-91-0x00007FF676580000-0x00007FF6768D1000-memory.dmp	upx
behavioral2/memory/1080-81-0x00007FF7D39B0000-0x00007FF7D3D01000-memory.dmp	upx
behavioral2/memory/4836-80-0x00007FF642900000-0x00007FF642C51000-memory.dmp	upx
behavioral2/memory/824-70-0x00007FF7791C0000-0x00007FF779511000-memory.dmp	upx
behavioral2/memory/3848-130-0x00007FF65DCA0000-0x00007FF65DFF1000-memory.dmp	upx
behavioral2/memory/760-134-0x00007FF7A24F0000-0x00007FF7A2841000-memory.dmp	upx
behavioral2/memory/4312-135-0x00007FF649250000-0x00007FF6495A1000-memory.dmp	upx
behavioral2/memory/824-141-0x00007FF7791C0000-0x00007FF779511000-memory.dmp	upx
behavioral2/memory/4380-147-0x00007FF76F650000-0x00007FF76F9A1000-memory.dmp	upx
behavioral2/memory/664-143-0x00007FF6C83D0000-0x00007FF6C8721000-memory.dmp	upx
behavioral2/memory/3356-140-0x00007FF6C5BA0000-0x00007FF6C5EF1000-memory.dmp	upx
behavioral2/memory/3672-132-0x00007FF648A30000-0x00007FF648D81000-memory.dmp	upx
behavioral2/memory/4808-129-0x00007FF7E4B70000-0x00007FF7E4EC1000-memory.dmp	upx
behavioral2/memory/3856-128-0x00007FF7FE610000-0x00007FF7FE961000-memory.dmp	upx
behavioral2/memory/3856-150-0x00007FF7FE610000-0x00007FF7FE961000-memory.dmp	upx
behavioral2/memory/4808-208-0x00007FF7E4B70000-0x00007FF7E4EC1000-memory.dmp	upx
behavioral2/memory/4044-210-0x00007FF70F540000-0x00007FF70F891000-memory.dmp	upx
behavioral2/memory/3672-212-0x00007FF648A30000-0x00007FF648D81000-memory.dmp	upx
behavioral2/memory/3848-214-0x00007FF65DCA0000-0x00007FF65DFF1000-memory.dmp	upx
behavioral2/memory/4836-216-0x00007FF642900000-0x00007FF642C51000-memory.dmp	upx
behavioral2/memory/4312-218-0x00007FF649250000-0x00007FF6495A1000-memory.dmp	upx
behavioral2/memory/2596-222-0x00007FF676580000-0x00007FF6768D1000-memory.dmp	upx
behavioral2/memory/4912-221-0x00007FF6EA170000-0x00007FF6EA4C1000-memory.dmp	upx
behavioral2/memory/760-226-0x00007FF7A24F0000-0x00007FF7A2841000-memory.dmp	upx
behavioral2/memory/1080-225-0x00007FF7D39B0000-0x00007FF7D3D01000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\TnZoXWc.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\usFVRfh.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\ggrtGAG.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\LbImLLu.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\ODsnpAG.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\DkgFByb.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\uLVdQEy.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\xITUJPM.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\dLyzVXg.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\TfiiOXk.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\oeaJczD.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\oivoLcB.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\tdFtyEQ.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\HITYKSm.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\QGpCoRB.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\cRHxMFv.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\zAnIdit.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\yYjnmMO.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\LwrFufj.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\mSSDfiY.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
File created	C:\Windows\System\SpJkuot.exe	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
Token: SeLockMemoryPrivilege	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 4808	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	91
PID 3856 wrote to memory of 4808	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	91
PID 3856 wrote to memory of 3848	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	92
PID 3856 wrote to memory of 3848	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	92
PID 3856 wrote to memory of 4044	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	93
PID 3856 wrote to memory of 4044	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	93
PID 3856 wrote to memory of 3672	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	94
PID 3856 wrote to memory of 3672	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	94
PID 3856 wrote to memory of 4836	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	95
PID 3856 wrote to memory of 4836	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	95
PID 3856 wrote to memory of 760	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	96
PID 3856 wrote to memory of 760	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	96
PID 3856 wrote to memory of 4312	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	97
PID 3856 wrote to memory of 4312	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	97
PID 3856 wrote to memory of 1080	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	98
PID 3856 wrote to memory of 1080	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	98
PID 3856 wrote to memory of 4912	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	99
PID 3856 wrote to memory of 4912	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	99
PID 3856 wrote to memory of 2596	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	100
PID 3856 wrote to memory of 2596	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	100
PID 3856 wrote to memory of 3728	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	101
PID 3856 wrote to memory of 3728	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	101
PID 3856 wrote to memory of 3356	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	102
PID 3856 wrote to memory of 3356	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	102
PID 3856 wrote to memory of 824	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	103
PID 3856 wrote to memory of 824	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	103
PID 3856 wrote to memory of 4692	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	104
PID 3856 wrote to memory of 4692	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	104
PID 3856 wrote to memory of 664	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	105
PID 3856 wrote to memory of 664	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	105
PID 3856 wrote to memory of 1796	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	106
PID 3856 wrote to memory of 1796	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	106
PID 3856 wrote to memory of 1248	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	107
PID 3856 wrote to memory of 1248	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	107
PID 3856 wrote to memory of 2452	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	108
PID 3856 wrote to memory of 2452	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	108
PID 3856 wrote to memory of 4380	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	109
PID 3856 wrote to memory of 4380	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	109
PID 3856 wrote to memory of 2404	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	110
PID 3856 wrote to memory of 2404	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	110
PID 3856 wrote to memory of 2468	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	111
PID 3856 wrote to memory of 2468	3856	2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe	111

C:\Users\Admin\AppData\Local\Temp\2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024052289bb0a8945c30a2a7e5f8c748f68bc54cobaltstrikecobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\System\tdFtyEQ.exe
  C:\Windows\System\tdFtyEQ.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\HITYKSm.exe
  C:\Windows\System\HITYKSm.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\DkgFByb.exe
  C:\Windows\System\DkgFByb.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\usFVRfh.exe
  C:\Windows\System\usFVRfh.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\QGpCoRB.exe
  C:\Windows\System\QGpCoRB.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\uLVdQEy.exe
  C:\Windows\System\uLVdQEy.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\cRHxMFv.exe
  C:\Windows\System\cRHxMFv.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\yYjnmMO.exe
  C:\Windows\System\yYjnmMO.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\LwrFufj.exe
  C:\Windows\System\LwrFufj.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\mSSDfiY.exe
  C:\Windows\System\mSSDfiY.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\xITUJPM.exe
  C:\Windows\System\xITUJPM.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\SpJkuot.exe
  C:\Windows\System\SpJkuot.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\ggrtGAG.exe
  C:\Windows\System\ggrtGAG.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\dLyzVXg.exe
  C:\Windows\System\dLyzVXg.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\TfiiOXk.exe
  C:\Windows\System\TfiiOXk.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\oeaJczD.exe
  C:\Windows\System\oeaJczD.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\LbImLLu.exe
  C:\Windows\System\LbImLLu.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\ODsnpAG.exe
  C:\Windows\System\ODsnpAG.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\zAnIdit.exe
  C:\Windows\System\zAnIdit.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\oivoLcB.exe
  C:\Windows\System\oivoLcB.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\TnZoXWc.exe
  C:\Windows\System\TnZoXWc.exe
  2⤵
  - Executes dropped EXE
  PID:2468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3416,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
1⤵
PID:3752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DkgFByb.exe

Path C:\Windows\System\DkgFByb.exe
Size 5.2MB
SHA256 a6bda6cb9b63987c5a04a656aa17cd3e503c5b78ff0eaa9b5e344697e48dcd90
MD5 95b4e331bf40000dd082f0f8bd41072d
SHA1 591dbbedadb46d8368005eddb804dd8532620df0
SHA512 acfa0aa173625b9fe69cb3f61f10de220f528133f0188c5789fc596f8ff6c112ad66fd154021b4edff8b916f97df2e5aa23195c454c2e200e55fda404fce23e4
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

HITYKSm.exe

Path C:\Windows\System\HITYKSm.exe
Size 5.2MB
SHA256 c2fe9d5731b692df7357e05ad3af66512a6b1207215716dd310d112588b863ca
MD5 49fbbec3eed76e2f95e6508c79ab1759
SHA1 19a16cd2a79ffa753c5c81ccead4c9eb156d820a
SHA512 72ccd3ec4324716720a134f5c49c3d4f5c463faa01d92a5890cf82c40a44823987774cb3d665b8c6494d4554561cf60d590c217814cf7a1b522bef4deaaae1e8
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lUx
MD5 SHA1 SHA512 SSDEEP

Submit Download

LbImLLu.exe

Path C:\Windows\System\LbImLLu.exe
Size 5.2MB
SHA256 79aec2606c2aa9296d3d5f4c776db5b8a666df29bb12110faf17ca30d4c8c457
MD5 b304e4160148fb7d6222442bb4d09370
SHA1 76696104b29c8c07d6e3941a5e5c41a2cb34150c
SHA512 a97b40dfe313223128f5d48932a7789e0b23154af1883cabcb11a686319c752f488cba31f95061b9b213265dda29f24a894738aad7bae5ce74e55d65515e5fa3
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBibf56utgpPFotBER/mQ32lU9
MD5 SHA1 SHA512 SSDEEP

Submit Download

LwrFufj.exe

Path C:\Windows\System\LwrFufj.exe
Size 5.2MB
SHA256 b97389ea79ad3217c43860d6f53fb33ce75092fc045c72bb53b0d6f919edae49
MD5 6e8dc1d1503ee84540fd97a4698529e6
SHA1 a92150f8e324b56865a454635de807b93a54f037
SHA512 a229a29f7b745c06e4f1c4ea51ec76c403ae6f3bdc8803d1914c8f2df4f6ba1e899159dd4a93053bf49af4e1808e97416a1cd837cd2f4efb9d22913fbc1a3c22
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lUV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ODsnpAG.exe

Path C:\Windows\System\ODsnpAG.exe
Size 5.2MB
SHA256 c3f7e90017d06c56ffdcd18a193b843aa5d39a8ad54a9af680b4aebdf42f999a
MD5 f1fab0a1f8ab73c585fa3af58b0a29ed
SHA1 7bdebe58da60a2663f5df79022ed6fc388a1e9dc
SHA512 7e6e5504f374f5eadca2835eb0036f089d02fb0d7a9d6d6c734c75a936e5ccf663cecd8303d2f0ffd4952e974b8ca8d63e221a9f26edae964c4015b0ad742922
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibf56utgpPFotBER/mQ32lUj
MD5 SHA1 SHA512 SSDEEP

Submit Download

QGpCoRB.exe

Path C:\Windows\System\QGpCoRB.exe
Size 5.2MB
SHA256 14bcdc8a409842c7450d9fdd697fdf157d013d8f896cef32b201ba45b6a0a164
MD5 dac8499b1382a5d36acb37315e10f504
SHA1 f36bed4cc7923e7950078c7c023528506284ccef
SHA512 23af2706f4ad2e8e5993edbf3554a213c6f34ee8b13dc05f757dcaf870556120a57de2012103d5a5a5088c569fa08ad862ba9a0c7ba547092f323bde14e9a493
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lF:RWWBibf56utgpPFotBER/mQ32lUh
MD5 SHA1 SHA512 SSDEEP

Submit Download

SpJkuot.exe

Path C:\Windows\System\SpJkuot.exe
Size 5.2MB
SHA256 92b1bb7afe38ef9d072cf7e6e3441e8a4ce9b8bcdcbbbc7881b4ae5ad574210d
MD5 9f4bfde4fd9b6953da78bf725fadd579
SHA1 c93a8e6fb705c0d27cdbdac88826012b6a687435
SHA512 b7e1302dbe2366fa8c83095e5268ba3b668e72b5578f4aa55e93ea9f6c6c39b6b2f568a4f138af0fffe82b451a0d08a3f25fda83924a49c3c23116ed24af2755
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l5:RWWBibf56utgpPFotBER/mQ32lU9
MD5 SHA1 SHA512 SSDEEP

Submit Download

TfiiOXk.exe

Path C:\Windows\System\TfiiOXk.exe
Size 5.2MB
SHA256 2da54da6f89f8da72b2aab929c63837d4cbb6f5b50f52f693b2a3e66e2eb5723
MD5 c5c558977945249f136b091e73cecef6
SHA1 a71c53deeba35351c14b17f9928034cdb32222df
SHA512 b7b44053c5ecf3927982a45e9307b081f4e7c28749292fab649552bd33b313a05eabc35abbdedff480032a249664ad348ebda74515ec68256a6a6638448caa49
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lj:RWWBibf56utgpPFotBER/mQ32lUf
MD5 SHA1 SHA512 SSDEEP

Submit Download

TnZoXWc.exe

Path C:\Windows\System\TnZoXWc.exe
Size 5.2MB
SHA256 3c41ae16766bd489526af680eaeb4099ae1ce2f7ac41ecfd9212c3d912c49334
MD5 f8b501722181d2d82e0ab6e396a4b950
SHA1 ab87433053d9f37218c62d0dfda120350a604918
SHA512 29295c3e8cafe17f0f05fb13a2aafce981d29376c57fd95782cf7d80a1b7eb589dd869ef61657ac1ab5bb84bd48680609e6c2cc106dc7c67af0fc80f1e5fa249
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lN:RWWBibf56utgpPFotBER/mQ32lUR
MD5 SHA1 SHA512 SSDEEP

Submit Download

cRHxMFv.exe

Path C:\Windows\System\cRHxMFv.exe
Size 5.2MB
SHA256 e9be2809a1cfc1a2db1b17fde7458beacf51878f4ab5430286287a9ba143ba09
MD5 8c8a9a5213745085deb91f37557d0daf
SHA1 88e0cdd334d52492b465753f2598cc31589db6ac
SHA512 d684b2688cc4dcb56c2f99cdbc66aef6fe116e789e179ba67698fd23b9d5a3f8321351f3f874c6c012a58c0cf2fe0523e6a08775f4a34e7cb3364c857a503d58
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lx:RWWBibf56utgpPFotBER/mQ32lUN
MD5 SHA1 SHA512 SSDEEP

Submit Download

dLyzVXg.exe

Path C:\Windows\System\dLyzVXg.exe
Size 5.2MB
SHA256 1c700c41f399d02af5603447b6d8f56b90d7fce33561966c7dc6be60d4604a25
MD5 b5b53e5c6feb994e720bc894ca353bc0
SHA1 fbee6daf9857a2a715edcb038ed3363af2ef8ce6
SHA512 5b1592dabfe52bc90718be4cc4cc89470019ac08240be9638e5c75fdb91ee29ce1666191369ce2e3ca2b2bb7b0087ba04fd3e2de699d6464c61c8542d71baf52
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lU/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ggrtGAG.exe

Path C:\Windows\System\ggrtGAG.exe
Size 5.2MB
SHA256 7f84608c7d3d96166ad51add6ccf40fc366a6b18535a20c9ef7e584028cb35bd
MD5 ee8e117b7e775cff6f1104e18f47887b
SHA1 80e1faed0a9913f53a7e6aaf42bc69cc13d2652e
SHA512 d0d783f335f24ec153906344d11bbeb0e0caa4f6c37b7a4ad90adfa1640050817514786ef010562b243056a27053d3eee18812b4b327e683c5fec14ae588e735
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibf56utgpPFotBER/mQ32lUa
MD5 SHA1 SHA512 SSDEEP

Submit Download

mSSDfiY.exe

Path C:\Windows\System\mSSDfiY.exe
Size 5.2MB
SHA256 21ba9473579a15f6cf1506fa53850e136f5c96f2e4f1723bed5d4c489c4c170d
MD5 05612b6374be4cb2c86d6024b03f6f24
SHA1 aaf2d6a5feb493e53ab9f461a344b3f14145e0d6
SHA512 046880484b92b23405e9d2eea590eae8c28dec9d9e258330ccaaf4c850f2a455fceac51b0837b17b348a93ce222adaeae8865e427f8d07e483f0cf4a12ca32c4
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibf56utgpPFotBER/mQ32lU6
MD5 SHA1 SHA512 SSDEEP

Submit Download

oeaJczD.exe

Path C:\Windows\System\oeaJczD.exe
Size 5.2MB
SHA256 fb7d19451fb222c0aa87afc697bc1a33e61bcbf7c27349423c4201433b8795ad
MD5 4a5b3edcd1934f806f6db0741219ced7
SHA1 b983da17ddb0fd75d7ca0de212c48c7f1fafe7af
SHA512 ef15dec89eac3e74041d19e273d2b414042ad080dffadde7744936f9fb9ead2461c0625b6fd8c560e0c192971e20b9951b29e1a4a2586aa92df639c2542ec42b
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l9:RWWBibf56utgpPFotBER/mQ32lUh
MD5 SHA1 SHA512 SSDEEP

Submit Download

oivoLcB.exe

Path C:\Windows\System\oivoLcB.exe
Size 5.2MB
SHA256 93eb7277b305f4c62a5cfd6a9ebfeb9b3ad719ceb0fec0d4be3b46862c7a8aa4
MD5 dde0c2f767323a7fefdfccd46c2136f5
SHA1 4a3c35ef49d6ec4de95cffd10e811e6ee6ac7aac
SHA512 b84f5b90eef453d1ba53b65ac0df5e93c3000167b9899338e4dea4d13d7fe4c2c023119637e13ae06e2d1a88b6c62fb2be79cd7a90456354f82fff7d7f8aabbd
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUD
MD5 SHA1 SHA512 SSDEEP

Submit Download

tdFtyEQ.exe

Path C:\Windows\System\tdFtyEQ.exe
Size 5.2MB
SHA256 1e40e10f290aff0be4def06a73d952c6b04033f613790f4ae5e05f7d4a79b1bf
MD5 6d5bf3a898be0514afc179f2d3bcff2c
SHA1 5dd441cee79956ca8af232696407f5b0650b5c8e
SHA512 12b28a200761f4b3c836075e081da72e178c36ae78be42e4557bdfc10c2f420e9224012308211e1f7671af02948b0dc176bec44b944d230300245596c9a24c49
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUA
MD5 SHA1 SHA512 SSDEEP

Submit Download

uLVdQEy.exe

Path C:\Windows\System\uLVdQEy.exe
Size 5.2MB
SHA256 6e268ae20037588f4675e621cb09f021b9cfda585a12cbebafb8b09625ad5f21
MD5 24aa8ddb413535943a20988702c3172e
SHA1 721fbc4d3ebe76bd6f1adfedc5a0409d9a4562f7
SHA512 298b4afc35d84bc012216b6609c040f535bd5b8098eedcb4019cc1b5e63655d2f9441bb08318ede18f2ab0273cf66f19b9aa8ab29755f9a5cb47cb9cba442596
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lE:RWWBibf56utgpPFotBER/mQ32lUY
MD5 SHA1 SHA512 SSDEEP

Submit Download

usFVRfh.exe

Path C:\Windows\System\usFVRfh.exe
Size 5.2MB
SHA256 a07cce2c4923a025a6a222968fd17f1f8939f7cd05dde3f52e8ca0511a9764de
MD5 e99aa5b370f0b3c303753c1bb1e7f171
SHA1 523773d3447fbb1aa85599854eaa1366b945ec3a
SHA512 e71aff1ce87e837e9a93ae08aaa741a24987c48d770264168541804c054a8e907b6033c2265ac77befd13bf46c31bb79a30c24cbe5e7d82d0a795e6be36e213e
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6le:RWWBibf56utgpPFotBER/mQ32lUC
MD5 SHA1 SHA512 SSDEEP

Submit Download

xITUJPM.exe

Path C:\Windows\System\xITUJPM.exe
Size 5.2MB
SHA256 fd9ba68517d5ba3a2b29e3ce53a84fc0692dc3eef1d4e7cf3f3c0f3bf0324c9e
MD5 8940f1433651066307c9b7c9428647df
SHA1 719788cc2f07f5a6ab1cbf74294f045d25263799
SHA512 b019778306cc1717b6ebf3d95a8bc8a0e7fa8aa4ba533df37f3c4bfb75d9748ea1efdb292d5d713239e838efb051df2547df78c1d4a703594d55f5ef71b99a11
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lf:RWWBibf56utgpPFotBER/mQ32lU7
MD5 SHA1 SHA512 SSDEEP

Submit Download

yYjnmMO.exe

Path C:\Windows\System\yYjnmMO.exe
Size 5.2MB
SHA256 8707401a469a6c3e41b2ca8f904bfa6f4d3e75f32c5bb0977c670c86b2646712
MD5 c81ee9c812b044d23c53d05d5a14663a
SHA1 1850df7992e7df646fbf191a27b06604dcd44de8
SHA512 1f47d89b895736607399205f4c7f3b652e22f9d2bcaf60e7fcaf54f7fe8cc3acbdac99b786597eeb17d74fd091c42bc248eeff750d58c0ed48488737a573d208
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibf56utgpPFotBER/mQ32lUU
MD5 SHA1 SHA512 SSDEEP

Submit Download

zAnIdit.exe

Path C:\Windows\System\zAnIdit.exe
Size 5.2MB
SHA256 8332fbc127ecdde43fc3af7e955e152b1f9fd8edb31f71fdf330dae42099b900
MD5 8a3e587f4f81a49db2d25115618f037e
SHA1 8bb35b33318fce1d16a010cf712e692ee5b6221a
SHA512 f6a7d8ef3941d80b32e9540bcd51edcc5695340e6d918b6fb4f525832d751798d667ecf886384aab44352c1433307433eb3a76eb51928c284a3e62267cd52856
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibf56utgpPFotBER/mQ32lUC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/664-236-0x00007FF6C83D0000-0x00007FF6C8721000-memory.dmp

Download

memory/664-107-0x00007FF6C83D0000-0x00007FF6C8721000-memory.dmp

Download

memory/664-143-0x00007FF6C83D0000-0x00007FF6C8721000-memory.dmp

Download

memory/760-226-0x00007FF7A24F0000-0x00007FF7A2841000-memory.dmp

Download

memory/760-134-0x00007FF7A24F0000-0x00007FF7A2841000-memory.dmp

Download

memory/760-42-0x00007FF7A24F0000-0x00007FF7A2841000-memory.dmp

Download

memory/824-141-0x00007FF7791C0000-0x00007FF779511000-memory.dmp

Download

memory/824-232-0x00007FF7791C0000-0x00007FF779511000-memory.dmp

Download

memory/824-70-0x00007FF7791C0000-0x00007FF779511000-memory.dmp

Download

memory/1080-81-0x00007FF7D39B0000-0x00007FF7D3D01000-memory.dmp

Download

memory/1080-225-0x00007FF7D39B0000-0x00007FF7D3D01000-memory.dmp

Download

memory/1248-109-0x00007FF799480000-0x00007FF7997D1000-memory.dmp

Download

memory/1248-242-0x00007FF799480000-0x00007FF7997D1000-memory.dmp

Download

memory/1796-235-0x00007FF7D89A0000-0x00007FF7D8CF1000-memory.dmp

Download

memory/1796-118-0x00007FF7D89A0000-0x00007FF7D8CF1000-memory.dmp

Download

memory/2404-127-0x00007FF721B50000-0x00007FF721EA1000-memory.dmp

Download

memory/2404-246-0x00007FF721B50000-0x00007FF721EA1000-memory.dmp

Download

memory/2452-114-0x00007FF766610000-0x00007FF766961000-memory.dmp

Download

memory/2452-240-0x00007FF766610000-0x00007FF766961000-memory.dmp

Download

memory/2468-245-0x00007FF79D2C0000-0x00007FF79D611000-memory.dmp

Download

memory/2468-126-0x00007FF79D2C0000-0x00007FF79D611000-memory.dmp

Download

memory/2596-222-0x00007FF676580000-0x00007FF6768D1000-memory.dmp

Download

memory/2596-91-0x00007FF676580000-0x00007FF6768D1000-memory.dmp

Download

memory/3356-140-0x00007FF6C5BA0000-0x00007FF6C5EF1000-memory.dmp

Download

memory/3356-67-0x00007FF6C5BA0000-0x00007FF6C5EF1000-memory.dmp

Download

memory/3356-229-0x00007FF6C5BA0000-0x00007FF6C5EF1000-memory.dmp

Download

memory/3672-27-0x00007FF648A30000-0x00007FF648D81000-memory.dmp

Download

memory/3672-212-0x00007FF648A30000-0x00007FF648D81000-memory.dmp

Download

memory/3672-132-0x00007FF648A30000-0x00007FF648D81000-memory.dmp

Download

memory/3728-95-0x00007FF682220000-0x00007FF682571000-memory.dmp

Download

memory/3728-230-0x00007FF682220000-0x00007FF682571000-memory.dmp

Download

memory/3848-18-0x00007FF65DCA0000-0x00007FF65DFF1000-memory.dmp

Download

memory/3848-130-0x00007FF65DCA0000-0x00007FF65DFF1000-memory.dmp

Download

memory/3848-214-0x00007FF65DCA0000-0x00007FF65DFF1000-memory.dmp

Download

memory/3856-128-0x00007FF7FE610000-0x00007FF7FE961000-memory.dmp

Download

memory/3856-0-0x00007FF7FE610000-0x00007FF7FE961000-memory.dmp

Download

memory/3856-1-0x000002789C960000-0x000002789C970000-memory.dmp

Download

memory/3856-150-0x00007FF7FE610000-0x00007FF7FE961000-memory.dmp

Download

memory/4044-34-0x00007FF70F540000-0x00007FF70F891000-memory.dmp

Download

memory/4044-210-0x00007FF70F540000-0x00007FF70F891000-memory.dmp

Download

memory/4312-218-0x00007FF649250000-0x00007FF6495A1000-memory.dmp

Download

memory/4312-60-0x00007FF649250000-0x00007FF6495A1000-memory.dmp

Download

memory/4312-135-0x00007FF649250000-0x00007FF6495A1000-memory.dmp

Download

memory/4380-147-0x00007FF76F650000-0x00007FF76F9A1000-memory.dmp

Download

memory/4380-125-0x00007FF76F650000-0x00007FF76F9A1000-memory.dmp

Download

memory/4380-248-0x00007FF76F650000-0x00007FF76F9A1000-memory.dmp

Download

memory/4692-117-0x00007FF734480000-0x00007FF7347D1000-memory.dmp

Download

memory/4692-239-0x00007FF734480000-0x00007FF7347D1000-memory.dmp

Download

memory/4808-208-0x00007FF7E4B70000-0x00007FF7E4EC1000-memory.dmp

Download

memory/4808-11-0x00007FF7E4B70000-0x00007FF7E4EC1000-memory.dmp

Download

memory/4808-129-0x00007FF7E4B70000-0x00007FF7E4EC1000-memory.dmp

Download

memory/4836-80-0x00007FF642900000-0x00007FF642C51000-memory.dmp

Download

memory/4836-216-0x00007FF642900000-0x00007FF642C51000-memory.dmp

Download

memory/4912-221-0x00007FF6EA170000-0x00007FF6EA4C1000-memory.dmp

Download

memory/4912-63-0x00007FF6EA170000-0x00007FF6EA4C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads