cobaltstrike | 54fa64466eb7c52976a8e59e0a3e57bf7a8aa76cb9533b0a0a12f4eceafe2fd0

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240525-lrfdeadd27
SHA256 54fa64466eb7c52976a8e59e0a3e57bf7a8aa76cb9533b0a0a12f4eceafe2fd0
MD5 6d3e56bca15bfb6397515c136b0036ee
SHA1 2fe25fb418c310f195cf8fee94855c78628f95ad
SHA512 6ee6a02e509468c52f67ee7ec69d966c2f47897186ee98c8cbf60eaf67d9ff2f5a34f904908772cc452aa723836805a5dd13f3ad27eb2c28b129589d4603ff05
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x001000000002324d-4.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023268-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023269-11.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326a-22.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023266-29.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326b-36.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326c-41.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326d-46.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326e-52.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326f-57.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023271-62.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023272-67.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023273-72.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023274-77.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023275-82.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023276-87.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023277-92.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023278-97.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023279-102.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002327a-106.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002327b-111.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x001000000002324d-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023268-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023269-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326a-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023266-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326b-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326c-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326d-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326e-52.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326f-57.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023271-62.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023272-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023273-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023274-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023275-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023276-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023277-92.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023278-97.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023279-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002327a-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002327b-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2260-0-0x00007FF70A3B0000-0x00007FF70A704000-memory.dmp	UPX
behavioral2/files/0x001000000002324d-4.dat	UPX
behavioral2/memory/3620-8-0x00007FF76BE60000-0x00007FF76C1B4000-memory.dmp	UPX
behavioral2/files/0x0008000000023268-10.dat	UPX
behavioral2/memory/4992-14-0x00007FF6C4090000-0x00007FF6C43E4000-memory.dmp	UPX
behavioral2/files/0x0007000000023269-11.dat	UPX
behavioral2/files/0x000700000002326a-22.dat	UPX
behavioral2/memory/1976-24-0x00007FF6A1160000-0x00007FF6A14B4000-memory.dmp	UPX
behavioral2/memory/1952-26-0x00007FF7108E0000-0x00007FF710C34000-memory.dmp	UPX
behavioral2/files/0x0008000000023266-29.dat	UPX
behavioral2/memory/4176-32-0x00007FF749AE0000-0x00007FF749E34000-memory.dmp	UPX
behavioral2/files/0x000700000002326b-36.dat	UPX
behavioral2/memory/924-38-0x00007FF6040B0000-0x00007FF604404000-memory.dmp	UPX
behavioral2/files/0x000700000002326c-41.dat	UPX
behavioral2/files/0x000700000002326d-46.dat	UPX
behavioral2/files/0x000700000002326e-52.dat	UPX
behavioral2/files/0x000700000002326f-57.dat	UPX
behavioral2/files/0x0007000000023271-62.dat	UPX
behavioral2/files/0x0007000000023272-67.dat	UPX
behavioral2/files/0x0007000000023273-72.dat	UPX
behavioral2/files/0x0007000000023274-77.dat	UPX
behavioral2/files/0x0007000000023275-82.dat	UPX
behavioral2/files/0x0007000000023276-87.dat	UPX
behavioral2/files/0x0007000000023277-92.dat	UPX
behavioral2/files/0x0007000000023278-97.dat	UPX
behavioral2/files/0x0007000000023279-102.dat	UPX
behavioral2/files/0x000700000002327a-106.dat	UPX
behavioral2/files/0x000700000002327b-111.dat	UPX
behavioral2/memory/772-113-0x00007FF71AB70000-0x00007FF71AEC4000-memory.dmp	UPX
behavioral2/memory/5448-114-0x00007FF791040000-0x00007FF791394000-memory.dmp	UPX
behavioral2/memory/5772-115-0x00007FF733600000-0x00007FF733954000-memory.dmp	UPX
behavioral2/memory/5340-116-0x00007FF79C730000-0x00007FF79CA84000-memory.dmp	UPX
behavioral2/memory/5376-117-0x00007FF6BAF80000-0x00007FF6BB2D4000-memory.dmp	UPX
behavioral2/memory/4608-119-0x00007FF6B7D60000-0x00007FF6B80B4000-memory.dmp	UPX
behavioral2/memory/4168-120-0x00007FF6F0BF0000-0x00007FF6F0F44000-memory.dmp	UPX
behavioral2/memory/5960-122-0x00007FF7C8EA0000-0x00007FF7C91F4000-memory.dmp	UPX
behavioral2/memory/5900-123-0x00007FF6BE5E0000-0x00007FF6BE934000-memory.dmp	UPX
behavioral2/memory/5988-125-0x00007FF6A9DE0000-0x00007FF6AA134000-memory.dmp	UPX
behavioral2/memory/5956-124-0x00007FF60A080000-0x00007FF60A3D4000-memory.dmp	UPX
behavioral2/memory/3592-126-0x00007FF6311E0000-0x00007FF631534000-memory.dmp	UPX
behavioral2/memory/4860-121-0x00007FF7CE1B0000-0x00007FF7CE504000-memory.dmp	UPX
behavioral2/memory/5316-118-0x00007FF73C850000-0x00007FF73CBA4000-memory.dmp	UPX
behavioral2/memory/5416-127-0x00007FF6F6A00000-0x00007FF6F6D54000-memory.dmp	UPX
behavioral2/memory/2260-128-0x00007FF70A3B0000-0x00007FF70A704000-memory.dmp	UPX
behavioral2/memory/3620-129-0x00007FF76BE60000-0x00007FF76C1B4000-memory.dmp	UPX
behavioral2/memory/4992-130-0x00007FF6C4090000-0x00007FF6C43E4000-memory.dmp	UPX
behavioral2/memory/772-131-0x00007FF71AB70000-0x00007FF71AEC4000-memory.dmp	UPX
behavioral2/memory/3620-132-0x00007FF76BE60000-0x00007FF76C1B4000-memory.dmp	UPX
behavioral2/memory/4992-133-0x00007FF6C4090000-0x00007FF6C43E4000-memory.dmp	UPX
behavioral2/memory/1976-134-0x00007FF6A1160000-0x00007FF6A14B4000-memory.dmp	UPX
behavioral2/memory/1952-135-0x00007FF7108E0000-0x00007FF710C34000-memory.dmp	UPX
behavioral2/memory/4176-136-0x00007FF749AE0000-0x00007FF749E34000-memory.dmp	UPX
behavioral2/memory/924-137-0x00007FF6040B0000-0x00007FF604404000-memory.dmp	UPX
behavioral2/memory/772-138-0x00007FF71AB70000-0x00007FF71AEC4000-memory.dmp	UPX
behavioral2/memory/5416-139-0x00007FF6F6A00000-0x00007FF6F6D54000-memory.dmp	UPX
behavioral2/memory/5448-140-0x00007FF791040000-0x00007FF791394000-memory.dmp	UPX
behavioral2/memory/5772-141-0x00007FF733600000-0x00007FF733954000-memory.dmp	UPX
behavioral2/memory/5340-142-0x00007FF79C730000-0x00007FF79CA84000-memory.dmp	UPX
behavioral2/memory/5376-143-0x00007FF6BAF80000-0x00007FF6BB2D4000-memory.dmp	UPX
behavioral2/memory/5316-144-0x00007FF73C850000-0x00007FF73CBA4000-memory.dmp	UPX
behavioral2/memory/4608-145-0x00007FF6B7D60000-0x00007FF6B80B4000-memory.dmp	UPX
behavioral2/memory/4168-146-0x00007FF6F0BF0000-0x00007FF6F0F44000-memory.dmp	UPX
behavioral2/memory/4860-147-0x00007FF7CE1B0000-0x00007FF7CE504000-memory.dmp	UPX
behavioral2/memory/5960-148-0x00007FF7C8EA0000-0x00007FF7C91F4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2260-0-0x00007FF70A3B0000-0x00007FF70A704000-memory.dmp	xmrig
behavioral2/files/0x001000000002324d-4.dat	xmrig
behavioral2/memory/3620-8-0x00007FF76BE60000-0x00007FF76C1B4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023268-10.dat	xmrig
behavioral2/memory/4992-14-0x00007FF6C4090000-0x00007FF6C43E4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023269-11.dat	xmrig
behavioral2/files/0x000700000002326a-22.dat	xmrig
behavioral2/memory/1976-24-0x00007FF6A1160000-0x00007FF6A14B4000-memory.dmp	xmrig
behavioral2/memory/1952-26-0x00007FF7108E0000-0x00007FF710C34000-memory.dmp	xmrig
behavioral2/files/0x0008000000023266-29.dat	xmrig
behavioral2/memory/4176-32-0x00007FF749AE0000-0x00007FF749E34000-memory.dmp	xmrig
behavioral2/files/0x000700000002326b-36.dat	xmrig
behavioral2/memory/924-38-0x00007FF6040B0000-0x00007FF604404000-memory.dmp	xmrig
behavioral2/files/0x000700000002326c-41.dat	xmrig
behavioral2/files/0x000700000002326d-46.dat	xmrig
behavioral2/files/0x000700000002326e-52.dat	xmrig
behavioral2/files/0x000700000002326f-57.dat	xmrig
behavioral2/files/0x0007000000023271-62.dat	xmrig
behavioral2/files/0x0007000000023272-67.dat	xmrig
behavioral2/files/0x0007000000023273-72.dat	xmrig
behavioral2/files/0x0007000000023274-77.dat	xmrig
behavioral2/files/0x0007000000023275-82.dat	xmrig
behavioral2/files/0x0007000000023276-87.dat	xmrig
behavioral2/files/0x0007000000023277-92.dat	xmrig
behavioral2/files/0x0007000000023278-97.dat	xmrig
behavioral2/files/0x0007000000023279-102.dat	xmrig
behavioral2/files/0x000700000002327a-106.dat	xmrig
behavioral2/files/0x000700000002327b-111.dat	xmrig
behavioral2/memory/772-113-0x00007FF71AB70000-0x00007FF71AEC4000-memory.dmp	xmrig
behavioral2/memory/5448-114-0x00007FF791040000-0x00007FF791394000-memory.dmp	xmrig
behavioral2/memory/5772-115-0x00007FF733600000-0x00007FF733954000-memory.dmp	xmrig
behavioral2/memory/5340-116-0x00007FF79C730000-0x00007FF79CA84000-memory.dmp	xmrig
behavioral2/memory/5376-117-0x00007FF6BAF80000-0x00007FF6BB2D4000-memory.dmp	xmrig
behavioral2/memory/4608-119-0x00007FF6B7D60000-0x00007FF6B80B4000-memory.dmp	xmrig
behavioral2/memory/4168-120-0x00007FF6F0BF0000-0x00007FF6F0F44000-memory.dmp	xmrig
behavioral2/memory/5960-122-0x00007FF7C8EA0000-0x00007FF7C91F4000-memory.dmp	xmrig
behavioral2/memory/5900-123-0x00007FF6BE5E0000-0x00007FF6BE934000-memory.dmp	xmrig
behavioral2/memory/5988-125-0x00007FF6A9DE0000-0x00007FF6AA134000-memory.dmp	xmrig
behavioral2/memory/5956-124-0x00007FF60A080000-0x00007FF60A3D4000-memory.dmp	xmrig
behavioral2/memory/3592-126-0x00007FF6311E0000-0x00007FF631534000-memory.dmp	xmrig
behavioral2/memory/4860-121-0x00007FF7CE1B0000-0x00007FF7CE504000-memory.dmp	xmrig
behavioral2/memory/5316-118-0x00007FF73C850000-0x00007FF73CBA4000-memory.dmp	xmrig
behavioral2/memory/5416-127-0x00007FF6F6A00000-0x00007FF6F6D54000-memory.dmp	xmrig
behavioral2/memory/2260-128-0x00007FF70A3B0000-0x00007FF70A704000-memory.dmp	xmrig
behavioral2/memory/3620-129-0x00007FF76BE60000-0x00007FF76C1B4000-memory.dmp	xmrig
behavioral2/memory/4992-130-0x00007FF6C4090000-0x00007FF6C43E4000-memory.dmp	xmrig
behavioral2/memory/772-131-0x00007FF71AB70000-0x00007FF71AEC4000-memory.dmp	xmrig
behavioral2/memory/3620-132-0x00007FF76BE60000-0x00007FF76C1B4000-memory.dmp	xmrig
behavioral2/memory/4992-133-0x00007FF6C4090000-0x00007FF6C43E4000-memory.dmp	xmrig
behavioral2/memory/1976-134-0x00007FF6A1160000-0x00007FF6A14B4000-memory.dmp	xmrig
behavioral2/memory/1952-135-0x00007FF7108E0000-0x00007FF710C34000-memory.dmp	xmrig
behavioral2/memory/4176-136-0x00007FF749AE0000-0x00007FF749E34000-memory.dmp	xmrig
behavioral2/memory/924-137-0x00007FF6040B0000-0x00007FF604404000-memory.dmp	xmrig
behavioral2/memory/772-138-0x00007FF71AB70000-0x00007FF71AEC4000-memory.dmp	xmrig
behavioral2/memory/5416-139-0x00007FF6F6A00000-0x00007FF6F6D54000-memory.dmp	xmrig
behavioral2/memory/5448-140-0x00007FF791040000-0x00007FF791394000-memory.dmp	xmrig
behavioral2/memory/5772-141-0x00007FF733600000-0x00007FF733954000-memory.dmp	xmrig
behavioral2/memory/5340-142-0x00007FF79C730000-0x00007FF79CA84000-memory.dmp	xmrig
behavioral2/memory/5376-143-0x00007FF6BAF80000-0x00007FF6BB2D4000-memory.dmp	xmrig
behavioral2/memory/5316-144-0x00007FF73C850000-0x00007FF73CBA4000-memory.dmp	xmrig
behavioral2/memory/4608-145-0x00007FF6B7D60000-0x00007FF6B80B4000-memory.dmp	xmrig
behavioral2/memory/4168-146-0x00007FF6F0BF0000-0x00007FF6F0F44000-memory.dmp	xmrig
behavioral2/memory/4860-147-0x00007FF7CE1B0000-0x00007FF7CE504000-memory.dmp	xmrig
behavioral2/memory/5960-148-0x00007FF7C8EA0000-0x00007FF7C91F4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3620	WCkfCgI.exe
4992	MdiXhGY.exe
1976	AcuYiNq.exe
1952	Gtwparz.exe
4176	bXXTZCL.exe
924	JfgrAma.exe
772	yygCbsG.exe
5416	DVCZctc.exe
5448	NrSDasY.exe
5772	cZldjYs.exe
5340	xMEJNLF.exe
5376	acubFwy.exe
5316	camjykP.exe
4608	PRLIWxD.exe
4168	TzNRAVO.exe
4860	znwMOkM.exe
5960	aOUbRFL.exe
5900	BKpnRQb.exe
5956	MmRmqiF.exe
5988	XDwKwKa.exe
3592	pWIEGkY.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2260-0-0x00007FF70A3B0000-0x00007FF70A704000-memory.dmp	upx
behavioral2/files/0x001000000002324d-4.dat	upx
behavioral2/memory/3620-8-0x00007FF76BE60000-0x00007FF76C1B4000-memory.dmp	upx
behavioral2/files/0x0008000000023268-10.dat	upx
behavioral2/memory/4992-14-0x00007FF6C4090000-0x00007FF6C43E4000-memory.dmp	upx
behavioral2/files/0x0007000000023269-11.dat	upx
behavioral2/files/0x000700000002326a-22.dat	upx
behavioral2/memory/1976-24-0x00007FF6A1160000-0x00007FF6A14B4000-memory.dmp	upx
behavioral2/memory/1952-26-0x00007FF7108E0000-0x00007FF710C34000-memory.dmp	upx
behavioral2/files/0x0008000000023266-29.dat	upx
behavioral2/memory/4176-32-0x00007FF749AE0000-0x00007FF749E34000-memory.dmp	upx
behavioral2/files/0x000700000002326b-36.dat	upx
behavioral2/memory/924-38-0x00007FF6040B0000-0x00007FF604404000-memory.dmp	upx
behavioral2/files/0x000700000002326c-41.dat	upx
behavioral2/files/0x000700000002326d-46.dat	upx
behavioral2/files/0x000700000002326e-52.dat	upx
behavioral2/files/0x000700000002326f-57.dat	upx
behavioral2/files/0x0007000000023271-62.dat	upx
behavioral2/files/0x0007000000023272-67.dat	upx
behavioral2/files/0x0007000000023273-72.dat	upx
behavioral2/files/0x0007000000023274-77.dat	upx
behavioral2/files/0x0007000000023275-82.dat	upx
behavioral2/files/0x0007000000023276-87.dat	upx
behavioral2/files/0x0007000000023277-92.dat	upx
behavioral2/files/0x0007000000023278-97.dat	upx
behavioral2/files/0x0007000000023279-102.dat	upx
behavioral2/files/0x000700000002327a-106.dat	upx
behavioral2/files/0x000700000002327b-111.dat	upx
behavioral2/memory/772-113-0x00007FF71AB70000-0x00007FF71AEC4000-memory.dmp	upx
behavioral2/memory/5448-114-0x00007FF791040000-0x00007FF791394000-memory.dmp	upx
behavioral2/memory/5772-115-0x00007FF733600000-0x00007FF733954000-memory.dmp	upx
behavioral2/memory/5340-116-0x00007FF79C730000-0x00007FF79CA84000-memory.dmp	upx
behavioral2/memory/5376-117-0x00007FF6BAF80000-0x00007FF6BB2D4000-memory.dmp	upx
behavioral2/memory/4608-119-0x00007FF6B7D60000-0x00007FF6B80B4000-memory.dmp	upx
behavioral2/memory/4168-120-0x00007FF6F0BF0000-0x00007FF6F0F44000-memory.dmp	upx
behavioral2/memory/5960-122-0x00007FF7C8EA0000-0x00007FF7C91F4000-memory.dmp	upx
behavioral2/memory/5900-123-0x00007FF6BE5E0000-0x00007FF6BE934000-memory.dmp	upx
behavioral2/memory/5988-125-0x00007FF6A9DE0000-0x00007FF6AA134000-memory.dmp	upx
behavioral2/memory/5956-124-0x00007FF60A080000-0x00007FF60A3D4000-memory.dmp	upx
behavioral2/memory/3592-126-0x00007FF6311E0000-0x00007FF631534000-memory.dmp	upx
behavioral2/memory/4860-121-0x00007FF7CE1B0000-0x00007FF7CE504000-memory.dmp	upx
behavioral2/memory/5316-118-0x00007FF73C850000-0x00007FF73CBA4000-memory.dmp	upx
behavioral2/memory/5416-127-0x00007FF6F6A00000-0x00007FF6F6D54000-memory.dmp	upx
behavioral2/memory/2260-128-0x00007FF70A3B0000-0x00007FF70A704000-memory.dmp	upx
behavioral2/memory/3620-129-0x00007FF76BE60000-0x00007FF76C1B4000-memory.dmp	upx
behavioral2/memory/4992-130-0x00007FF6C4090000-0x00007FF6C43E4000-memory.dmp	upx
behavioral2/memory/772-131-0x00007FF71AB70000-0x00007FF71AEC4000-memory.dmp	upx
behavioral2/memory/3620-132-0x00007FF76BE60000-0x00007FF76C1B4000-memory.dmp	upx
behavioral2/memory/4992-133-0x00007FF6C4090000-0x00007FF6C43E4000-memory.dmp	upx
behavioral2/memory/1976-134-0x00007FF6A1160000-0x00007FF6A14B4000-memory.dmp	upx
behavioral2/memory/1952-135-0x00007FF7108E0000-0x00007FF710C34000-memory.dmp	upx
behavioral2/memory/4176-136-0x00007FF749AE0000-0x00007FF749E34000-memory.dmp	upx
behavioral2/memory/924-137-0x00007FF6040B0000-0x00007FF604404000-memory.dmp	upx
behavioral2/memory/772-138-0x00007FF71AB70000-0x00007FF71AEC4000-memory.dmp	upx
behavioral2/memory/5416-139-0x00007FF6F6A00000-0x00007FF6F6D54000-memory.dmp	upx
behavioral2/memory/5448-140-0x00007FF791040000-0x00007FF791394000-memory.dmp	upx
behavioral2/memory/5772-141-0x00007FF733600000-0x00007FF733954000-memory.dmp	upx
behavioral2/memory/5340-142-0x00007FF79C730000-0x00007FF79CA84000-memory.dmp	upx
behavioral2/memory/5376-143-0x00007FF6BAF80000-0x00007FF6BB2D4000-memory.dmp	upx
behavioral2/memory/5316-144-0x00007FF73C850000-0x00007FF73CBA4000-memory.dmp	upx
behavioral2/memory/4608-145-0x00007FF6B7D60000-0x00007FF6B80B4000-memory.dmp	upx
behavioral2/memory/4168-146-0x00007FF6F0BF0000-0x00007FF6F0F44000-memory.dmp	upx
behavioral2/memory/4860-147-0x00007FF7CE1B0000-0x00007FF7CE504000-memory.dmp	upx
behavioral2/memory/5960-148-0x00007FF7C8EA0000-0x00007FF7C91F4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\znwMOkM.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MmRmqiF.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XDwKwKa.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pWIEGkY.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WCkfCgI.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bXXTZCL.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NrSDasY.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yygCbsG.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\acubFwy.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aOUbRFL.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BKpnRQb.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AcuYiNq.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DVCZctc.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\cZldjYs.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xMEJNLF.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\camjykP.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PRLIWxD.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TzNRAVO.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MdiXhGY.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\Gtwparz.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JfgrAma.exe	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 3620	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	92
PID 2260 wrote to memory of 3620	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	92
PID 2260 wrote to memory of 4992	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	93
PID 2260 wrote to memory of 4992	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	93
PID 2260 wrote to memory of 1976	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	94
PID 2260 wrote to memory of 1976	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	94
PID 2260 wrote to memory of 1952	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	95
PID 2260 wrote to memory of 1952	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	95
PID 2260 wrote to memory of 4176	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	96
PID 2260 wrote to memory of 4176	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	96
PID 2260 wrote to memory of 924	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	97
PID 2260 wrote to memory of 924	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	97
PID 2260 wrote to memory of 772	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	98
PID 2260 wrote to memory of 772	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	98
PID 2260 wrote to memory of 5416	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	99
PID 2260 wrote to memory of 5416	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	99
PID 2260 wrote to memory of 5448	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	100
PID 2260 wrote to memory of 5448	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	100
PID 2260 wrote to memory of 5772	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	101
PID 2260 wrote to memory of 5772	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	101
PID 2260 wrote to memory of 5340	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	102
PID 2260 wrote to memory of 5340	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	102
PID 2260 wrote to memory of 5376	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	103
PID 2260 wrote to memory of 5376	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	103
PID 2260 wrote to memory of 5316	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	104
PID 2260 wrote to memory of 5316	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	104
PID 2260 wrote to memory of 4608	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	105
PID 2260 wrote to memory of 4608	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	105
PID 2260 wrote to memory of 4168	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	106
PID 2260 wrote to memory of 4168	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	106
PID 2260 wrote to memory of 4860	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	107
PID 2260 wrote to memory of 4860	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	107
PID 2260 wrote to memory of 5960	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	108
PID 2260 wrote to memory of 5960	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	108
PID 2260 wrote to memory of 5900	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	109
PID 2260 wrote to memory of 5900	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	109
PID 2260 wrote to memory of 5956	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	110
PID 2260 wrote to memory of 5956	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	110
PID 2260 wrote to memory of 5988	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	111
PID 2260 wrote to memory of 5988	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	111
PID 2260 wrote to memory of 3592	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	112
PID 2260 wrote to memory of 3592	2260	2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe	112

C:\Users\Admin\AppData\Local\Temp\2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-25_6d3e56bca15bfb6397515c136b0036ee_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\System\WCkfCgI.exe
  C:\Windows\System\WCkfCgI.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\MdiXhGY.exe
  C:\Windows\System\MdiXhGY.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\AcuYiNq.exe
  C:\Windows\System\AcuYiNq.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\Gtwparz.exe
  C:\Windows\System\Gtwparz.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\bXXTZCL.exe
  C:\Windows\System\bXXTZCL.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\JfgrAma.exe
  C:\Windows\System\JfgrAma.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\yygCbsG.exe
  C:\Windows\System\yygCbsG.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\DVCZctc.exe
  C:\Windows\System\DVCZctc.exe
  2⤵
  - Executes dropped EXE
  PID:5416
- C:\Windows\System\NrSDasY.exe
  C:\Windows\System\NrSDasY.exe
  2⤵
  - Executes dropped EXE
  PID:5448
- C:\Windows\System\cZldjYs.exe
  C:\Windows\System\cZldjYs.exe
  2⤵
  - Executes dropped EXE
  PID:5772
- C:\Windows\System\xMEJNLF.exe
  C:\Windows\System\xMEJNLF.exe
  2⤵
  - Executes dropped EXE
  PID:5340
- C:\Windows\System\acubFwy.exe
  C:\Windows\System\acubFwy.exe
  2⤵
  - Executes dropped EXE
  PID:5376
- C:\Windows\System\camjykP.exe
  C:\Windows\System\camjykP.exe
  2⤵
  - Executes dropped EXE
  PID:5316
- C:\Windows\System\PRLIWxD.exe
  C:\Windows\System\PRLIWxD.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\TzNRAVO.exe
  C:\Windows\System\TzNRAVO.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\znwMOkM.exe
  C:\Windows\System\znwMOkM.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\aOUbRFL.exe
  C:\Windows\System\aOUbRFL.exe
  2⤵
  - Executes dropped EXE
  PID:5960
- C:\Windows\System\BKpnRQb.exe
  C:\Windows\System\BKpnRQb.exe
  2⤵
  - Executes dropped EXE
  PID:5900
- C:\Windows\System\MmRmqiF.exe
  C:\Windows\System\MmRmqiF.exe
  2⤵
  - Executes dropped EXE
  PID:5956
- C:\Windows\System\XDwKwKa.exe
  C:\Windows\System\XDwKwKa.exe
  2⤵
  - Executes dropped EXE
  PID:5988
- C:\Windows\System\pWIEGkY.exe
  C:\Windows\System\pWIEGkY.exe
  2⤵
  - Executes dropped EXE
  PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3892 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:3396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AcuYiNq.exe

Path C:\Windows\System\AcuYiNq.exe
Size 5.9MB
SHA256 17649cca3fab9d8d8de372dce5dc53a1eb8baa917fc3d39eed5a6cbc9df19b92
MD5 31ec8dcc6cc8422eca5db16e02ce7e66
SHA1 d07193a716cca9d76d87652a3e142980fb4ec5bf
SHA512 19973bac4d542fd7e0bb8216dc8f3ea8a07a595948de5f23ddc5a37fbd20c66f31438c4ec32739a7c9b263f2d9527ceb4d18f64998033553189f5d515f462dab
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

BKpnRQb.exe

Path C:\Windows\System\BKpnRQb.exe
Size 5.9MB
SHA256 fc39a133a661d6710691866627fbcc825fd238968e3506f2d36ec4eb23849c86
MD5 6b24db213aa5cb97a261911b5cb045e4
SHA1 c3b7ea6fbffa439c90cfbcfb1d6f22bb47ee17fb
SHA512 8dcc39aa62a582dd7c3c601755951f3d61349850a9377f2baacbef777202009924640a767e5a0e511e35431021a85b6d709a42b607fb708e490af2a4ac3549c4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

DVCZctc.exe

Path C:\Windows\System\DVCZctc.exe
Size 5.9MB
SHA256 d8178f8162979ade3e264c99eda3120dc21ced18044cf29674e549d69f0ae093
MD5 d7f4fb4d877b5a453af0d8c6b46f63fa
SHA1 bc863bfed4f5573c5857547b43f041fdec7367f5
SHA512 dbc51373ff945633e2d1f2b8f3676624d7cf048a92f7fa9a79f301dd1080b747d56b39fc1bd9fae994c9afcbee7cefd78dc9e8eb5a33c776531b0a8623236348
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gtwparz.exe

Path C:\Windows\System\Gtwparz.exe
Size 5.9MB
SHA256 123ef949106e77c204400eb12392634c47c0354cec6c0b77ace0c2abffa34f96
MD5 2dbcc9636ca5ccd76f53727f408defb6
SHA1 deaa0ea817b5e16f395dac5505c32ec1156bf1fa
SHA512 c7e9da7f2b1dde5e92d316b4dd97533e433a3995e3552ead27af8adcebb86b8d4c7ccf2542cf4de7bb5b85cdfb1265971ad91e15eec1777b532483c594827336
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

JfgrAma.exe

Path C:\Windows\System\JfgrAma.exe
Size 5.9MB
SHA256 ff13cd99c66fcfd28904b5b92541949e037fd8c3f0f73d41edd379a490dc2fb5
MD5 b4052f2c669951893dc2ffa6e685ba1f
SHA1 9a6ecbe297dbf042144dd74e65500bec9d43de20
SHA512 8d41e66042d00826258e441ebb674080f776736fc375ed88870f160edd01ab47c4a104287dbe02026e337b8a6d90f35b44f27552f6d6f5a42e6e0feab63845f6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

MdiXhGY.exe

Path C:\Windows\System\MdiXhGY.exe
Size 5.9MB
SHA256 da0f8dd6156b067a509b5b825d7e679c666069bd429cf928643257733d75739d
MD5 81afeedac9a267997cdfdc1e7eba73a7
SHA1 076faa1faaa9781fc877a3febae7d06732e7a94c
SHA512 0d94b5bf465d6e48667a4429f86ac84fe6f49c885a3009ebd8bf66e2778f51270b8ac3bccf184b34f1425f41450c310c302cfcfad29168203fa054301b7ed70e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

MmRmqiF.exe

Path C:\Windows\System\MmRmqiF.exe
Size 5.9MB
SHA256 abd8b2fa9dc5e0e712fc609cfffba0e2ef1d8129c69db3ad3635ee6745bb8b92
MD5 b49fd7ff9aaa98a327747fdf8acf473e
SHA1 f2e00bd6d0727986078e09fe30a4e5de73893e15
SHA512 79d6f305745ba356ecce1394a8668e87ad262ba816e0c836239b6ab18cb5210a77d57602b15002bd16e4073876add87f9b12319268ea9b2a2dc88549556945c7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

NrSDasY.exe

Path C:\Windows\System\NrSDasY.exe
Size 5.9MB
SHA256 28a0de00b808dd0ba792cecfde0360f1fb29ac4169d276f8225608652b210f94
MD5 82e30339e02a39582243254ba0c7eb7d
SHA1 b20fef42d5e74783525ff9b2bb18672367150645
SHA512 7d182ff1df6e0b9883d4c445502ad88a1c3999a636e4b1b399685f4f265f6e6b58be95996eb8d40afbece2234c17ce43d35d55508454d1758cf1eac6184e7050
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

PRLIWxD.exe

Path C:\Windows\System\PRLIWxD.exe
Size 5.9MB
SHA256 fd896804da706cb6b4e9f5067353f74a556b70895f2287c5fa00b4838551d422
MD5 2459f32c08abca6a8a8ef4e9436749f5
SHA1 7ac2703d614cb24cffaf06d9dbfe1e07195c41c6
SHA512 1ffb44677b2e99fb2b60265fc4ad9184215bba2e7e52536ee89a95e641a9c59f71a489230599e18224d041b7aa77a759f70b315c74ef65ad168cebb2cec40b58
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:Q+856utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

TzNRAVO.exe

Path C:\Windows\System\TzNRAVO.exe
Size 5.9MB
SHA256 477f1ad39521d31743f795de08e77abec3bbba4a6f8587ad1f7f7823bb2975b2
MD5 10fdc0eab729e2b706205d0157b4cf90
SHA1 8d27652601e16ac70db4b15615938d2cdd499e28
SHA512 7ccf9723c206c52d7e13c26287821f9db23af65189da9b121747216d2699ad1ebc8952d79e4ae794e1933caad5e3be8265795d787667b843ec9f0dbf619b3177
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

WCkfCgI.exe

Path C:\Windows\System\WCkfCgI.exe
Size 5.9MB
SHA256 d250446c2c61b269e3fead8804c1dce96e8453f863064820f1a2ce8087c2fba2
MD5 1345b68fe06c99b02f4a4026e2bcc996
SHA1 c1fd41db341bc33e6d03db1bea01278ae3f4a410
SHA512 cc553d8c774f431927dad41723af27ec80a096342ce81612914a720aeacee89509754c84b2ec0829476c382fb6110f51e6c2beef493d19d0e7724833250de734
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

XDwKwKa.exe

Path C:\Windows\System\XDwKwKa.exe
Size 5.9MB
SHA256 c8c38cfa86530029fc9d376b4abc65729ff47da57633058af3b529ae87d9633e
MD5 368110afb52b26b35473dec95ca28fde
SHA1 9e5427a27b146bb866bac02a68c88953049b9d6d
SHA512 7786f49e97c43bc58c867b22b87946be65c9e1b2353a8a261602cbac01b7541594210c51b9c201360ea1cfae93b790f6d0351affe70d7aa7065574e0ef1eb008
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

aOUbRFL.exe

Path C:\Windows\System\aOUbRFL.exe
Size 5.9MB
SHA256 94cf1cfcfc71142275947fb65c81f3a750bb2c3d86aca125cc921764f76e3ec8
MD5 f5e0d4da937a7728b66015342681a684
SHA1 ec42b67e1ebecdd5100f4bbffcbae1e586947150
SHA512 8717c72f1e7a5635c4ee2cdc3a1ef5aae6b8830d69f7909ba54c62d3680d3463bed7891bea6872f95cb27a49c61c9055785560ea7268d73c8b3e0d3474d7ff30
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

acubFwy.exe

Path C:\Windows\System\acubFwy.exe
Size 5.9MB
SHA256 73c7f12b53e93673e8082331bc9443eb1e9450c7b22912f7a32f87e11dbe3d76
MD5 ef44bc4ff73148a5f2c760b9f7c67407
SHA1 4dcd08cf1d41bd7f92031050f338ef46b6b42668
SHA512 40e9c121bff35ff5e117d413de14975c807b9067f280a887c4bccf7a8e749b3a283a67c4d11999992976d4e0da7af518b2ba21c3e9985562c7db296368e6b6e6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

bXXTZCL.exe

Path C:\Windows\System\bXXTZCL.exe
Size 5.9MB
SHA256 357fa5534822405013a87da7300332684e5b91b5b3ab176f58ff2c897b98368e
MD5 d293a83a08fd4c276f1bf24549a19555
SHA1 d502152af9c1bfece176414ca527d7e6b72974d8
SHA512 5d4e89576278ced8003feb76633b64c0bf912698897d424c5470dc150bc069884968d138e66de45870bd6150189e40aceebdbc8a3cd4cc20f7040715b4081389
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

cZldjYs.exe

Path C:\Windows\System\cZldjYs.exe
Size 5.9MB
SHA256 1ea7238d790233e9c1e0f768413cd64ba4a92eac18d08ba64f13d7dab0dd6458
MD5 9c1425ce5e7c9bb38e3586ddf35e4aa2
SHA1 ccf677e7080f613dfc3dfef5dabe0241951d3421
SHA512 460ba203f8a1d8f4d70b6def4700c85e5860b1075bc59b5edf3177f045dee640959972bfd0598ba8c9b1206aeb58736cbdc58c9b86601edf14bfba64f12d29e2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

camjykP.exe

Path C:\Windows\System\camjykP.exe
Size 5.9MB
SHA256 ad47e39e73b47806dee75e8c898486baa40ce0bab36e7507b822c1846a946d32
MD5 640a3743714692cb56feb6b30ca0cf01
SHA1 ecb74bcd7308b4297b789f60e8a2b84a7dafb56c
SHA512 ab531421cec81e60041ab2fa99eb1eddd1e40fb104cd6a83bb3fd968cdfa41df5851e170c382ad1574f5019e968504ad12a69398111d4664e3cfed8720fed81a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

pWIEGkY.exe

Path C:\Windows\System\pWIEGkY.exe
Size 5.9MB
SHA256 b9c72983eba5bf595e3f8ef65ef63e6c4b7d5fdf32a719a02f0e8bd7ce3ad4ff
MD5 54954bd6088d3114fb75064adcbabb3e
SHA1 394657872c96ec20439c492dd71f1b32ccbf4beb
SHA512 00985d1e0551e7e69da383e6b22eb53f45567b53d1019e28a60bb1cf543646e19488ed461e9f4b88668fd1ac86abecaac504450819ae72ad94e8ae3f5e3eb676
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

xMEJNLF.exe

Path C:\Windows\System\xMEJNLF.exe
Size 5.9MB
SHA256 a7644c35f8342c4ff7f0732ed27e619652e844c5bb01cf1cc6fb62c7f098f8b6
MD5 0d87301a0016e6883d7bbdb66a379072
SHA1 ddf26b5f37ff22f646c21dee095ae42e3b6e0292
SHA512 d066267307a9efcb3ba7f9c9d4c5191ef1b80bce99b4c7e32c7ddb5e37a064396b6a3308edfd410ba57207450f7746d69d1bce9fb7c947a53f0dce8b7ecf7cd5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

yygCbsG.exe

Path C:\Windows\System\yygCbsG.exe
Size 5.9MB
SHA256 6357176ded57aca18b750ceb93d6dfa601df8b925fd9ef9ff2f632e7cdb141ae
MD5 dc451ef72bce141f960294f1b666a895
SHA1 3f465b1d725413e7d57802591a15eef59cee1935
SHA512 3226d611e480fd6454b330ba0c9c88dcea5fff825bab00a7e5558b86942aa0d87af6375fc21e111ce88da56ba6d40d0598e16dea3acccf4c7dd242a266f98729
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:Q+856utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

znwMOkM.exe

Path C:\Windows\System\znwMOkM.exe
Size 5.9MB
SHA256 278bf2c7879607ccca1edddc97e06c9e6330167ad66567ddee360588d29d9e81
MD5 a78ecbb49c76a8f88d4af6e8db8d487b
SHA1 0600902f201da00ddd302d45b9e389f4982de292
SHA512 147124c3a389d73ef7e6427105a9f62b9b359b45cf5fd178bc8786034d42cc84c2dfd7654855d9ae1891cb421d875a9d0f57a24f28a79fd07b1f7a4951575e2e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/772-131-0x00007FF71AB70000-0x00007FF71AEC4000-memory.dmp

Download

memory/772-138-0x00007FF71AB70000-0x00007FF71AEC4000-memory.dmp

Download

memory/772-113-0x00007FF71AB70000-0x00007FF71AEC4000-memory.dmp

Download

memory/924-137-0x00007FF6040B0000-0x00007FF604404000-memory.dmp

Download

memory/924-38-0x00007FF6040B0000-0x00007FF604404000-memory.dmp

Download

memory/1952-135-0x00007FF7108E0000-0x00007FF710C34000-memory.dmp

Download

memory/1952-26-0x00007FF7108E0000-0x00007FF710C34000-memory.dmp

Download

memory/1976-134-0x00007FF6A1160000-0x00007FF6A14B4000-memory.dmp

Download

memory/1976-24-0x00007FF6A1160000-0x00007FF6A14B4000-memory.dmp

Download

memory/2260-0-0x00007FF70A3B0000-0x00007FF70A704000-memory.dmp

Download

memory/2260-128-0x00007FF70A3B0000-0x00007FF70A704000-memory.dmp

Download

memory/2260-1-0x000001B3F07D0000-0x000001B3F07E0000-memory.dmp

Download

memory/3592-126-0x00007FF6311E0000-0x00007FF631534000-memory.dmp

Download

memory/3592-152-0x00007FF6311E0000-0x00007FF631534000-memory.dmp

Download

memory/3620-132-0x00007FF76BE60000-0x00007FF76C1B4000-memory.dmp

Download

memory/3620-129-0x00007FF76BE60000-0x00007FF76C1B4000-memory.dmp

Download

memory/3620-8-0x00007FF76BE60000-0x00007FF76C1B4000-memory.dmp

Download

memory/4168-120-0x00007FF6F0BF0000-0x00007FF6F0F44000-memory.dmp

Download

memory/4168-146-0x00007FF6F0BF0000-0x00007FF6F0F44000-memory.dmp

Download

memory/4176-32-0x00007FF749AE0000-0x00007FF749E34000-memory.dmp

Download

memory/4176-136-0x00007FF749AE0000-0x00007FF749E34000-memory.dmp

Download

memory/4608-145-0x00007FF6B7D60000-0x00007FF6B80B4000-memory.dmp

Download

memory/4608-119-0x00007FF6B7D60000-0x00007FF6B80B4000-memory.dmp

Download

memory/4860-121-0x00007FF7CE1B0000-0x00007FF7CE504000-memory.dmp

Download

memory/4860-147-0x00007FF7CE1B0000-0x00007FF7CE504000-memory.dmp

Download

memory/4992-133-0x00007FF6C4090000-0x00007FF6C43E4000-memory.dmp

Download

memory/4992-14-0x00007FF6C4090000-0x00007FF6C43E4000-memory.dmp

Download

memory/4992-130-0x00007FF6C4090000-0x00007FF6C43E4000-memory.dmp

Download

memory/5316-118-0x00007FF73C850000-0x00007FF73CBA4000-memory.dmp

Download

memory/5316-144-0x00007FF73C850000-0x00007FF73CBA4000-memory.dmp

Download

memory/5340-116-0x00007FF79C730000-0x00007FF79CA84000-memory.dmp

Download

memory/5340-142-0x00007FF79C730000-0x00007FF79CA84000-memory.dmp

Download

memory/5376-143-0x00007FF6BAF80000-0x00007FF6BB2D4000-memory.dmp

Download

memory/5376-117-0x00007FF6BAF80000-0x00007FF6BB2D4000-memory.dmp

Download

memory/5416-139-0x00007FF6F6A00000-0x00007FF6F6D54000-memory.dmp

Download

memory/5416-127-0x00007FF6F6A00000-0x00007FF6F6D54000-memory.dmp

Download

memory/5448-140-0x00007FF791040000-0x00007FF791394000-memory.dmp

Download

memory/5448-114-0x00007FF791040000-0x00007FF791394000-memory.dmp

Download

memory/5772-115-0x00007FF733600000-0x00007FF733954000-memory.dmp

Download

memory/5772-141-0x00007FF733600000-0x00007FF733954000-memory.dmp

Download

memory/5900-123-0x00007FF6BE5E0000-0x00007FF6BE934000-memory.dmp

Download

memory/5900-149-0x00007FF6BE5E0000-0x00007FF6BE934000-memory.dmp

Download

memory/5956-124-0x00007FF60A080000-0x00007FF60A3D4000-memory.dmp

Download

memory/5956-150-0x00007FF60A080000-0x00007FF60A3D4000-memory.dmp

Download

memory/5960-122-0x00007FF7C8EA0000-0x00007FF7C91F4000-memory.dmp

Download

memory/5960-148-0x00007FF7C8EA0000-0x00007FF7C91F4000-memory.dmp

Download

memory/5988-125-0x00007FF6A9DE0000-0x00007FF6AA134000-memory.dmp

Download

memory/5988-151-0x00007FF6A9DE0000-0x00007FF6AA134000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads