cobaltstrike | 90f687bd0dc89bc2c12725bd6798fee0ffbd57bb87620d93b2d5df0b4ec2d4c7

Analysis

max time kernel
138s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240525-peeswsaa3w
SHA256 90f687bd0dc89bc2c12725bd6798fee0ffbd57bb87620d93b2d5df0b4ec2d4c7
MD5 ee64a18e4cdf1da5dc37842152825058
SHA1 1e7a2fcecb76c55431c525a3707c06f5cd45b4fb
SHA512 1000c0f8e3fdb941adf45d6866854e699daa84cc20d3ba622fd5ef7b380664e99d35a2bfe2a9bb9e657ce11b39742c710970b30dec641be4e306e8bddf18984d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023454-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023458-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023459-11.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002345a-24.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002345b-28.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002345c-36.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002345e-46.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002345f-52.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023460-56.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023461-68.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023462-74.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023463-82.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023466-98.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002346a-114.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023469-112.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023468-107.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023467-103.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023465-93.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023464-85.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023455-72.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002345d-42.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023454-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023458-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023459-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002345a-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002345b-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002345c-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002345e-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002345f-52.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023460-56.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023461-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023462-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023463-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023466-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002346a-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023469-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023468-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023467-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023465-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023464-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023455-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002345d-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/5080-0-0x00007FF65FAB0000-0x00007FF65FE04000-memory.dmp	UPX
behavioral2/files/0x0008000000023454-4.dat	UPX
behavioral2/memory/3556-8-0x00007FF75F5E0000-0x00007FF75F934000-memory.dmp	UPX
behavioral2/files/0x0007000000023458-10.dat	UPX
behavioral2/files/0x0007000000023459-11.dat	UPX
behavioral2/memory/3752-15-0x00007FF795240000-0x00007FF795594000-memory.dmp	UPX
behavioral2/memory/5092-20-0x00007FF74E940000-0x00007FF74EC94000-memory.dmp	UPX
behavioral2/files/0x000700000002345a-24.dat	UPX
behavioral2/files/0x000700000002345b-28.dat	UPX
behavioral2/memory/4308-26-0x00007FF7C8020000-0x00007FF7C8374000-memory.dmp	UPX
behavioral2/files/0x000700000002345c-36.dat	UPX
behavioral2/files/0x000700000002345e-46.dat	UPX
behavioral2/files/0x000700000002345f-52.dat	UPX
behavioral2/files/0x0007000000023460-56.dat	UPX
behavioral2/memory/2064-58-0x00007FF6B67B0000-0x00007FF6B6B04000-memory.dmp	UPX
behavioral2/files/0x0007000000023461-68.dat	UPX
behavioral2/files/0x0007000000023462-74.dat	UPX
behavioral2/files/0x0007000000023463-82.dat	UPX
behavioral2/files/0x0007000000023466-98.dat	UPX
behavioral2/files/0x000700000002346a-114.dat	UPX
behavioral2/files/0x0007000000023469-112.dat	UPX
behavioral2/files/0x0007000000023468-107.dat	UPX
behavioral2/files/0x0007000000023467-103.dat	UPX
behavioral2/files/0x0007000000023465-93.dat	UPX
behavioral2/files/0x0007000000023464-85.dat	UPX
behavioral2/files/0x0008000000023455-72.dat	UPX
behavioral2/memory/3312-63-0x00007FF6D8B60000-0x00007FF6D8EB4000-memory.dmp	UPX
behavioral2/memory/3096-59-0x00007FF715710000-0x00007FF715A64000-memory.dmp	UPX
behavioral2/memory/4400-57-0x00007FF66E820000-0x00007FF66EB74000-memory.dmp	UPX
behavioral2/files/0x000700000002345d-42.dat	UPX
behavioral2/memory/1264-38-0x00007FF729880000-0x00007FF729BD4000-memory.dmp	UPX
behavioral2/memory/872-31-0x00007FF7A9110000-0x00007FF7A9464000-memory.dmp	UPX
behavioral2/memory/1168-116-0x00007FF6F48C0000-0x00007FF6F4C14000-memory.dmp	UPX
behavioral2/memory/2488-118-0x00007FF6E3D90000-0x00007FF6E40E4000-memory.dmp	UPX
behavioral2/memory/3152-119-0x00007FF715D60000-0x00007FF7160B4000-memory.dmp	UPX
behavioral2/memory/3156-121-0x00007FF66B8D0000-0x00007FF66BC24000-memory.dmp	UPX
behavioral2/memory/4552-120-0x00007FF6FB110000-0x00007FF6FB464000-memory.dmp	UPX
behavioral2/memory/1668-124-0x00007FF7B89D0000-0x00007FF7B8D24000-memory.dmp	UPX
behavioral2/memory/4844-127-0x00007FF626960000-0x00007FF626CB4000-memory.dmp	UPX
behavioral2/memory/3712-126-0x00007FF6E3040000-0x00007FF6E3394000-memory.dmp	UPX
behavioral2/memory/4872-125-0x00007FF7638F0000-0x00007FF763C44000-memory.dmp	UPX
behavioral2/memory/4736-123-0x00007FF6BA020000-0x00007FF6BA374000-memory.dmp	UPX
behavioral2/memory/4376-122-0x00007FF624750000-0x00007FF624AA4000-memory.dmp	UPX
behavioral2/memory/5080-128-0x00007FF65FAB0000-0x00007FF65FE04000-memory.dmp	UPX
behavioral2/memory/872-129-0x00007FF7A9110000-0x00007FF7A9464000-memory.dmp	UPX
behavioral2/memory/3312-130-0x00007FF6D8B60000-0x00007FF6D8EB4000-memory.dmp	UPX
behavioral2/memory/3556-131-0x00007FF75F5E0000-0x00007FF75F934000-memory.dmp	UPX
behavioral2/memory/3752-132-0x00007FF795240000-0x00007FF795594000-memory.dmp	UPX
behavioral2/memory/5092-133-0x00007FF74E940000-0x00007FF74EC94000-memory.dmp	UPX
behavioral2/memory/4308-134-0x00007FF7C8020000-0x00007FF7C8374000-memory.dmp	UPX
behavioral2/memory/872-135-0x00007FF7A9110000-0x00007FF7A9464000-memory.dmp	UPX
behavioral2/memory/1264-136-0x00007FF729880000-0x00007FF729BD4000-memory.dmp	UPX
behavioral2/memory/4400-137-0x00007FF66E820000-0x00007FF66EB74000-memory.dmp	UPX
behavioral2/memory/2064-138-0x00007FF6B67B0000-0x00007FF6B6B04000-memory.dmp	UPX
behavioral2/memory/3096-139-0x00007FF715710000-0x00007FF715A64000-memory.dmp	UPX
behavioral2/memory/1168-140-0x00007FF6F48C0000-0x00007FF6F4C14000-memory.dmp	UPX
behavioral2/memory/2488-141-0x00007FF6E3D90000-0x00007FF6E40E4000-memory.dmp	UPX
behavioral2/memory/3152-142-0x00007FF715D60000-0x00007FF7160B4000-memory.dmp	UPX
behavioral2/memory/3156-144-0x00007FF66B8D0000-0x00007FF66BC24000-memory.dmp	UPX
behavioral2/memory/4552-143-0x00007FF6FB110000-0x00007FF6FB464000-memory.dmp	UPX
behavioral2/memory/4736-146-0x00007FF6BA020000-0x00007FF6BA374000-memory.dmp	UPX
behavioral2/memory/1668-147-0x00007FF7B89D0000-0x00007FF7B8D24000-memory.dmp	UPX
behavioral2/memory/4376-145-0x00007FF624750000-0x00007FF624AA4000-memory.dmp	UPX
behavioral2/memory/4844-149-0x00007FF626960000-0x00007FF626CB4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/5080-0-0x00007FF65FAB0000-0x00007FF65FE04000-memory.dmp	xmrig
behavioral2/files/0x0008000000023454-4.dat	xmrig
behavioral2/memory/3556-8-0x00007FF75F5E0000-0x00007FF75F934000-memory.dmp	xmrig
behavioral2/files/0x0007000000023458-10.dat	xmrig
behavioral2/files/0x0007000000023459-11.dat	xmrig
behavioral2/memory/3752-15-0x00007FF795240000-0x00007FF795594000-memory.dmp	xmrig
behavioral2/memory/5092-20-0x00007FF74E940000-0x00007FF74EC94000-memory.dmp	xmrig
behavioral2/files/0x000700000002345a-24.dat	xmrig
behavioral2/files/0x000700000002345b-28.dat	xmrig
behavioral2/memory/4308-26-0x00007FF7C8020000-0x00007FF7C8374000-memory.dmp	xmrig
behavioral2/files/0x000700000002345c-36.dat	xmrig
behavioral2/files/0x000700000002345e-46.dat	xmrig
behavioral2/files/0x000700000002345f-52.dat	xmrig
behavioral2/files/0x0007000000023460-56.dat	xmrig
behavioral2/memory/2064-58-0x00007FF6B67B0000-0x00007FF6B6B04000-memory.dmp	xmrig
behavioral2/files/0x0007000000023461-68.dat	xmrig
behavioral2/files/0x0007000000023462-74.dat	xmrig
behavioral2/files/0x0007000000023463-82.dat	xmrig
behavioral2/files/0x0007000000023466-98.dat	xmrig
behavioral2/files/0x000700000002346a-114.dat	xmrig
behavioral2/files/0x0007000000023469-112.dat	xmrig
behavioral2/files/0x0007000000023468-107.dat	xmrig
behavioral2/files/0x0007000000023467-103.dat	xmrig
behavioral2/files/0x0007000000023465-93.dat	xmrig
behavioral2/files/0x0007000000023464-85.dat	xmrig
behavioral2/files/0x0008000000023455-72.dat	xmrig
behavioral2/memory/3312-63-0x00007FF6D8B60000-0x00007FF6D8EB4000-memory.dmp	xmrig
behavioral2/memory/3096-59-0x00007FF715710000-0x00007FF715A64000-memory.dmp	xmrig
behavioral2/memory/4400-57-0x00007FF66E820000-0x00007FF66EB74000-memory.dmp	xmrig
behavioral2/files/0x000700000002345d-42.dat	xmrig
behavioral2/memory/1264-38-0x00007FF729880000-0x00007FF729BD4000-memory.dmp	xmrig
behavioral2/memory/872-31-0x00007FF7A9110000-0x00007FF7A9464000-memory.dmp	xmrig
behavioral2/memory/1168-116-0x00007FF6F48C0000-0x00007FF6F4C14000-memory.dmp	xmrig
behavioral2/memory/2488-118-0x00007FF6E3D90000-0x00007FF6E40E4000-memory.dmp	xmrig
behavioral2/memory/3152-119-0x00007FF715D60000-0x00007FF7160B4000-memory.dmp	xmrig
behavioral2/memory/3156-121-0x00007FF66B8D0000-0x00007FF66BC24000-memory.dmp	xmrig
behavioral2/memory/4552-120-0x00007FF6FB110000-0x00007FF6FB464000-memory.dmp	xmrig
behavioral2/memory/1668-124-0x00007FF7B89D0000-0x00007FF7B8D24000-memory.dmp	xmrig
behavioral2/memory/4844-127-0x00007FF626960000-0x00007FF626CB4000-memory.dmp	xmrig
behavioral2/memory/3712-126-0x00007FF6E3040000-0x00007FF6E3394000-memory.dmp	xmrig
behavioral2/memory/4872-125-0x00007FF7638F0000-0x00007FF763C44000-memory.dmp	xmrig
behavioral2/memory/4736-123-0x00007FF6BA020000-0x00007FF6BA374000-memory.dmp	xmrig
behavioral2/memory/4376-122-0x00007FF624750000-0x00007FF624AA4000-memory.dmp	xmrig
behavioral2/memory/5080-128-0x00007FF65FAB0000-0x00007FF65FE04000-memory.dmp	xmrig
behavioral2/memory/872-129-0x00007FF7A9110000-0x00007FF7A9464000-memory.dmp	xmrig
behavioral2/memory/3312-130-0x00007FF6D8B60000-0x00007FF6D8EB4000-memory.dmp	xmrig
behavioral2/memory/3556-131-0x00007FF75F5E0000-0x00007FF75F934000-memory.dmp	xmrig
behavioral2/memory/3752-132-0x00007FF795240000-0x00007FF795594000-memory.dmp	xmrig
behavioral2/memory/5092-133-0x00007FF74E940000-0x00007FF74EC94000-memory.dmp	xmrig
behavioral2/memory/4308-134-0x00007FF7C8020000-0x00007FF7C8374000-memory.dmp	xmrig
behavioral2/memory/872-135-0x00007FF7A9110000-0x00007FF7A9464000-memory.dmp	xmrig
behavioral2/memory/1264-136-0x00007FF729880000-0x00007FF729BD4000-memory.dmp	xmrig
behavioral2/memory/4400-137-0x00007FF66E820000-0x00007FF66EB74000-memory.dmp	xmrig
behavioral2/memory/2064-138-0x00007FF6B67B0000-0x00007FF6B6B04000-memory.dmp	xmrig
behavioral2/memory/3096-139-0x00007FF715710000-0x00007FF715A64000-memory.dmp	xmrig
behavioral2/memory/1168-140-0x00007FF6F48C0000-0x00007FF6F4C14000-memory.dmp	xmrig
behavioral2/memory/2488-141-0x00007FF6E3D90000-0x00007FF6E40E4000-memory.dmp	xmrig
behavioral2/memory/3152-142-0x00007FF715D60000-0x00007FF7160B4000-memory.dmp	xmrig
behavioral2/memory/3156-144-0x00007FF66B8D0000-0x00007FF66BC24000-memory.dmp	xmrig
behavioral2/memory/4552-143-0x00007FF6FB110000-0x00007FF6FB464000-memory.dmp	xmrig
behavioral2/memory/4736-146-0x00007FF6BA020000-0x00007FF6BA374000-memory.dmp	xmrig
behavioral2/memory/1668-147-0x00007FF7B89D0000-0x00007FF7B8D24000-memory.dmp	xmrig
behavioral2/memory/4376-145-0x00007FF624750000-0x00007FF624AA4000-memory.dmp	xmrig
behavioral2/memory/4844-149-0x00007FF626960000-0x00007FF626CB4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3556	dxjjBYN.exe
3752	DEyKQYv.exe
5092	dYQPdPA.exe
4308	AxVvPrg.exe
872	RNAaLfm.exe
1264	JCPFAiR.exe
4400	YttiBvn.exe
2064	wRLZOjR.exe
3096	vWjqLHr.exe
3312	eUyaGzp.exe
1168	KYhDIcl.exe
2488	rImKckJ.exe
3152	RwzbZDb.exe
4552	eVkkiWT.exe
3156	jzdkBys.exe
4376	zxxNPzS.exe
4736	ISuJCuH.exe
1668	uQqrLCn.exe
4872	PCRtyLP.exe
3712	MJcKzMz.exe
4844	gxJKTQE.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5080-0-0x00007FF65FAB0000-0x00007FF65FE04000-memory.dmp	upx
behavioral2/files/0x0008000000023454-4.dat	upx
behavioral2/memory/3556-8-0x00007FF75F5E0000-0x00007FF75F934000-memory.dmp	upx
behavioral2/files/0x0007000000023458-10.dat	upx
behavioral2/files/0x0007000000023459-11.dat	upx
behavioral2/memory/3752-15-0x00007FF795240000-0x00007FF795594000-memory.dmp	upx
behavioral2/memory/5092-20-0x00007FF74E940000-0x00007FF74EC94000-memory.dmp	upx
behavioral2/files/0x000700000002345a-24.dat	upx
behavioral2/files/0x000700000002345b-28.dat	upx
behavioral2/memory/4308-26-0x00007FF7C8020000-0x00007FF7C8374000-memory.dmp	upx
behavioral2/files/0x000700000002345c-36.dat	upx
behavioral2/files/0x000700000002345e-46.dat	upx
behavioral2/files/0x000700000002345f-52.dat	upx
behavioral2/files/0x0007000000023460-56.dat	upx
behavioral2/memory/2064-58-0x00007FF6B67B0000-0x00007FF6B6B04000-memory.dmp	upx
behavioral2/files/0x0007000000023461-68.dat	upx
behavioral2/files/0x0007000000023462-74.dat	upx
behavioral2/files/0x0007000000023463-82.dat	upx
behavioral2/files/0x0007000000023466-98.dat	upx
behavioral2/files/0x000700000002346a-114.dat	upx
behavioral2/files/0x0007000000023469-112.dat	upx
behavioral2/files/0x0007000000023468-107.dat	upx
behavioral2/files/0x0007000000023467-103.dat	upx
behavioral2/files/0x0007000000023465-93.dat	upx
behavioral2/files/0x0007000000023464-85.dat	upx
behavioral2/files/0x0008000000023455-72.dat	upx
behavioral2/memory/3312-63-0x00007FF6D8B60000-0x00007FF6D8EB4000-memory.dmp	upx
behavioral2/memory/3096-59-0x00007FF715710000-0x00007FF715A64000-memory.dmp	upx
behavioral2/memory/4400-57-0x00007FF66E820000-0x00007FF66EB74000-memory.dmp	upx
behavioral2/files/0x000700000002345d-42.dat	upx
behavioral2/memory/1264-38-0x00007FF729880000-0x00007FF729BD4000-memory.dmp	upx
behavioral2/memory/872-31-0x00007FF7A9110000-0x00007FF7A9464000-memory.dmp	upx
behavioral2/memory/1168-116-0x00007FF6F48C0000-0x00007FF6F4C14000-memory.dmp	upx
behavioral2/memory/2488-118-0x00007FF6E3D90000-0x00007FF6E40E4000-memory.dmp	upx
behavioral2/memory/3152-119-0x00007FF715D60000-0x00007FF7160B4000-memory.dmp	upx
behavioral2/memory/3156-121-0x00007FF66B8D0000-0x00007FF66BC24000-memory.dmp	upx
behavioral2/memory/4552-120-0x00007FF6FB110000-0x00007FF6FB464000-memory.dmp	upx
behavioral2/memory/1668-124-0x00007FF7B89D0000-0x00007FF7B8D24000-memory.dmp	upx
behavioral2/memory/4844-127-0x00007FF626960000-0x00007FF626CB4000-memory.dmp	upx
behavioral2/memory/3712-126-0x00007FF6E3040000-0x00007FF6E3394000-memory.dmp	upx
behavioral2/memory/4872-125-0x00007FF7638F0000-0x00007FF763C44000-memory.dmp	upx
behavioral2/memory/4736-123-0x00007FF6BA020000-0x00007FF6BA374000-memory.dmp	upx
behavioral2/memory/4376-122-0x00007FF624750000-0x00007FF624AA4000-memory.dmp	upx
behavioral2/memory/5080-128-0x00007FF65FAB0000-0x00007FF65FE04000-memory.dmp	upx
behavioral2/memory/872-129-0x00007FF7A9110000-0x00007FF7A9464000-memory.dmp	upx
behavioral2/memory/3312-130-0x00007FF6D8B60000-0x00007FF6D8EB4000-memory.dmp	upx
behavioral2/memory/3556-131-0x00007FF75F5E0000-0x00007FF75F934000-memory.dmp	upx
behavioral2/memory/3752-132-0x00007FF795240000-0x00007FF795594000-memory.dmp	upx
behavioral2/memory/5092-133-0x00007FF74E940000-0x00007FF74EC94000-memory.dmp	upx
behavioral2/memory/4308-134-0x00007FF7C8020000-0x00007FF7C8374000-memory.dmp	upx
behavioral2/memory/872-135-0x00007FF7A9110000-0x00007FF7A9464000-memory.dmp	upx
behavioral2/memory/1264-136-0x00007FF729880000-0x00007FF729BD4000-memory.dmp	upx
behavioral2/memory/4400-137-0x00007FF66E820000-0x00007FF66EB74000-memory.dmp	upx
behavioral2/memory/2064-138-0x00007FF6B67B0000-0x00007FF6B6B04000-memory.dmp	upx
behavioral2/memory/3096-139-0x00007FF715710000-0x00007FF715A64000-memory.dmp	upx
behavioral2/memory/1168-140-0x00007FF6F48C0000-0x00007FF6F4C14000-memory.dmp	upx
behavioral2/memory/2488-141-0x00007FF6E3D90000-0x00007FF6E40E4000-memory.dmp	upx
behavioral2/memory/3152-142-0x00007FF715D60000-0x00007FF7160B4000-memory.dmp	upx
behavioral2/memory/3156-144-0x00007FF66B8D0000-0x00007FF66BC24000-memory.dmp	upx
behavioral2/memory/4552-143-0x00007FF6FB110000-0x00007FF6FB464000-memory.dmp	upx
behavioral2/memory/4736-146-0x00007FF6BA020000-0x00007FF6BA374000-memory.dmp	upx
behavioral2/memory/1668-147-0x00007FF7B89D0000-0x00007FF7B8D24000-memory.dmp	upx
behavioral2/memory/4376-145-0x00007FF624750000-0x00007FF624AA4000-memory.dmp	upx
behavioral2/memory/4844-149-0x00007FF626960000-0x00007FF626CB4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\ISuJCuH.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dxjjBYN.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AxVvPrg.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YttiBvn.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rImKckJ.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RwzbZDb.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jzdkBys.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MJcKzMz.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dYQPdPA.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RNAaLfm.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vWjqLHr.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eVkkiWT.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zxxNPzS.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PCRtyLP.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wRLZOjR.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DEyKQYv.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JCPFAiR.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eUyaGzp.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KYhDIcl.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uQqrLCn.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gxJKTQE.exe	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 3556	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	86
PID 5080 wrote to memory of 3556	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	86
PID 5080 wrote to memory of 3752	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	87
PID 5080 wrote to memory of 3752	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	87
PID 5080 wrote to memory of 5092	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	88
PID 5080 wrote to memory of 5092	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	88
PID 5080 wrote to memory of 4308	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	89
PID 5080 wrote to memory of 4308	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	89
PID 5080 wrote to memory of 872	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	90
PID 5080 wrote to memory of 872	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	90
PID 5080 wrote to memory of 1264	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	91
PID 5080 wrote to memory of 1264	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	91
PID 5080 wrote to memory of 4400	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	92
PID 5080 wrote to memory of 4400	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	92
PID 5080 wrote to memory of 2064	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	93
PID 5080 wrote to memory of 2064	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	93
PID 5080 wrote to memory of 3096	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	95
PID 5080 wrote to memory of 3096	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	95
PID 5080 wrote to memory of 3312	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	96
PID 5080 wrote to memory of 3312	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	96
PID 5080 wrote to memory of 1168	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	97
PID 5080 wrote to memory of 1168	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	97
PID 5080 wrote to memory of 2488	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	98
PID 5080 wrote to memory of 2488	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	98
PID 5080 wrote to memory of 3152	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	99
PID 5080 wrote to memory of 3152	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	99
PID 5080 wrote to memory of 4552	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	100
PID 5080 wrote to memory of 4552	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	100
PID 5080 wrote to memory of 3156	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	101
PID 5080 wrote to memory of 3156	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	101
PID 5080 wrote to memory of 4376	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	102
PID 5080 wrote to memory of 4376	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	102
PID 5080 wrote to memory of 4736	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	103
PID 5080 wrote to memory of 4736	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	103
PID 5080 wrote to memory of 1668	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	104
PID 5080 wrote to memory of 1668	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	104
PID 5080 wrote to memory of 4872	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	105
PID 5080 wrote to memory of 4872	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	105
PID 5080 wrote to memory of 3712	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	106
PID 5080 wrote to memory of 3712	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	106
PID 5080 wrote to memory of 4844	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	107
PID 5080 wrote to memory of 4844	5080	2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe	107

C:\Users\Admin\AppData\Local\Temp\2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-25_ee64a18e4cdf1da5dc37842152825058_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\System\dxjjBYN.exe
  C:\Windows\System\dxjjBYN.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\DEyKQYv.exe
  C:\Windows\System\DEyKQYv.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\dYQPdPA.exe
  C:\Windows\System\dYQPdPA.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\AxVvPrg.exe
  C:\Windows\System\AxVvPrg.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\RNAaLfm.exe
  C:\Windows\System\RNAaLfm.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\JCPFAiR.exe
  C:\Windows\System\JCPFAiR.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\YttiBvn.exe
  C:\Windows\System\YttiBvn.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\wRLZOjR.exe
  C:\Windows\System\wRLZOjR.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\vWjqLHr.exe
  C:\Windows\System\vWjqLHr.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\eUyaGzp.exe
  C:\Windows\System\eUyaGzp.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\KYhDIcl.exe
  C:\Windows\System\KYhDIcl.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\rImKckJ.exe
  C:\Windows\System\rImKckJ.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\RwzbZDb.exe
  C:\Windows\System\RwzbZDb.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\eVkkiWT.exe
  C:\Windows\System\eVkkiWT.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\jzdkBys.exe
  C:\Windows\System\jzdkBys.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\zxxNPzS.exe
  C:\Windows\System\zxxNPzS.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\ISuJCuH.exe
  C:\Windows\System\ISuJCuH.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\uQqrLCn.exe
  C:\Windows\System\uQqrLCn.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\PCRtyLP.exe
  C:\Windows\System\PCRtyLP.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\MJcKzMz.exe
  C:\Windows\System\MJcKzMz.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\gxJKTQE.exe
  C:\Windows\System\gxJKTQE.exe
  2⤵
  - Executes dropped EXE
  PID:4844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AxVvPrg.exe

Path C:\Windows\System\AxVvPrg.exe
Size 5.9MB
SHA256 03e13b3f1eafe48e915a5e62033f0b82b5d9921d2438d46388b5cf71aca991f3
MD5 c783955f3aa5de828f9b528afe0fc8b6
SHA1 f7f791015facab12187fb76526662f1fa7a241bd
SHA512 9ca5b3ee5ee087714c26f1b07a99aecaaad97229746ef8d72d072cb2bdece4dad2c9574b69c256b7034cb0a1ece7dd777a6f0957f99067159c838554e0bb7fba
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEyKQYv.exe

Path C:\Windows\System\DEyKQYv.exe
Size 5.9MB
SHA256 744fabba92145b52c0033224251b372b559d2b0592112ba200811c172e86190a
MD5 c3938c69849dd023867247945f63bfbf
SHA1 53e1394f7239ddc0f8a09abf7caccd4f2775e128
SHA512 9589b4e7051e543573ce5999e787d7590498e4faabbae1028c39e2230ead9dded4ed1267e781d63e707de0d4b5f1b33dd88c7b3ab1447506896e2ab139799ce2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISuJCuH.exe

Path C:\Windows\System\ISuJCuH.exe
Size 5.9MB
SHA256 03265d9b5417d036377d7872b7eefb21dcfb4b0f056c253218bfa116aa008017
MD5 21307d592efc57a8fa157cd647fe4c75
SHA1 0391906c9a298a561c1d036de8e71c3206e5df69
SHA512 bc53eabbfb446bf13a9df3417a3673ea853d981994ae7b19a7031c9db861cf14050baf4ce0a5b9889e3597fe04915b546e50d113249398e9b4e793e83fccf8f7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

JCPFAiR.exe

Path C:\Windows\System\JCPFAiR.exe
Size 5.9MB
SHA256 3b895547ad5f449ec2ea08252936f9542d281df07c21acc87838d61424c452e7
MD5 adca86cb06a19effd7333bc8f1b1c3da
SHA1 32fb75e61352d78cc36be6b278daa57845c081ab
SHA512 d66d8dd0b6f8b62518a486307ceb6f614fbfacc17b9221cae6e70a9e700fcf28aefbfdacd7b9741026e9b952bddbb6f105743adeae5389545a3ac0b0c0af7d77
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

KYhDIcl.exe

Path C:\Windows\System\KYhDIcl.exe
Size 5.9MB
SHA256 17b1f7ab82829d0dcae36e064d78bd130171351abf6574344165785d9956ae7b
MD5 0e85025e19df8d59b555fabdbfbe4853
SHA1 388e67590f2f3e31feabf989edaa0212b59755e1
SHA512 be506cad34f30f1b8999204010c395112a44323de3ea4a12809680b57bb8c4724dfc6f012d177f98af7feadee6a469c3c0a67ef16522c6ed13a6bdf381f39ad8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

MJcKzMz.exe

Path C:\Windows\System\MJcKzMz.exe
Size 5.9MB
SHA256 34a01ac6c14d7f8bab75c7f233d3f498fe8cd6f88e699d0c8193e019b1982e4f
MD5 5be04927fb54ba9d36819b18d8a166a1
SHA1 d56420a2f6800f62555957f9ac9e48d44b5b27d0
SHA512 4c748328f012bb83876eb04fa9680a36ad1c021c7c2c986a23feb8cdc903de2caafd3b67edf349a4adf7d823e2aa3315d95cdc5d138f097ce338ac055ac976b6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

PCRtyLP.exe

Path C:\Windows\System\PCRtyLP.exe
Size 5.9MB
SHA256 146d83f4d597fbcb67ef2291270a564dbf50dfbc98e8857f0b458a9ca6115399
MD5 5d91b9db4c1338ad4f812cb4c7b2b06e
SHA1 f73febd6c7f203df712288d3b973695e56d2b7ea
SHA512 3c0f08108e7ac86e65005787f682b2980944291815155fc7551efe8ba658bfb83f840ab28a6e8781fc6b068ade4e4251bda774263e277bcf3f582afedc2ed34b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

RNAaLfm.exe

Path C:\Windows\System\RNAaLfm.exe
Size 5.9MB
SHA256 cdac2ecc8743a3538f87b5deb6257c2a68772704c556d63672913582ac5e63e0
MD5 1e33aca80ce82305f6e9d6260a054f78
SHA1 d3d06e591e44ca2e6d9cdcba4e1f37b01c0021db
SHA512 f766c8867d26d75b685000e84f7259f6fc18d213430bf8d13a8e60dd496b5a90ab32a7e6c27af20f4ba6cdee5ad17cb093e4857f96c3da8ae4dc8f3c65187524
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

RwzbZDb.exe

Path C:\Windows\System\RwzbZDb.exe
Size 5.9MB
SHA256 fcaefd512ae01fe01b5346de7e66ad4b3ab0a132d6f84afa980d7f8e181e6c34
MD5 cf97cd09c3035c122e1b7b7683c37947
SHA1 641a1596ab6b29a449ac37aec5d86ba6ed02c756
SHA512 04b6845a06c19e32256e0f2853178dd439b963f2f95710b1bc4bb1bc6fa71b3e21810d4f2430a943d29f400e1ede2d197b3b6fb7545733ca557d6325bbc97a98
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

YttiBvn.exe

Path C:\Windows\System\YttiBvn.exe
Size 5.9MB
SHA256 a3af25759c51748aa3e3eb3ac9e7451812bb88917d0bb7f9e483c47b18b4f61f
MD5 247bbbb116ba2468a30c400627ca3378
SHA1 7dac6d1d92f79ea3922ae9fb13f67cbc0fd6f1fb
SHA512 60b24c8ece9aad6d1f784b430db3579b9631f0404d652834590007cb47bc0bb0d828a879f72419ce78152fe902c361308948b8195406593b312728206dd05acb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

dYQPdPA.exe

Path C:\Windows\System\dYQPdPA.exe
Size 5.9MB
SHA256 01dc5c4fe19c4b15fdc91385fe5252e2f9b806841cb5396294dbb786c6172cc3
MD5 16088ffcac60896d54dd6cb568d1e67a
SHA1 3aba395632ea74532e6bbbefc229a599b8ff5b80
SHA512 928517e4cb56973dc428fbd1cbcc85bbac81a53ff6603f666f313cb84dbb38a1b1b340067dc48ea31b6ef13d652695206ef4fe8c1774ef54c5938ac9a7609ac9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxjjBYN.exe

Path C:\Windows\System\dxjjBYN.exe
Size 5.9MB
SHA256 4f13f066e85aa2cc02343e9cb0f78ea5df0adcec08dba9e57da056fcbf10be29
MD5 bb64d61c7e788cc0f501b456cd0c6419
SHA1 58179dcc4d17ff38e1d9d1d34c165a7988190aa3
SHA512 de248a253f1e995206c9b1859f32f7f60bdc008d33d83163ae02a43047ae3b95d1afc966f2243cada65612145847213001c15a54ff569132c1f3a6423f83d699
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

eUyaGzp.exe

Path C:\Windows\System\eUyaGzp.exe
Size 5.9MB
SHA256 7f3753f0a742e291c1d8faaa3dafd665a54343e0acd6a6f5d1b60483db848a6f
MD5 e3274b9eaafdab6394eae92dbedded1c
SHA1 072bcb06fd5b262ec7ed9559b1323efae17af821
SHA512 d8365ba6e1a81862bb68685236d6ec7fd5785a8a3b658d2b8b172f74ad353d237eb9c8f1a994ea201cfc1ac113e51397238cd091e26bc91c41e7f84e57e897ad
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

eVkkiWT.exe

Path C:\Windows\System\eVkkiWT.exe
Size 5.9MB
SHA256 27e28cc2073d556ac786a094eb0339980bbaeb39e66466d4694b296d1657fe29
MD5 fd3b29036bd592bb63313fecb130f0b7
SHA1 21adb2f05faeeec693a5adfc5ffc79ad38e48444
SHA512 17d0ec8ccb7836651b71f183640498cb306c4276484a9811e8d8c9149f5d1999157e8fcb24a9d2c73d5b2f63d2607fbfdeb563bfeae68f952b5bba6269264e32
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

gxJKTQE.exe

Path C:\Windows\System\gxJKTQE.exe
Size 5.9MB
SHA256 d14bb814f5bc1419ed32b396ea8c1b425f6a2b1e024c392a82215a77310187fe
MD5 491f9e3e0035b4d5aa301f9f12b02fd4
SHA1 5ac0a86842e58088e566cd87377ad868dce92051
SHA512 7e4a38b4701dfc745ef291323e7bf668c1236023c3a85a99c5bd27067392de274b41bb6e0f6703304b599e070b9fa37bcc696d618880d09757c8b3caabec61b4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

jzdkBys.exe

Path C:\Windows\System\jzdkBys.exe
Size 5.9MB
SHA256 5c1461ef6f3cc6c19af55a004a0a5eea4a48b071c171ff0d1557b0a662b11a11
MD5 effc4ed6fa856e3f21cc8d1ea028b98f
SHA1 94100a6e75fe8bc3cc78de24dd35ed6dc0a903da
SHA512 57b6fa50584bf5d41309f76e3c8e39d4f75bae1e23f5866ed355e89c6713dc05bf48af2f96b5ec12a75ed4320d714aae692fa1733183f5aec822ee4bb31fbc95
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

rImKckJ.exe

Path C:\Windows\System\rImKckJ.exe
Size 5.9MB
SHA256 d65048179bb48952e711f5c91d39f6587bdeb7c0730d6b93f1c1a3dc5c08bda9
MD5 0153bd3e76f5b3a5ba0dbf0a822ad614
SHA1 dcaaaee6136079db51727f730479a5796d5d1fd6
SHA512 ae25c704e21d85a6ffcf92f120b122f2af4562bea8d23c018414f1cf120c6f5e46020f9473f85112186b8d550d8c6ead6cb1bf95e4d442056bba9b550870b386
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

uQqrLCn.exe

Path C:\Windows\System\uQqrLCn.exe
Size 5.9MB
SHA256 10de141765eb1c35cb425e9263fc99e0e822b975ef7cac43b65d0716722793b3
MD5 5c58082b1a658301126cc3d2cb09cae5
SHA1 30677d66314aac7e1bf1620e314a2a21b4e17e1c
SHA512 ccaaa4f060c52a39a6b2b11a03eee5d75caaf71fa90691ef1e136fe8a4e5e05b96cb9eebb840e9bd0a5f48b3458c77c2c3d1527f2ef148dba579cf4a876ce00c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:Q+856utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

vWjqLHr.exe

Path C:\Windows\System\vWjqLHr.exe
Size 5.9MB
SHA256 9d7ff390e929cf27b61f7b982ddfa760c7f79c1651dbe41ffc149c809e258c9d
MD5 902cb1651df29cce67661151a8efc774
SHA1 41f4aabb0ecca212177af04f86144e4c8a7d28ed
SHA512 5193ad347ff1cc34e40c33e4f3d73e1c01845d3d2525351b66a10a552008d80ee1a25827de3b51033d12a890a5bca7cac61f385d915fe01ae76f71d91f90f99e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

wRLZOjR.exe

Path C:\Windows\System\wRLZOjR.exe
Size 5.9MB
SHA256 2c302b42a66d34781aa9b6e91476ea1fd8f79143b15eac1c9c8be2898a3298e4
MD5 703fdf72c78fb0db213e9cc4c713694f
SHA1 b6466c6495a15170a61791608eff9fc2d90a4c8e
SHA512 5839038bf4228c6cd0a92bf34da3bc103e212c96ea8633d35ddbb4bd045e368b938531ac5121cb34eacd896d9adac9d532b585f5278d8d931b2ad690495b67ff
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

zxxNPzS.exe

Path C:\Windows\System\zxxNPzS.exe
Size 5.9MB
SHA256 09c6869ab860de1cfd1779d179a85028e5244e0ef375d1dea01090db9054af9e
MD5 536b9c23feb09f8227ad582506e19a88
SHA1 2b4451020e6ebc4c76ef12f8314fb36b590dfcb5
SHA512 5a588987c687ab5db4e36e46c5234b1e260f5508d55f54fbcf1ce8e11718beaf4683359b857f464eabc3a4a5c9fe7e0f9e39980fbecb155b28873e27b4a9b271
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/872-31-0x00007FF7A9110000-0x00007FF7A9464000-memory.dmp

Download

memory/872-129-0x00007FF7A9110000-0x00007FF7A9464000-memory.dmp

Download

memory/872-135-0x00007FF7A9110000-0x00007FF7A9464000-memory.dmp

Download

memory/1168-116-0x00007FF6F48C0000-0x00007FF6F4C14000-memory.dmp

Download

memory/1168-140-0x00007FF6F48C0000-0x00007FF6F4C14000-memory.dmp

Download

memory/1264-136-0x00007FF729880000-0x00007FF729BD4000-memory.dmp

Download

memory/1264-38-0x00007FF729880000-0x00007FF729BD4000-memory.dmp

Download

memory/1668-147-0x00007FF7B89D0000-0x00007FF7B8D24000-memory.dmp

Download

memory/1668-124-0x00007FF7B89D0000-0x00007FF7B8D24000-memory.dmp

Download

memory/2064-138-0x00007FF6B67B0000-0x00007FF6B6B04000-memory.dmp

Download

memory/2064-58-0x00007FF6B67B0000-0x00007FF6B6B04000-memory.dmp

Download

memory/2488-141-0x00007FF6E3D90000-0x00007FF6E40E4000-memory.dmp

Download

memory/2488-118-0x00007FF6E3D90000-0x00007FF6E40E4000-memory.dmp

Download

memory/3096-139-0x00007FF715710000-0x00007FF715A64000-memory.dmp

Download

memory/3096-59-0x00007FF715710000-0x00007FF715A64000-memory.dmp

Download

memory/3152-119-0x00007FF715D60000-0x00007FF7160B4000-memory.dmp

Download

memory/3152-142-0x00007FF715D60000-0x00007FF7160B4000-memory.dmp

Download

memory/3156-144-0x00007FF66B8D0000-0x00007FF66BC24000-memory.dmp

Download

memory/3156-121-0x00007FF66B8D0000-0x00007FF66BC24000-memory.dmp

Download

memory/3312-151-0x00007FF6D8B60000-0x00007FF6D8EB4000-memory.dmp

Download

memory/3312-130-0x00007FF6D8B60000-0x00007FF6D8EB4000-memory.dmp

Download

memory/3312-63-0x00007FF6D8B60000-0x00007FF6D8EB4000-memory.dmp

Download

memory/3556-131-0x00007FF75F5E0000-0x00007FF75F934000-memory.dmp

Download

memory/3556-8-0x00007FF75F5E0000-0x00007FF75F934000-memory.dmp

Download

memory/3712-150-0x00007FF6E3040000-0x00007FF6E3394000-memory.dmp

Download

memory/3712-126-0x00007FF6E3040000-0x00007FF6E3394000-memory.dmp

Download

memory/3752-15-0x00007FF795240000-0x00007FF795594000-memory.dmp

Download

memory/3752-132-0x00007FF795240000-0x00007FF795594000-memory.dmp

Download

memory/4308-26-0x00007FF7C8020000-0x00007FF7C8374000-memory.dmp

Download

memory/4308-134-0x00007FF7C8020000-0x00007FF7C8374000-memory.dmp

Download

memory/4376-122-0x00007FF624750000-0x00007FF624AA4000-memory.dmp

Download

memory/4376-145-0x00007FF624750000-0x00007FF624AA4000-memory.dmp

Download

memory/4400-57-0x00007FF66E820000-0x00007FF66EB74000-memory.dmp

Download

memory/4400-137-0x00007FF66E820000-0x00007FF66EB74000-memory.dmp

Download

memory/4552-120-0x00007FF6FB110000-0x00007FF6FB464000-memory.dmp

Download

memory/4552-143-0x00007FF6FB110000-0x00007FF6FB464000-memory.dmp

Download

memory/4736-146-0x00007FF6BA020000-0x00007FF6BA374000-memory.dmp

Download

memory/4736-123-0x00007FF6BA020000-0x00007FF6BA374000-memory.dmp

Download

memory/4844-149-0x00007FF626960000-0x00007FF626CB4000-memory.dmp

Download

memory/4844-127-0x00007FF626960000-0x00007FF626CB4000-memory.dmp

Download

memory/4872-125-0x00007FF7638F0000-0x00007FF763C44000-memory.dmp

Download

memory/4872-148-0x00007FF7638F0000-0x00007FF763C44000-memory.dmp

Download

memory/5080-128-0x00007FF65FAB0000-0x00007FF65FE04000-memory.dmp

Download

memory/5080-1-0x000001C1F7BF0000-0x000001C1F7C00000-memory.dmp

Download

memory/5080-0-0x00007FF65FAB0000-0x00007FF65FE04000-memory.dmp

Download

memory/5092-20-0x00007FF74E940000-0x00007FF74EC94000-memory.dmp

Download

memory/5092-133-0x00007FF74E940000-0x00007FF74EC94000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads