cobaltstrike | e4f9ff88f4511e88e1db77fb12581dcd80993c63e613c42bc352b449eb723e1a

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 13:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240525-qnk7psea4y
SHA256 e4f9ff88f4511e88e1db77fb12581dcd80993c63e613c42bc352b449eb723e1a
MD5 bfad8857d2186b5cb1dd6039864be94a
SHA1 2536f7a0d9e79fe9a787faff16adc02622d618d4
SHA512 1c20fcfe0c66069cbccae045e63a3b3aaf3a2a5d52ee4595de73c4bebd07955d3e4c912d81282ea3f8de75091596ddbcafb158fe87b57792ea1e852e6ab997d0
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUA:Q+u56utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0006000000023308-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023491-11.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023487-18.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023492-22.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023493-28.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023495-35.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023496-41.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023497-46.dat	cobalt_reflective_dll
behavioral2/files/0x00030000000229de-53.dat	cobalt_reflective_dll
behavioral2/files/0x000300000001e3ce-58.dat	cobalt_reflective_dll
behavioral2/files/0x0005000000022b21-66.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000022b23-73.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023404-79.dat	cobalt_reflective_dll
behavioral2/files/0x000d000000023406-86.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023499-98.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349a-106.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349b-110.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349c-116.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349e-125.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349d-122.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023498-99.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023308-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023491-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0009000000023487-18.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023492-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023493-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023495-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023496-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023497-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00030000000229de-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000300000001e3ce-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0005000000022b21-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000022b23-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0009000000023404-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d000000023406-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023499-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349a-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349b-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349c-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349e-125.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349d-122.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023498-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/220-0-0x00007FF65A1F0000-0x00007FF65A544000-memory.dmp	UPX
behavioral2/files/0x0006000000023308-4.dat	UPX
behavioral2/memory/4720-8-0x00007FF6E7DF0000-0x00007FF6E8144000-memory.dmp	UPX
behavioral2/files/0x0007000000023491-11.dat	UPX
behavioral2/memory/3644-14-0x00007FF704CA0000-0x00007FF704FF4000-memory.dmp	UPX
behavioral2/files/0x0009000000023487-18.dat	UPX
behavioral2/memory/4624-20-0x00007FF62BE40000-0x00007FF62C194000-memory.dmp	UPX
behavioral2/files/0x0007000000023492-22.dat	UPX
behavioral2/memory/4124-26-0x00007FF6B3360000-0x00007FF6B36B4000-memory.dmp	UPX
behavioral2/files/0x0007000000023493-28.dat	UPX
behavioral2/memory/4028-32-0x00007FF667C80000-0x00007FF667FD4000-memory.dmp	UPX
behavioral2/files/0x0007000000023495-35.dat	UPX
behavioral2/files/0x0007000000023496-41.dat	UPX
behavioral2/memory/3376-44-0x00007FF7A0D00000-0x00007FF7A1054000-memory.dmp	UPX
behavioral2/memory/1180-36-0x00007FF61D520000-0x00007FF61D874000-memory.dmp	UPX
behavioral2/files/0x0007000000023497-46.dat	UPX
behavioral2/memory/2252-47-0x00007FF7D2ED0000-0x00007FF7D3224000-memory.dmp	UPX
behavioral2/files/0x00030000000229de-53.dat	UPX
behavioral2/memory/3412-56-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp	UPX
behavioral2/files/0x000300000001e3ce-58.dat	UPX
behavioral2/memory/220-62-0x00007FF65A1F0000-0x00007FF65A544000-memory.dmp	UPX
behavioral2/memory/1572-63-0x00007FF6FCF10000-0x00007FF6FD264000-memory.dmp	UPX
behavioral2/memory/4720-67-0x00007FF6E7DF0000-0x00007FF6E8144000-memory.dmp	UPX
behavioral2/files/0x0005000000022b21-66.dat	UPX
behavioral2/memory/2808-70-0x00007FF7C34B0000-0x00007FF7C3804000-memory.dmp	UPX
behavioral2/files/0x0007000000022b23-73.dat	UPX
behavioral2/memory/3644-74-0x00007FF704CA0000-0x00007FF704FF4000-memory.dmp	UPX
behavioral2/memory/2020-75-0x00007FF7E5140000-0x00007FF7E5494000-memory.dmp	UPX
behavioral2/files/0x0009000000023404-79.dat	UPX
behavioral2/files/0x000d000000023406-86.dat	UPX
behavioral2/memory/1804-92-0x00007FF7E62E0000-0x00007FF7E6634000-memory.dmp	UPX
behavioral2/memory/2288-94-0x00007FF67C950000-0x00007FF67CCA4000-memory.dmp	UPX
behavioral2/memory/4028-95-0x00007FF667C80000-0x00007FF667FD4000-memory.dmp	UPX
behavioral2/files/0x0007000000023499-98.dat	UPX
behavioral2/files/0x000700000002349a-106.dat	UPX
behavioral2/files/0x000700000002349b-110.dat	UPX
behavioral2/files/0x000700000002349c-116.dat	UPX
behavioral2/files/0x000700000002349e-125.dat	UPX
behavioral2/files/0x000700000002349d-122.dat	UPX
behavioral2/files/0x0007000000023498-99.dat	UPX
behavioral2/memory/4124-93-0x00007FF6B3360000-0x00007FF6B36B4000-memory.dmp	UPX
behavioral2/memory/1052-90-0x00007FF79A380000-0x00007FF79A6D4000-memory.dmp	UPX
behavioral2/memory/3788-127-0x00007FF799FD0000-0x00007FF79A324000-memory.dmp	UPX
behavioral2/memory/3836-128-0x00007FF653CB0000-0x00007FF654004000-memory.dmp	UPX
behavioral2/memory/2804-129-0x00007FF694C20000-0x00007FF694F74000-memory.dmp	UPX
behavioral2/memory/1236-130-0x00007FF7C3EB0000-0x00007FF7C4204000-memory.dmp	UPX
behavioral2/memory/5096-131-0x00007FF789EA0000-0x00007FF78A1F4000-memory.dmp	UPX
behavioral2/memory/1180-132-0x00007FF61D520000-0x00007FF61D874000-memory.dmp	UPX
behavioral2/memory/2724-133-0x00007FF6346A0000-0x00007FF6349F4000-memory.dmp	UPX
behavioral2/memory/2252-134-0x00007FF7D2ED0000-0x00007FF7D3224000-memory.dmp	UPX
behavioral2/memory/4720-135-0x00007FF6E7DF0000-0x00007FF6E8144000-memory.dmp	UPX
behavioral2/memory/2808-136-0x00007FF7C34B0000-0x00007FF7C3804000-memory.dmp	UPX
behavioral2/memory/3644-137-0x00007FF704CA0000-0x00007FF704FF4000-memory.dmp	UPX
behavioral2/memory/4624-138-0x00007FF62BE40000-0x00007FF62C194000-memory.dmp	UPX
behavioral2/memory/2020-139-0x00007FF7E5140000-0x00007FF7E5494000-memory.dmp	UPX
behavioral2/memory/4124-140-0x00007FF6B3360000-0x00007FF6B36B4000-memory.dmp	UPX
behavioral2/memory/4028-141-0x00007FF667C80000-0x00007FF667FD4000-memory.dmp	UPX
behavioral2/memory/3376-142-0x00007FF7A0D00000-0x00007FF7A1054000-memory.dmp	UPX
behavioral2/memory/1180-143-0x00007FF61D520000-0x00007FF61D874000-memory.dmp	UPX
behavioral2/memory/2252-144-0x00007FF7D2ED0000-0x00007FF7D3224000-memory.dmp	UPX
behavioral2/memory/3412-145-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp	UPX
behavioral2/memory/1572-146-0x00007FF6FCF10000-0x00007FF6FD264000-memory.dmp	UPX
behavioral2/memory/2288-147-0x00007FF67C950000-0x00007FF67CCA4000-memory.dmp	UPX
behavioral2/memory/2808-148-0x00007FF7C34B0000-0x00007FF7C3804000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/220-0-0x00007FF65A1F0000-0x00007FF65A544000-memory.dmp	xmrig
behavioral2/files/0x0006000000023308-4.dat	xmrig
behavioral2/memory/4720-8-0x00007FF6E7DF0000-0x00007FF6E8144000-memory.dmp	xmrig
behavioral2/files/0x0007000000023491-11.dat	xmrig
behavioral2/memory/3644-14-0x00007FF704CA0000-0x00007FF704FF4000-memory.dmp	xmrig
behavioral2/files/0x0009000000023487-18.dat	xmrig
behavioral2/memory/4624-20-0x00007FF62BE40000-0x00007FF62C194000-memory.dmp	xmrig
behavioral2/files/0x0007000000023492-22.dat	xmrig
behavioral2/memory/4124-26-0x00007FF6B3360000-0x00007FF6B36B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023493-28.dat	xmrig
behavioral2/memory/4028-32-0x00007FF667C80000-0x00007FF667FD4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023495-35.dat	xmrig
behavioral2/files/0x0007000000023496-41.dat	xmrig
behavioral2/memory/3376-44-0x00007FF7A0D00000-0x00007FF7A1054000-memory.dmp	xmrig
behavioral2/memory/1180-36-0x00007FF61D520000-0x00007FF61D874000-memory.dmp	xmrig
behavioral2/files/0x0007000000023497-46.dat	xmrig
behavioral2/memory/2252-47-0x00007FF7D2ED0000-0x00007FF7D3224000-memory.dmp	xmrig
behavioral2/files/0x00030000000229de-53.dat	xmrig
behavioral2/memory/3412-56-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp	xmrig
behavioral2/files/0x000300000001e3ce-58.dat	xmrig
behavioral2/memory/220-62-0x00007FF65A1F0000-0x00007FF65A544000-memory.dmp	xmrig
behavioral2/memory/1572-63-0x00007FF6FCF10000-0x00007FF6FD264000-memory.dmp	xmrig
behavioral2/memory/4720-67-0x00007FF6E7DF0000-0x00007FF6E8144000-memory.dmp	xmrig
behavioral2/files/0x0005000000022b21-66.dat	xmrig
behavioral2/memory/2808-70-0x00007FF7C34B0000-0x00007FF7C3804000-memory.dmp	xmrig
behavioral2/files/0x0007000000022b23-73.dat	xmrig
behavioral2/memory/3644-74-0x00007FF704CA0000-0x00007FF704FF4000-memory.dmp	xmrig
behavioral2/memory/2020-75-0x00007FF7E5140000-0x00007FF7E5494000-memory.dmp	xmrig
behavioral2/files/0x0009000000023404-79.dat	xmrig
behavioral2/files/0x000d000000023406-86.dat	xmrig
behavioral2/memory/1804-92-0x00007FF7E62E0000-0x00007FF7E6634000-memory.dmp	xmrig
behavioral2/memory/2288-94-0x00007FF67C950000-0x00007FF67CCA4000-memory.dmp	xmrig
behavioral2/memory/4028-95-0x00007FF667C80000-0x00007FF667FD4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023499-98.dat	xmrig
behavioral2/files/0x000700000002349a-106.dat	xmrig
behavioral2/files/0x000700000002349b-110.dat	xmrig
behavioral2/files/0x000700000002349c-116.dat	xmrig
behavioral2/files/0x000700000002349e-125.dat	xmrig
behavioral2/files/0x000700000002349d-122.dat	xmrig
behavioral2/files/0x0007000000023498-99.dat	xmrig
behavioral2/memory/4124-93-0x00007FF6B3360000-0x00007FF6B36B4000-memory.dmp	xmrig
behavioral2/memory/1052-90-0x00007FF79A380000-0x00007FF79A6D4000-memory.dmp	xmrig
behavioral2/memory/3788-127-0x00007FF799FD0000-0x00007FF79A324000-memory.dmp	xmrig
behavioral2/memory/3836-128-0x00007FF653CB0000-0x00007FF654004000-memory.dmp	xmrig
behavioral2/memory/2804-129-0x00007FF694C20000-0x00007FF694F74000-memory.dmp	xmrig
behavioral2/memory/1236-130-0x00007FF7C3EB0000-0x00007FF7C4204000-memory.dmp	xmrig
behavioral2/memory/5096-131-0x00007FF789EA0000-0x00007FF78A1F4000-memory.dmp	xmrig
behavioral2/memory/1180-132-0x00007FF61D520000-0x00007FF61D874000-memory.dmp	xmrig
behavioral2/memory/2724-133-0x00007FF6346A0000-0x00007FF6349F4000-memory.dmp	xmrig
behavioral2/memory/2252-134-0x00007FF7D2ED0000-0x00007FF7D3224000-memory.dmp	xmrig
behavioral2/memory/4720-135-0x00007FF6E7DF0000-0x00007FF6E8144000-memory.dmp	xmrig
behavioral2/memory/2808-136-0x00007FF7C34B0000-0x00007FF7C3804000-memory.dmp	xmrig
behavioral2/memory/3644-137-0x00007FF704CA0000-0x00007FF704FF4000-memory.dmp	xmrig
behavioral2/memory/4624-138-0x00007FF62BE40000-0x00007FF62C194000-memory.dmp	xmrig
behavioral2/memory/2020-139-0x00007FF7E5140000-0x00007FF7E5494000-memory.dmp	xmrig
behavioral2/memory/4124-140-0x00007FF6B3360000-0x00007FF6B36B4000-memory.dmp	xmrig
behavioral2/memory/4028-141-0x00007FF667C80000-0x00007FF667FD4000-memory.dmp	xmrig
behavioral2/memory/3376-142-0x00007FF7A0D00000-0x00007FF7A1054000-memory.dmp	xmrig
behavioral2/memory/1180-143-0x00007FF61D520000-0x00007FF61D874000-memory.dmp	xmrig
behavioral2/memory/2252-144-0x00007FF7D2ED0000-0x00007FF7D3224000-memory.dmp	xmrig
behavioral2/memory/3412-145-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp	xmrig
behavioral2/memory/1572-146-0x00007FF6FCF10000-0x00007FF6FD264000-memory.dmp	xmrig
behavioral2/memory/2288-147-0x00007FF67C950000-0x00007FF67CCA4000-memory.dmp	xmrig
behavioral2/memory/2808-148-0x00007FF7C34B0000-0x00007FF7C3804000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4720	EGvnXmz.exe
3644	IDaklQX.exe
4624	jjJSvgM.exe
4124	UbMLMko.exe
4028	SZsYXaZ.exe
1180	OzHOmCP.exe
3376	lHfUNvT.exe
2252	plOUtHv.exe
3412	iltawKi.exe
1572	QjLpPLO.exe
2808	PdxVAfx.exe
2020	oteqolE.exe
1052	OXkVuOI.exe
1804	ULlBPmj.exe
2288	DVwVccN.exe
2724	oFfKTDD.exe
3788	RyTnkFU.exe
3836	vZJpxtu.exe
2804	SKTvQFt.exe
1236	LTbxVVQ.exe
5096	VBDlWLK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/220-0-0x00007FF65A1F0000-0x00007FF65A544000-memory.dmp	upx
behavioral2/files/0x0006000000023308-4.dat	upx
behavioral2/memory/4720-8-0x00007FF6E7DF0000-0x00007FF6E8144000-memory.dmp	upx
behavioral2/files/0x0007000000023491-11.dat	upx
behavioral2/memory/3644-14-0x00007FF704CA0000-0x00007FF704FF4000-memory.dmp	upx
behavioral2/files/0x0009000000023487-18.dat	upx
behavioral2/memory/4624-20-0x00007FF62BE40000-0x00007FF62C194000-memory.dmp	upx
behavioral2/files/0x0007000000023492-22.dat	upx
behavioral2/memory/4124-26-0x00007FF6B3360000-0x00007FF6B36B4000-memory.dmp	upx
behavioral2/files/0x0007000000023493-28.dat	upx
behavioral2/memory/4028-32-0x00007FF667C80000-0x00007FF667FD4000-memory.dmp	upx
behavioral2/files/0x0007000000023495-35.dat	upx
behavioral2/files/0x0007000000023496-41.dat	upx
behavioral2/memory/3376-44-0x00007FF7A0D00000-0x00007FF7A1054000-memory.dmp	upx
behavioral2/memory/1180-36-0x00007FF61D520000-0x00007FF61D874000-memory.dmp	upx
behavioral2/files/0x0007000000023497-46.dat	upx
behavioral2/memory/2252-47-0x00007FF7D2ED0000-0x00007FF7D3224000-memory.dmp	upx
behavioral2/files/0x00030000000229de-53.dat	upx
behavioral2/memory/3412-56-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp	upx
behavioral2/files/0x000300000001e3ce-58.dat	upx
behavioral2/memory/220-62-0x00007FF65A1F0000-0x00007FF65A544000-memory.dmp	upx
behavioral2/memory/1572-63-0x00007FF6FCF10000-0x00007FF6FD264000-memory.dmp	upx
behavioral2/memory/4720-67-0x00007FF6E7DF0000-0x00007FF6E8144000-memory.dmp	upx
behavioral2/files/0x0005000000022b21-66.dat	upx
behavioral2/memory/2808-70-0x00007FF7C34B0000-0x00007FF7C3804000-memory.dmp	upx
behavioral2/files/0x0007000000022b23-73.dat	upx
behavioral2/memory/3644-74-0x00007FF704CA0000-0x00007FF704FF4000-memory.dmp	upx
behavioral2/memory/2020-75-0x00007FF7E5140000-0x00007FF7E5494000-memory.dmp	upx
behavioral2/files/0x0009000000023404-79.dat	upx
behavioral2/files/0x000d000000023406-86.dat	upx
behavioral2/memory/1804-92-0x00007FF7E62E0000-0x00007FF7E6634000-memory.dmp	upx
behavioral2/memory/2288-94-0x00007FF67C950000-0x00007FF67CCA4000-memory.dmp	upx
behavioral2/memory/4028-95-0x00007FF667C80000-0x00007FF667FD4000-memory.dmp	upx
behavioral2/files/0x0007000000023499-98.dat	upx
behavioral2/files/0x000700000002349a-106.dat	upx
behavioral2/files/0x000700000002349b-110.dat	upx
behavioral2/files/0x000700000002349c-116.dat	upx
behavioral2/files/0x000700000002349e-125.dat	upx
behavioral2/files/0x000700000002349d-122.dat	upx
behavioral2/files/0x0007000000023498-99.dat	upx
behavioral2/memory/4124-93-0x00007FF6B3360000-0x00007FF6B36B4000-memory.dmp	upx
behavioral2/memory/1052-90-0x00007FF79A380000-0x00007FF79A6D4000-memory.dmp	upx
behavioral2/memory/3788-127-0x00007FF799FD0000-0x00007FF79A324000-memory.dmp	upx
behavioral2/memory/3836-128-0x00007FF653CB0000-0x00007FF654004000-memory.dmp	upx
behavioral2/memory/2804-129-0x00007FF694C20000-0x00007FF694F74000-memory.dmp	upx
behavioral2/memory/1236-130-0x00007FF7C3EB0000-0x00007FF7C4204000-memory.dmp	upx
behavioral2/memory/5096-131-0x00007FF789EA0000-0x00007FF78A1F4000-memory.dmp	upx
behavioral2/memory/1180-132-0x00007FF61D520000-0x00007FF61D874000-memory.dmp	upx
behavioral2/memory/2724-133-0x00007FF6346A0000-0x00007FF6349F4000-memory.dmp	upx
behavioral2/memory/2252-134-0x00007FF7D2ED0000-0x00007FF7D3224000-memory.dmp	upx
behavioral2/memory/4720-135-0x00007FF6E7DF0000-0x00007FF6E8144000-memory.dmp	upx
behavioral2/memory/2808-136-0x00007FF7C34B0000-0x00007FF7C3804000-memory.dmp	upx
behavioral2/memory/3644-137-0x00007FF704CA0000-0x00007FF704FF4000-memory.dmp	upx
behavioral2/memory/4624-138-0x00007FF62BE40000-0x00007FF62C194000-memory.dmp	upx
behavioral2/memory/2020-139-0x00007FF7E5140000-0x00007FF7E5494000-memory.dmp	upx
behavioral2/memory/4124-140-0x00007FF6B3360000-0x00007FF6B36B4000-memory.dmp	upx
behavioral2/memory/4028-141-0x00007FF667C80000-0x00007FF667FD4000-memory.dmp	upx
behavioral2/memory/3376-142-0x00007FF7A0D00000-0x00007FF7A1054000-memory.dmp	upx
behavioral2/memory/1180-143-0x00007FF61D520000-0x00007FF61D874000-memory.dmp	upx
behavioral2/memory/2252-144-0x00007FF7D2ED0000-0x00007FF7D3224000-memory.dmp	upx
behavioral2/memory/3412-145-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp	upx
behavioral2/memory/1572-146-0x00007FF6FCF10000-0x00007FF6FD264000-memory.dmp	upx
behavioral2/memory/2288-147-0x00007FF67C950000-0x00007FF67CCA4000-memory.dmp	upx
behavioral2/memory/2808-148-0x00007FF7C34B0000-0x00007FF7C3804000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\SZsYXaZ.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lHfUNvT.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\plOUtHv.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iltawKi.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PdxVAfx.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DVwVccN.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LTbxVVQ.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EGvnXmz.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QjLpPLO.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RyTnkFU.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vZJpxtu.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IDaklQX.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jjJSvgM.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UbMLMko.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OzHOmCP.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OXkVuOI.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ULlBPmj.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oFfKTDD.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SKTvQFt.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VBDlWLK.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oteqolE.exe	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 4720	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	84
PID 220 wrote to memory of 4720	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	84
PID 220 wrote to memory of 3644	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	85
PID 220 wrote to memory of 3644	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	85
PID 220 wrote to memory of 4624	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	86
PID 220 wrote to memory of 4624	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	86
PID 220 wrote to memory of 4124	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	88
PID 220 wrote to memory of 4124	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	88
PID 220 wrote to memory of 4028	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	90
PID 220 wrote to memory of 4028	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	90
PID 220 wrote to memory of 1180	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	92
PID 220 wrote to memory of 1180	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	92
PID 220 wrote to memory of 3376	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	93
PID 220 wrote to memory of 3376	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	93
PID 220 wrote to memory of 2252	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	94
PID 220 wrote to memory of 2252	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	94
PID 220 wrote to memory of 3412	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	95
PID 220 wrote to memory of 3412	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	95
PID 220 wrote to memory of 1572	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	96
PID 220 wrote to memory of 1572	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	96
PID 220 wrote to memory of 2808	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	97
PID 220 wrote to memory of 2808	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	97
PID 220 wrote to memory of 2020	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	98
PID 220 wrote to memory of 2020	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	98
PID 220 wrote to memory of 1052	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	99
PID 220 wrote to memory of 1052	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	99
PID 220 wrote to memory of 1804	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	102
PID 220 wrote to memory of 1804	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	102
PID 220 wrote to memory of 2288	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	103
PID 220 wrote to memory of 2288	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	103
PID 220 wrote to memory of 2724	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	104
PID 220 wrote to memory of 2724	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	104
PID 220 wrote to memory of 3788	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	105
PID 220 wrote to memory of 3788	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	105
PID 220 wrote to memory of 3836	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	106
PID 220 wrote to memory of 3836	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	106
PID 220 wrote to memory of 2804	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	107
PID 220 wrote to memory of 2804	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	107
PID 220 wrote to memory of 1236	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	108
PID 220 wrote to memory of 1236	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	108
PID 220 wrote to memory of 5096	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	109
PID 220 wrote to memory of 5096	220	2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe	109

C:\Users\Admin\AppData\Local\Temp\2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-25_bfad8857d2186b5cb1dd6039864be94a_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\System\EGvnXmz.exe
  C:\Windows\System\EGvnXmz.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\IDaklQX.exe
  C:\Windows\System\IDaklQX.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\jjJSvgM.exe
  C:\Windows\System\jjJSvgM.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\UbMLMko.exe
  C:\Windows\System\UbMLMko.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\SZsYXaZ.exe
  C:\Windows\System\SZsYXaZ.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\OzHOmCP.exe
  C:\Windows\System\OzHOmCP.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\lHfUNvT.exe
  C:\Windows\System\lHfUNvT.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\plOUtHv.exe
  C:\Windows\System\plOUtHv.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\iltawKi.exe
  C:\Windows\System\iltawKi.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\QjLpPLO.exe
  C:\Windows\System\QjLpPLO.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\PdxVAfx.exe
  C:\Windows\System\PdxVAfx.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\oteqolE.exe
  C:\Windows\System\oteqolE.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\OXkVuOI.exe
  C:\Windows\System\OXkVuOI.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\ULlBPmj.exe
  C:\Windows\System\ULlBPmj.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\DVwVccN.exe
  C:\Windows\System\DVwVccN.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\oFfKTDD.exe
  C:\Windows\System\oFfKTDD.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\RyTnkFU.exe
  C:\Windows\System\RyTnkFU.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\vZJpxtu.exe
  C:\Windows\System\vZJpxtu.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\SKTvQFt.exe
  C:\Windows\System\SKTvQFt.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\LTbxVVQ.exe
  C:\Windows\System\LTbxVVQ.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\VBDlWLK.exe
  C:\Windows\System\VBDlWLK.exe
  2⤵
  - Executes dropped EXE
  PID:5096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DVwVccN.exe

Path C:\Windows\System\DVwVccN.exe
Size 5.9MB
SHA256 0d4bb4e48fff1a64ee5b3b7fd4076fb24795535b44518b4e9559f1c51c7358a6
MD5 165abdf2a2841c234742851e4d36940b
SHA1 3a3088b9bbd07ac319dbaa9f5622a32834ead234
SHA512 6127320aab089bbd354a354aca3163f1183a52437751ff917df8f89364543ebb73a4fd43a6c08ecebdc444edafe07f3c64a434c8340148bb3594c4ebd7d22d35
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUw:Q+u56utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

EGvnXmz.exe

Path C:\Windows\System\EGvnXmz.exe
Size 5.9MB
SHA256 f08a5adec6de8bf585b8ef0e8d60cdc91eeceeb8659ef78c9d2efa3b6eb61418
MD5 38260f324703dafe28e42ccd644df119
SHA1 770d77e06f999f9a997e6eebd69e98a4e44d3cb0
SHA512 9311d441ef61dd87491157186f4e9fdfb39c95f6d49049112919de384451f5deeedc2a79ef4a00860747b9e8ac8e0a042f4593e42c8ac43aa9003ab3ae78d3c9
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUQ:Q+u56utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

IDaklQX.exe

Path C:\Windows\System\IDaklQX.exe
Size 5.9MB
SHA256 29b14fd743825476b4637a57d199f4d15149046366268c84b514bdab54817d10
MD5 7e74a7580dbb089d35789123df4def6d
SHA1 294afcb1095ae3d6c678b3b9ab28fa053ae1cbca
SHA512 f1deeadf37c20392f0fce348cf6f36ea7affcdc4d53bc18410fb4a4e7533deb4d512975ab7dfc3b2351317fb1f14be1bd5096bdfb0f44fe5fc10159dfd47170d
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUs:Q+u56utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

LTbxVVQ.exe

Path C:\Windows\System\LTbxVVQ.exe
Size 5.9MB
SHA256 a793d8b10c18f3f3cde10c1d6b377d0a60c9668e1616cacd6f3bce750d64d2fe
MD5 4ca3ee1a8e00ce3134f9cb58f0b7f468
SHA1 ef5f459bf14b20efff26b83646ed2de2aec847de
SHA512 b05ce7b2ae12d62c585dc01611e700cad4e72ac338afe473d0fa8666e170478024f32e82304c6773cb5896bf129504627103a1a3a4c01a117c3598267a8f4fe6
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU4:Q+u56utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

OXkVuOI.exe

Path C:\Windows\System\OXkVuOI.exe
Size 5.9MB
SHA256 a39c0b2f8c3db7ee8d7bcbd2e548303807f0ffb5b58186b49cf6552f74758a79
MD5 367492cdd7bcd9ab6d78242d3ccee469
SHA1 f63a5ed829ac1da7ba96bd9c22181f7115364d53
SHA512 8e8637b9e49c44b5e0a2641e3f47094cf91c7a07d70f77d3d33b7bcf46b5d84ad5f03ca6ba73846c4474ff1fdfc44d616d3f2e35e97f14988bd6d00611d7e112
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUa:Q+u56utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

OzHOmCP.exe

Path C:\Windows\System\OzHOmCP.exe
Size 5.9MB
SHA256 bf0237287b481b20e4369cf1c54e8698b97e5ab4901930e95f686f45b33cef11
MD5 28e76e0c8e73cb4defd1122cf9efeaf2
SHA1 42fd66bda31608aa6db4730a0e4d6b0af5674fb7
SHA512 5bc623968be6d4cb743c70d1db7b6845b8f58a726aa5dbd5b9df815b14a27223d5290895112e336b1adac8e5f96b004c01079fe30587be60091a42fe708ac65d
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUT:Q+u56utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

PdxVAfx.exe

Path C:\Windows\System\PdxVAfx.exe
Size 5.9MB
SHA256 1aabcd0b643ba6e7a14b41db2876ec79fff37ecf6ab34de40ccbb2143c11b22b
MD5 4bae0993e2f3ae9563a7ad4331e101ab
SHA1 2274de7c4e74b8bf242fff374686f40cff2ea7d4
SHA512 8ac23d691f841ce35cfdbb08a6cfb9f1400903d007d460b840e099a636b22a060518f906369d58514e788d858334d96d209ab36db11af5302b8cb891b095748b
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU2:Q+u56utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

QjLpPLO.exe

Path C:\Windows\System\QjLpPLO.exe
Size 5.9MB
SHA256 c0c8b0b66acffc81fffe2eee4ddbae764760c18fab15994e0e6676e732464db4
MD5 3c1e75f4c78e0b9d19cfe87bc64161f0
SHA1 250384b11e2d86e3fd510baba2825d36d0a0e06d
SHA512 af5dceef604ef1b9a2b888f2818b5bae6a18a10926267a3fba540a60f6fd03e680e608dff4aa1dcd1e27e226b7b31de8a2f74247ee3bc9fb47421e8601dfeada
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU6:Q+u56utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

RyTnkFU.exe

Path C:\Windows\System\RyTnkFU.exe
Size 5.9MB
SHA256 dbc8c594020cf6e123726845e9d7b4c9681977b3dc2ddcc5b792a03e63b23cdb
MD5 617104b8855960abb4117f5acdab4ee2
SHA1 024f4635b59533822558e9cc4d0b26ca8b74321e
SHA512 faa723ad726bd8390ff38e271a936438cfa62e66d30f85f27ad6c8e46286c79ad5ad8d4ef53b3ec4814a112ef20dd9545fd83491b8c3468149848a9ba7881491
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUn:Q+u56utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

SKTvQFt.exe

Path C:\Windows\System\SKTvQFt.exe
Size 5.9MB
SHA256 d80fdae989097c0984e2e528cd859c9dd01cc97ae95b0dd476683a854dee958c
MD5 7070b23d1eda84bac00fc22e84a981dd
SHA1 3e6fcc6328c93ddfdacaf2bcce311d0c6b3ce9b1
SHA512 5d2ff173a718f4f99b3f0946f37048310b05509f3aee189c9d407a6ae209cbe90ebf0d8acb62a48d70d5e39c495564e7792b90acd3b5b4c976e1f90d3812234f
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUQ:Q+u56utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

SZsYXaZ.exe

Path C:\Windows\System\SZsYXaZ.exe
Size 5.9MB
SHA256 e45d22099baa813216e1ee1008ea6c0c56befe7e3d807020be4e309711ff5621
MD5 450d5bbf16d7d22673f3ed5960afc77c
SHA1 71696abbc4e61043feaa90a3cc28c6306cf085cd
SHA512 53926b7022c5faf939b1a475fee5799ef78716968ad3d474992b452b2cac2fe94d40a9c9bb1f685e547af2c2c0adab5fe77a59cacce5b88d50447acf903f5317
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUN:Q+u56utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

ULlBPmj.exe

Path C:\Windows\System\ULlBPmj.exe
Size 5.9MB
SHA256 f5432ec6b5724bf886d5f55f6fbd0689546ada329dbe708b58d7243cc26beff8
MD5 a8934f4bf4f9bc4cc723c3c03f869be2
SHA1 44e702bddd4ca12fd6cfb034a01ab133fec42db4
SHA512 00f5d9af27869f7f8ad945e11e82e16809552f7bc6f41cd52b1ef7337f92765bc15cfe271e75190495a5088d999232604f052aff380cb368f7f2375014225498
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU/:Q+u56utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

UbMLMko.exe

Path C:\Windows\System\UbMLMko.exe
Size 5.9MB
SHA256 2e80ed5cc86c287616183ee22a389d07b7cae9851d45b9e43856fe66e147ecba
MD5 a237e84881bc02f77e0ed328f038dce7
SHA1 6285e1e083e6b858a284d5ef9e4bec22508e63b9
SHA512 b01376feffce73e1ca25aa370b8c1c04317b3abe0ea1c3c3890d76118493f8617d955506a83d347bea41d7778b9447c8531d4c0b03ea37c7f08e05b1945b4b0c
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUJ:Q+u56utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

VBDlWLK.exe

Path C:\Windows\System\VBDlWLK.exe
Size 5.9MB
SHA256 737eeb3b8041588d510726ef0d893d5a97518675b1b5b8800d0ddc1460809846
MD5 1baf544e3e45c58a36bb5594f562cd17
SHA1 572b308334e3cf2920adbe6af2e6e9752cb2a9f6
SHA512 eb33c2f4c1e868408d1171b68c065f5ee6cce6f1a6c6fa0e1b9f9130c946a734d0d50aef1cf0f4e064977d07c2728661fe262ad7ce402d87ff1b2094d6a901a4
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUR:Q+u56utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

iltawKi.exe

Path C:\Windows\System\iltawKi.exe
Size 5.9MB
SHA256 85fd0fa38511502332e207b02cda28c4aafbbbebed8b4aea0a7cf8ff138befc3
MD5 51cf04361ec6113f199982c7461321bf
SHA1 ef45a48d224200b96347d2c9da30ff11d3c03c6a
SHA512 25c9ba76d18a62a50ec7d1886771a379ef147613ecc4b93ae3256b18e642d62eca47d8aef41b3a8d9a0ec16358fcf8d43a5eeff478ffe2b12ac62ea4825429c1
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUA:Q+u56utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

jjJSvgM.exe

Path C:\Windows\System\jjJSvgM.exe
Size 5.9MB
SHA256 442f8a478b7c1015685f75341b8ce3fa3bed069b9bc5601f3a55be881f67bd79
MD5 621ba7aed07f633f2f3322009520dbbf
SHA1 a746bc54ff2db7e93bf99c3e4977ed2f2b1bc558
SHA512 39955daf87b3c80147d9c350425123c8943d66b33aa0dca6fc98182c28afbe886ec02c93a993fee4959b66335def8e3e499410e61793b4c5264d42546bd4e68f
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUv:Q+u56utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

lHfUNvT.exe

Path C:\Windows\System\lHfUNvT.exe
Size 5.9MB
SHA256 8f25f91cba5afd7d54b9f25c6a82eabb7c01a52fbadf123bd4f248b17f7b9f60
MD5 e6adf2e3c5095714b71ab3bdc9988071
SHA1 de0b8af016e490f93c6887f47d88b375c8dd340e
SHA512 a3f8a20865a12c4b0e5646c7866de6455fa8550eb1bb2567851f01ded8264142ac5410758920cb365563abf50ac07fa7ad3283c8251da983fc105b4689a71e8a
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUD:Q+u56utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

oFfKTDD.exe

Path C:\Windows\System\oFfKTDD.exe
Size 5.9MB
SHA256 757a4861be45725d1caabeab87c77e54b52784118d977a1b7bd9bd5c7dff6a19
MD5 a80fb21dad208d04f18e9de98b237e61
SHA1 8f077540cc36cab8d17e146753d9821540196f70
SHA512 858b8c2faaac6646dbddd52c0d027ca9786c632750652a867c8fbed8ae38fb2acd44986a0d875ea3ef3166eb121697cd90d22de960115c50e9e9ce2fae06c65b
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUx:Q+u56utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

oteqolE.exe

Path C:\Windows\System\oteqolE.exe
Size 5.9MB
SHA256 82443216599a91998801f9dfaad97f0450c794fc2692f787e9c4267adba7111f
MD5 c894b02103b674a2c8cbabcf44fc78cb
SHA1 b800c4e687ba387c645fe5a658e44fceb5d367e9
SHA512 dae517fa6dbc7b0cd8f74ea541d206481cc39b444be84601b1a0c7d5688fde87e863a493e5db418440d9861503dc06b34a4ab395696e6c48081a01f9ae2f9bc6
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUj:Q+u56utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

plOUtHv.exe

Path C:\Windows\System\plOUtHv.exe
Size 5.9MB
SHA256 9ad3bd4a669602e95ec68b59793b4f8efbb0026c7d20cbed7a04d334a7ca5197
MD5 8fd821b76b768333d9045ff47fc1a82b
SHA1 0756a59ebaa6a91f87111b8c0d9b9319ec61847d
SHA512 10ef22162329ae8eb352fbab86fd521168535acfec06f23be5f619eb41b7f7f09560af01df5abbd93c1bcddedf1ef81b3fae3acec268c8304d99e12897a9ac93
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lUV:Q+u56utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

vZJpxtu.exe

Path C:\Windows\System\vZJpxtu.exe
Size 5.9MB
SHA256 f6714bf0ffa1ded93884524ed8c41faaa10bf240efa7eb8fb53f9534a7b23e14
MD5 d312734b9b5e0883747172775499af99
SHA1 2a5de475fb6318ac2ec52a18811e01f18cb37a90
SHA512 0cc99055d333a3239d1647bd499a8059bd6cb6e14e9416af001b597ce32cfbaa0bb33d56813087c64c437773babfa0e8a647746906c11a8ea5099c2215c26d82
SSDEEP 98304:BemTLkNdfE0pZrT56utgpPFotBER/mQ32lU+:Q+u56utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-0-0x00007FF65A1F0000-0x00007FF65A544000-memory.dmp

Download

memory/220-62-0x00007FF65A1F0000-0x00007FF65A544000-memory.dmp

Download

memory/220-1-0x000001995D5D0000-0x000001995D5E0000-memory.dmp

Download

memory/1052-90-0x00007FF79A380000-0x00007FF79A6D4000-memory.dmp

Download

memory/1052-150-0x00007FF79A380000-0x00007FF79A6D4000-memory.dmp

Download

memory/1180-132-0x00007FF61D520000-0x00007FF61D874000-memory.dmp

Download

memory/1180-36-0x00007FF61D520000-0x00007FF61D874000-memory.dmp

Download

memory/1180-143-0x00007FF61D520000-0x00007FF61D874000-memory.dmp

Download

memory/1236-130-0x00007FF7C3EB0000-0x00007FF7C4204000-memory.dmp

Download

memory/1236-158-0x00007FF7C3EB0000-0x00007FF7C4204000-memory.dmp

Download

memory/1572-63-0x00007FF6FCF10000-0x00007FF6FD264000-memory.dmp

Download

memory/1572-146-0x00007FF6FCF10000-0x00007FF6FD264000-memory.dmp

Download

memory/1804-92-0x00007FF7E62E0000-0x00007FF7E6634000-memory.dmp

Download

memory/1804-151-0x00007FF7E62E0000-0x00007FF7E6634000-memory.dmp

Download

memory/2020-75-0x00007FF7E5140000-0x00007FF7E5494000-memory.dmp

Download

memory/2020-149-0x00007FF7E5140000-0x00007FF7E5494000-memory.dmp

Download

memory/2020-139-0x00007FF7E5140000-0x00007FF7E5494000-memory.dmp

Download

memory/2252-47-0x00007FF7D2ED0000-0x00007FF7D3224000-memory.dmp

Download

memory/2252-144-0x00007FF7D2ED0000-0x00007FF7D3224000-memory.dmp

Download

memory/2252-134-0x00007FF7D2ED0000-0x00007FF7D3224000-memory.dmp

Download

memory/2288-94-0x00007FF67C950000-0x00007FF67CCA4000-memory.dmp

Download

memory/2288-147-0x00007FF67C950000-0x00007FF67CCA4000-memory.dmp

Download

memory/2288-152-0x00007FF67C950000-0x00007FF67CCA4000-memory.dmp

Download

memory/2724-133-0x00007FF6346A0000-0x00007FF6349F4000-memory.dmp

Download

memory/2724-153-0x00007FF6346A0000-0x00007FF6349F4000-memory.dmp

Download

memory/2804-129-0x00007FF694C20000-0x00007FF694F74000-memory.dmp

Download

memory/2804-156-0x00007FF694C20000-0x00007FF694F74000-memory.dmp

Download

memory/2808-70-0x00007FF7C34B0000-0x00007FF7C3804000-memory.dmp

Download

memory/2808-148-0x00007FF7C34B0000-0x00007FF7C3804000-memory.dmp

Download

memory/2808-136-0x00007FF7C34B0000-0x00007FF7C3804000-memory.dmp

Download

memory/3376-44-0x00007FF7A0D00000-0x00007FF7A1054000-memory.dmp

Download

memory/3376-142-0x00007FF7A0D00000-0x00007FF7A1054000-memory.dmp

Download

memory/3412-56-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp

Download

memory/3412-145-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp

Download

memory/3644-137-0x00007FF704CA0000-0x00007FF704FF4000-memory.dmp

Download

memory/3644-74-0x00007FF704CA0000-0x00007FF704FF4000-memory.dmp

Download

memory/3644-14-0x00007FF704CA0000-0x00007FF704FF4000-memory.dmp

Download

memory/3788-127-0x00007FF799FD0000-0x00007FF79A324000-memory.dmp

Download

memory/3788-154-0x00007FF799FD0000-0x00007FF79A324000-memory.dmp

Download

memory/3836-155-0x00007FF653CB0000-0x00007FF654004000-memory.dmp

Download

memory/3836-128-0x00007FF653CB0000-0x00007FF654004000-memory.dmp

Download

memory/4028-141-0x00007FF667C80000-0x00007FF667FD4000-memory.dmp

Download

memory/4028-32-0x00007FF667C80000-0x00007FF667FD4000-memory.dmp

Download

memory/4028-95-0x00007FF667C80000-0x00007FF667FD4000-memory.dmp

Download

memory/4124-140-0x00007FF6B3360000-0x00007FF6B36B4000-memory.dmp

Download

memory/4124-93-0x00007FF6B3360000-0x00007FF6B36B4000-memory.dmp

Download

memory/4124-26-0x00007FF6B3360000-0x00007FF6B36B4000-memory.dmp

Download

memory/4624-20-0x00007FF62BE40000-0x00007FF62C194000-memory.dmp

Download

memory/4624-138-0x00007FF62BE40000-0x00007FF62C194000-memory.dmp

Download

memory/4720-135-0x00007FF6E7DF0000-0x00007FF6E8144000-memory.dmp

Download

memory/4720-67-0x00007FF6E7DF0000-0x00007FF6E8144000-memory.dmp

Download

memory/4720-8-0x00007FF6E7DF0000-0x00007FF6E8144000-memory.dmp

Download

memory/5096-131-0x00007FF789EA0000-0x00007FF78A1F4000-memory.dmp

Download

memory/5096-157-0x00007FF789EA0000-0x00007FF78A1F4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads