cobaltstrike | fda4225ef3187dd0071dc666fb894e5fefe10d6ad9278906b08850e85b8867b0

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 15:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
Size 5.2MB
Sample240525-s52bcshd31
SHA256 fda4225ef3187dd0071dc666fb894e5fefe10d6ad9278906b08850e85b8867b0
MD5 1304348961947d4e925c09d9869ac9a2
SHA1 5113fde51851fd4335cd8c18bdf64de706d2aa0a
SHA512 83f831acdf4dc3c6da32835cc1300376dab2a30ac3178bbf95e9038719016813cce126a4e2ce7a55bc2dc362517765c0b2ead1706cb520437ad8e7b40f6fb37a
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lT:RWWBibW56utgpPFotBER/mQ32lUP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000c0000000233da-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023427-12.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023428-23.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342a-22.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023429-21.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342d-46.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023430-84.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023434-97.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023435-103.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023439-118.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023437-116.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023438-114.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023436-110.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023432-106.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023433-101.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023431-87.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023424-82.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342f-68.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342e-64.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342c-47.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342b-40.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000c0000000233da-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023427-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023428-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342a-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023429-21.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342d-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023430-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023434-97.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023435-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023439-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023437-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023438-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023436-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023432-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023433-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023431-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023424-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342f-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342e-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342c-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342b-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3268-0-0x00007FF66A090000-0x00007FF66A3E1000-memory.dmp	UPX
behavioral2/files/0x000c0000000233da-4.dat	UPX
behavioral2/memory/5100-8-0x00007FF6C4E50000-0x00007FF6C51A1000-memory.dmp	UPX
behavioral2/files/0x0007000000023427-12.dat	UPX
behavioral2/files/0x0007000000023428-23.dat	UPX
behavioral2/files/0x000700000002342a-22.dat	UPX
behavioral2/files/0x0007000000023429-21.dat	UPX
behavioral2/memory/4964-19-0x00007FF731770000-0x00007FF731AC1000-memory.dmp	UPX
behavioral2/memory/3960-31-0x00007FF7E39F0000-0x00007FF7E3D41000-memory.dmp	UPX
behavioral2/files/0x000700000002342d-46.dat	UPX
behavioral2/files/0x0007000000023430-84.dat	UPX
behavioral2/files/0x0007000000023434-97.dat	UPX
behavioral2/files/0x0007000000023435-103.dat	UPX
behavioral2/memory/1212-112-0x00007FF6C2DD0000-0x00007FF6C3121000-memory.dmp	UPX
behavioral2/memory/3068-120-0x00007FF7D3020000-0x00007FF7D3371000-memory.dmp	UPX
behavioral2/memory/3284-125-0x00007FF7F8F00000-0x00007FF7F9251000-memory.dmp	UPX
behavioral2/memory/2816-126-0x00007FF6DCB90000-0x00007FF6DCEE1000-memory.dmp	UPX
behavioral2/memory/4344-124-0x00007FF739DB0000-0x00007FF73A101000-memory.dmp	UPX
behavioral2/memory/2416-123-0x00007FF7E0F70000-0x00007FF7E12C1000-memory.dmp	UPX
behavioral2/memory/5020-122-0x00007FF7BFAA0000-0x00007FF7BFDF1000-memory.dmp	UPX
behavioral2/memory/1996-121-0x00007FF7A1AF0000-0x00007FF7A1E41000-memory.dmp	UPX
behavioral2/files/0x0007000000023439-118.dat	UPX
behavioral2/files/0x0007000000023437-116.dat	UPX
behavioral2/files/0x0007000000023438-114.dat	UPX
behavioral2/memory/1900-113-0x00007FF6FC850000-0x00007FF6FCBA1000-memory.dmp	UPX
behavioral2/files/0x0007000000023436-110.dat	UPX
behavioral2/memory/5116-109-0x00007FF76E970000-0x00007FF76ECC1000-memory.dmp	UPX
behavioral2/files/0x0007000000023432-106.dat	UPX
behavioral2/memory/2184-99-0x00007FF77FF60000-0x00007FF7802B1000-memory.dmp	UPX
behavioral2/files/0x0007000000023433-101.dat	UPX
behavioral2/memory/1044-91-0x00007FF6DFC70000-0x00007FF6DFFC1000-memory.dmp	UPX
behavioral2/files/0x0007000000023431-87.dat	UPX
behavioral2/files/0x0008000000023424-82.dat	UPX
behavioral2/memory/4656-80-0x00007FF6985F0000-0x00007FF698941000-memory.dmp	UPX
behavioral2/memory/4140-77-0x00007FF7950A0000-0x00007FF7953F1000-memory.dmp	UPX
behavioral2/files/0x000700000002342f-68.dat	UPX
behavioral2/files/0x000700000002342e-64.dat	UPX
behavioral2/memory/2608-61-0x00007FF6B9A20000-0x00007FF6B9D71000-memory.dmp	UPX
behavioral2/memory/4772-55-0x00007FF6E9570000-0x00007FF6E98C1000-memory.dmp	UPX
behavioral2/files/0x000700000002342c-47.dat	UPX
behavioral2/memory/3480-45-0x00007FF7AE710000-0x00007FF7AEA61000-memory.dmp	UPX
behavioral2/memory/2732-42-0x00007FF634400000-0x00007FF634751000-memory.dmp	UPX
behavioral2/files/0x000700000002342b-40.dat	UPX
behavioral2/memory/3268-128-0x00007FF66A090000-0x00007FF66A3E1000-memory.dmp	UPX
behavioral2/memory/5100-129-0x00007FF6C4E50000-0x00007FF6C51A1000-memory.dmp	UPX
behavioral2/memory/2184-144-0x00007FF77FF60000-0x00007FF7802B1000-memory.dmp	UPX
behavioral2/memory/1900-149-0x00007FF6FC850000-0x00007FF6FCBA1000-memory.dmp	UPX
behavioral2/memory/1212-146-0x00007FF6C2DD0000-0x00007FF6C3121000-memory.dmp	UPX
behavioral2/memory/5116-145-0x00007FF76E970000-0x00007FF76ECC1000-memory.dmp	UPX
behavioral2/memory/1044-143-0x00007FF6DFC70000-0x00007FF6DFFC1000-memory.dmp	UPX
behavioral2/memory/4656-140-0x00007FF6985F0000-0x00007FF698941000-memory.dmp	UPX
behavioral2/memory/4140-139-0x00007FF7950A0000-0x00007FF7953F1000-memory.dmp	UPX
behavioral2/memory/4772-136-0x00007FF6E9570000-0x00007FF6E98C1000-memory.dmp	UPX
behavioral2/memory/3268-150-0x00007FF66A090000-0x00007FF66A3E1000-memory.dmp	UPX
behavioral2/memory/3268-172-0x00007FF66A090000-0x00007FF66A3E1000-memory.dmp	UPX
behavioral2/memory/5100-196-0x00007FF6C4E50000-0x00007FF6C51A1000-memory.dmp	UPX
behavioral2/memory/4964-198-0x00007FF731770000-0x00007FF731AC1000-memory.dmp	UPX
behavioral2/memory/3960-200-0x00007FF7E39F0000-0x00007FF7E3D41000-memory.dmp	UPX
behavioral2/memory/2732-202-0x00007FF634400000-0x00007FF634751000-memory.dmp	UPX
behavioral2/memory/3480-204-0x00007FF7AE710000-0x00007FF7AEA61000-memory.dmp	UPX
behavioral2/memory/2608-207-0x00007FF6B9A20000-0x00007FF6B9D71000-memory.dmp	UPX
behavioral2/memory/3068-210-0x00007FF7D3020000-0x00007FF7D3371000-memory.dmp	UPX
behavioral2/memory/4772-209-0x00007FF6E9570000-0x00007FF6E98C1000-memory.dmp	UPX
behavioral2/memory/1996-212-0x00007FF7A1AF0000-0x00007FF7A1E41000-memory.dmp	UPX

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/4964-19-0x00007FF731770000-0x00007FF731AC1000-memory.dmp	xmrig
behavioral2/memory/3960-31-0x00007FF7E39F0000-0x00007FF7E3D41000-memory.dmp	xmrig
behavioral2/memory/3068-120-0x00007FF7D3020000-0x00007FF7D3371000-memory.dmp	xmrig
behavioral2/memory/3284-125-0x00007FF7F8F00000-0x00007FF7F9251000-memory.dmp	xmrig
behavioral2/memory/2816-126-0x00007FF6DCB90000-0x00007FF6DCEE1000-memory.dmp	xmrig
behavioral2/memory/4344-124-0x00007FF739DB0000-0x00007FF73A101000-memory.dmp	xmrig
behavioral2/memory/2416-123-0x00007FF7E0F70000-0x00007FF7E12C1000-memory.dmp	xmrig
behavioral2/memory/5020-122-0x00007FF7BFAA0000-0x00007FF7BFDF1000-memory.dmp	xmrig
behavioral2/memory/1996-121-0x00007FF7A1AF0000-0x00007FF7A1E41000-memory.dmp	xmrig
behavioral2/memory/2608-61-0x00007FF6B9A20000-0x00007FF6B9D71000-memory.dmp	xmrig
behavioral2/memory/4772-55-0x00007FF6E9570000-0x00007FF6E98C1000-memory.dmp	xmrig
behavioral2/memory/3480-45-0x00007FF7AE710000-0x00007FF7AEA61000-memory.dmp	xmrig
behavioral2/memory/2732-42-0x00007FF634400000-0x00007FF634751000-memory.dmp	xmrig
behavioral2/memory/3268-128-0x00007FF66A090000-0x00007FF66A3E1000-memory.dmp	xmrig
behavioral2/memory/5100-129-0x00007FF6C4E50000-0x00007FF6C51A1000-memory.dmp	xmrig
behavioral2/memory/2184-144-0x00007FF77FF60000-0x00007FF7802B1000-memory.dmp	xmrig
behavioral2/memory/1900-149-0x00007FF6FC850000-0x00007FF6FCBA1000-memory.dmp	xmrig
behavioral2/memory/1212-146-0x00007FF6C2DD0000-0x00007FF6C3121000-memory.dmp	xmrig
behavioral2/memory/5116-145-0x00007FF76E970000-0x00007FF76ECC1000-memory.dmp	xmrig
behavioral2/memory/1044-143-0x00007FF6DFC70000-0x00007FF6DFFC1000-memory.dmp	xmrig
behavioral2/memory/4656-140-0x00007FF6985F0000-0x00007FF698941000-memory.dmp	xmrig
behavioral2/memory/4140-139-0x00007FF7950A0000-0x00007FF7953F1000-memory.dmp	xmrig
behavioral2/memory/4772-136-0x00007FF6E9570000-0x00007FF6E98C1000-memory.dmp	xmrig
behavioral2/memory/3268-150-0x00007FF66A090000-0x00007FF66A3E1000-memory.dmp	xmrig
behavioral2/memory/3268-172-0x00007FF66A090000-0x00007FF66A3E1000-memory.dmp	xmrig
behavioral2/memory/5100-196-0x00007FF6C4E50000-0x00007FF6C51A1000-memory.dmp	xmrig
behavioral2/memory/4964-198-0x00007FF731770000-0x00007FF731AC1000-memory.dmp	xmrig
behavioral2/memory/3960-200-0x00007FF7E39F0000-0x00007FF7E3D41000-memory.dmp	xmrig
behavioral2/memory/2732-202-0x00007FF634400000-0x00007FF634751000-memory.dmp	xmrig
behavioral2/memory/3480-204-0x00007FF7AE710000-0x00007FF7AEA61000-memory.dmp	xmrig
behavioral2/memory/2608-207-0x00007FF6B9A20000-0x00007FF6B9D71000-memory.dmp	xmrig
behavioral2/memory/3068-210-0x00007FF7D3020000-0x00007FF7D3371000-memory.dmp	xmrig
behavioral2/memory/4772-209-0x00007FF6E9570000-0x00007FF6E98C1000-memory.dmp	xmrig
behavioral2/memory/1996-212-0x00007FF7A1AF0000-0x00007FF7A1E41000-memory.dmp	xmrig
behavioral2/memory/5020-214-0x00007FF7BFAA0000-0x00007FF7BFDF1000-memory.dmp	xmrig
behavioral2/memory/4656-218-0x00007FF6985F0000-0x00007FF698941000-memory.dmp	xmrig
behavioral2/memory/4140-217-0x00007FF7950A0000-0x00007FF7953F1000-memory.dmp	xmrig
behavioral2/memory/1044-220-0x00007FF6DFC70000-0x00007FF6DFFC1000-memory.dmp	xmrig
behavioral2/memory/4344-231-0x00007FF739DB0000-0x00007FF73A101000-memory.dmp	xmrig
behavioral2/memory/3284-232-0x00007FF7F8F00000-0x00007FF7F9251000-memory.dmp	xmrig
behavioral2/memory/1900-234-0x00007FF6FC850000-0x00007FF6FCBA1000-memory.dmp	xmrig
behavioral2/memory/5116-228-0x00007FF76E970000-0x00007FF76ECC1000-memory.dmp	xmrig
behavioral2/memory/2184-224-0x00007FF77FF60000-0x00007FF7802B1000-memory.dmp	xmrig
behavioral2/memory/2416-223-0x00007FF7E0F70000-0x00007FF7E12C1000-memory.dmp	xmrig
behavioral2/memory/2816-227-0x00007FF6DCB90000-0x00007FF6DCEE1000-memory.dmp	xmrig
behavioral2/memory/1212-240-0x00007FF6C2DD0000-0x00007FF6C3121000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
5100	CyewiOF.exe
4964	lDqXgDH.exe
3960	rSNGyOc.exe
2732	LTodHrD.exe
3480	uhllFsw.exe
3068	FGasiot.exe
4772	bpewYaw.exe
2608	dgUaZoL.exe
1996	kMISiZL.exe
5020	TvDjbZM.exe
4140	rtGQIvg.exe
4656	zHqjFzl.exe
2416	LXHdFrW.exe
4344	vpCnVoz.exe
1044	hwwfCXL.exe
2184	nCbDqAf.exe
5116	nKbzOhd.exe
1212	ugyLYKe.exe
3284	Ntemgdn.exe
2816	diOJdJg.exe
1900	IBSkpur.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3268-0-0x00007FF66A090000-0x00007FF66A3E1000-memory.dmp	upx
behavioral2/files/0x000c0000000233da-4.dat	upx
behavioral2/memory/5100-8-0x00007FF6C4E50000-0x00007FF6C51A1000-memory.dmp	upx
behavioral2/files/0x0007000000023427-12.dat	upx
behavioral2/files/0x0007000000023428-23.dat	upx
behavioral2/files/0x000700000002342a-22.dat	upx
behavioral2/files/0x0007000000023429-21.dat	upx
behavioral2/memory/4964-19-0x00007FF731770000-0x00007FF731AC1000-memory.dmp	upx
behavioral2/memory/3960-31-0x00007FF7E39F0000-0x00007FF7E3D41000-memory.dmp	upx
behavioral2/files/0x000700000002342d-46.dat	upx
behavioral2/files/0x0007000000023430-84.dat	upx
behavioral2/files/0x0007000000023434-97.dat	upx
behavioral2/files/0x0007000000023435-103.dat	upx
behavioral2/memory/1212-112-0x00007FF6C2DD0000-0x00007FF6C3121000-memory.dmp	upx
behavioral2/memory/3068-120-0x00007FF7D3020000-0x00007FF7D3371000-memory.dmp	upx
behavioral2/memory/3284-125-0x00007FF7F8F00000-0x00007FF7F9251000-memory.dmp	upx
behavioral2/memory/2816-126-0x00007FF6DCB90000-0x00007FF6DCEE1000-memory.dmp	upx
behavioral2/memory/4344-124-0x00007FF739DB0000-0x00007FF73A101000-memory.dmp	upx
behavioral2/memory/2416-123-0x00007FF7E0F70000-0x00007FF7E12C1000-memory.dmp	upx
behavioral2/memory/5020-122-0x00007FF7BFAA0000-0x00007FF7BFDF1000-memory.dmp	upx
behavioral2/memory/1996-121-0x00007FF7A1AF0000-0x00007FF7A1E41000-memory.dmp	upx
behavioral2/files/0x0007000000023439-118.dat	upx
behavioral2/files/0x0007000000023437-116.dat	upx
behavioral2/files/0x0007000000023438-114.dat	upx
behavioral2/memory/1900-113-0x00007FF6FC850000-0x00007FF6FCBA1000-memory.dmp	upx
behavioral2/files/0x0007000000023436-110.dat	upx
behavioral2/memory/5116-109-0x00007FF76E970000-0x00007FF76ECC1000-memory.dmp	upx
behavioral2/files/0x0007000000023432-106.dat	upx
behavioral2/memory/2184-99-0x00007FF77FF60000-0x00007FF7802B1000-memory.dmp	upx
behavioral2/files/0x0007000000023433-101.dat	upx
behavioral2/memory/1044-91-0x00007FF6DFC70000-0x00007FF6DFFC1000-memory.dmp	upx
behavioral2/files/0x0007000000023431-87.dat	upx
behavioral2/files/0x0008000000023424-82.dat	upx
behavioral2/memory/4656-80-0x00007FF6985F0000-0x00007FF698941000-memory.dmp	upx
behavioral2/memory/4140-77-0x00007FF7950A0000-0x00007FF7953F1000-memory.dmp	upx
behavioral2/files/0x000700000002342f-68.dat	upx
behavioral2/files/0x000700000002342e-64.dat	upx
behavioral2/memory/2608-61-0x00007FF6B9A20000-0x00007FF6B9D71000-memory.dmp	upx
behavioral2/memory/4772-55-0x00007FF6E9570000-0x00007FF6E98C1000-memory.dmp	upx
behavioral2/files/0x000700000002342c-47.dat	upx
behavioral2/memory/3480-45-0x00007FF7AE710000-0x00007FF7AEA61000-memory.dmp	upx
behavioral2/memory/2732-42-0x00007FF634400000-0x00007FF634751000-memory.dmp	upx
behavioral2/files/0x000700000002342b-40.dat	upx
behavioral2/memory/3268-128-0x00007FF66A090000-0x00007FF66A3E1000-memory.dmp	upx
behavioral2/memory/5100-129-0x00007FF6C4E50000-0x00007FF6C51A1000-memory.dmp	upx
behavioral2/memory/2184-144-0x00007FF77FF60000-0x00007FF7802B1000-memory.dmp	upx
behavioral2/memory/1900-149-0x00007FF6FC850000-0x00007FF6FCBA1000-memory.dmp	upx
behavioral2/memory/1212-146-0x00007FF6C2DD0000-0x00007FF6C3121000-memory.dmp	upx
behavioral2/memory/5116-145-0x00007FF76E970000-0x00007FF76ECC1000-memory.dmp	upx
behavioral2/memory/1044-143-0x00007FF6DFC70000-0x00007FF6DFFC1000-memory.dmp	upx
behavioral2/memory/4656-140-0x00007FF6985F0000-0x00007FF698941000-memory.dmp	upx
behavioral2/memory/4140-139-0x00007FF7950A0000-0x00007FF7953F1000-memory.dmp	upx
behavioral2/memory/4772-136-0x00007FF6E9570000-0x00007FF6E98C1000-memory.dmp	upx
behavioral2/memory/3268-150-0x00007FF66A090000-0x00007FF66A3E1000-memory.dmp	upx
behavioral2/memory/3268-172-0x00007FF66A090000-0x00007FF66A3E1000-memory.dmp	upx
behavioral2/memory/5100-196-0x00007FF6C4E50000-0x00007FF6C51A1000-memory.dmp	upx
behavioral2/memory/4964-198-0x00007FF731770000-0x00007FF731AC1000-memory.dmp	upx
behavioral2/memory/3960-200-0x00007FF7E39F0000-0x00007FF7E3D41000-memory.dmp	upx
behavioral2/memory/2732-202-0x00007FF634400000-0x00007FF634751000-memory.dmp	upx
behavioral2/memory/3480-204-0x00007FF7AE710000-0x00007FF7AEA61000-memory.dmp	upx
behavioral2/memory/2608-207-0x00007FF6B9A20000-0x00007FF6B9D71000-memory.dmp	upx
behavioral2/memory/3068-210-0x00007FF7D3020000-0x00007FF7D3371000-memory.dmp	upx
behavioral2/memory/4772-209-0x00007FF6E9570000-0x00007FF6E98C1000-memory.dmp	upx
behavioral2/memory/1996-212-0x00007FF7A1AF0000-0x00007FF7A1E41000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\LTodHrD.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rtGQIvg.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vpCnVoz.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\diOJdJg.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CyewiOF.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lDqXgDH.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FGasiot.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bpewYaw.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kMISiZL.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hwwfCXL.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\Ntemgdn.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rSNGyOc.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dgUaZoL.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TvDjbZM.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zHqjFzl.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LXHdFrW.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nKbzOhd.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ugyLYKe.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uhllFsw.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nCbDqAf.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IBSkpur.exe	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 5100	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	86
PID 3268 wrote to memory of 5100	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	86
PID 3268 wrote to memory of 4964	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	87
PID 3268 wrote to memory of 4964	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	87
PID 3268 wrote to memory of 3960	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	88
PID 3268 wrote to memory of 3960	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	88
PID 3268 wrote to memory of 2732	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	89
PID 3268 wrote to memory of 2732	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	89
PID 3268 wrote to memory of 3480	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	90
PID 3268 wrote to memory of 3480	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	90
PID 3268 wrote to memory of 3068	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	91
PID 3268 wrote to memory of 3068	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	91
PID 3268 wrote to memory of 2608	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	92
PID 3268 wrote to memory of 2608	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	92
PID 3268 wrote to memory of 4772	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	93
PID 3268 wrote to memory of 4772	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	93
PID 3268 wrote to memory of 1996	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	94
PID 3268 wrote to memory of 1996	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	94
PID 3268 wrote to memory of 5020	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	95
PID 3268 wrote to memory of 5020	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	95
PID 3268 wrote to memory of 4140	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	96
PID 3268 wrote to memory of 4140	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	96
PID 3268 wrote to memory of 4656	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	98
PID 3268 wrote to memory of 4656	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	98
PID 3268 wrote to memory of 2416	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	99
PID 3268 wrote to memory of 2416	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	99
PID 3268 wrote to memory of 4344	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	100
PID 3268 wrote to memory of 4344	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	100
PID 3268 wrote to memory of 1044	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	101
PID 3268 wrote to memory of 1044	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	101
PID 3268 wrote to memory of 2184	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	102
PID 3268 wrote to memory of 2184	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	102
PID 3268 wrote to memory of 5116	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	103
PID 3268 wrote to memory of 5116	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	103
PID 3268 wrote to memory of 1212	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	104
PID 3268 wrote to memory of 1212	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	104
PID 3268 wrote to memory of 3284	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	105
PID 3268 wrote to memory of 3284	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	105
PID 3268 wrote to memory of 2816	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	106
PID 3268 wrote to memory of 2816	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	106
PID 3268 wrote to memory of 1900	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	107
PID 3268 wrote to memory of 1900	3268	2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe	107

C:\Users\Admin\AppData\Local\Temp\2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-25_1304348961947d4e925c09d9869ac9a2_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\System\CyewiOF.exe
  C:\Windows\System\CyewiOF.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\lDqXgDH.exe
  C:\Windows\System\lDqXgDH.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\rSNGyOc.exe
  C:\Windows\System\rSNGyOc.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\LTodHrD.exe
  C:\Windows\System\LTodHrD.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\uhllFsw.exe
  C:\Windows\System\uhllFsw.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\FGasiot.exe
  C:\Windows\System\FGasiot.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\dgUaZoL.exe
  C:\Windows\System\dgUaZoL.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\bpewYaw.exe
  C:\Windows\System\bpewYaw.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\kMISiZL.exe
  C:\Windows\System\kMISiZL.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\TvDjbZM.exe
  C:\Windows\System\TvDjbZM.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\rtGQIvg.exe
  C:\Windows\System\rtGQIvg.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\zHqjFzl.exe
  C:\Windows\System\zHqjFzl.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\LXHdFrW.exe
  C:\Windows\System\LXHdFrW.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\vpCnVoz.exe
  C:\Windows\System\vpCnVoz.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\hwwfCXL.exe
  C:\Windows\System\hwwfCXL.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\nCbDqAf.exe
  C:\Windows\System\nCbDqAf.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\nKbzOhd.exe
  C:\Windows\System\nKbzOhd.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\ugyLYKe.exe
  C:\Windows\System\ugyLYKe.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\Ntemgdn.exe
  C:\Windows\System\Ntemgdn.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\diOJdJg.exe
  C:\Windows\System\diOJdJg.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\IBSkpur.exe
  C:\Windows\System\IBSkpur.exe
  2⤵
  - Executes dropped EXE
  PID:1900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CyewiOF.exe

Path C:\Windows\System\CyewiOF.exe
Size 5.2MB
SHA256 4ff4925c6d9622b1ca16eba3dd259da8e5ebb05b0793824a730bac8f6a6af6dc
MD5 c546844b7df08e8e9f5735b8a0cf29e3
SHA1 82f4adc665f564807b8e0340277865212c229fbb
SHA512 930eade2f4270687f7c5162f038c27f7a6ef114726670a097cf964ccf5d5d286f304d77313394600ba2da2f0bf3f5bd5372dc94fa2e75be40fc835c63c101633
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibW56utgpPFotBER/mQ32lU5
MD5 SHA1 SHA512 SSDEEP

Submit Download

FGasiot.exe

Path C:\Windows\System\FGasiot.exe
Size 5.2MB
SHA256 3bc8a1fee33359fdd6dd2ff772dc75e6fa55ebe6096067d71d1b874d83cd48bc
MD5 1763d6b430f6140e707b1eddf0087f71
SHA1 5358132fe6d169fc6246f950a98f46f51974c924
SHA512 09e2b96a272d462369912fcfeaaf2f4a4c8feedfd4ae86c65dfd54ba234705284187e4d0c3fb8dc25d1a11c1e73bdb5f8d058da279619541fefbe9cd371fb11c
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l1:RWWBibW56utgpPFotBER/mQ32lUp
MD5 SHA1 SHA512 SSDEEP

Submit Download

IBSkpur.exe

Path C:\Windows\System\IBSkpur.exe
Size 5.2MB
SHA256 ea6301be02035eeeaedae458a3024cd8ae0e295198684ee459bd773506ca1046
MD5 57663db79162c7ed5fcb5bf0140ab28e
SHA1 e6a8752ab1ae021a9a034f1c05915b4f5a6c3160
SHA512 2ba1929108259b63e12e2155871b81d3951d675fc2464a9b35cb171f4ce567e7fdd983f2215301e21555e8acc034812e1ef9b91db7a9ac56c5d0b3b2fdbf83f2
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lU:RWWBibW56utgpPFotBER/mQ32lU4
MD5 SHA1 SHA512 SSDEEP

Submit Download

LTodHrD.exe

Path C:\Windows\System\LTodHrD.exe
Size 5.2MB
SHA256 4048f5989fce5c043e7daf84ca33ddf2193c14d765192868acd0cde234fb4485
MD5 f6e370d7349b5a250275ece341c23484
SHA1 29bf6c855c49a2f276af7d393b1f7896d466ede4
SHA512 4caa7909b520e4d1ca77c407909dfd30cba3c26b83064a1e13c493a7a9661b2167db01a16f7ff68c2ecc610ad61ee4cf27bb229de95e758c7d20d1d2a9452214
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l8:RWWBibW56utgpPFotBER/mQ32lUg
MD5 SHA1 SHA512 SSDEEP

Submit Download

LXHdFrW.exe

Path C:\Windows\System\LXHdFrW.exe
Size 5.2MB
SHA256 96098d42405625ccae5e7b0cc18a0d5190dd7e4acf2be7505498b466071fdec3
MD5 6d1eea16fefb7b73780e933e5a977ba0
SHA1 64066e97a8f3ea8c37b13b513dd1f6d6519666fb
SHA512 e408b55a902f8a06b7e200a4b24873ad3dc0f163f29c911adb049e38029f9d2d531e1c3ed46a4a87407ad6f3ebb3e3b9d235140bad37bbc6ecf215675605a8c0
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lM:RWWBibW56utgpPFotBER/mQ32lUo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ntemgdn.exe

Path C:\Windows\System\Ntemgdn.exe
Size 5.2MB
SHA256 48ea84f58eec07b49b2c45013476c69dd88cf39fa959c7ead127abb14a771e1f
MD5 0d8f8d76b6990005f403a7118c8eb763
SHA1 d5dd59d87386a69120d8d330b073f6d6c3b50add
SHA512 f0c4f7df0abb7cfe3e5e62356df62a7d5e61d917ca76380d8c833ec4458dfce7fb186aabedcb7ed8456d9b9612bb84f79b376b062818d88e541bf409a6799bce
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ls:RWWBibW56utgpPFotBER/mQ32lUQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TvDjbZM.exe

Path C:\Windows\System\TvDjbZM.exe
Size 5.2MB
SHA256 58438aa957e96462585e43f1872d09180950f491388f987494bd1134fff2a504
MD5 ba49e5c0c6c5aed590147a46e9b0b308
SHA1 7bd460295d3c6d8d64ea74cde415d2db33a046fa
SHA512 aa42a873871451643eab203eae5583f511aba3435c667e040c7de23f344169133cfe2525b112fdb8c62cf4e3f05071d0ad1100cb2cb0875083bacde34e346483
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lr:RWWBibW56utgpPFotBER/mQ32lUf
MD5 SHA1 SHA512 SSDEEP

Submit Download

bpewYaw.exe

Path C:\Windows\System\bpewYaw.exe
Size 5.2MB
SHA256 e3fe3690837081fb88b6839d93f96e0a385841f245f4070e5d52a22406c5c3b0
MD5 76d7ad40b753b62c00e8bc7f69d96c00
SHA1 bf4a17cb45070420f815b4ab40483370134761d7
SHA512 c53cf5daf6425dc4985e2d9c16a81435f8ea16af2b8190a1b8838662406e82aaba349439577ccc10c4a73fc6a1f25d1f917d345019fac711b48429eba08b6e31
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l7:RWWBibW56utgpPFotBER/mQ32lUv
MD5 SHA1 SHA512 SSDEEP

Submit Download

dgUaZoL.exe

Path C:\Windows\System\dgUaZoL.exe
Size 5.2MB
SHA256 19be3228d2bf06b6b3e5841dffd9cf3c91f2f5a26eff43be404f893f4603cb4a
MD5 9b8beac340060b5dd5fdd6cffea3c2f6
SHA1 7e5da47578bded9e2917c5836c8e4bc4460763da
SHA512 11ae290e47af2b602e841a63e140af7e8f9ac5416b7424c66a0484ac310fe6d0e2781b5e5e17c25e906d1d2499adabf36956fc036e7ccf75469b496f0c64ae1a
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l6:RWWBibW56utgpPFotBER/mQ32lU2
MD5 SHA1 SHA512 SSDEEP

Submit Download

diOJdJg.exe

Path C:\Windows\System\diOJdJg.exe
Size 5.2MB
SHA256 55b2b02bda0c891b4fb0eaa842d28b1a94bb0392cb8d6a49ef0e85f500e5daa4
MD5 fba8a9f649875e5fab53095d4f8b85a7
SHA1 92e649e99a829079587c9814fb05e5c21f116945
SHA512 486c28c327ece0a7ba57d67f1df08a145129b4b9e045e354e98911efdd558dc1ef81f01a3a87eac33afa3bbcbc39444835609830f4e0f60cccbcf23862d1004b
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibW56utgpPFotBER/mQ32lUg
MD5 SHA1 SHA512 SSDEEP

Submit Download

hwwfCXL.exe

Path C:\Windows\System\hwwfCXL.exe
Size 5.2MB
SHA256 02880b79a326fd2c21544688fabd5a4024bc9e3bfc712b50e9fd039e6b2c4377
MD5 1a1b7cdf7d3e8f897aab6f4614b98b58
SHA1 4002f21cd0f458b53d810330f9f094371995a1fa
SHA512 e132a530f090be5b8775fc5b1f0de9ea15fca2cfa785791bf8fff796102cbfbf97c2f36e85acc19204cca3cc34c6e8cf1271ba6ed7bf6a50b56efc6a6e8986bd
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lg:RWWBibW56utgpPFotBER/mQ32lUs
MD5 SHA1 SHA512 SSDEEP

Submit Download

kMISiZL.exe

Path C:\Windows\System\kMISiZL.exe
Size 5.2MB
SHA256 be74055e61153dedbc717bf0920ad35c4f010b1eb2baf646598fc8aee7d85e61
MD5 3073309b2bf2e5dd23626e72ca46498b
SHA1 484350d2430b3de59be1fea6640fb7f3d19070dc
SHA512 2204515aca43658a5d808e4d5082d5dd74a25239e31352464fcb3da23537ad6d90f147e81fc05cbb326ff9128eee50af67a9d04fd58658bfba1a86dfbc8e04a2
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lc:RWWBibW56utgpPFotBER/mQ32lUo
MD5 SHA1 SHA512 SSDEEP

Submit Download

lDqXgDH.exe

Path C:\Windows\System\lDqXgDH.exe
Size 5.2MB
SHA256 f7bdc34fcd3118f38045a7f49ae2e7e164202ed694bf9fe1dfc2cabe2c9c387c
MD5 f1c8b263802930fb03981be74d823512
SHA1 a5acc46b3751c7ef724685437639ae3045771d61
SHA512 8eb29de7ffb0f25e922c9b7bb99c4a6425c60078be9dd74fc8299bc1c5db9c862f3eadb24e30db4ceeb9f1da176e83c10ddd6dce439ef7789d816b58ecd1159c
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lr:RWWBibW56utgpPFotBER/mQ32lUP
MD5 SHA1 SHA512 SSDEEP

Submit Download

nCbDqAf.exe

Path C:\Windows\System\nCbDqAf.exe
Size 5.2MB
SHA256 d15f4de9cc9c81de4836d5f29644e8e586587a01eaf999cd3b6e2f46007e66c7
MD5 5ee2034ae34629346a68d5d714451da8
SHA1 37f89c3af4d7612cc902270e0692622a3f68bf37
SHA512 c589b637d820635bc8db9827b7454a118bde7f796e92474d253dac4d26fd8880cf799245211e4b2e7eb4f4d2a9c15b3bde9f0d687799f842169337e2d894b898
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l9:RWWBibW56utgpPFotBER/mQ32lUZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

nKbzOhd.exe

Path C:\Windows\System\nKbzOhd.exe
Size 5.2MB
SHA256 1ed4e58d11ec88a7699f7ddbc6fecf3d47add0a2f839a9272c4a049605349a14
MD5 1725798e9024fa6d1e73875841933093
SHA1 ac2c974a0858da2b4ab2b2907e32d9507d4564fe
SHA512 0c5bb3be37813c05beb806c38e48b8a2280c797f0eb089a03dcd8c697f360ccfc0b30374a2fe8912a31087ae8df651fa058fd232af90cfca6ead8988f7874db1
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibW56utgpPFotBER/mQ32lUd
MD5 SHA1 SHA512 SSDEEP

Submit Download

rSNGyOc.exe

Path C:\Windows\System\rSNGyOc.exe
Size 5.2MB
SHA256 945b8aeea07d84a9d981e8384d770b2fe80be25afee6a5feb43310308e7461c7
MD5 c3c51fedb297560e50fad3b7d8a842d6
SHA1 d4fdb992e6266b85767c24483b0c4429fcf4dbf3
SHA512 dec084d65d835729b7167bd1179b56afd3614de442da2bd0446dec6ff25bd30fcc0cdf84d097597515ad9256fd260bcbb4af386600fefd4382a64c90200a7cdb
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibW56utgpPFotBER/mQ32lUz
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtGQIvg.exe

Path C:\Windows\System\rtGQIvg.exe
Size 5.2MB
SHA256 07eaec97f2dc871fe9e1bee5947801e5a7a5f970a758f8dd65abc9e5a8e5004f
MD5 bac13e0903d0a3a8fa021c41d932d2b0
SHA1 d91c8b610c7ad3daede74f86499e516aed56f4ee
SHA512 5e0f395fb6ae8358e0024fb856af2a5e55631705b2eb7406acaee54d11d875796334cfdb05d65ee127d183a78eb068ead60a2142f3b93877ba182c4708ac93a0
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lB:RWWBibW56utgpPFotBER/mQ32lUN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ugyLYKe.exe

Path C:\Windows\System\ugyLYKe.exe
Size 5.2MB
SHA256 566facb98af0f843a63f387958e6c3274dfc723e6b31bb09ef0a8ef84fa84b66
MD5 e34785db60d7f9a3347c21ed47940c9c
SHA1 5951604ec9701124307c394c7f21d366557a399e
SHA512 880929736ed49fbdd4fc35f81168b1f1552cb56aa61b56a292bafe290dfab00b68bec7025dec753ec74494720bae8c0bd9aefde82b23be4f4f583fea970b6a5d
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6la:RWWBibW56utgpPFotBER/mQ32lUm
MD5 SHA1 SHA512 SSDEEP

Submit Download

uhllFsw.exe

Path C:\Windows\System\uhllFsw.exe
Size 5.2MB
SHA256 cb3d609e9fdad3f1d5867a04f7cb59dd8851e1663cad889a27b22aa2e640e57c
MD5 eb945de83b37580671314203d6697eb8
SHA1 20e075e7389ec0cbf115253095bab35d7f85e3dd
SHA512 a8498d1ac08e27b0ad0a57c52cb4d4eca122b5854d5226a6c2fa5caf898877d3224a9415e1afbe76aea0c2edf0672fbde7f357365f0ea6aa858d7a9fd18621c9
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lC:RWWBibW56utgpPFotBER/mQ32lU2
MD5 SHA1 SHA512 SSDEEP

Submit Download

vpCnVoz.exe

Path C:\Windows\System\vpCnVoz.exe
Size 5.2MB
SHA256 5be3aeec8d8ef7363554e3f9a4fbd7edb3f1257fe930bfecbea9b19882e860cf
MD5 0cddf3bc67dac57a372adb098115cf9b
SHA1 9e9f9abc4605ba093d6c7c0d7e2852daa78094d6
SHA512 75c7eb3fdfac0677bd629f54bb7c72e81007158a6b455e8020f66baf8b70c003c46b2e9fb286d97be6847d2c90d05e8cc4be7b1b6df120e60f27572ece201d1a
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lY:RWWBibW56utgpPFotBER/mQ32lUE
MD5 SHA1 SHA512 SSDEEP

Submit Download

zHqjFzl.exe

Path C:\Windows\System\zHqjFzl.exe
Size 5.2MB
SHA256 eeea7ae040739f9ec4af8e6fae3207616de2c5d345bc1815b739720f23f0864b
MD5 2d9d510bd4b3878851d99fabdf8ea57d
SHA1 2ec5d95030192e8710981f27ac8cfe309068781d
SHA512 83f9fd12cd26d8413250c2a50e1d3e60523502bf85159ac1b2cc507eb9fde13b2c8114ac7ef3464d289e2ca12358942514f7cfe1c766fcf30bca65b1a3c6541e
SSDEEP 49152:ROdWCCi7/raN56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lE:RWWBibW56utgpPFotBER/mQ32lUQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1044-143-0x00007FF6DFC70000-0x00007FF6DFFC1000-memory.dmp

Download

memory/1044-220-0x00007FF6DFC70000-0x00007FF6DFFC1000-memory.dmp

Download

memory/1044-91-0x00007FF6DFC70000-0x00007FF6DFFC1000-memory.dmp

Download

memory/1212-112-0x00007FF6C2DD0000-0x00007FF6C3121000-memory.dmp

Download

memory/1212-146-0x00007FF6C2DD0000-0x00007FF6C3121000-memory.dmp

Download

memory/1212-240-0x00007FF6C2DD0000-0x00007FF6C3121000-memory.dmp

Download

memory/1900-149-0x00007FF6FC850000-0x00007FF6FCBA1000-memory.dmp

Download

memory/1900-113-0x00007FF6FC850000-0x00007FF6FCBA1000-memory.dmp

Download

memory/1900-234-0x00007FF6FC850000-0x00007FF6FCBA1000-memory.dmp

Download

memory/1996-121-0x00007FF7A1AF0000-0x00007FF7A1E41000-memory.dmp

Download

memory/1996-212-0x00007FF7A1AF0000-0x00007FF7A1E41000-memory.dmp

Download

memory/2184-224-0x00007FF77FF60000-0x00007FF7802B1000-memory.dmp

Download

memory/2184-144-0x00007FF77FF60000-0x00007FF7802B1000-memory.dmp

Download

memory/2184-99-0x00007FF77FF60000-0x00007FF7802B1000-memory.dmp

Download

memory/2416-223-0x00007FF7E0F70000-0x00007FF7E12C1000-memory.dmp

Download

memory/2416-123-0x00007FF7E0F70000-0x00007FF7E12C1000-memory.dmp

Download

memory/2608-207-0x00007FF6B9A20000-0x00007FF6B9D71000-memory.dmp

Download

memory/2608-61-0x00007FF6B9A20000-0x00007FF6B9D71000-memory.dmp

Download

memory/2732-202-0x00007FF634400000-0x00007FF634751000-memory.dmp

Download

memory/2732-42-0x00007FF634400000-0x00007FF634751000-memory.dmp

Download

memory/2816-227-0x00007FF6DCB90000-0x00007FF6DCEE1000-memory.dmp

Download

memory/2816-126-0x00007FF6DCB90000-0x00007FF6DCEE1000-memory.dmp

Download

memory/3068-210-0x00007FF7D3020000-0x00007FF7D3371000-memory.dmp

Download

memory/3068-120-0x00007FF7D3020000-0x00007FF7D3371000-memory.dmp

Download

memory/3268-172-0x00007FF66A090000-0x00007FF66A3E1000-memory.dmp

Download

memory/3268-150-0x00007FF66A090000-0x00007FF66A3E1000-memory.dmp

Download

memory/3268-128-0x00007FF66A090000-0x00007FF66A3E1000-memory.dmp

Download

memory/3268-0-0x00007FF66A090000-0x00007FF66A3E1000-memory.dmp

Download

memory/3268-1-0x000001E4EAA60000-0x000001E4EAA70000-memory.dmp

Download

memory/3284-232-0x00007FF7F8F00000-0x00007FF7F9251000-memory.dmp

Download

memory/3284-125-0x00007FF7F8F00000-0x00007FF7F9251000-memory.dmp

Download

memory/3480-45-0x00007FF7AE710000-0x00007FF7AEA61000-memory.dmp

Download

memory/3480-204-0x00007FF7AE710000-0x00007FF7AEA61000-memory.dmp

Download

memory/3960-31-0x00007FF7E39F0000-0x00007FF7E3D41000-memory.dmp

Download

memory/3960-200-0x00007FF7E39F0000-0x00007FF7E3D41000-memory.dmp

Download

memory/4140-217-0x00007FF7950A0000-0x00007FF7953F1000-memory.dmp

Download

memory/4140-139-0x00007FF7950A0000-0x00007FF7953F1000-memory.dmp

Download

memory/4140-77-0x00007FF7950A0000-0x00007FF7953F1000-memory.dmp

Download

memory/4344-124-0x00007FF739DB0000-0x00007FF73A101000-memory.dmp

Download

memory/4344-231-0x00007FF739DB0000-0x00007FF73A101000-memory.dmp

Download

memory/4656-80-0x00007FF6985F0000-0x00007FF698941000-memory.dmp

Download

memory/4656-140-0x00007FF6985F0000-0x00007FF698941000-memory.dmp

Download

memory/4656-218-0x00007FF6985F0000-0x00007FF698941000-memory.dmp

Download

memory/4772-136-0x00007FF6E9570000-0x00007FF6E98C1000-memory.dmp

Download

memory/4772-209-0x00007FF6E9570000-0x00007FF6E98C1000-memory.dmp

Download

memory/4772-55-0x00007FF6E9570000-0x00007FF6E98C1000-memory.dmp

Download

memory/4964-19-0x00007FF731770000-0x00007FF731AC1000-memory.dmp

Download

memory/4964-198-0x00007FF731770000-0x00007FF731AC1000-memory.dmp

Download

memory/5020-214-0x00007FF7BFAA0000-0x00007FF7BFDF1000-memory.dmp

Download

memory/5020-122-0x00007FF7BFAA0000-0x00007FF7BFDF1000-memory.dmp

Download

memory/5100-129-0x00007FF6C4E50000-0x00007FF6C51A1000-memory.dmp

Download

memory/5100-196-0x00007FF6C4E50000-0x00007FF6C51A1000-memory.dmp

Download

memory/5100-8-0x00007FF6C4E50000-0x00007FF6C51A1000-memory.dmp

Download

memory/5116-228-0x00007FF76E970000-0x00007FF76ECC1000-memory.dmp

Download

memory/5116-109-0x00007FF76E970000-0x00007FF76ECC1000-memory.dmp

Download

memory/5116-145-0x00007FF76E970000-0x00007FF76ECC1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads