cobaltstrike | 25fad504c73c8025773f171267939ef57da04ee9a338513841ea6b7f55470d09

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 16:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
Size 5.2MB
Sample240525-t22ndsbb22
SHA256 25fad504c73c8025773f171267939ef57da04ee9a338513841ea6b7f55470d09
MD5 eaefb47189ae3adf6ccdaef5af81f128
SHA1 4bdefbdad7eb9c23da6be7f5943b03f3cb04a8ad
SHA512 6a596a9ea3f9b0a7ab6a7f7657b0d8b539f410f39c06dc88bc892d6c41b98f0d9d7bcf0ec03af61c0e21c8132dff597d32a212dd3646d70d960559c88e4931ac
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lU:RWWBibf56utgpPFotBER/mQ32lUw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000800000002342c-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023433-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023434-9.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023435-24.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023436-29.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023437-33.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023438-40.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023439-51.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343c-65.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343b-63.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343a-55.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023430-70.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343d-78.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343e-84.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343f-91.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023440-97.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023443-109.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023444-116.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023445-122.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023446-130.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023442-105.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000800000002342c-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023433-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023434-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023435-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023436-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023437-33.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023438-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023439-51.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343c-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343b-63.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343a-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023430-70.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343d-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343e-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343f-91.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023440-97.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023443-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023444-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023445-122.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023446-130.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023442-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4644-0-0x00007FF6E7FD0000-0x00007FF6E8321000-memory.dmp	UPX
behavioral2/files/0x000800000002342c-4.dat	UPX
behavioral2/files/0x0007000000023433-10.dat	UPX
behavioral2/files/0x0007000000023434-9.dat	UPX
behavioral2/memory/4036-6-0x00007FF6A2D90000-0x00007FF6A30E1000-memory.dmp	UPX
behavioral2/memory/4540-12-0x00007FF7F6DB0000-0x00007FF7F7101000-memory.dmp	UPX
behavioral2/memory/2400-20-0x00007FF71EA00000-0x00007FF71ED51000-memory.dmp	UPX
behavioral2/files/0x0007000000023435-24.dat	UPX
behavioral2/files/0x0007000000023436-29.dat	UPX
behavioral2/files/0x0007000000023437-33.dat	UPX
behavioral2/memory/2088-32-0x00007FF6BBF60000-0x00007FF6BC2B1000-memory.dmp	UPX
behavioral2/files/0x0007000000023438-40.dat	UPX
behavioral2/memory/732-43-0x00007FF694FC0000-0x00007FF695311000-memory.dmp	UPX
behavioral2/files/0x0007000000023439-51.dat	UPX
behavioral2/memory/3636-59-0x00007FF7BACF0000-0x00007FF7BB041000-memory.dmp	UPX
behavioral2/files/0x000700000002343c-65.dat	UPX
behavioral2/files/0x000700000002343b-63.dat	UPX
behavioral2/memory/2268-61-0x00007FF78F720000-0x00007FF78FA71000-memory.dmp	UPX
behavioral2/memory/696-58-0x00007FF798A70000-0x00007FF798DC1000-memory.dmp	UPX
behavioral2/files/0x000700000002343a-55.dat	UPX
behavioral2/memory/3092-46-0x00007FF6CE4E0000-0x00007FF6CE831000-memory.dmp	UPX
behavioral2/memory/2952-42-0x00007FF78D870000-0x00007FF78DBC1000-memory.dmp	UPX
behavioral2/memory/2008-68-0x00007FF7A3720000-0x00007FF7A3A71000-memory.dmp	UPX
behavioral2/files/0x0008000000023430-70.dat	UPX
behavioral2/files/0x000700000002343d-78.dat	UPX
behavioral2/memory/4136-74-0x00007FF678D50000-0x00007FF6790A1000-memory.dmp	UPX
behavioral2/files/0x000700000002343e-84.dat	UPX
behavioral2/memory/1884-80-0x00007FF659190000-0x00007FF6594E1000-memory.dmp	UPX
behavioral2/memory/4512-87-0x00007FF78A170000-0x00007FF78A4C1000-memory.dmp	UPX
behavioral2/files/0x000700000002343f-91.dat	UPX
behavioral2/memory/4644-86-0x00007FF6E7FD0000-0x00007FF6E8321000-memory.dmp	UPX
behavioral2/memory/772-94-0x00007FF71F2C0000-0x00007FF71F611000-memory.dmp	UPX
behavioral2/memory/4036-93-0x00007FF6A2D90000-0x00007FF6A30E1000-memory.dmp	UPX
behavioral2/files/0x0007000000023440-97.dat	UPX
behavioral2/memory/2272-100-0x00007FF70EC20000-0x00007FF70EF71000-memory.dmp	UPX
behavioral2/files/0x0007000000023443-109.dat	UPX
behavioral2/files/0x0007000000023444-116.dat	UPX
behavioral2/files/0x0007000000023445-122.dat	UPX
behavioral2/memory/2268-126-0x00007FF78F720000-0x00007FF78FA71000-memory.dmp	UPX
behavioral2/files/0x0007000000023446-130.dat	UPX
behavioral2/memory/4592-127-0x00007FF657F30000-0x00007FF658281000-memory.dmp	UPX
behavioral2/memory/3924-125-0x00007FF7C8D80000-0x00007FF7C90D1000-memory.dmp	UPX
behavioral2/memory/4880-121-0x00007FF76AA10000-0x00007FF76AD61000-memory.dmp	UPX
behavioral2/memory/4836-120-0x00007FF63FAD0000-0x00007FF63FE21000-memory.dmp	UPX
behavioral2/memory/376-108-0x00007FF70D010000-0x00007FF70D361000-memory.dmp	UPX
behavioral2/files/0x0007000000023442-105.dat	UPX
behavioral2/memory/4540-99-0x00007FF7F6DB0000-0x00007FF7F7101000-memory.dmp	UPX
behavioral2/memory/4644-132-0x00007FF6E7FD0000-0x00007FF6E8321000-memory.dmp	UPX
behavioral2/memory/4136-140-0x00007FF678D50000-0x00007FF6790A1000-memory.dmp	UPX
behavioral2/memory/2272-149-0x00007FF70EC20000-0x00007FF70EF71000-memory.dmp	UPX
behavioral2/memory/376-150-0x00007FF70D010000-0x00007FF70D361000-memory.dmp	UPX
behavioral2/memory/3924-153-0x00007FF7C8D80000-0x00007FF7C90D1000-memory.dmp	UPX
behavioral2/memory/4592-154-0x00007FF657F30000-0x00007FF658281000-memory.dmp	UPX
behavioral2/memory/4644-155-0x00007FF6E7FD0000-0x00007FF6E8321000-memory.dmp	UPX
behavioral2/memory/4036-201-0x00007FF6A2D90000-0x00007FF6A30E1000-memory.dmp	UPX
behavioral2/memory/4540-203-0x00007FF7F6DB0000-0x00007FF7F7101000-memory.dmp	UPX
behavioral2/memory/2400-205-0x00007FF71EA00000-0x00007FF71ED51000-memory.dmp	UPX
behavioral2/memory/2088-207-0x00007FF6BBF60000-0x00007FF6BC2B1000-memory.dmp	UPX
behavioral2/memory/3092-210-0x00007FF6CE4E0000-0x00007FF6CE831000-memory.dmp	UPX
behavioral2/memory/2952-213-0x00007FF78D870000-0x00007FF78DBC1000-memory.dmp	UPX
behavioral2/memory/732-212-0x00007FF694FC0000-0x00007FF695311000-memory.dmp	UPX
behavioral2/memory/696-215-0x00007FF798A70000-0x00007FF798DC1000-memory.dmp	UPX
behavioral2/memory/3636-219-0x00007FF7BACF0000-0x00007FF7BB041000-memory.dmp	UPX
behavioral2/memory/2008-218-0x00007FF7A3720000-0x00007FF7A3A71000-memory.dmp	UPX

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/2400-20-0x00007FF71EA00000-0x00007FF71ED51000-memory.dmp	xmrig
behavioral2/memory/2088-32-0x00007FF6BBF60000-0x00007FF6BC2B1000-memory.dmp	xmrig
behavioral2/memory/732-43-0x00007FF694FC0000-0x00007FF695311000-memory.dmp	xmrig
behavioral2/memory/3636-59-0x00007FF7BACF0000-0x00007FF7BB041000-memory.dmp	xmrig
behavioral2/memory/696-58-0x00007FF798A70000-0x00007FF798DC1000-memory.dmp	xmrig
behavioral2/memory/3092-46-0x00007FF6CE4E0000-0x00007FF6CE831000-memory.dmp	xmrig
behavioral2/memory/2952-42-0x00007FF78D870000-0x00007FF78DBC1000-memory.dmp	xmrig
behavioral2/memory/2008-68-0x00007FF7A3720000-0x00007FF7A3A71000-memory.dmp	xmrig
behavioral2/memory/4136-74-0x00007FF678D50000-0x00007FF6790A1000-memory.dmp	xmrig
behavioral2/memory/1884-80-0x00007FF659190000-0x00007FF6594E1000-memory.dmp	xmrig
behavioral2/memory/4512-87-0x00007FF78A170000-0x00007FF78A4C1000-memory.dmp	xmrig
behavioral2/memory/4644-86-0x00007FF6E7FD0000-0x00007FF6E8321000-memory.dmp	xmrig
behavioral2/memory/772-94-0x00007FF71F2C0000-0x00007FF71F611000-memory.dmp	xmrig
behavioral2/memory/4036-93-0x00007FF6A2D90000-0x00007FF6A30E1000-memory.dmp	xmrig
behavioral2/memory/2268-126-0x00007FF78F720000-0x00007FF78FA71000-memory.dmp	xmrig
behavioral2/memory/4880-121-0x00007FF76AA10000-0x00007FF76AD61000-memory.dmp	xmrig
behavioral2/memory/4836-120-0x00007FF63FAD0000-0x00007FF63FE21000-memory.dmp	xmrig
behavioral2/memory/376-108-0x00007FF70D010000-0x00007FF70D361000-memory.dmp	xmrig
behavioral2/memory/4540-99-0x00007FF7F6DB0000-0x00007FF7F7101000-memory.dmp	xmrig
behavioral2/memory/4644-132-0x00007FF6E7FD0000-0x00007FF6E8321000-memory.dmp	xmrig
behavioral2/memory/4136-140-0x00007FF678D50000-0x00007FF6790A1000-memory.dmp	xmrig
behavioral2/memory/2272-149-0x00007FF70EC20000-0x00007FF70EF71000-memory.dmp	xmrig
behavioral2/memory/376-150-0x00007FF70D010000-0x00007FF70D361000-memory.dmp	xmrig
behavioral2/memory/3924-153-0x00007FF7C8D80000-0x00007FF7C90D1000-memory.dmp	xmrig
behavioral2/memory/4592-154-0x00007FF657F30000-0x00007FF658281000-memory.dmp	xmrig
behavioral2/memory/4644-155-0x00007FF6E7FD0000-0x00007FF6E8321000-memory.dmp	xmrig
behavioral2/memory/4036-201-0x00007FF6A2D90000-0x00007FF6A30E1000-memory.dmp	xmrig
behavioral2/memory/4540-203-0x00007FF7F6DB0000-0x00007FF7F7101000-memory.dmp	xmrig
behavioral2/memory/2400-205-0x00007FF71EA00000-0x00007FF71ED51000-memory.dmp	xmrig
behavioral2/memory/2088-207-0x00007FF6BBF60000-0x00007FF6BC2B1000-memory.dmp	xmrig
behavioral2/memory/3092-210-0x00007FF6CE4E0000-0x00007FF6CE831000-memory.dmp	xmrig
behavioral2/memory/2952-213-0x00007FF78D870000-0x00007FF78DBC1000-memory.dmp	xmrig
behavioral2/memory/732-212-0x00007FF694FC0000-0x00007FF695311000-memory.dmp	xmrig
behavioral2/memory/696-215-0x00007FF798A70000-0x00007FF798DC1000-memory.dmp	xmrig
behavioral2/memory/3636-219-0x00007FF7BACF0000-0x00007FF7BB041000-memory.dmp	xmrig
behavioral2/memory/2008-218-0x00007FF7A3720000-0x00007FF7A3A71000-memory.dmp	xmrig
behavioral2/memory/2268-221-0x00007FF78F720000-0x00007FF78FA71000-memory.dmp	xmrig
behavioral2/memory/4136-224-0x00007FF678D50000-0x00007FF6790A1000-memory.dmp	xmrig
behavioral2/memory/1884-226-0x00007FF659190000-0x00007FF6594E1000-memory.dmp	xmrig
behavioral2/memory/4512-228-0x00007FF78A170000-0x00007FF78A4C1000-memory.dmp	xmrig
behavioral2/memory/772-230-0x00007FF71F2C0000-0x00007FF71F611000-memory.dmp	xmrig
behavioral2/memory/2272-238-0x00007FF70EC20000-0x00007FF70EF71000-memory.dmp	xmrig
behavioral2/memory/376-240-0x00007FF70D010000-0x00007FF70D361000-memory.dmp	xmrig
behavioral2/memory/4836-244-0x00007FF63FAD0000-0x00007FF63FE21000-memory.dmp	xmrig
behavioral2/memory/4880-243-0x00007FF76AA10000-0x00007FF76AD61000-memory.dmp	xmrig
behavioral2/memory/4592-247-0x00007FF657F30000-0x00007FF658281000-memory.dmp	xmrig
behavioral2/memory/3924-248-0x00007FF7C8D80000-0x00007FF7C90D1000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4036	ELTFBrB.exe
4540	BXZduTV.exe
2400	nabWhsJ.exe
2088	YLSxwDS.exe
3092	AnmMhyA.exe
2952	ZnxkRKo.exe
732	kuOTlkH.exe
696	QRFpQeK.exe
3636	HcZjkFp.exe
2268	DgadmZd.exe
2008	oFoYxip.exe
4136	MlHiSPb.exe
1884	ladavvz.exe
4512	iElevMD.exe
772	YOidzAN.exe
2272	XIPOPRP.exe
376	wFevzcK.exe
4836	cJEXOfZ.exe
4880	YthfhNO.exe
3924	FMwPpHd.exe
4592	sSoJTxf.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4644-0-0x00007FF6E7FD0000-0x00007FF6E8321000-memory.dmp	upx
behavioral2/files/0x000800000002342c-4.dat	upx
behavioral2/files/0x0007000000023433-10.dat	upx
behavioral2/files/0x0007000000023434-9.dat	upx
behavioral2/memory/4036-6-0x00007FF6A2D90000-0x00007FF6A30E1000-memory.dmp	upx
behavioral2/memory/4540-12-0x00007FF7F6DB0000-0x00007FF7F7101000-memory.dmp	upx
behavioral2/memory/2400-20-0x00007FF71EA00000-0x00007FF71ED51000-memory.dmp	upx
behavioral2/files/0x0007000000023435-24.dat	upx
behavioral2/files/0x0007000000023436-29.dat	upx
behavioral2/files/0x0007000000023437-33.dat	upx
behavioral2/memory/2088-32-0x00007FF6BBF60000-0x00007FF6BC2B1000-memory.dmp	upx
behavioral2/files/0x0007000000023438-40.dat	upx
behavioral2/memory/732-43-0x00007FF694FC0000-0x00007FF695311000-memory.dmp	upx
behavioral2/files/0x0007000000023439-51.dat	upx
behavioral2/memory/3636-59-0x00007FF7BACF0000-0x00007FF7BB041000-memory.dmp	upx
behavioral2/files/0x000700000002343c-65.dat	upx
behavioral2/files/0x000700000002343b-63.dat	upx
behavioral2/memory/2268-61-0x00007FF78F720000-0x00007FF78FA71000-memory.dmp	upx
behavioral2/memory/696-58-0x00007FF798A70000-0x00007FF798DC1000-memory.dmp	upx
behavioral2/files/0x000700000002343a-55.dat	upx
behavioral2/memory/3092-46-0x00007FF6CE4E0000-0x00007FF6CE831000-memory.dmp	upx
behavioral2/memory/2952-42-0x00007FF78D870000-0x00007FF78DBC1000-memory.dmp	upx
behavioral2/memory/2008-68-0x00007FF7A3720000-0x00007FF7A3A71000-memory.dmp	upx
behavioral2/files/0x0008000000023430-70.dat	upx
behavioral2/files/0x000700000002343d-78.dat	upx
behavioral2/memory/4136-74-0x00007FF678D50000-0x00007FF6790A1000-memory.dmp	upx
behavioral2/files/0x000700000002343e-84.dat	upx
behavioral2/memory/1884-80-0x00007FF659190000-0x00007FF6594E1000-memory.dmp	upx
behavioral2/memory/4512-87-0x00007FF78A170000-0x00007FF78A4C1000-memory.dmp	upx
behavioral2/files/0x000700000002343f-91.dat	upx
behavioral2/memory/4644-86-0x00007FF6E7FD0000-0x00007FF6E8321000-memory.dmp	upx
behavioral2/memory/772-94-0x00007FF71F2C0000-0x00007FF71F611000-memory.dmp	upx
behavioral2/memory/4036-93-0x00007FF6A2D90000-0x00007FF6A30E1000-memory.dmp	upx
behavioral2/files/0x0007000000023440-97.dat	upx
behavioral2/memory/2272-100-0x00007FF70EC20000-0x00007FF70EF71000-memory.dmp	upx
behavioral2/files/0x0007000000023443-109.dat	upx
behavioral2/files/0x0007000000023444-116.dat	upx
behavioral2/files/0x0007000000023445-122.dat	upx
behavioral2/memory/2268-126-0x00007FF78F720000-0x00007FF78FA71000-memory.dmp	upx
behavioral2/files/0x0007000000023446-130.dat	upx
behavioral2/memory/4592-127-0x00007FF657F30000-0x00007FF658281000-memory.dmp	upx
behavioral2/memory/3924-125-0x00007FF7C8D80000-0x00007FF7C90D1000-memory.dmp	upx
behavioral2/memory/4880-121-0x00007FF76AA10000-0x00007FF76AD61000-memory.dmp	upx
behavioral2/memory/4836-120-0x00007FF63FAD0000-0x00007FF63FE21000-memory.dmp	upx
behavioral2/memory/376-108-0x00007FF70D010000-0x00007FF70D361000-memory.dmp	upx
behavioral2/files/0x0007000000023442-105.dat	upx
behavioral2/memory/4540-99-0x00007FF7F6DB0000-0x00007FF7F7101000-memory.dmp	upx
behavioral2/memory/4644-132-0x00007FF6E7FD0000-0x00007FF6E8321000-memory.dmp	upx
behavioral2/memory/4136-140-0x00007FF678D50000-0x00007FF6790A1000-memory.dmp	upx
behavioral2/memory/2272-149-0x00007FF70EC20000-0x00007FF70EF71000-memory.dmp	upx
behavioral2/memory/376-150-0x00007FF70D010000-0x00007FF70D361000-memory.dmp	upx
behavioral2/memory/3924-153-0x00007FF7C8D80000-0x00007FF7C90D1000-memory.dmp	upx
behavioral2/memory/4592-154-0x00007FF657F30000-0x00007FF658281000-memory.dmp	upx
behavioral2/memory/4644-155-0x00007FF6E7FD0000-0x00007FF6E8321000-memory.dmp	upx
behavioral2/memory/4036-201-0x00007FF6A2D90000-0x00007FF6A30E1000-memory.dmp	upx
behavioral2/memory/4540-203-0x00007FF7F6DB0000-0x00007FF7F7101000-memory.dmp	upx
behavioral2/memory/2400-205-0x00007FF71EA00000-0x00007FF71ED51000-memory.dmp	upx
behavioral2/memory/2088-207-0x00007FF6BBF60000-0x00007FF6BC2B1000-memory.dmp	upx
behavioral2/memory/3092-210-0x00007FF6CE4E0000-0x00007FF6CE831000-memory.dmp	upx
behavioral2/memory/2952-213-0x00007FF78D870000-0x00007FF78DBC1000-memory.dmp	upx
behavioral2/memory/732-212-0x00007FF694FC0000-0x00007FF695311000-memory.dmp	upx
behavioral2/memory/696-215-0x00007FF798A70000-0x00007FF798DC1000-memory.dmp	upx
behavioral2/memory/3636-219-0x00007FF7BACF0000-0x00007FF7BB041000-memory.dmp	upx
behavioral2/memory/2008-218-0x00007FF7A3720000-0x00007FF7A3A71000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\wFevzcK.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YthfhNO.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nabWhsJ.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DgadmZd.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MlHiSPb.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QRFpQeK.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HcZjkFp.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XIPOPRP.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FMwPpHd.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ELTFBrB.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BXZduTV.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kuOTlkH.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oFoYxip.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YOidzAN.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\cJEXOfZ.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ladavvz.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iElevMD.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\sSoJTxf.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YLSxwDS.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AnmMhyA.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZnxkRKo.exe	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 4036	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	84
PID 4644 wrote to memory of 4036	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	84
PID 4644 wrote to memory of 4540	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	85
PID 4644 wrote to memory of 4540	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	85
PID 4644 wrote to memory of 2400	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	86
PID 4644 wrote to memory of 2400	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	86
PID 4644 wrote to memory of 2088	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	87
PID 4644 wrote to memory of 2088	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	87
PID 4644 wrote to memory of 3092	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	88
PID 4644 wrote to memory of 3092	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	88
PID 4644 wrote to memory of 2952	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	89
PID 4644 wrote to memory of 2952	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	89
PID 4644 wrote to memory of 732	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	90
PID 4644 wrote to memory of 732	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	90
PID 4644 wrote to memory of 696	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	91
PID 4644 wrote to memory of 696	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	91
PID 4644 wrote to memory of 3636	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	92
PID 4644 wrote to memory of 3636	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	92
PID 4644 wrote to memory of 2268	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	93
PID 4644 wrote to memory of 2268	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	93
PID 4644 wrote to memory of 2008	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	94
PID 4644 wrote to memory of 2008	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	94
PID 4644 wrote to memory of 4136	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	95
PID 4644 wrote to memory of 4136	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	95
PID 4644 wrote to memory of 1884	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	96
PID 4644 wrote to memory of 1884	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	96
PID 4644 wrote to memory of 4512	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	97
PID 4644 wrote to memory of 4512	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	97
PID 4644 wrote to memory of 772	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	99
PID 4644 wrote to memory of 772	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	99
PID 4644 wrote to memory of 2272	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	100
PID 4644 wrote to memory of 2272	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	100
PID 4644 wrote to memory of 376	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	102
PID 4644 wrote to memory of 376	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	102
PID 4644 wrote to memory of 4836	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	103
PID 4644 wrote to memory of 4836	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	103
PID 4644 wrote to memory of 4880	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	104
PID 4644 wrote to memory of 4880	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	104
PID 4644 wrote to memory of 3924	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	105
PID 4644 wrote to memory of 3924	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	105
PID 4644 wrote to memory of 4592	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	106
PID 4644 wrote to memory of 4592	4644	2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe	106

C:\Users\Admin\AppData\Local\Temp\2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-25_eaefb47189ae3adf6ccdaef5af81f128_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\System\ELTFBrB.exe
  C:\Windows\System\ELTFBrB.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\BXZduTV.exe
  C:\Windows\System\BXZduTV.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\nabWhsJ.exe
  C:\Windows\System\nabWhsJ.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\YLSxwDS.exe
  C:\Windows\System\YLSxwDS.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\AnmMhyA.exe
  C:\Windows\System\AnmMhyA.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\ZnxkRKo.exe
  C:\Windows\System\ZnxkRKo.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\kuOTlkH.exe
  C:\Windows\System\kuOTlkH.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\QRFpQeK.exe
  C:\Windows\System\QRFpQeK.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\HcZjkFp.exe
  C:\Windows\System\HcZjkFp.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\DgadmZd.exe
  C:\Windows\System\DgadmZd.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\oFoYxip.exe
  C:\Windows\System\oFoYxip.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\MlHiSPb.exe
  C:\Windows\System\MlHiSPb.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\ladavvz.exe
  C:\Windows\System\ladavvz.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\iElevMD.exe
  C:\Windows\System\iElevMD.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\YOidzAN.exe
  C:\Windows\System\YOidzAN.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\XIPOPRP.exe
  C:\Windows\System\XIPOPRP.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\wFevzcK.exe
  C:\Windows\System\wFevzcK.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\cJEXOfZ.exe
  C:\Windows\System\cJEXOfZ.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\YthfhNO.exe
  C:\Windows\System\YthfhNO.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\FMwPpHd.exe
  C:\Windows\System\FMwPpHd.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\sSoJTxf.exe
  C:\Windows\System\sSoJTxf.exe
  2⤵
  - Executes dropped EXE
  PID:4592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AnmMhyA.exe

Path C:\Windows\System\AnmMhyA.exe
Size 5.2MB
SHA256 c2c7c35ce7560e0952e0dabbe2446e6328daef67a978c36b0c9c6d1076151511
MD5 796d0864a55512b71df15897a34546cd
SHA1 342701f4850a580b9feb35498916f4af8edf2010
SHA512 78849795bbf3c1e872c2addd4572b62f8a4af72184cbba8da44572781d9b9dd1b6c6b5a98ceb297dc1b8a94ccd01fe0a3c6cda71aea970a652ccc55bc9361531
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lo:RWWBibf56utgpPFotBER/mQ32lUE
MD5 SHA1 SHA512 SSDEEP

Submit Download

BXZduTV.exe

Path C:\Windows\System\BXZduTV.exe
Size 5.2MB
SHA256 97b5dea78b8467602ab2ead0dbaf12258023592714f8c5fb42a3d1e5defd4bbc
MD5 883da3a5c1847febd84acb9c1e0d1c72
SHA1 5dbdf2c9b4e89fad57b45dd85af39e8a46708b5f
SHA512 d79b097f4cd8fe34b1b9654d0d422f2ecd9f6387f5323373800c0b460494f21fb8d22d4bbda4359127d4aad365ba45a91ad7280e2f6722f313caade55cde2673
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibf56utgpPFotBER/mQ32lUR
MD5 SHA1 SHA512 SSDEEP

Submit Download

DgadmZd.exe

Path C:\Windows\System\DgadmZd.exe
Size 5.2MB
SHA256 61a21d1eff1f2bbdd8c6055a6d1d24c46b06b47b76051388279e1fc1f788ab0e
MD5 7a7e15da47b0cb4fb2a7493e3f189d5a
SHA1 085987307a3b2d0af2f565c43291eb4fcd295c04
SHA512 d2aa4d707bb21ad25211f5165cfcbe406b1948054994e71da76196343a121810c8ff22eeae1b52225ef25fe4a637d23f7d90b28e577eb2716ba5f1b9021052d8
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibf56utgpPFotBER/mQ32lUd
MD5 SHA1 SHA512 SSDEEP

Submit Download

ELTFBrB.exe

Path C:\Windows\System\ELTFBrB.exe
Size 5.2MB
SHA256 8763c2768b09834454535317365bf5a7737a0d7521ced531b1659005dea48345
MD5 cab456ba1044125a8f89ad5dbb1e3e94
SHA1 e333f69b3da4605e34a6bf3b82db379cd7655e3f
SHA512 508f2e6d83017ccd57dc90995255b2274dde15048dbfdcad12d2abe78e57d00042c3f6362e888935c0b706eee7affb90245f99972aa749e82e8354e2073099c0
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lb:RWWBibf56utgpPFotBER/mQ32lU3
MD5 SHA1 SHA512 SSDEEP

Submit Download

FMwPpHd.exe

Path C:\Windows\System\FMwPpHd.exe
Size 5.2MB
SHA256 ca51238c9cad495163d53d115cf598e39847303386e2c0f91dae97d17c73dab4
MD5 e3fad07350d80a6c0f911b7c5678bef3
SHA1 ed938d6c819da739836debdf9ac201423c0a946d
SHA512 719b2d1fd9f7c796a74435699e23d173206fc533bbc75a66f53675ee3ded7fa6c3da25a9741e8757d38de1393081b323f6f78487720ce7548c4df4f788730969
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBibf56utgpPFotBER/mQ32lUB
MD5 SHA1 SHA512 SSDEEP

Submit Download

HcZjkFp.exe

Path C:\Windows\System\HcZjkFp.exe
Size 5.2MB
SHA256 209cc28d93f64f66eb1e14a0510e51e8ea0d13c49d931a29942360d977b6767a
MD5 adfc0b94b77b6fc44b350a68c633a690
SHA1 e6b829a7155d95e7184d73702d3736855d973ea4
SHA512 e96b0a021117483f325afcd55cca90a679e8e032d5eab75f49764d5ec62db4b35a5336c2dc45cfccbb9db01c0ce35d2b99effc84a1c34de01d5fea4d19e5d9f7
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBibf56utgpPFotBER/mQ32lUR
MD5 SHA1 SHA512 SSDEEP

Submit Download

MlHiSPb.exe

Path C:\Windows\System\MlHiSPb.exe
Size 5.2MB
SHA256 fd56b87b85000e2b638e90d97b9712cc0fcb80b09249d256400047151015f345
MD5 9370669d004e97653e9b550418f3a045
SHA1 ec7293a04a9619a230dbca86a9157749acb04c93
SHA512 588a88d04f4e19b9ea15538aefce2814270a3defc02b1157bf0ea450f1122fe65bf64c479c5428ec11baa54f37cf8584d239bac8c961092311e1827fd5a3d77f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lUP
MD5 SHA1 SHA512 SSDEEP

Submit Download

QRFpQeK.exe

Path C:\Windows\System\QRFpQeK.exe
Size 5.2MB
SHA256 64fbef9fc3ddd3d9388f2ed0aa7d3f0a8cb704c033548f424cc080fa7adc9f58
MD5 100f9e37e653a8f9c36ca3aa7a273a53
SHA1 c811a15929bc069d0fbcb8638a762bacb2ea0669
SHA512 ad4f80f7e0888d09cfc483a21f3371b87472e37ce8f13c4785d2e09ffc1a8f4d0c1fb026275a8e225c6f89a535b01d68597dc7b0ebea2cf241614f28ce1a8913
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUL
MD5 SHA1 SHA512 SSDEEP

Submit Download

XIPOPRP.exe

Path C:\Windows\System\XIPOPRP.exe
Size 5.2MB
SHA256 7ca200f903b1cf4672208dd61d787dd54aa8deb7b4a013a5c8bb54a24df56e98
MD5 d68bc2ef2da7704e1a6953cc5e0f5889
SHA1 30781785d6da870650b484ac9b5a43d51eb81149
SHA512 3df1fba7e5f94937fe5b9a9613e09d8a8cd7dfe4894c430c596d1fa740a5e812f15aa86668826d261d9936621edbd4212f600588a25ae9e49071dea45300f89b
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lb:RWWBibf56utgpPFotBER/mQ32lUH
MD5 SHA1 SHA512 SSDEEP

Submit Download

YLSxwDS.exe

Path C:\Windows\System\YLSxwDS.exe
Size 5.2MB
SHA256 7712014ce42f37f6a61c95db7999e834662a5e804e92de5095d091b3aa777c8e
MD5 d85d0a5e621017e3d310dc096aa0a38b
SHA1 2bb33b0238f160c4465384a7680f825b012453c3
SHA512 24b3aded2ca71a61373aa4f9f6ac046a0b28ad50e43482a9100c3de6d5fc187fe1a434486cb9513c01f658556f0d703b64329cbcc71bd002fedea5f406bbe23a
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lg:RWWBibf56utgpPFotBER/mQ32lUM
MD5 SHA1 SHA512 SSDEEP

Submit Download

YOidzAN.exe

Path C:\Windows\System\YOidzAN.exe
Size 5.2MB
SHA256 a69170f57dad72c5bc0aa01565722c6f38e4e4f7d38427c74689327b64e94df7
MD5 e3932aa680ca1155759f1a0fc321baa7
SHA1 82674ba1f52a376cf33f939e00d34f9fb2f25b01
SHA512 8414449561230d7607b7d845a34090c4c77831f66864c6af7f15a798bee7cc49f3feb9d4a7408246a83ecd850cb8cabab037b349caa74088489f4bee4448e115
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lQ:RWWBibf56utgpPFotBER/mQ32lUk
MD5 SHA1 SHA512 SSDEEP

Submit Download

YthfhNO.exe

Path C:\Windows\System\YthfhNO.exe
Size 5.2MB
SHA256 867bf368e9c64fd6975d486c0411b0d762b30966c197d5ee19b75a4f8e32ede2
MD5 51e1852f79d2410e374ab389002a9ffb
SHA1 50090aed43257f6baaebec7e1368c6eec4baf4c9
SHA512 9ae4c423275ba3ce8913311d4d2aff3ed5f24d15d0701682ce479ac0daa6614c18eca70697f22cf58c53a44a09a0709559655a38a8181e2c5697e30897068e43
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibf56utgpPFotBER/mQ32lUt
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZnxkRKo.exe

Path C:\Windows\System\ZnxkRKo.exe
Size 5.2MB
SHA256 0a5d503697276c8de65342e2c1499e94e7dfda4fdb7850313a5ab42ad99d6320
MD5 d034bca959c68ffe5ecf48356beb3b86
SHA1 9d295b13df0ce1b1331e24b1560fc1b3b3a299c7
SHA512 d1e4ed29dd8b8b94e0e77f9a018a7db43a4eb8820780698fc9b3d19c937e1df74cca1f223bd70c4729de49f39a427317db0fe42ecf2ca7e002a5c16f2ab60ced
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBibf56utgpPFotBER/mQ32lUV
MD5 SHA1 SHA512 SSDEEP

Submit Download

cJEXOfZ.exe

Path C:\Windows\System\cJEXOfZ.exe
Size 5.2MB
SHA256 75276b39a7f4d8c499a35373e8f6009b3be2c40e563e4b48f0f4d07b4acbdaea
MD5 414205405e9b15e03b5cedffe1310a87
SHA1 e2b555e8cc349a066a2e1168e9fed50c624e649a
SHA512 50afcf76b909496d91d7045ac24daead60c50820fdbb7ec4199bc3e9186af2a8d041db10a0b3341ce8173dcf72ed74972d3d1f64126127655d4cbf9002179680
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lN:RWWBibf56utgpPFotBER/mQ32lU5
MD5 SHA1 SHA512 SSDEEP

Submit Download

iElevMD.exe

Path C:\Windows\System\iElevMD.exe
Size 5.2MB
SHA256 daba40e4808530ec210c7cfede51e007ba152088819d7203ec9cbe26fb793512
MD5 bd0cb9835e16cf6c96686715922585cf
SHA1 94983494591055ff8b03d6004cd4b9455a826e6f
SHA512 d97435c9ebd4596bdb09c379f8445dece12ac3466755da293aa60398438dd23d74cd0b39ba0f7266f08e0d3161a0ab2d93b64e9400975afc386fdcbb53814448
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lUd
MD5 SHA1 SHA512 SSDEEP

Submit Download

kuOTlkH.exe

Path C:\Windows\System\kuOTlkH.exe
Size 5.2MB
SHA256 8f8ca5119796c428c1424aa1a79fde5a8a2dddb022e6b42e5430bdc67d0371d0
MD5 04bff5f6f96bc26d524a23a6c0587b83
SHA1 5138c4847dcf253d6345eedef43705e9ea48f6bf
SHA512 852211eb88256612f0cf2510c22c71bf6ce692d7fade0f7ed69be876d4e4b770e942a6d765bf004784069d17885c759ad5ca8fbf89b3e8ca3586b651dec369aa
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lP:RWWBibf56utgpPFotBER/mQ32lUT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ladavvz.exe

Path C:\Windows\System\ladavvz.exe
Size 5.2MB
SHA256 a48d23f6a809b322820277a0c88e14356034527cd366b87b94ddf3357a7c6d49
MD5 44ef5fb7ed0d712d10e0710c515e3314
SHA1 073c94eae97f688dfdcb728919ea09b1d5a1d6b5
SHA512 a97a77a511a55c80a2a15d4941f0e23fd9c6e67549ce3014c9fea8a4743377ea203a81c47f8afe8ad0d256ac879a27d8dcf562ae5781784e9b6c9bcc4b9411d2
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l9:RWWBibf56utgpPFotBER/mQ32lUJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

nabWhsJ.exe

Path C:\Windows\System\nabWhsJ.exe
Size 5.2MB
SHA256 95f2bdc37f2ab608110ae1aaa5ca51dd8516357683bfa553a3dbfaca02dfa159
MD5 af8336aba46f6e6bcc615207cfbf48f2
SHA1 717d420adc19bab59422ec18922c4064964656a5
SHA512 cc6d5bbd3fb3dea73a01666782daf1b1d0c250fda797af6a0c85b01d07439c48073e1cb8eaae8a7fa7d23154e09ea5cf29315feb70210867ca17bb818fc2699c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lL:RWWBibf56utgpPFotBER/mQ32lU3
MD5 SHA1 SHA512 SSDEEP

Submit Download

oFoYxip.exe

Path C:\Windows\System\oFoYxip.exe
Size 5.2MB
SHA256 570f69cbc8f21f3721a3edd4950c7349f96775708195a6e755f20199f2abaed4
MD5 c607c09bc60ef4e1b143db386aad1bdc
SHA1 a8ce1859a658f93da3fe2462cc174e2c8fd98f03
SHA512 77fd06b25b057d247b0c4469bc44ce775b632b2a2b51132e7a7514b938aa97e7ddf31512c17b2b2782157a33463f18b7000ce5508b47ba0c82d26b7af88d44da
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ln:RWWBibf56utgpPFotBER/mQ32lUr
MD5 SHA1 SHA512 SSDEEP

Submit Download

sSoJTxf.exe

Path C:\Windows\System\sSoJTxf.exe
Size 5.2MB
SHA256 22bb6139fae1ce857ea012c9aa3a449021dc74a2c919ccce78cc4c7e89c17ea8
MD5 fa3c35075ec3ca5017695e7527c76ea6
SHA1 23bc208743cf94bafb257a5e481a57494b5815e3
SHA512 cd9f806b66045e09ae825004b6e64de8542c27003aacb5a3962775667aead6feec79123b6829d8a64c9d07c884c41bafa598e5e8a0edbb5aa289b9a11b340ebf
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibf56utgpPFotBER/mQ32lU7
MD5 SHA1 SHA512 SSDEEP

Submit Download

wFevzcK.exe

Path C:\Windows\System\wFevzcK.exe
Size 5.2MB
SHA256 a45ab57f3c054216bdd2fecc10e57a6b8f46c738b4bbc832742ac8912e4a1bf4
MD5 4e43e66cdaf25b56cb7f6f69923f5497
SHA1 f312ac49f3bf8b763b820cae008bd996c12d6f4f
SHA512 192e38bc8b7856fcbe16c4dbe66d5aa1ed1d8106f4e40ebf656fde4e38eba8dedd6c008975159dc0cace8c353cdc5738b510a9c6f02a4822f3c69fa39a80ba15
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lI:RWWBibf56utgpPFotBER/mQ32lUs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/376-108-0x00007FF70D010000-0x00007FF70D361000-memory.dmp

Download

memory/376-150-0x00007FF70D010000-0x00007FF70D361000-memory.dmp

Download

memory/376-240-0x00007FF70D010000-0x00007FF70D361000-memory.dmp

Download

memory/696-58-0x00007FF798A70000-0x00007FF798DC1000-memory.dmp

Download

memory/696-215-0x00007FF798A70000-0x00007FF798DC1000-memory.dmp

Download

memory/732-212-0x00007FF694FC0000-0x00007FF695311000-memory.dmp

Download

memory/732-43-0x00007FF694FC0000-0x00007FF695311000-memory.dmp

Download

memory/772-230-0x00007FF71F2C0000-0x00007FF71F611000-memory.dmp

Download

memory/772-94-0x00007FF71F2C0000-0x00007FF71F611000-memory.dmp

Download

memory/1884-226-0x00007FF659190000-0x00007FF6594E1000-memory.dmp

Download

memory/1884-80-0x00007FF659190000-0x00007FF6594E1000-memory.dmp

Download

memory/2008-68-0x00007FF7A3720000-0x00007FF7A3A71000-memory.dmp

Download

memory/2008-218-0x00007FF7A3720000-0x00007FF7A3A71000-memory.dmp

Download

memory/2088-207-0x00007FF6BBF60000-0x00007FF6BC2B1000-memory.dmp

Download

memory/2088-32-0x00007FF6BBF60000-0x00007FF6BC2B1000-memory.dmp

Download

memory/2268-61-0x00007FF78F720000-0x00007FF78FA71000-memory.dmp

Download

memory/2268-126-0x00007FF78F720000-0x00007FF78FA71000-memory.dmp

Download

memory/2268-221-0x00007FF78F720000-0x00007FF78FA71000-memory.dmp

Download

memory/2272-100-0x00007FF70EC20000-0x00007FF70EF71000-memory.dmp

Download

memory/2272-238-0x00007FF70EC20000-0x00007FF70EF71000-memory.dmp

Download

memory/2272-149-0x00007FF70EC20000-0x00007FF70EF71000-memory.dmp

Download

memory/2400-20-0x00007FF71EA00000-0x00007FF71ED51000-memory.dmp

Download

memory/2400-205-0x00007FF71EA00000-0x00007FF71ED51000-memory.dmp

Download

memory/2952-213-0x00007FF78D870000-0x00007FF78DBC1000-memory.dmp

Download

memory/2952-42-0x00007FF78D870000-0x00007FF78DBC1000-memory.dmp

Download

memory/3092-46-0x00007FF6CE4E0000-0x00007FF6CE831000-memory.dmp

Download

memory/3092-210-0x00007FF6CE4E0000-0x00007FF6CE831000-memory.dmp

Download

memory/3636-59-0x00007FF7BACF0000-0x00007FF7BB041000-memory.dmp

Download

memory/3636-219-0x00007FF7BACF0000-0x00007FF7BB041000-memory.dmp

Download

memory/3924-125-0x00007FF7C8D80000-0x00007FF7C90D1000-memory.dmp

Download

memory/3924-153-0x00007FF7C8D80000-0x00007FF7C90D1000-memory.dmp

Download

memory/3924-248-0x00007FF7C8D80000-0x00007FF7C90D1000-memory.dmp

Download

memory/4036-6-0x00007FF6A2D90000-0x00007FF6A30E1000-memory.dmp

Download

memory/4036-201-0x00007FF6A2D90000-0x00007FF6A30E1000-memory.dmp

Download

memory/4036-93-0x00007FF6A2D90000-0x00007FF6A30E1000-memory.dmp

Download

memory/4136-140-0x00007FF678D50000-0x00007FF6790A1000-memory.dmp

Download

memory/4136-224-0x00007FF678D50000-0x00007FF6790A1000-memory.dmp

Download

memory/4136-74-0x00007FF678D50000-0x00007FF6790A1000-memory.dmp

Download

memory/4512-87-0x00007FF78A170000-0x00007FF78A4C1000-memory.dmp

Download

memory/4512-228-0x00007FF78A170000-0x00007FF78A4C1000-memory.dmp

Download

memory/4540-203-0x00007FF7F6DB0000-0x00007FF7F7101000-memory.dmp

Download

memory/4540-99-0x00007FF7F6DB0000-0x00007FF7F7101000-memory.dmp

Download

memory/4540-12-0x00007FF7F6DB0000-0x00007FF7F7101000-memory.dmp

Download

memory/4592-247-0x00007FF657F30000-0x00007FF658281000-memory.dmp

Download

memory/4592-127-0x00007FF657F30000-0x00007FF658281000-memory.dmp

Download

memory/4592-154-0x00007FF657F30000-0x00007FF658281000-memory.dmp

Download

memory/4644-132-0x00007FF6E7FD0000-0x00007FF6E8321000-memory.dmp

Download

memory/4644-155-0x00007FF6E7FD0000-0x00007FF6E8321000-memory.dmp

Download

memory/4644-1-0x000002C341FB0000-0x000002C341FC0000-memory.dmp

Download

memory/4644-86-0x00007FF6E7FD0000-0x00007FF6E8321000-memory.dmp

Download

memory/4644-0-0x00007FF6E7FD0000-0x00007FF6E8321000-memory.dmp

Download

memory/4836-120-0x00007FF63FAD0000-0x00007FF63FE21000-memory.dmp

Download

memory/4836-244-0x00007FF63FAD0000-0x00007FF63FE21000-memory.dmp

Download

memory/4880-121-0x00007FF76AA10000-0x00007FF76AD61000-memory.dmp

Download

memory/4880-243-0x00007FF76AA10000-0x00007FF76AD61000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads