cobaltstrike | e6049dd2fdb3e511693946a9f4ed846d37f7153bcfb2fcd0af5a8f2c8200ecb0

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240525-wbbqdscg22
SHA256 e6049dd2fdb3e511693946a9f4ed846d37f7153bcfb2fcd0af5a8f2c8200ecb0
MD5 05eb69090ab56492cbda7141c2fc0af2
SHA1 721fb3ea67b7f34a897b18d07912620bb06d1076
SHA512 b3dd2119ab1f05aa87945addc64f5a802400e5b44bcc253d48fb9a5800c1ea584a68c67e8fb97047bf32657d534ce469b5b95480091978851915e2b90f1c1502
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000022f51-5.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340d-9.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340e-17.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340f-25.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023410-30.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023411-34.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023413-45.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023412-41.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023414-53.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023415-57.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023416-65.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-72.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023418-77.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341b-92.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341c-95.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341a-86.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341d-105.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341e-110.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023420-125.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341f-119.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023421-132.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000022f51-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340d-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340e-17.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340f-25.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023410-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023411-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023413-45.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023412-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023414-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023415-57.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023416-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023418-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341b-92.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341c-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341a-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341d-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341e-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023420-125.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341f-119.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023421-132.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1192-0-0x00007FF734AE0000-0x00007FF734E34000-memory.dmp	UPX
behavioral2/files/0x0008000000022f51-5.dat	UPX
behavioral2/memory/3712-6-0x00007FF688620000-0x00007FF688974000-memory.dmp	UPX
behavioral2/files/0x000700000002340d-9.dat	UPX
behavioral2/files/0x000700000002340e-17.dat	UPX
behavioral2/memory/2728-20-0x00007FF69E5F0000-0x00007FF69E944000-memory.dmp	UPX
behavioral2/files/0x000700000002340f-25.dat	UPX
behavioral2/files/0x0007000000023410-30.dat	UPX
behavioral2/files/0x0007000000023411-34.dat	UPX
behavioral2/files/0x0007000000023413-45.dat	UPX
behavioral2/memory/3460-48-0x00007FF7C1EE0000-0x00007FF7C2234000-memory.dmp	UPX
behavioral2/memory/1216-43-0x00007FF604070000-0x00007FF6043C4000-memory.dmp	UPX
behavioral2/files/0x0007000000023412-41.dat	UPX
behavioral2/memory/3588-40-0x00007FF6FCF00000-0x00007FF6FD254000-memory.dmp	UPX
behavioral2/memory/2460-38-0x00007FF75BB90000-0x00007FF75BEE4000-memory.dmp	UPX
behavioral2/memory/2608-23-0x00007FF6AEB70000-0x00007FF6AEEC4000-memory.dmp	UPX
behavioral2/memory/1760-19-0x00007FF7128B0000-0x00007FF712C04000-memory.dmp	UPX
behavioral2/files/0x0007000000023414-53.dat	UPX
behavioral2/memory/2076-54-0x00007FF64F830000-0x00007FF64FB84000-memory.dmp	UPX
behavioral2/files/0x0007000000023415-57.dat	UPX
behavioral2/files/0x0007000000023416-65.dat	UPX
behavioral2/memory/2968-63-0x00007FF7283D0000-0x00007FF728724000-memory.dmp	UPX
behavioral2/memory/1600-70-0x00007FF6C93E0000-0x00007FF6C9734000-memory.dmp	UPX
behavioral2/files/0x0007000000023417-72.dat	UPX
behavioral2/files/0x0007000000023418-77.dat	UPX
behavioral2/memory/4684-76-0x00007FF7BCAE0000-0x00007FF7BCE34000-memory.dmp	UPX
behavioral2/memory/1192-74-0x00007FF734AE0000-0x00007FF734E34000-memory.dmp	UPX
behavioral2/memory/1760-82-0x00007FF7128B0000-0x00007FF712C04000-memory.dmp	UPX
behavioral2/memory/3712-81-0x00007FF688620000-0x00007FF688974000-memory.dmp	UPX
behavioral2/memory/1720-91-0x00007FF6D3DF0000-0x00007FF6D4144000-memory.dmp	UPX
behavioral2/files/0x000700000002341b-92.dat	UPX
behavioral2/files/0x000700000002341c-95.dat	UPX
behavioral2/memory/4380-90-0x00007FF62B710000-0x00007FF62BA64000-memory.dmp	UPX
behavioral2/files/0x000700000002341a-86.dat	UPX
behavioral2/files/0x000700000002341d-105.dat	UPX
behavioral2/memory/3492-102-0x00007FF600C30000-0x00007FF600F84000-memory.dmp	UPX
behavioral2/memory/2608-107-0x00007FF6AEB70000-0x00007FF6AEEC4000-memory.dmp	UPX
behavioral2/memory/5020-109-0x00007FF638960000-0x00007FF638CB4000-memory.dmp	UPX
behavioral2/files/0x000700000002341e-110.dat	UPX
behavioral2/memory/1380-100-0x00007FF72F7B0000-0x00007FF72FB04000-memory.dmp	UPX
behavioral2/memory/3460-122-0x00007FF7C1EE0000-0x00007FF7C2234000-memory.dmp	UPX
behavioral2/memory/2076-129-0x00007FF64F830000-0x00007FF64FB84000-memory.dmp	UPX
behavioral2/memory/3116-130-0x00007FF672FB0000-0x00007FF673304000-memory.dmp	UPX
behavioral2/memory/3664-128-0x00007FF700D20000-0x00007FF701074000-memory.dmp	UPX
behavioral2/files/0x0007000000023420-125.dat	UPX
behavioral2/memory/1764-121-0x00007FF7E9690000-0x00007FF7E99E4000-memory.dmp	UPX
behavioral2/files/0x000700000002341f-119.dat	UPX
behavioral2/memory/1216-115-0x00007FF604070000-0x00007FF6043C4000-memory.dmp	UPX
behavioral2/memory/3588-114-0x00007FF6FCF00000-0x00007FF6FD254000-memory.dmp	UPX
behavioral2/files/0x0007000000023421-132.dat	UPX
behavioral2/memory/2968-134-0x00007FF7283D0000-0x00007FF728724000-memory.dmp	UPX
behavioral2/memory/1612-136-0x00007FF67F760000-0x00007FF67FAB4000-memory.dmp	UPX
behavioral2/memory/1612-137-0x00007FF67F760000-0x00007FF67FAB4000-memory.dmp	UPX
behavioral2/memory/3712-138-0x00007FF688620000-0x00007FF688974000-memory.dmp	UPX
behavioral2/memory/1760-139-0x00007FF7128B0000-0x00007FF712C04000-memory.dmp	UPX
behavioral2/memory/2728-140-0x00007FF69E5F0000-0x00007FF69E944000-memory.dmp	UPX
behavioral2/memory/2460-141-0x00007FF75BB90000-0x00007FF75BEE4000-memory.dmp	UPX
behavioral2/memory/2608-142-0x00007FF6AEB70000-0x00007FF6AEEC4000-memory.dmp	UPX
behavioral2/memory/1216-144-0x00007FF604070000-0x00007FF6043C4000-memory.dmp	UPX
behavioral2/memory/3460-145-0x00007FF7C1EE0000-0x00007FF7C2234000-memory.dmp	UPX
behavioral2/memory/3588-143-0x00007FF6FCF00000-0x00007FF6FD254000-memory.dmp	UPX
behavioral2/memory/2076-146-0x00007FF64F830000-0x00007FF64FB84000-memory.dmp	UPX
behavioral2/memory/2968-147-0x00007FF7283D0000-0x00007FF728724000-memory.dmp	UPX
behavioral2/memory/1600-148-0x00007FF6C93E0000-0x00007FF6C9734000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1192-0-0x00007FF734AE0000-0x00007FF734E34000-memory.dmp	xmrig
behavioral2/files/0x0008000000022f51-5.dat	xmrig
behavioral2/memory/3712-6-0x00007FF688620000-0x00007FF688974000-memory.dmp	xmrig
behavioral2/files/0x000700000002340d-9.dat	xmrig
behavioral2/files/0x000700000002340e-17.dat	xmrig
behavioral2/memory/2728-20-0x00007FF69E5F0000-0x00007FF69E944000-memory.dmp	xmrig
behavioral2/files/0x000700000002340f-25.dat	xmrig
behavioral2/files/0x0007000000023410-30.dat	xmrig
behavioral2/files/0x0007000000023411-34.dat	xmrig
behavioral2/files/0x0007000000023413-45.dat	xmrig
behavioral2/memory/3460-48-0x00007FF7C1EE0000-0x00007FF7C2234000-memory.dmp	xmrig
behavioral2/memory/1216-43-0x00007FF604070000-0x00007FF6043C4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023412-41.dat	xmrig
behavioral2/memory/3588-40-0x00007FF6FCF00000-0x00007FF6FD254000-memory.dmp	xmrig
behavioral2/memory/2460-38-0x00007FF75BB90000-0x00007FF75BEE4000-memory.dmp	xmrig
behavioral2/memory/2608-23-0x00007FF6AEB70000-0x00007FF6AEEC4000-memory.dmp	xmrig
behavioral2/memory/1760-19-0x00007FF7128B0000-0x00007FF712C04000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-53.dat	xmrig
behavioral2/memory/2076-54-0x00007FF64F830000-0x00007FF64FB84000-memory.dmp	xmrig
behavioral2/files/0x0007000000023415-57.dat	xmrig
behavioral2/files/0x0007000000023416-65.dat	xmrig
behavioral2/memory/2968-63-0x00007FF7283D0000-0x00007FF728724000-memory.dmp	xmrig
behavioral2/memory/1600-70-0x00007FF6C93E0000-0x00007FF6C9734000-memory.dmp	xmrig
behavioral2/files/0x0007000000023417-72.dat	xmrig
behavioral2/files/0x0007000000023418-77.dat	xmrig
behavioral2/memory/4684-76-0x00007FF7BCAE0000-0x00007FF7BCE34000-memory.dmp	xmrig
behavioral2/memory/1192-74-0x00007FF734AE0000-0x00007FF734E34000-memory.dmp	xmrig
behavioral2/memory/1760-82-0x00007FF7128B0000-0x00007FF712C04000-memory.dmp	xmrig
behavioral2/memory/3712-81-0x00007FF688620000-0x00007FF688974000-memory.dmp	xmrig
behavioral2/memory/1720-91-0x00007FF6D3DF0000-0x00007FF6D4144000-memory.dmp	xmrig
behavioral2/files/0x000700000002341b-92.dat	xmrig
behavioral2/files/0x000700000002341c-95.dat	xmrig
behavioral2/memory/4380-90-0x00007FF62B710000-0x00007FF62BA64000-memory.dmp	xmrig
behavioral2/files/0x000700000002341a-86.dat	xmrig
behavioral2/files/0x000700000002341d-105.dat	xmrig
behavioral2/memory/3492-102-0x00007FF600C30000-0x00007FF600F84000-memory.dmp	xmrig
behavioral2/memory/2608-107-0x00007FF6AEB70000-0x00007FF6AEEC4000-memory.dmp	xmrig
behavioral2/memory/5020-109-0x00007FF638960000-0x00007FF638CB4000-memory.dmp	xmrig
behavioral2/files/0x000700000002341e-110.dat	xmrig
behavioral2/memory/1380-100-0x00007FF72F7B0000-0x00007FF72FB04000-memory.dmp	xmrig
behavioral2/memory/3460-122-0x00007FF7C1EE0000-0x00007FF7C2234000-memory.dmp	xmrig
behavioral2/memory/2076-129-0x00007FF64F830000-0x00007FF64FB84000-memory.dmp	xmrig
behavioral2/memory/3116-130-0x00007FF672FB0000-0x00007FF673304000-memory.dmp	xmrig
behavioral2/memory/3664-128-0x00007FF700D20000-0x00007FF701074000-memory.dmp	xmrig
behavioral2/files/0x0007000000023420-125.dat	xmrig
behavioral2/memory/1764-121-0x00007FF7E9690000-0x00007FF7E99E4000-memory.dmp	xmrig
behavioral2/files/0x000700000002341f-119.dat	xmrig
behavioral2/memory/1216-115-0x00007FF604070000-0x00007FF6043C4000-memory.dmp	xmrig
behavioral2/memory/3588-114-0x00007FF6FCF00000-0x00007FF6FD254000-memory.dmp	xmrig
behavioral2/files/0x0007000000023421-132.dat	xmrig
behavioral2/memory/2968-134-0x00007FF7283D0000-0x00007FF728724000-memory.dmp	xmrig
behavioral2/memory/1612-136-0x00007FF67F760000-0x00007FF67FAB4000-memory.dmp	xmrig
behavioral2/memory/1612-137-0x00007FF67F760000-0x00007FF67FAB4000-memory.dmp	xmrig
behavioral2/memory/3712-138-0x00007FF688620000-0x00007FF688974000-memory.dmp	xmrig
behavioral2/memory/1760-139-0x00007FF7128B0000-0x00007FF712C04000-memory.dmp	xmrig
behavioral2/memory/2728-140-0x00007FF69E5F0000-0x00007FF69E944000-memory.dmp	xmrig
behavioral2/memory/2460-141-0x00007FF75BB90000-0x00007FF75BEE4000-memory.dmp	xmrig
behavioral2/memory/2608-142-0x00007FF6AEB70000-0x00007FF6AEEC4000-memory.dmp	xmrig
behavioral2/memory/1216-144-0x00007FF604070000-0x00007FF6043C4000-memory.dmp	xmrig
behavioral2/memory/3460-145-0x00007FF7C1EE0000-0x00007FF7C2234000-memory.dmp	xmrig
behavioral2/memory/3588-143-0x00007FF6FCF00000-0x00007FF6FD254000-memory.dmp	xmrig
behavioral2/memory/2076-146-0x00007FF64F830000-0x00007FF64FB84000-memory.dmp	xmrig
behavioral2/memory/2968-147-0x00007FF7283D0000-0x00007FF728724000-memory.dmp	xmrig
behavioral2/memory/1600-148-0x00007FF6C93E0000-0x00007FF6C9734000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3712	KPYSLOG.exe
1760	ZTSBPeB.exe
2728	aTcNact.exe
2608	ewGOyyH.exe
2460	STRPrSu.exe
3588	DbDdvFt.exe
1216	YZUEQuP.exe
3460	ltLZOiQ.exe
2076	lwFnVtg.exe
2968	jvmptxE.exe
1600	sUgcstG.exe
4684	rroBLvS.exe
4380	iOPdiky.exe
1720	vfHEuJX.exe
1380	vAgzruF.exe
3492	YqYASWB.exe
5020	riggQwy.exe
1764	tOScciS.exe
3664	RRModZR.exe
3116	mUncRkg.exe
1612	cfzwcLQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1192-0-0x00007FF734AE0000-0x00007FF734E34000-memory.dmp	upx
behavioral2/files/0x0008000000022f51-5.dat	upx
behavioral2/memory/3712-6-0x00007FF688620000-0x00007FF688974000-memory.dmp	upx
behavioral2/files/0x000700000002340d-9.dat	upx
behavioral2/files/0x000700000002340e-17.dat	upx
behavioral2/memory/2728-20-0x00007FF69E5F0000-0x00007FF69E944000-memory.dmp	upx
behavioral2/files/0x000700000002340f-25.dat	upx
behavioral2/files/0x0007000000023410-30.dat	upx
behavioral2/files/0x0007000000023411-34.dat	upx
behavioral2/files/0x0007000000023413-45.dat	upx
behavioral2/memory/3460-48-0x00007FF7C1EE0000-0x00007FF7C2234000-memory.dmp	upx
behavioral2/memory/1216-43-0x00007FF604070000-0x00007FF6043C4000-memory.dmp	upx
behavioral2/files/0x0007000000023412-41.dat	upx
behavioral2/memory/3588-40-0x00007FF6FCF00000-0x00007FF6FD254000-memory.dmp	upx
behavioral2/memory/2460-38-0x00007FF75BB90000-0x00007FF75BEE4000-memory.dmp	upx
behavioral2/memory/2608-23-0x00007FF6AEB70000-0x00007FF6AEEC4000-memory.dmp	upx
behavioral2/memory/1760-19-0x00007FF7128B0000-0x00007FF712C04000-memory.dmp	upx
behavioral2/files/0x0007000000023414-53.dat	upx
behavioral2/memory/2076-54-0x00007FF64F830000-0x00007FF64FB84000-memory.dmp	upx
behavioral2/files/0x0007000000023415-57.dat	upx
behavioral2/files/0x0007000000023416-65.dat	upx
behavioral2/memory/2968-63-0x00007FF7283D0000-0x00007FF728724000-memory.dmp	upx
behavioral2/memory/1600-70-0x00007FF6C93E0000-0x00007FF6C9734000-memory.dmp	upx
behavioral2/files/0x0007000000023417-72.dat	upx
behavioral2/files/0x0007000000023418-77.dat	upx
behavioral2/memory/4684-76-0x00007FF7BCAE0000-0x00007FF7BCE34000-memory.dmp	upx
behavioral2/memory/1192-74-0x00007FF734AE0000-0x00007FF734E34000-memory.dmp	upx
behavioral2/memory/1760-82-0x00007FF7128B0000-0x00007FF712C04000-memory.dmp	upx
behavioral2/memory/3712-81-0x00007FF688620000-0x00007FF688974000-memory.dmp	upx
behavioral2/memory/1720-91-0x00007FF6D3DF0000-0x00007FF6D4144000-memory.dmp	upx
behavioral2/files/0x000700000002341b-92.dat	upx
behavioral2/files/0x000700000002341c-95.dat	upx
behavioral2/memory/4380-90-0x00007FF62B710000-0x00007FF62BA64000-memory.dmp	upx
behavioral2/files/0x000700000002341a-86.dat	upx
behavioral2/files/0x000700000002341d-105.dat	upx
behavioral2/memory/3492-102-0x00007FF600C30000-0x00007FF600F84000-memory.dmp	upx
behavioral2/memory/2608-107-0x00007FF6AEB70000-0x00007FF6AEEC4000-memory.dmp	upx
behavioral2/memory/5020-109-0x00007FF638960000-0x00007FF638CB4000-memory.dmp	upx
behavioral2/files/0x000700000002341e-110.dat	upx
behavioral2/memory/1380-100-0x00007FF72F7B0000-0x00007FF72FB04000-memory.dmp	upx
behavioral2/memory/3460-122-0x00007FF7C1EE0000-0x00007FF7C2234000-memory.dmp	upx
behavioral2/memory/2076-129-0x00007FF64F830000-0x00007FF64FB84000-memory.dmp	upx
behavioral2/memory/3116-130-0x00007FF672FB0000-0x00007FF673304000-memory.dmp	upx
behavioral2/memory/3664-128-0x00007FF700D20000-0x00007FF701074000-memory.dmp	upx
behavioral2/files/0x0007000000023420-125.dat	upx
behavioral2/memory/1764-121-0x00007FF7E9690000-0x00007FF7E99E4000-memory.dmp	upx
behavioral2/files/0x000700000002341f-119.dat	upx
behavioral2/memory/1216-115-0x00007FF604070000-0x00007FF6043C4000-memory.dmp	upx
behavioral2/memory/3588-114-0x00007FF6FCF00000-0x00007FF6FD254000-memory.dmp	upx
behavioral2/files/0x0007000000023421-132.dat	upx
behavioral2/memory/2968-134-0x00007FF7283D0000-0x00007FF728724000-memory.dmp	upx
behavioral2/memory/1612-136-0x00007FF67F760000-0x00007FF67FAB4000-memory.dmp	upx
behavioral2/memory/1612-137-0x00007FF67F760000-0x00007FF67FAB4000-memory.dmp	upx
behavioral2/memory/3712-138-0x00007FF688620000-0x00007FF688974000-memory.dmp	upx
behavioral2/memory/1760-139-0x00007FF7128B0000-0x00007FF712C04000-memory.dmp	upx
behavioral2/memory/2728-140-0x00007FF69E5F0000-0x00007FF69E944000-memory.dmp	upx
behavioral2/memory/2460-141-0x00007FF75BB90000-0x00007FF75BEE4000-memory.dmp	upx
behavioral2/memory/2608-142-0x00007FF6AEB70000-0x00007FF6AEEC4000-memory.dmp	upx
behavioral2/memory/1216-144-0x00007FF604070000-0x00007FF6043C4000-memory.dmp	upx
behavioral2/memory/3460-145-0x00007FF7C1EE0000-0x00007FF7C2234000-memory.dmp	upx
behavioral2/memory/3588-143-0x00007FF6FCF00000-0x00007FF6FD254000-memory.dmp	upx
behavioral2/memory/2076-146-0x00007FF64F830000-0x00007FF64FB84000-memory.dmp	upx
behavioral2/memory/2968-147-0x00007FF7283D0000-0x00007FF728724000-memory.dmp	upx
behavioral2/memory/1600-148-0x00007FF6C93E0000-0x00007FF6C9734000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\iOPdiky.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ewGOyyH.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\STRPrSu.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lwFnVtg.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jvmptxE.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\sUgcstG.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KPYSLOG.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aTcNact.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DbDdvFt.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ltLZOiQ.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rroBLvS.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vAgzruF.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YqYASWB.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\riggQwy.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tOScciS.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RRModZR.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZTSBPeB.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YZUEQuP.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vfHEuJX.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mUncRkg.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\cfzwcLQ.exe	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 3712	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	85
PID 1192 wrote to memory of 3712	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	85
PID 1192 wrote to memory of 1760	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	86
PID 1192 wrote to memory of 1760	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	86
PID 1192 wrote to memory of 2728	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	87
PID 1192 wrote to memory of 2728	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	87
PID 1192 wrote to memory of 2608	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	88
PID 1192 wrote to memory of 2608	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	88
PID 1192 wrote to memory of 2460	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	89
PID 1192 wrote to memory of 2460	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	89
PID 1192 wrote to memory of 3588	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	90
PID 1192 wrote to memory of 3588	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	90
PID 1192 wrote to memory of 1216	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	91
PID 1192 wrote to memory of 1216	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	91
PID 1192 wrote to memory of 3460	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	92
PID 1192 wrote to memory of 3460	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	92
PID 1192 wrote to memory of 2076	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	93
PID 1192 wrote to memory of 2076	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	93
PID 1192 wrote to memory of 2968	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	96
PID 1192 wrote to memory of 2968	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	96
PID 1192 wrote to memory of 1600	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	97
PID 1192 wrote to memory of 1600	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	97
PID 1192 wrote to memory of 4684	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	98
PID 1192 wrote to memory of 4684	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	98
PID 1192 wrote to memory of 4380	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	100
PID 1192 wrote to memory of 4380	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	100
PID 1192 wrote to memory of 1720	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	101
PID 1192 wrote to memory of 1720	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	101
PID 1192 wrote to memory of 1380	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	102
PID 1192 wrote to memory of 1380	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	102
PID 1192 wrote to memory of 3492	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	103
PID 1192 wrote to memory of 3492	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	103
PID 1192 wrote to memory of 5020	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	104
PID 1192 wrote to memory of 5020	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	104
PID 1192 wrote to memory of 1764	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	106
PID 1192 wrote to memory of 1764	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	106
PID 1192 wrote to memory of 3664	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	107
PID 1192 wrote to memory of 3664	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	107
PID 1192 wrote to memory of 3116	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	108
PID 1192 wrote to memory of 3116	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	108
PID 1192 wrote to memory of 1612	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	109
PID 1192 wrote to memory of 1612	1192	2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe	109

C:\Users\Admin\AppData\Local\Temp\2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-25_05eb69090ab56492cbda7141c2fc0af2_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\System\KPYSLOG.exe
  C:\Windows\System\KPYSLOG.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\ZTSBPeB.exe
  C:\Windows\System\ZTSBPeB.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\aTcNact.exe
  C:\Windows\System\aTcNact.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\ewGOyyH.exe
  C:\Windows\System\ewGOyyH.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\STRPrSu.exe
  C:\Windows\System\STRPrSu.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\DbDdvFt.exe
  C:\Windows\System\DbDdvFt.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\YZUEQuP.exe
  C:\Windows\System\YZUEQuP.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\ltLZOiQ.exe
  C:\Windows\System\ltLZOiQ.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\lwFnVtg.exe
  C:\Windows\System\lwFnVtg.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\jvmptxE.exe
  C:\Windows\System\jvmptxE.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\sUgcstG.exe
  C:\Windows\System\sUgcstG.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\rroBLvS.exe
  C:\Windows\System\rroBLvS.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\iOPdiky.exe
  C:\Windows\System\iOPdiky.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\vfHEuJX.exe
  C:\Windows\System\vfHEuJX.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\vAgzruF.exe
  C:\Windows\System\vAgzruF.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\YqYASWB.exe
  C:\Windows\System\YqYASWB.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\riggQwy.exe
  C:\Windows\System\riggQwy.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\tOScciS.exe
  C:\Windows\System\tOScciS.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\RRModZR.exe
  C:\Windows\System\RRModZR.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\mUncRkg.exe
  C:\Windows\System\mUncRkg.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\cfzwcLQ.exe
  C:\Windows\System\cfzwcLQ.exe
  2⤵
  - Executes dropped EXE
  PID:1612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DbDdvFt.exe

Path C:\Windows\System\DbDdvFt.exe
Size 5.9MB
SHA256 a3fc5650cfb0bb328f17a78db9ca70f4cb745b377bc1ff53d6ce5f8aa0eb4bbd
MD5 450596f6cdc52304c251d57179161be1
SHA1 6f85b81ef496c321d605ef21876e940bbe9b5d21
SHA512 dd830bd8abb050d3b7dd5fdfd891d2ebf07153a2881b046c1b37acff9d7bf569b246334a888f956edffc03f0228dc908973038fb7a9f7294769de2201cdd1699
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

KPYSLOG.exe

Path C:\Windows\System\KPYSLOG.exe
Size 5.9MB
SHA256 7d6d3fb7ad76fd2f582cc195757ec36f8516de2997cfe84676dad12befc302a3
MD5 f03681ef12891a028f0bf878253e1780
SHA1 60ed1d59f51d34d0cd8f9cae2514fc1fcec3cbfa
SHA512 1f101ac847733bfc3d68a5ce1a621118ad2ab618533bb36b6e058135663b3f5b4e32e508613c612aa8d0edbb2575c9b58c4e3b6cf86613cc7899375ce82a11c0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

RRModZR.exe

Path C:\Windows\System\RRModZR.exe
Size 5.9MB
SHA256 bd5c228e70627a9eeed9cfe4431a52c8f11d7e9ad7ef8d9522c1d8b315425e5c
MD5 76797f7bcf1f66e5a4155509b3246654
SHA1 952d19fe8221ffb944dc7bfbf7c3a908d2d64373
SHA512 9d8f74d722320be2ae1be2b2bff78d620ce77991fc75fcb32d88ee225f2ee93bfdc429bf387d9b8e988914c9f27ab3d90e89724d79f66c936cc62a92669fd18d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

STRPrSu.exe

Path C:\Windows\System\STRPrSu.exe
Size 5.9MB
SHA256 b3b504840abf94dfed08b08dcc3c393c3a4363e3d32891c317da2e34877bff47
MD5 a1a71889a86e3de168397718c52dd022
SHA1 e124406c945cb22efde8a0448828c994ec394c78
SHA512 5427ff9c98cc37e4a90b8439d9c297280dc700bd27a3b93dddabeeeed68c87a1a98bdd5839a7b7b7f150e56c0bc61e78b7bfc1ed4e6787c6e73de4c3ee1b9763
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

YZUEQuP.exe

Path C:\Windows\System\YZUEQuP.exe
Size 5.9MB
SHA256 73fbc1841aca211afcb891ae326fe6f73bcd68009557ee67508c3b471030c028
MD5 0d267ce1644fafd90f83d943cceb7969
SHA1 e1bce645f8481884440ca2584234b088057e4e43
SHA512 5904bdbfab7ef5edfe29b75ee215c7c665731752cae73b56b50a69d003e75d4aa36ba48a9b4be936df9611f2bec95157ca9d9eabfbdb5faf18572e67a8079da8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

YqYASWB.exe

Path C:\Windows\System\YqYASWB.exe
Size 5.9MB
SHA256 c4311642d3739f6d6158d2376bd10f2c3d5bd61c3f28e02664d68a86a7cbb5d5
MD5 88523333c150615ebe84084c4c5e009c
SHA1 80c6c7dfe8bf1b93e5cbf9d95e1f4ac5c023f619
SHA512 0561e8e40dd208efe37a3af17efa6543d15140de12a596734c1f3ebd606f59b80572ae597fe9164763e2c49e849fe3bbe47d6c05f74aa1d54929888c8792f404
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZTSBPeB.exe

Path C:\Windows\System\ZTSBPeB.exe
Size 5.9MB
SHA256 10d54c5a55a6ecdfe44ee827eb8d31227ba8c18987e01a60935bc7d5c40a60f8
MD5 618d2053281fb69bba2c95099bd4e434
SHA1 850f4e7c2df6bea4cfa403e29658e3a5e9a87310
SHA512 eb7c160e10a88161e85984e1d63c5685710c6f7853b8d9f943546ee8530da9d67dbc9351503860c75b754362415ab1c62e2094e73a14a2687ab6cf1dcb60788a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

aTcNact.exe

Path C:\Windows\System\aTcNact.exe
Size 5.9MB
SHA256 534d68625980dd8fe3bae9af20f55b69fa719dfe2aa64aea444f820c90ecefe2
MD5 f7b36843204107e7c55295afd72ace36
SHA1 1778b9c2a224935302d51cd200acd82db4259bfd
SHA512 b1c8ef9333027bbc5a822e57f29fcdc0da5a3ff2515b745e81f389978e16e6d068378ab5f745f9d47c49f7af43fcad32c83b62053e06153080aa4403a1cd7eee
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

cfzwcLQ.exe

Path C:\Windows\System\cfzwcLQ.exe
Size 5.9MB
SHA256 770aa959bf463eb5c12be626fa3af5cc9217aa85d75f9eb9471f0e6ae2b7a799
MD5 4ba759444ced69e81e7601f2258f99fc
SHA1 ea069f9b48a1fd2262b5f6410ea56029991a4f7b
SHA512 12b92670e799e48732d60b73620ea8e532432fface704c8cad95867b0379dd930bbf7eaa363da4a56d8171149a4705441153ae4f165849f45535435191987451
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

ewGOyyH.exe

Path C:\Windows\System\ewGOyyH.exe
Size 5.9MB
SHA256 21949103157a56eeb77184e261ad04664e40d4befa3c5576891fa99168fc2c40
MD5 7818782466b7fa9f7147a09f0d9bb6b9
SHA1 09ffa328bdc5bc391e62de5430d44a36c1fc21ae
SHA512 d9c096324bf1e2f126d135d275741841201c64ebcab2ce77df78177c79ba16f6d467da4defec03fb7260cf801153eb32ac50d087aa332c693a6261cb8cbd847e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

iOPdiky.exe

Path C:\Windows\System\iOPdiky.exe
Size 5.9MB
SHA256 a6178cd2e5385bf5e7010e9e0f82a3eaef69ac402c17370bf9b03c106ea26216
MD5 af2a22316197a903589c9e9f0e1e9cad
SHA1 36734001a2f95ef02a1515cb5f18401537e2a68a
SHA512 cd2a0de8860458052f8ffbf81a4574ceebc9ed6cf86cfabd78a6b9c7865be5883e16b50acdb6b87247611854454cf639aa1dd1106669c6a73d356d3e406c4ffc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvmptxE.exe

Path C:\Windows\System\jvmptxE.exe
Size 5.9MB
SHA256 604ddfb9de219874dec9b57ed0b54a21af57510ff898c5f7cccdf795093a8cee
MD5 7675bed39cfd24d79fd4a350b7dec189
SHA1 1cd26403a51d86ae7cb2ec65ec7b413411e31fc0
SHA512 aadb4d343711da1b57e5888b37d3ad19c6c9aed456956798647d074daecaf75f3ebcf9314b9887ff3a0ed93aa71f7ad4edf861c5a6de5d4ec158f79fc3266bba
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

ltLZOiQ.exe

Path C:\Windows\System\ltLZOiQ.exe
Size 5.9MB
SHA256 970396282ee46efaf86a5f090e86a8dac6794b61186a9701f8ee0519bdaaa12c
MD5 93c48be50afb768f52948bbb75c89a0e
SHA1 35e068a68248cc91fcc9371ff4a72fd9fe1bf6fa
SHA512 a07d8970b3a0d51c5c623f0d83b73ac4950d86195099ff51807485dbfbd48ede2fa1e0f4360d1ea634500a4bb824cc7ec63f537607a67fe737e1754788a3c2c7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

lwFnVtg.exe

Path C:\Windows\System\lwFnVtg.exe
Size 5.9MB
SHA256 3a1033272c9f7e1e070629c8a1d3890e9765e5568c0da2e6ec1c94d6a90f011b
MD5 9af454b1200ce318c090bae66d283c68
SHA1 c9c174b29f6fa421bf81c8fcfb8d2768d819a1fd
SHA512 8a3dff603d2c523ed7fd5cea18d1d6d1eee4bf90c80aba836c14d0fb7d09c32c50909846c42e2d6851c618928e14b49a0ca0919d44bea933208b9e22488465bc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

mUncRkg.exe

Path C:\Windows\System\mUncRkg.exe
Size 5.9MB
SHA256 ca2886bb837ae2284a965e4d57cee0d197f6adf6f1f0bdff33eaf972a79e8e76
MD5 23023a0b8cffbbcf00f4a44cb75eb773
SHA1 388f183579a99ce059fc8b6a3b8e9bf0a017f74f
SHA512 26713a6a6102234df8b3ae7f5f8e1b62c5c7754b0cd40d1fcbf6f445bf2e0abbc858738fa84eb5462691174f2e512770496670d95dcdd6e61380b995adc5ab7f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

riggQwy.exe

Path C:\Windows\System\riggQwy.exe
Size 5.9MB
SHA256 426527999a7cd3179ec819c768aede0d63a5c3f17bcbdf27f521de308c49ad77
MD5 395fc7ed5b8ed3f6cf4cfbb059992fa0
SHA1 f50197da3204b13e2f336d2c433262acbfa145de
SHA512 a456d54eb75321cab1c6d231f74f94c641d2aebb611b569a27399a5c0cb2aa25b83cdd561263c51f3be70d6c11ebb2704d18eecbb44f8b1d0092727b222ef635
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

rroBLvS.exe

Path C:\Windows\System\rroBLvS.exe
Size 5.9MB
SHA256 00305d203bc4bfd6fa1293bbce22946720649fc097ac65661f929a057c133b9d
MD5 2afd0948ad5d147d9bd46b1f9ed48803
SHA1 6585fe3cc295f5e1afd50376047124167aa57639
SHA512 387f57f6a5feb2a0d82de1d137a1ede20088884683097541db478d687266f6eaa7d7f79b0a5ec813f9d4dffc2f7fcb902dc985d9e38b21658cdc6cdd08726f98
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

sUgcstG.exe

Path C:\Windows\System\sUgcstG.exe
Size 5.9MB
SHA256 db3d8ee3f0605dfe15222ce0e84faf0999be7fdd07a89cf0449e94f6d33de81c
MD5 3bc6bbe86dad034b7374989d3b110a1c
SHA1 f29dafdfc1175da8384ab09eb165917bd1a9bc8e
SHA512 414e7405351056d33bd6aa0feb0cffadb76e2419f6dc909e5cfd9b7aa570d5c39c39e3c21653994d3bdbc378d1414ad2202365db981d6c44914dbf2bbeb2332f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:Q+856utgpPF8u/7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

tOScciS.exe

Path C:\Windows\System\tOScciS.exe
Size 5.9MB
SHA256 d71c96c9025c3fff589e69a0ad2f9670fd08fc2ffea2d66fd068031fcae5a570
MD5 ff584272ab3f19b4a8118834a9ae4361
SHA1 6fa8c07c520888704e850122346ef24c658a3f41
SHA512 75c9741fb52c2364240a103fbdb01fe0dfd095eb02caa9088d8db4d941bb2b6f1b52b24b85805cd8a9281b29016913cd229b0027af966c464eb2b6d55c07e44c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

vAgzruF.exe

Path C:\Windows\System\vAgzruF.exe
Size 5.9MB
SHA256 6f49245a73f43f3b498139634998e1c3f9baaaba00590e17101299cf5f390434
MD5 e4ed04e46a5d26e09d4196a4649948dd
SHA1 ffedc031af0e2f1d4f71d716aa394e3fdb940d5c
SHA512 6d53740b051acb56fca77d0c902b63864e29e0daaab04aed6f63d891874f37c5d9e1115a344e68f338777ded4dd9543bb11ce1fc47743bb7d88b0a4e44c24ac6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

vfHEuJX.exe

Path C:\Windows\System\vfHEuJX.exe
Size 5.9MB
SHA256 df500db562f1fdf74f292b7bd418205c249c81c63aaf714c7fc600ce9f597636
MD5 f3295f475354d48f1e86e0375e482ddd
SHA1 9b6ed67aff52a024c9c2b6795f83b01ae57958cc
SHA512 0dd0561362cdb0537bc9f99c74b114561f13635c5c03809a1908aebff82712b009d4acce639c9c66175dc90dd59deef761cbe1905a8793882544ae411a042bfa
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1192-0-0x00007FF734AE0000-0x00007FF734E34000-memory.dmp

Download

memory/1192-74-0x00007FF734AE0000-0x00007FF734E34000-memory.dmp

Download

memory/1192-1-0x00000233BBDD0000-0x00000233BBDE0000-memory.dmp

Download

memory/1216-144-0x00007FF604070000-0x00007FF6043C4000-memory.dmp

Download

memory/1216-43-0x00007FF604070000-0x00007FF6043C4000-memory.dmp

Download

memory/1216-115-0x00007FF604070000-0x00007FF6043C4000-memory.dmp

Download

memory/1380-152-0x00007FF72F7B0000-0x00007FF72FB04000-memory.dmp

Download

memory/1380-100-0x00007FF72F7B0000-0x00007FF72FB04000-memory.dmp

Download

memory/1600-148-0x00007FF6C93E0000-0x00007FF6C9734000-memory.dmp

Download

memory/1600-70-0x00007FF6C93E0000-0x00007FF6C9734000-memory.dmp

Download

memory/1612-158-0x00007FF67F760000-0x00007FF67FAB4000-memory.dmp

Download

memory/1612-137-0x00007FF67F760000-0x00007FF67FAB4000-memory.dmp

Download

memory/1612-136-0x00007FF67F760000-0x00007FF67FAB4000-memory.dmp

Download

memory/1720-91-0x00007FF6D3DF0000-0x00007FF6D4144000-memory.dmp

Download

memory/1720-151-0x00007FF6D3DF0000-0x00007FF6D4144000-memory.dmp

Download

memory/1760-139-0x00007FF7128B0000-0x00007FF712C04000-memory.dmp

Download

memory/1760-19-0x00007FF7128B0000-0x00007FF712C04000-memory.dmp

Download

memory/1760-82-0x00007FF7128B0000-0x00007FF712C04000-memory.dmp

Download

memory/1764-121-0x00007FF7E9690000-0x00007FF7E99E4000-memory.dmp

Download

memory/1764-155-0x00007FF7E9690000-0x00007FF7E99E4000-memory.dmp

Download

memory/2076-146-0x00007FF64F830000-0x00007FF64FB84000-memory.dmp

Download

memory/2076-129-0x00007FF64F830000-0x00007FF64FB84000-memory.dmp

Download

memory/2076-54-0x00007FF64F830000-0x00007FF64FB84000-memory.dmp

Download

memory/2460-38-0x00007FF75BB90000-0x00007FF75BEE4000-memory.dmp

Download

memory/2460-141-0x00007FF75BB90000-0x00007FF75BEE4000-memory.dmp

Download

memory/2608-23-0x00007FF6AEB70000-0x00007FF6AEEC4000-memory.dmp

Download

memory/2608-142-0x00007FF6AEB70000-0x00007FF6AEEC4000-memory.dmp

Download

memory/2608-107-0x00007FF6AEB70000-0x00007FF6AEEC4000-memory.dmp

Download

memory/2728-20-0x00007FF69E5F0000-0x00007FF69E944000-memory.dmp

Download

memory/2728-140-0x00007FF69E5F0000-0x00007FF69E944000-memory.dmp

Download

memory/2968-63-0x00007FF7283D0000-0x00007FF728724000-memory.dmp

Download

memory/2968-134-0x00007FF7283D0000-0x00007FF728724000-memory.dmp

Download

memory/2968-147-0x00007FF7283D0000-0x00007FF728724000-memory.dmp

Download

memory/3116-130-0x00007FF672FB0000-0x00007FF673304000-memory.dmp

Download

memory/3116-157-0x00007FF672FB0000-0x00007FF673304000-memory.dmp

Download

memory/3460-48-0x00007FF7C1EE0000-0x00007FF7C2234000-memory.dmp

Download

memory/3460-122-0x00007FF7C1EE0000-0x00007FF7C2234000-memory.dmp

Download

memory/3460-145-0x00007FF7C1EE0000-0x00007FF7C2234000-memory.dmp

Download

memory/3492-102-0x00007FF600C30000-0x00007FF600F84000-memory.dmp

Download

memory/3492-153-0x00007FF600C30000-0x00007FF600F84000-memory.dmp

Download

memory/3588-143-0x00007FF6FCF00000-0x00007FF6FD254000-memory.dmp

Download

memory/3588-40-0x00007FF6FCF00000-0x00007FF6FD254000-memory.dmp

Download

memory/3588-114-0x00007FF6FCF00000-0x00007FF6FD254000-memory.dmp

Download

memory/3664-156-0x00007FF700D20000-0x00007FF701074000-memory.dmp

Download

memory/3664-128-0x00007FF700D20000-0x00007FF701074000-memory.dmp

Download

memory/3712-81-0x00007FF688620000-0x00007FF688974000-memory.dmp

Download

memory/3712-138-0x00007FF688620000-0x00007FF688974000-memory.dmp

Download

memory/3712-6-0x00007FF688620000-0x00007FF688974000-memory.dmp

Download

memory/4380-90-0x00007FF62B710000-0x00007FF62BA64000-memory.dmp

Download

memory/4380-150-0x00007FF62B710000-0x00007FF62BA64000-memory.dmp

Download

memory/4684-149-0x00007FF7BCAE0000-0x00007FF7BCE34000-memory.dmp

Download

memory/4684-76-0x00007FF7BCAE0000-0x00007FF7BCE34000-memory.dmp

Download

memory/5020-109-0x00007FF638960000-0x00007FF638CB4000-memory.dmp

Download

memory/5020-154-0x00007FF638960000-0x00007FF638CB4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads