cobaltstrike | c743593ed751cd33e3cb494b5fc231caa6c48dbea8fcee3e7c235154763f73f4

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
Size 5.2MB
Sample240527-cbcsxacb5v
SHA256 c743593ed751cd33e3cb494b5fc231caa6c48dbea8fcee3e7c235154763f73f4
MD5 f4132317beb8f4efb954ff525c88ebe3
SHA1 07be3c502ab999b81ef3b5085a193d9673498c18
SHA512 538504d0730295712b2d293f3823c02126883fc7569efb6db2756c530a4d2180498855ef65d5c1d5a94a6a22143c207e7a412ec0f3f776d086fba9d8cbe895ca
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l+:RWWBibf56utgpPFotBER/mQ32lUy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000700000002328e-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023444-9.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023445-10.dat	cobalt_reflective_dll
behavioral2/files/0x000900000002343d-23.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023447-31.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344c-57.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344e-63.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344f-74.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023450-78.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344d-67.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344b-65.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344a-51.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023448-45.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023449-36.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023451-91.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023453-107.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023452-114.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023456-117.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023457-127.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023455-124.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023454-118.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000700000002328e-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023444-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023445-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000900000002343d-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023447-31.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344c-57.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344e-63.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344f-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023450-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344d-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344b-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344a-51.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023448-45.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023449-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023451-91.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023453-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023452-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023456-117.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023457-127.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023455-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023454-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3644-0-0x00007FF65C700000-0x00007FF65CA51000-memory.dmp	UPX
behavioral2/files/0x000700000002328e-4.dat	UPX
behavioral2/memory/4064-7-0x00007FF6E4050000-0x00007FF6E43A1000-memory.dmp	UPX
behavioral2/files/0x0007000000023444-9.dat	UPX
behavioral2/memory/3572-13-0x00007FF771B80000-0x00007FF771ED1000-memory.dmp	UPX
behavioral2/files/0x0007000000023445-10.dat	UPX
behavioral2/memory/1076-20-0x00007FF7E2230000-0x00007FF7E2581000-memory.dmp	UPX
behavioral2/files/0x000900000002343d-23.dat	UPX
behavioral2/files/0x0007000000023447-31.dat	UPX
behavioral2/memory/1232-34-0x00007FF71A630000-0x00007FF71A981000-memory.dmp	UPX
behavioral2/memory/3152-38-0x00007FF62E9C0000-0x00007FF62ED11000-memory.dmp	UPX
behavioral2/memory/4948-47-0x00007FF688680000-0x00007FF6889D1000-memory.dmp	UPX
behavioral2/files/0x000700000002344c-57.dat	UPX
behavioral2/files/0x000700000002344e-63.dat	UPX
behavioral2/files/0x000700000002344f-74.dat	UPX
behavioral2/files/0x0007000000023450-78.dat	UPX
behavioral2/memory/3460-84-0x00007FF72B770000-0x00007FF72BAC1000-memory.dmp	UPX
behavioral2/memory/4064-81-0x00007FF6E4050000-0x00007FF6E43A1000-memory.dmp	UPX
behavioral2/memory/4484-80-0x00007FF70BF80000-0x00007FF70C2D1000-memory.dmp	UPX
behavioral2/memory/3644-77-0x00007FF65C700000-0x00007FF65CA51000-memory.dmp	UPX
behavioral2/memory/1368-76-0x00007FF685D90000-0x00007FF6860E1000-memory.dmp	UPX
behavioral2/memory/4136-70-0x00007FF6B42C0000-0x00007FF6B4611000-memory.dmp	UPX
behavioral2/files/0x000700000002344d-67.dat	UPX
behavioral2/files/0x000700000002344b-65.dat	UPX
behavioral2/memory/3576-64-0x00007FF7EF8B0000-0x00007FF7EFC01000-memory.dmp	UPX
behavioral2/memory/3160-59-0x00007FF73F010000-0x00007FF73F361000-memory.dmp	UPX
behavioral2/memory/4704-53-0x00007FF78CE30000-0x00007FF78D181000-memory.dmp	UPX
behavioral2/files/0x000700000002344a-51.dat	UPX
behavioral2/files/0x0007000000023448-45.dat	UPX
behavioral2/files/0x0007000000023449-36.dat	UPX
behavioral2/memory/1244-26-0x00007FF721A70000-0x00007FF721DC1000-memory.dmp	UPX
behavioral2/files/0x0007000000023451-91.dat	UPX
behavioral2/memory/3572-97-0x00007FF771B80000-0x00007FF771ED1000-memory.dmp	UPX
behavioral2/memory/4192-100-0x00007FF7115C0000-0x00007FF711911000-memory.dmp	UPX
behavioral2/files/0x0007000000023453-107.dat	UPX
behavioral2/files/0x0007000000023452-114.dat	UPX
behavioral2/files/0x0007000000023456-117.dat	UPX
behavioral2/files/0x0007000000023457-127.dat	UPX
behavioral2/memory/388-129-0x00007FF680990000-0x00007FF680CE1000-memory.dmp	UPX
behavioral2/memory/4616-137-0x00007FF6E66F0000-0x00007FF6E6A41000-memory.dmp	UPX
behavioral2/memory/3152-135-0x00007FF62E9C0000-0x00007FF62ED11000-memory.dmp	UPX
behavioral2/memory/1128-131-0x00007FF70B5E0000-0x00007FF70B931000-memory.dmp	UPX
behavioral2/memory/4332-130-0x00007FF6C45F0000-0x00007FF6C4941000-memory.dmp	UPX
behavioral2/memory/1232-126-0x00007FF71A630000-0x00007FF71A981000-memory.dmp	UPX
behavioral2/memory/1244-125-0x00007FF721A70000-0x00007FF721DC1000-memory.dmp	UPX
behavioral2/files/0x0007000000023455-124.dat	UPX
behavioral2/files/0x0007000000023454-118.dat	UPX
behavioral2/memory/3684-112-0x00007FF69FC90000-0x00007FF69FFE1000-memory.dmp	UPX
behavioral2/memory/4420-110-0x00007FF7A7E00000-0x00007FF7A8151000-memory.dmp	UPX
behavioral2/memory/3160-144-0x00007FF73F010000-0x00007FF73F361000-memory.dmp	UPX
behavioral2/memory/4484-147-0x00007FF70BF80000-0x00007FF70C2D1000-memory.dmp	UPX
behavioral2/memory/3576-145-0x00007FF7EF8B0000-0x00007FF7EFC01000-memory.dmp	UPX
behavioral2/memory/4136-143-0x00007FF6B42C0000-0x00007FF6B4611000-memory.dmp	UPX
behavioral2/memory/4704-142-0x00007FF78CE30000-0x00007FF78D181000-memory.dmp	UPX
behavioral2/memory/4948-141-0x00007FF688680000-0x00007FF6889D1000-memory.dmp	UPX
behavioral2/memory/4192-149-0x00007FF7115C0000-0x00007FF711911000-memory.dmp	UPX
behavioral2/memory/3460-148-0x00007FF72B770000-0x00007FF72BAC1000-memory.dmp	UPX
behavioral2/memory/1368-146-0x00007FF685D90000-0x00007FF6860E1000-memory.dmp	UPX
behavioral2/memory/3644-150-0x00007FF65C700000-0x00007FF65CA51000-memory.dmp	UPX
behavioral2/memory/4420-166-0x00007FF7A7E00000-0x00007FF7A8151000-memory.dmp	UPX
behavioral2/memory/4616-171-0x00007FF6E66F0000-0x00007FF6E6A41000-memory.dmp	UPX
behavioral2/memory/388-168-0x00007FF680990000-0x00007FF680CE1000-memory.dmp	UPX
behavioral2/memory/3684-167-0x00007FF69FC90000-0x00007FF69FFE1000-memory.dmp	UPX
behavioral2/memory/3644-172-0x00007FF65C700000-0x00007FF65CA51000-memory.dmp	UPX

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/1076-20-0x00007FF7E2230000-0x00007FF7E2581000-memory.dmp	xmrig
behavioral2/memory/4064-81-0x00007FF6E4050000-0x00007FF6E43A1000-memory.dmp	xmrig
behavioral2/memory/3644-77-0x00007FF65C700000-0x00007FF65CA51000-memory.dmp	xmrig
behavioral2/memory/3572-97-0x00007FF771B80000-0x00007FF771ED1000-memory.dmp	xmrig
behavioral2/memory/3152-135-0x00007FF62E9C0000-0x00007FF62ED11000-memory.dmp	xmrig
behavioral2/memory/1128-131-0x00007FF70B5E0000-0x00007FF70B931000-memory.dmp	xmrig
behavioral2/memory/4332-130-0x00007FF6C45F0000-0x00007FF6C4941000-memory.dmp	xmrig
behavioral2/memory/1232-126-0x00007FF71A630000-0x00007FF71A981000-memory.dmp	xmrig
behavioral2/memory/1244-125-0x00007FF721A70000-0x00007FF721DC1000-memory.dmp	xmrig
behavioral2/memory/3160-144-0x00007FF73F010000-0x00007FF73F361000-memory.dmp	xmrig
behavioral2/memory/4484-147-0x00007FF70BF80000-0x00007FF70C2D1000-memory.dmp	xmrig
behavioral2/memory/3576-145-0x00007FF7EF8B0000-0x00007FF7EFC01000-memory.dmp	xmrig
behavioral2/memory/4136-143-0x00007FF6B42C0000-0x00007FF6B4611000-memory.dmp	xmrig
behavioral2/memory/4704-142-0x00007FF78CE30000-0x00007FF78D181000-memory.dmp	xmrig
behavioral2/memory/4948-141-0x00007FF688680000-0x00007FF6889D1000-memory.dmp	xmrig
behavioral2/memory/4192-149-0x00007FF7115C0000-0x00007FF711911000-memory.dmp	xmrig
behavioral2/memory/3460-148-0x00007FF72B770000-0x00007FF72BAC1000-memory.dmp	xmrig
behavioral2/memory/1368-146-0x00007FF685D90000-0x00007FF6860E1000-memory.dmp	xmrig
behavioral2/memory/3644-150-0x00007FF65C700000-0x00007FF65CA51000-memory.dmp	xmrig
behavioral2/memory/4420-166-0x00007FF7A7E00000-0x00007FF7A8151000-memory.dmp	xmrig
behavioral2/memory/4616-171-0x00007FF6E66F0000-0x00007FF6E6A41000-memory.dmp	xmrig
behavioral2/memory/388-168-0x00007FF680990000-0x00007FF680CE1000-memory.dmp	xmrig
behavioral2/memory/3684-167-0x00007FF69FC90000-0x00007FF69FFE1000-memory.dmp	xmrig
behavioral2/memory/3644-172-0x00007FF65C700000-0x00007FF65CA51000-memory.dmp	xmrig
behavioral2/memory/4064-199-0x00007FF6E4050000-0x00007FF6E43A1000-memory.dmp	xmrig
behavioral2/memory/3572-201-0x00007FF771B80000-0x00007FF771ED1000-memory.dmp	xmrig
behavioral2/memory/1076-203-0x00007FF7E2230000-0x00007FF7E2581000-memory.dmp	xmrig
behavioral2/memory/1244-205-0x00007FF721A70000-0x00007FF721DC1000-memory.dmp	xmrig
behavioral2/memory/4948-207-0x00007FF688680000-0x00007FF6889D1000-memory.dmp	xmrig
behavioral2/memory/1232-209-0x00007FF71A630000-0x00007FF71A981000-memory.dmp	xmrig
behavioral2/memory/4704-211-0x00007FF78CE30000-0x00007FF78D181000-memory.dmp	xmrig
behavioral2/memory/3152-213-0x00007FF62E9C0000-0x00007FF62ED11000-memory.dmp	xmrig
behavioral2/memory/4136-215-0x00007FF6B42C0000-0x00007FF6B4611000-memory.dmp	xmrig
behavioral2/memory/3160-222-0x00007FF73F010000-0x00007FF73F361000-memory.dmp	xmrig
behavioral2/memory/3576-223-0x00007FF7EF8B0000-0x00007FF7EFC01000-memory.dmp	xmrig
behavioral2/memory/1368-220-0x00007FF685D90000-0x00007FF6860E1000-memory.dmp	xmrig
behavioral2/memory/4484-218-0x00007FF70BF80000-0x00007FF70C2D1000-memory.dmp	xmrig
behavioral2/memory/3460-225-0x00007FF72B770000-0x00007FF72BAC1000-memory.dmp	xmrig
behavioral2/memory/4192-241-0x00007FF7115C0000-0x00007FF711911000-memory.dmp	xmrig
behavioral2/memory/1128-243-0x00007FF70B5E0000-0x00007FF70B931000-memory.dmp	xmrig
behavioral2/memory/3684-245-0x00007FF69FC90000-0x00007FF69FFE1000-memory.dmp	xmrig
behavioral2/memory/4332-248-0x00007FF6C45F0000-0x00007FF6C4941000-memory.dmp	xmrig
behavioral2/memory/4420-249-0x00007FF7A7E00000-0x00007FF7A8151000-memory.dmp	xmrig
behavioral2/memory/388-251-0x00007FF680990000-0x00007FF680CE1000-memory.dmp	xmrig
behavioral2/memory/4616-253-0x00007FF6E66F0000-0x00007FF6E6A41000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4064	JqUYmwT.exe
3572	ksYeQFc.exe
1076	JiZPXLc.exe
1244	mlnzFag.exe
1232	zDkcFel.exe
3152	tXseasa.exe
4948	IgTHLap.exe
4704	jaDySCV.exe
4136	aIGkMWc.exe
3160	iPqokwF.exe
3576	jvpjTSy.exe
1368	fbcgUAO.exe
4484	pvjfNGX.exe
3460	UqCxtYB.exe
4192	SSOIWxe.exe
4420	lxEhfeT.exe
3684	qPBsSAi.exe
388	GqSTibB.exe
4332	jbPGvob.exe
1128	iyvlIFw.exe
4616	VSxeorM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3644-0-0x00007FF65C700000-0x00007FF65CA51000-memory.dmp	upx
behavioral2/files/0x000700000002328e-4.dat	upx
behavioral2/memory/4064-7-0x00007FF6E4050000-0x00007FF6E43A1000-memory.dmp	upx
behavioral2/files/0x0007000000023444-9.dat	upx
behavioral2/memory/3572-13-0x00007FF771B80000-0x00007FF771ED1000-memory.dmp	upx
behavioral2/files/0x0007000000023445-10.dat	upx
behavioral2/memory/1076-20-0x00007FF7E2230000-0x00007FF7E2581000-memory.dmp	upx
behavioral2/files/0x000900000002343d-23.dat	upx
behavioral2/files/0x0007000000023447-31.dat	upx
behavioral2/memory/1232-34-0x00007FF71A630000-0x00007FF71A981000-memory.dmp	upx
behavioral2/memory/3152-38-0x00007FF62E9C0000-0x00007FF62ED11000-memory.dmp	upx
behavioral2/memory/4948-47-0x00007FF688680000-0x00007FF6889D1000-memory.dmp	upx
behavioral2/files/0x000700000002344c-57.dat	upx
behavioral2/files/0x000700000002344e-63.dat	upx
behavioral2/files/0x000700000002344f-74.dat	upx
behavioral2/files/0x0007000000023450-78.dat	upx
behavioral2/memory/3460-84-0x00007FF72B770000-0x00007FF72BAC1000-memory.dmp	upx
behavioral2/memory/4064-81-0x00007FF6E4050000-0x00007FF6E43A1000-memory.dmp	upx
behavioral2/memory/4484-80-0x00007FF70BF80000-0x00007FF70C2D1000-memory.dmp	upx
behavioral2/memory/3644-77-0x00007FF65C700000-0x00007FF65CA51000-memory.dmp	upx
behavioral2/memory/1368-76-0x00007FF685D90000-0x00007FF6860E1000-memory.dmp	upx
behavioral2/memory/4136-70-0x00007FF6B42C0000-0x00007FF6B4611000-memory.dmp	upx
behavioral2/files/0x000700000002344d-67.dat	upx
behavioral2/files/0x000700000002344b-65.dat	upx
behavioral2/memory/3576-64-0x00007FF7EF8B0000-0x00007FF7EFC01000-memory.dmp	upx
behavioral2/memory/3160-59-0x00007FF73F010000-0x00007FF73F361000-memory.dmp	upx
behavioral2/memory/4704-53-0x00007FF78CE30000-0x00007FF78D181000-memory.dmp	upx
behavioral2/files/0x000700000002344a-51.dat	upx
behavioral2/files/0x0007000000023448-45.dat	upx
behavioral2/files/0x0007000000023449-36.dat	upx
behavioral2/memory/1244-26-0x00007FF721A70000-0x00007FF721DC1000-memory.dmp	upx
behavioral2/files/0x0007000000023451-91.dat	upx
behavioral2/memory/3572-97-0x00007FF771B80000-0x00007FF771ED1000-memory.dmp	upx
behavioral2/memory/4192-100-0x00007FF7115C0000-0x00007FF711911000-memory.dmp	upx
behavioral2/files/0x0007000000023453-107.dat	upx
behavioral2/files/0x0007000000023452-114.dat	upx
behavioral2/files/0x0007000000023456-117.dat	upx
behavioral2/files/0x0007000000023457-127.dat	upx
behavioral2/memory/388-129-0x00007FF680990000-0x00007FF680CE1000-memory.dmp	upx
behavioral2/memory/4616-137-0x00007FF6E66F0000-0x00007FF6E6A41000-memory.dmp	upx
behavioral2/memory/3152-135-0x00007FF62E9C0000-0x00007FF62ED11000-memory.dmp	upx
behavioral2/memory/1128-131-0x00007FF70B5E0000-0x00007FF70B931000-memory.dmp	upx
behavioral2/memory/4332-130-0x00007FF6C45F0000-0x00007FF6C4941000-memory.dmp	upx
behavioral2/memory/1232-126-0x00007FF71A630000-0x00007FF71A981000-memory.dmp	upx
behavioral2/memory/1244-125-0x00007FF721A70000-0x00007FF721DC1000-memory.dmp	upx
behavioral2/files/0x0007000000023455-124.dat	upx
behavioral2/files/0x0007000000023454-118.dat	upx
behavioral2/memory/3684-112-0x00007FF69FC90000-0x00007FF69FFE1000-memory.dmp	upx
behavioral2/memory/4420-110-0x00007FF7A7E00000-0x00007FF7A8151000-memory.dmp	upx
behavioral2/memory/3160-144-0x00007FF73F010000-0x00007FF73F361000-memory.dmp	upx
behavioral2/memory/4484-147-0x00007FF70BF80000-0x00007FF70C2D1000-memory.dmp	upx
behavioral2/memory/3576-145-0x00007FF7EF8B0000-0x00007FF7EFC01000-memory.dmp	upx
behavioral2/memory/4136-143-0x00007FF6B42C0000-0x00007FF6B4611000-memory.dmp	upx
behavioral2/memory/4704-142-0x00007FF78CE30000-0x00007FF78D181000-memory.dmp	upx
behavioral2/memory/4948-141-0x00007FF688680000-0x00007FF6889D1000-memory.dmp	upx
behavioral2/memory/4192-149-0x00007FF7115C0000-0x00007FF711911000-memory.dmp	upx
behavioral2/memory/3460-148-0x00007FF72B770000-0x00007FF72BAC1000-memory.dmp	upx
behavioral2/memory/1368-146-0x00007FF685D90000-0x00007FF6860E1000-memory.dmp	upx
behavioral2/memory/3644-150-0x00007FF65C700000-0x00007FF65CA51000-memory.dmp	upx
behavioral2/memory/4420-166-0x00007FF7A7E00000-0x00007FF7A8151000-memory.dmp	upx
behavioral2/memory/4616-171-0x00007FF6E66F0000-0x00007FF6E6A41000-memory.dmp	upx
behavioral2/memory/388-168-0x00007FF680990000-0x00007FF680CE1000-memory.dmp	upx
behavioral2/memory/3684-167-0x00007FF69FC90000-0x00007FF69FFE1000-memory.dmp	upx
behavioral2/memory/3644-172-0x00007FF65C700000-0x00007FF65CA51000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\pvjfNGX.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UqCxtYB.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JqUYmwT.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mlnzFag.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zDkcFel.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aIGkMWc.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fbcgUAO.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jaDySCV.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SSOIWxe.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lxEhfeT.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GqSTibB.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iyvlIFw.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JiZPXLc.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IgTHLap.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jvpjTSy.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VSxeorM.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ksYeQFc.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tXseasa.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iPqokwF.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qPBsSAi.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jbPGvob.exe	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 4064	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	84
PID 3644 wrote to memory of 4064	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	84
PID 3644 wrote to memory of 3572	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	85
PID 3644 wrote to memory of 3572	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	85
PID 3644 wrote to memory of 1076	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	86
PID 3644 wrote to memory of 1076	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	86
PID 3644 wrote to memory of 1244	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	87
PID 3644 wrote to memory of 1244	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	87
PID 3644 wrote to memory of 1232	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	88
PID 3644 wrote to memory of 1232	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	88
PID 3644 wrote to memory of 3152	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	89
PID 3644 wrote to memory of 3152	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	89
PID 3644 wrote to memory of 4948	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	90
PID 3644 wrote to memory of 4948	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	90
PID 3644 wrote to memory of 4704	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	91
PID 3644 wrote to memory of 4704	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	91
PID 3644 wrote to memory of 4136	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	92
PID 3644 wrote to memory of 4136	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	92
PID 3644 wrote to memory of 3160	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	93
PID 3644 wrote to memory of 3160	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	93
PID 3644 wrote to memory of 3576	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	94
PID 3644 wrote to memory of 3576	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	94
PID 3644 wrote to memory of 1368	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	95
PID 3644 wrote to memory of 1368	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	95
PID 3644 wrote to memory of 4484	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	96
PID 3644 wrote to memory of 4484	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	96
PID 3644 wrote to memory of 3460	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	97
PID 3644 wrote to memory of 3460	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	97
PID 3644 wrote to memory of 4192	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	98
PID 3644 wrote to memory of 4192	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	98
PID 3644 wrote to memory of 4420	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	99
PID 3644 wrote to memory of 4420	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	99
PID 3644 wrote to memory of 3684	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	100
PID 3644 wrote to memory of 3684	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	100
PID 3644 wrote to memory of 388	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	101
PID 3644 wrote to memory of 388	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	101
PID 3644 wrote to memory of 4332	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	102
PID 3644 wrote to memory of 4332	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	102
PID 3644 wrote to memory of 1128	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	103
PID 3644 wrote to memory of 1128	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	103
PID 3644 wrote to memory of 4616	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	104
PID 3644 wrote to memory of 4616	3644	2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe	104

C:\Users\Admin\AppData\Local\Temp\2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_f4132317beb8f4efb954ff525c88ebe3_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Windows\System\JqUYmwT.exe
  C:\Windows\System\JqUYmwT.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\ksYeQFc.exe
  C:\Windows\System\ksYeQFc.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\JiZPXLc.exe
  C:\Windows\System\JiZPXLc.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\mlnzFag.exe
  C:\Windows\System\mlnzFag.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\zDkcFel.exe
  C:\Windows\System\zDkcFel.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\tXseasa.exe
  C:\Windows\System\tXseasa.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\IgTHLap.exe
  C:\Windows\System\IgTHLap.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\jaDySCV.exe
  C:\Windows\System\jaDySCV.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\aIGkMWc.exe
  C:\Windows\System\aIGkMWc.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\iPqokwF.exe
  C:\Windows\System\iPqokwF.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\jvpjTSy.exe
  C:\Windows\System\jvpjTSy.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\fbcgUAO.exe
  C:\Windows\System\fbcgUAO.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\pvjfNGX.exe
  C:\Windows\System\pvjfNGX.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\UqCxtYB.exe
  C:\Windows\System\UqCxtYB.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\SSOIWxe.exe
  C:\Windows\System\SSOIWxe.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\lxEhfeT.exe
  C:\Windows\System\lxEhfeT.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\qPBsSAi.exe
  C:\Windows\System\qPBsSAi.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\GqSTibB.exe
  C:\Windows\System\GqSTibB.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\jbPGvob.exe
  C:\Windows\System\jbPGvob.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\iyvlIFw.exe
  C:\Windows\System\iyvlIFw.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\VSxeorM.exe
  C:\Windows\System\VSxeorM.exe
  2⤵
  - Executes dropped EXE
  PID:4616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

GqSTibB.exe

Path C:\Windows\System\GqSTibB.exe
Size 5.2MB
SHA256 3c8db31eaaa1e2034d42db5fc70de1e970d03406b77858938c297743fc4f029c
MD5 05f2dcd5568f746bc4cc1a971fc54930
SHA1 c8dbe81d117de41c627096030a188086c815232e
SHA512 b535e8397af0bf319355261e4b500ce4c1c25ea1a57ea5e1c2cecf9d664f9afbff6b4a05de823a5cc7799193de61e940a1b9e582cc7da4a50c76568bfcca7828
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lt:RWWBibf56utgpPFotBER/mQ32lUR
MD5 SHA1 SHA512 SSDEEP

Submit Download

IgTHLap.exe

Path C:\Windows\System\IgTHLap.exe
Size 5.2MB
SHA256 00c9dfbb9a9fe54a70ca63f6bd27be27095a89fbd2731ac189755385fbdb37d2
MD5 9b039a407a882a85407246492345a215
SHA1 7826898abe402ebc57e86a0753521b1c62eec8b3
SHA512 e126336d889db4e7b907e58107c5bb8230d9daa60b1e388c187dd1884427768a2ba303580b91addb9db1caa0867ef732c22973c5cfd03ffdc91a42fcae04c149
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibf56utgpPFotBER/mQ32lUa
MD5 SHA1 SHA512 SSDEEP

Submit Download

JiZPXLc.exe

Path C:\Windows\System\JiZPXLc.exe
Size 5.2MB
SHA256 1e260c77683a2302e688e2bbe7b1c287288b1a8018ac29f3c9a3bf0c4304f3f4
MD5 eb5c61ed6048754d960af357ef3341c7
SHA1 ff082fa1a8edcf5e7f37984d60d98daa7a66fd20
SHA512 88711c773a07d7d3694b47905e9f0a930a7a35688d117015f1a6a68c66c49a36a56c19eb7762b46d22f1316e8122f351a79ec73334ded726db7d9fbe258c64f7
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l8:RWWBibf56utgpPFotBER/mQ32lUw
MD5 SHA1 SHA512 SSDEEP

Submit Download

JqUYmwT.exe

Path C:\Windows\System\JqUYmwT.exe
Size 5.2MB
SHA256 54c7e10cf9c84b325cc684862f82014f69cf70c77a741c53b25bdd0695a6f783
MD5 a510ac87e26677432a4893a5f46f36fa
SHA1 61443810bfbdf06629f59855ed07ae0ff0ba9352
SHA512 7ac8882ea8574235b210344e3fe09651a9a1c017c02866a9c7325b7c823c54bd1c1aaeb0377d2b7609adced865d761a033d16d70a7a1aa9bd5cd8cbda2837e7e
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l2:RWWBibf56utgpPFotBER/mQ32lUq
MD5 SHA1 SHA512 SSDEEP

Submit Download

SSOIWxe.exe

Path C:\Windows\System\SSOIWxe.exe
Size 5.2MB
SHA256 cc6bf2ad7203e994aeaa134aaa77c48b7da966182099e04d850578d199f94536
MD5 747685c1cbdb3fc3a23a8e7c476af846
SHA1 2d7cfb9a1f41f92fc8739f4ce9ca8ea2a4a16f77
SHA512 97850fdccb8b00b6115084b4771152820eb3843a5972abbe28cdd4b23f50962ca71b05c7ac9ec8b7fa85ee1ce198909c1b13ca766b97f71d4249db1786767294
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibf56utgpPFotBER/mQ32lUe
MD5 SHA1 SHA512 SSDEEP

Submit Download

UqCxtYB.exe

Path C:\Windows\System\UqCxtYB.exe
Size 5.2MB
SHA256 be9dc8883c9f60cd443f5b9f5f2ee683d0c32e6911d68d9a6a60c8849fe598dd
MD5 427db6afc288c85ca6ef9d4801b86852
SHA1 f8d70768e71ead2aafad54512b458a60c3357d03
SHA512 d0468e8a92a245071cbd5ad98328621f6f37a5b722af413615f9503b5d9fd4247575ce27aa5a18a125902db9c62e7a846e273fafd9ae9a5b992c71eb03aed1f2
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lU:RWWBibf56utgpPFotBER/mQ32lUA
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSxeorM.exe

Path C:\Windows\System\VSxeorM.exe
Size 5.2MB
SHA256 666f2d7eb929d94a96908723413d44f5e1f7454c9f84e195dc9b93255cbfa009
MD5 e5526803301ae36809fa63e9afefcd42
SHA1 34764bcb458b15316b33d77780ddc0290795df8e
SHA512 74002e53ae600ce4811c0b52fe1922fb11dbae94b30d076166b71fce9edf22cd242dd0ffd02c8a3fdaa735ec1e60d240de13f9ac715c99764c11db659859e9e0
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lT:RWWBibf56utgpPFotBER/mQ32lUP
MD5 SHA1 SHA512 SSDEEP

Submit Download

aIGkMWc.exe

Path C:\Windows\System\aIGkMWc.exe
Size 5.2MB
SHA256 51e1359e38ac150212d8f3bf7ae5c8a0598a56516f365e09d13059722f7cc00d
MD5 f592f201df8320457cf27cce8559cebf
SHA1 5b46cab621c4e35adaea2f2088fc9b1d1209bbb7
SHA512 1b69e62f96bcfc5b87c629c8f85827a338524afac283b0df9e02f747b4fda1c1d93e8fdb106f7c06c26336b5c6baa530d330a0d9278961c12316b3a5006a74e5
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lr:RWWBibf56utgpPFotBER/mQ32lUf
MD5 SHA1 SHA512 SSDEEP

Submit Download

fbcgUAO.exe

Path C:\Windows\System\fbcgUAO.exe
Size 5.2MB
SHA256 dda00193df0157e917cb1b0109307726dd0354960859ce1b2b546ca421c7b13e
MD5 6385217f644bed3b53a35480060c0807
SHA1 00d06ed50c4a09a760c3cdf0108c61525fc4ede3
SHA512 e0ddbbba8a8236ee797a812f781bd286fc6b5d4f894f28760c94fc7d8e6905000c509ae57ec598b50a4a340b657a762a3d5a3517e6ade1541572c93311e45f04
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibf56utgpPFotBER/mQ32lUE
MD5 SHA1 SHA512 SSDEEP

Submit Download

iPqokwF.exe

Path C:\Windows\System\iPqokwF.exe
Size 5.2MB
SHA256 735a1859d5da5b4745fc725958f9302c4d47e3682943ed7593a2e00e9e3a245f
MD5 108584c42f53524f2268eb56714a2a45
SHA1 288c426e6801a2c77c418f7f0a2723c037c5470f
SHA512 f7612bd8b24f4e73a7a89c18766a595947cc5d06c86024536a501fcdc9dae157a1451eaace1ea1ea883e523d8f9d903ae1d866c9f4e2d5a5976288d16ecf4f54
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUw
MD5 SHA1 SHA512 SSDEEP

Submit Download

iyvlIFw.exe

Path C:\Windows\System\iyvlIFw.exe
Size 5.2MB
SHA256 ab74a55813dfde90b630c6867b08a71c0ef4bd9a354165aa7ab4d13ef4b6aace
MD5 a839440b34a3e7a208d415ea1720c638
SHA1 5b29d49b86390f1540014b414fa4bf3533c8abb2
SHA512 fb5c9ca59e42ed31343ce9d92856d1378a8bab22c58fb31af4d910e91676420d6794afb1a427b4e939409723f76b02c86525f914d7b7ebbf9838d142ce6bb96e
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibf56utgpPFotBER/mQ32lUt
MD5 SHA1 SHA512 SSDEEP

Submit Download

jaDySCV.exe

Path C:\Windows\System\jaDySCV.exe
Size 5.2MB
SHA256 d5bd27f9ebf94182ff615bb4c86cbd41b7ab15ab931861b7d0870657e90c3eab
MD5 7fc2f09c11632af04cad85e61b76dde4
SHA1 7e7e8938a2170831c1f08767bba839d78896e55d
SHA512 2bcdf50eabe7c2a740f2f5d427c4dd711fbe8a38dfd9e65cf05292ecd7b7f9836c1a1aacc1716418e797378de03b589313614de1e5c2a7efc0c46753568bd55f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lj:RWWBibf56utgpPFotBER/mQ32lUv
MD5 SHA1 SHA512 SSDEEP

Submit Download

jbPGvob.exe

Path C:\Windows\System\jbPGvob.exe
Size 5.2MB
SHA256 eceda88da5fab1b689e67a3163483cdfc5daf209af674eb95d7562c06c3fe0dd
MD5 b38b99d93041d2d19301f342505401e9
SHA1 acf2c10b776fb7544bb5a819b088535f3e433853
SHA512 98a0bc7ed3fde5fbe7a0f479b17e9ee25c787381fb9be65878245c0da966c9e5e6071a5fff60dced54dd00c8e5c04dc98f9f592f0b91d7857b81b87ceb0438d1
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibf56utgpPFotBER/mQ32lU+
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvpjTSy.exe

Path C:\Windows\System\jvpjTSy.exe
Size 5.2MB
SHA256 fc37144a03dd07d10fbf6cfba45a98bc52d5d89c484a6909317ce1d9e4638174
MD5 6525b1dd4402af03dd27239e1d1d1d23
SHA1 ae3ae40475032664a0e7e42f4c577db3b49dfa5e
SHA512 6c1e1a7e25d21652c0788a5da502da5f39db94b14f9644a1895b36fb711a31eafbdf2a94fc07d6f363b402f45fa47f4c033a9ce02c760c7415e8addfbf5036d4
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibf56utgpPFotBER/mQ32lUz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ksYeQFc.exe

Path C:\Windows\System\ksYeQFc.exe
Size 5.2MB
SHA256 9158ac2303bbbf0cb3e79a7147e91d7ee51561d9c8160d0dc27a62f3f5645622
MD5 b9bd7e5c372b22a65688b0c88b8515e4
SHA1 777496900c53665da33dd56fcec23eb32a7fc3be
SHA512 c7138426ef9f5275b287835d5e44a6e5f0370e644bc2f663c1ce1234b0e4bfbac0ea53d916a938c01bce926ab71831d22298e2253764d6f7bd8764a5daaff72e
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lK:RWWBibf56utgpPFotBER/mQ32lUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

lxEhfeT.exe

Path C:\Windows\System\lxEhfeT.exe
Size 5.2MB
SHA256 3ab385cdf90832f2d94112e040527a9228b9d4331aeafef650f324e1c54441f3
MD5 aa815adb73647094728cf85685c4ba06
SHA1 338da010c2be33c71f3ffd9d15887e6c590a81ba
SHA512 b675acdb2cea8d12b3a0e12a88417cf6dc6c3179c71de76fe241b76f5a2dcf9e2e14424fcc9b9d317f42f716ae485dd8596420b9bbf94457c4c82781d30d8ccf
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibf56utgpPFotBER/mQ32lUF
MD5 SHA1 SHA512 SSDEEP

Submit Download

mlnzFag.exe

Path C:\Windows\System\mlnzFag.exe
Size 5.2MB
SHA256 7b33c486be74efbe5b093af09ac757b04ff5d5970d02757bcd48d08e6562aed1
MD5 1e62a9e64c955ce5b51bc41d6b64203d
SHA1 4e6843de7e30158b7cc6bda4836a401555c93af9
SHA512 c99e97a7e3dddf6fa4af2a943607b408285d6c9bd1536bd78c25c9caa799ec7da1da2675a93b071640610d6b8c2fa6e3d7e11dcae81aa73e53a220ca85613593
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lV:RWWBibf56utgpPFotBER/mQ32lUZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

pvjfNGX.exe

Path C:\Windows\System\pvjfNGX.exe
Size 5.2MB
SHA256 e254c11178cabaed521c6e35d4e252e95bdd0c1c63d7d8650f9fc72543d03aef
MD5 5e2d0e770d41cb366f3ad3a6ae5ed5f2
SHA1 46e4660f4d3f6b4ec79b28efdfd89c6651a7fd06
SHA512 de2929b56bbcce10b3adfa0ae8a07d0f0f79d7b87b85f3fc1a61248387aad0475a65b37591bfa2e2448debb7f058ec3ea5cf0bb12b80ac8a701ec42a957c82ef
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lk:RWWBibf56utgpPFotBER/mQ32lU4
MD5 SHA1 SHA512 SSDEEP

Submit Download

qPBsSAi.exe

Path C:\Windows\System\qPBsSAi.exe
Size 5.2MB
SHA256 a0cb732748dd8757a783578236942d2132b4626fd1aa4563c760cf7e9d912c2b
MD5 4e907150d4a761187ab870de3f7bc850
SHA1 1d6cf3ce449b9e0f138de8c158cf1020593ca9c8
SHA512 438ae9c668f529ca50d36caf5eefe6e357a576aa28855cf940e5f4bd27d1c5ba4f052e0ab7e3baa398d0023d1475153f73fc5e5ebb48a8f77a9782189f74173d
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lT:RWWBibf56utgpPFotBER/mQ32lUf
MD5 SHA1 SHA512 SSDEEP

Submit Download

tXseasa.exe

Path C:\Windows\System\tXseasa.exe
Size 5.2MB
SHA256 ac088253bfa382388078b09b3e22ab3d80bd0a1777b85299b271b02f262a5f48
MD5 7d1b648bad8cc0026bc74996b91ce2b1
SHA1 72dca2f38b77d5223574e7330b32cdf342861229
SHA512 7e15236c101f505988ef56a7c6e22886dd0722f9da9a1396ab6dfc681ab86769dd4a6c3e486e53e52bbe78798925501f2c02b447f60715d0c8c1f8645cc85efc
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibf56utgpPFotBER/mQ32lUN
MD5 SHA1 SHA512 SSDEEP

Submit Download

zDkcFel.exe

Path C:\Windows\System\zDkcFel.exe
Size 5.2MB
SHA256 de2daea0ee1e886c07ce325bbefc0502ba1a8af2b6baf1838e40164692e9706d
MD5 3295e352b37f302676965b678acce6f1
SHA1 0fe42b4cccaba8a071307c277f7b6c662d6b393b
SHA512 fb88d44f2df2ac8ac854d534a409e806ecdc19eedd7347f020a6a5063ded88304946e248c41db718b6b629a9b03a0df6398dacdcb283da423fbd5fff23a027b8
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lK:RWWBibf56utgpPFotBER/mQ32lU2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/388-129-0x00007FF680990000-0x00007FF680CE1000-memory.dmp

Download

memory/388-168-0x00007FF680990000-0x00007FF680CE1000-memory.dmp

Download

memory/388-251-0x00007FF680990000-0x00007FF680CE1000-memory.dmp

Download

memory/1076-203-0x00007FF7E2230000-0x00007FF7E2581000-memory.dmp

Download

memory/1076-20-0x00007FF7E2230000-0x00007FF7E2581000-memory.dmp

Download

memory/1128-243-0x00007FF70B5E0000-0x00007FF70B931000-memory.dmp

Download

memory/1128-131-0x00007FF70B5E0000-0x00007FF70B931000-memory.dmp

Download

memory/1232-209-0x00007FF71A630000-0x00007FF71A981000-memory.dmp

Download

memory/1232-126-0x00007FF71A630000-0x00007FF71A981000-memory.dmp

Download

memory/1232-34-0x00007FF71A630000-0x00007FF71A981000-memory.dmp

Download

memory/1244-205-0x00007FF721A70000-0x00007FF721DC1000-memory.dmp

Download

memory/1244-125-0x00007FF721A70000-0x00007FF721DC1000-memory.dmp

Download

memory/1244-26-0x00007FF721A70000-0x00007FF721DC1000-memory.dmp

Download

memory/1368-220-0x00007FF685D90000-0x00007FF6860E1000-memory.dmp

Download

memory/1368-146-0x00007FF685D90000-0x00007FF6860E1000-memory.dmp

Download

memory/1368-76-0x00007FF685D90000-0x00007FF6860E1000-memory.dmp

Download

memory/3152-135-0x00007FF62E9C0000-0x00007FF62ED11000-memory.dmp

Download

memory/3152-213-0x00007FF62E9C0000-0x00007FF62ED11000-memory.dmp

Download

memory/3152-38-0x00007FF62E9C0000-0x00007FF62ED11000-memory.dmp

Download

memory/3160-222-0x00007FF73F010000-0x00007FF73F361000-memory.dmp

Download

memory/3160-144-0x00007FF73F010000-0x00007FF73F361000-memory.dmp

Download

memory/3160-59-0x00007FF73F010000-0x00007FF73F361000-memory.dmp

Download

memory/3460-148-0x00007FF72B770000-0x00007FF72BAC1000-memory.dmp

Download

memory/3460-225-0x00007FF72B770000-0x00007FF72BAC1000-memory.dmp

Download

memory/3460-84-0x00007FF72B770000-0x00007FF72BAC1000-memory.dmp

Download

memory/3572-201-0x00007FF771B80000-0x00007FF771ED1000-memory.dmp

Download

memory/3572-13-0x00007FF771B80000-0x00007FF771ED1000-memory.dmp

Download

memory/3572-97-0x00007FF771B80000-0x00007FF771ED1000-memory.dmp

Download

memory/3576-64-0x00007FF7EF8B0000-0x00007FF7EFC01000-memory.dmp

Download

memory/3576-223-0x00007FF7EF8B0000-0x00007FF7EFC01000-memory.dmp

Download

memory/3576-145-0x00007FF7EF8B0000-0x00007FF7EFC01000-memory.dmp

Download

memory/3644-77-0x00007FF65C700000-0x00007FF65CA51000-memory.dmp

Download

memory/3644-1-0x000002391E1C0000-0x000002391E1D0000-memory.dmp

Download

memory/3644-0-0x00007FF65C700000-0x00007FF65CA51000-memory.dmp

Download

memory/3644-172-0x00007FF65C700000-0x00007FF65CA51000-memory.dmp

Download

memory/3644-150-0x00007FF65C700000-0x00007FF65CA51000-memory.dmp

Download

memory/3684-112-0x00007FF69FC90000-0x00007FF69FFE1000-memory.dmp

Download

memory/3684-245-0x00007FF69FC90000-0x00007FF69FFE1000-memory.dmp

Download

memory/3684-167-0x00007FF69FC90000-0x00007FF69FFE1000-memory.dmp

Download

memory/4064-199-0x00007FF6E4050000-0x00007FF6E43A1000-memory.dmp

Download

memory/4064-81-0x00007FF6E4050000-0x00007FF6E43A1000-memory.dmp

Download

memory/4064-7-0x00007FF6E4050000-0x00007FF6E43A1000-memory.dmp

Download

memory/4136-143-0x00007FF6B42C0000-0x00007FF6B4611000-memory.dmp

Download

memory/4136-215-0x00007FF6B42C0000-0x00007FF6B4611000-memory.dmp

Download

memory/4136-70-0x00007FF6B42C0000-0x00007FF6B4611000-memory.dmp

Download

memory/4192-149-0x00007FF7115C0000-0x00007FF711911000-memory.dmp

Download

memory/4192-100-0x00007FF7115C0000-0x00007FF711911000-memory.dmp

Download

memory/4192-241-0x00007FF7115C0000-0x00007FF711911000-memory.dmp

Download

memory/4332-248-0x00007FF6C45F0000-0x00007FF6C4941000-memory.dmp

Download

memory/4332-130-0x00007FF6C45F0000-0x00007FF6C4941000-memory.dmp

Download

memory/4420-110-0x00007FF7A7E00000-0x00007FF7A8151000-memory.dmp

Download

memory/4420-249-0x00007FF7A7E00000-0x00007FF7A8151000-memory.dmp

Download

memory/4420-166-0x00007FF7A7E00000-0x00007FF7A8151000-memory.dmp

Download

memory/4484-218-0x00007FF70BF80000-0x00007FF70C2D1000-memory.dmp

Download

memory/4484-147-0x00007FF70BF80000-0x00007FF70C2D1000-memory.dmp

Download

memory/4484-80-0x00007FF70BF80000-0x00007FF70C2D1000-memory.dmp

Download

memory/4616-171-0x00007FF6E66F0000-0x00007FF6E6A41000-memory.dmp

Download

memory/4616-137-0x00007FF6E66F0000-0x00007FF6E6A41000-memory.dmp

Download

memory/4616-253-0x00007FF6E66F0000-0x00007FF6E6A41000-memory.dmp

Download

memory/4704-211-0x00007FF78CE30000-0x00007FF78D181000-memory.dmp

Download

memory/4704-53-0x00007FF78CE30000-0x00007FF78D181000-memory.dmp

Download

memory/4704-142-0x00007FF78CE30000-0x00007FF78D181000-memory.dmp

Download

memory/4948-47-0x00007FF688680000-0x00007FF6889D1000-memory.dmp

Download

memory/4948-207-0x00007FF688680000-0x00007FF6889D1000-memory.dmp

Download

memory/4948-141-0x00007FF688680000-0x00007FF6889D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads