cobaltstrike | 6ab2aaad508b8ccf96101fdbcee0f6fb02b6d33b292a2da73c5834b943bcd690

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 02:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
Size 5.2MB
Sample240527-cjhdcsce2y
SHA256 6ab2aaad508b8ccf96101fdbcee0f6fb02b6d33b292a2da73c5834b943bcd690
MD5 dbdb46463a64e885d36daf22f44f3e93
SHA1 f12c2816d4f10dd753fbc71d793e10898db05402
SHA512 372c61846e21d59c2767de713ccb3a6d8cb85ad71d0f661a716163d118afb77b9f0e222aa9d318cfadb1c36c0a314913d0d7a16bac01d28c5c776e74dbffbc90
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lG:RWWBibf56utgpPFotBER/mQ32lUq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023257-5.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002325c-12.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002325d-10.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002325e-24.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002325a-28.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023260-36.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023261-42.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023262-47.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023263-52.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023264-57.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023265-62.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023266-67.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023267-71.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023268-77.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023269-81.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326a-87.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326b-92.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326c-97.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326d-102.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326e-112.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326f-124.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023257-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002325c-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002325d-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002325e-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002325a-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023260-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023261-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023262-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023263-52.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023264-57.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023265-62.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023266-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023267-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023268-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023269-81.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326a-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326b-92.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326c-97.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326d-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326e-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326f-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/824-0-0x00007FF782E40000-0x00007FF783191000-memory.dmp	UPX
behavioral2/files/0x0008000000023257-5.dat	UPX
behavioral2/memory/2128-7-0x00007FF7FAC40000-0x00007FF7FAF91000-memory.dmp	UPX
behavioral2/files/0x000800000002325c-12.dat	UPX
behavioral2/files/0x000700000002325d-10.dat	UPX
behavioral2/memory/3264-14-0x00007FF75FF20000-0x00007FF760271000-memory.dmp	UPX
behavioral2/memory/1920-18-0x00007FF705220000-0x00007FF705571000-memory.dmp	UPX
behavioral2/files/0x000700000002325e-24.dat	UPX
behavioral2/memory/2612-26-0x00007FF681A90000-0x00007FF681DE1000-memory.dmp	UPX
behavioral2/files/0x000800000002325a-28.dat	UPX
behavioral2/memory/2352-29-0x00007FF745450000-0x00007FF7457A1000-memory.dmp	UPX
behavioral2/files/0x0007000000023260-36.dat	UPX
behavioral2/memory/4668-38-0x00007FF7CE970000-0x00007FF7CECC1000-memory.dmp	UPX
behavioral2/files/0x0007000000023261-42.dat	UPX
behavioral2/files/0x0007000000023262-47.dat	UPX
behavioral2/files/0x0007000000023263-52.dat	UPX
behavioral2/files/0x0007000000023264-57.dat	UPX
behavioral2/files/0x0007000000023265-62.dat	UPX
behavioral2/files/0x0007000000023266-67.dat	UPX
behavioral2/files/0x0007000000023267-71.dat	UPX
behavioral2/files/0x0007000000023268-77.dat	UPX
behavioral2/files/0x0007000000023269-81.dat	UPX
behavioral2/files/0x000700000002326a-87.dat	UPX
behavioral2/files/0x000700000002326b-92.dat	UPX
behavioral2/files/0x000700000002326c-97.dat	UPX
behavioral2/files/0x000700000002326d-102.dat	UPX
behavioral2/memory/3084-104-0x00007FF645450000-0x00007FF6457A1000-memory.dmp	UPX
behavioral2/memory/2928-110-0x00007FF6606F0000-0x00007FF660A41000-memory.dmp	UPX
behavioral2/memory/3652-114-0x00007FF7EC910000-0x00007FF7ECC61000-memory.dmp	UPX
behavioral2/memory/684-118-0x00007FF708AA0000-0x00007FF708DF1000-memory.dmp	UPX
behavioral2/memory/3544-121-0x00007FF6553F0000-0x00007FF655741000-memory.dmp	UPX
behavioral2/memory/4636-122-0x00007FF6E8740000-0x00007FF6E8A91000-memory.dmp	UPX
behavioral2/memory/4500-120-0x00007FF7025D0000-0x00007FF702921000-memory.dmp	UPX
behavioral2/memory/1988-119-0x00007FF7108B0000-0x00007FF710C01000-memory.dmp	UPX
behavioral2/memory/1336-117-0x00007FF7E9B30000-0x00007FF7E9E81000-memory.dmp	UPX
behavioral2/memory/1292-116-0x00007FF796010000-0x00007FF796361000-memory.dmp	UPX
behavioral2/memory/1136-115-0x00007FF7B1290000-0x00007FF7B15E1000-memory.dmp	UPX
behavioral2/files/0x000700000002326e-112.dat	UPX
behavioral2/memory/644-111-0x00007FF76E1F0000-0x00007FF76E541000-memory.dmp	UPX
behavioral2/memory/2112-109-0x00007FF7D2F10000-0x00007FF7D3261000-memory.dmp	UPX
behavioral2/memory/1636-107-0x00007FF694690000-0x00007FF6949E1000-memory.dmp	UPX
behavioral2/files/0x000700000002326f-124.dat	UPX
behavioral2/memory/1920-130-0x00007FF705220000-0x00007FF705571000-memory.dmp	UPX
behavioral2/memory/2128-126-0x00007FF7FAC40000-0x00007FF7FAF91000-memory.dmp	UPX
behavioral2/memory/824-125-0x00007FF782E40000-0x00007FF783191000-memory.dmp	UPX
behavioral2/memory/2352-132-0x00007FF745450000-0x00007FF7457A1000-memory.dmp	UPX
behavioral2/memory/924-143-0x00007FF7B7DB0000-0x00007FF7B8101000-memory.dmp	UPX
behavioral2/memory/824-150-0x00007FF782E40000-0x00007FF783191000-memory.dmp	UPX
behavioral2/memory/824-151-0x00007FF782E40000-0x00007FF783191000-memory.dmp	UPX
behavioral2/memory/2128-201-0x00007FF7FAC40000-0x00007FF7FAF91000-memory.dmp	UPX
behavioral2/memory/3264-203-0x00007FF75FF20000-0x00007FF760271000-memory.dmp	UPX
behavioral2/memory/1920-205-0x00007FF705220000-0x00007FF705571000-memory.dmp	UPX
behavioral2/memory/2612-207-0x00007FF681A90000-0x00007FF681DE1000-memory.dmp	UPX
behavioral2/memory/2352-209-0x00007FF745450000-0x00007FF7457A1000-memory.dmp	UPX
behavioral2/memory/4668-211-0x00007FF7CE970000-0x00007FF7CECC1000-memory.dmp	UPX
behavioral2/memory/3084-216-0x00007FF645450000-0x00007FF6457A1000-memory.dmp	UPX
behavioral2/memory/1636-218-0x00007FF694690000-0x00007FF6949E1000-memory.dmp	UPX
behavioral2/memory/2112-220-0x00007FF7D2F10000-0x00007FF7D3261000-memory.dmp	UPX
behavioral2/memory/2928-222-0x00007FF6606F0000-0x00007FF660A41000-memory.dmp	UPX
behavioral2/memory/644-224-0x00007FF76E1F0000-0x00007FF76E541000-memory.dmp	UPX
behavioral2/memory/3652-226-0x00007FF7EC910000-0x00007FF7ECC61000-memory.dmp	UPX
behavioral2/memory/1136-228-0x00007FF7B1290000-0x00007FF7B15E1000-memory.dmp	UPX
behavioral2/memory/1292-230-0x00007FF796010000-0x00007FF796361000-memory.dmp	UPX
behavioral2/memory/1336-232-0x00007FF7E9B30000-0x00007FF7E9E81000-memory.dmp	UPX

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/3264-14-0x00007FF75FF20000-0x00007FF760271000-memory.dmp	xmrig
behavioral2/memory/2612-26-0x00007FF681A90000-0x00007FF681DE1000-memory.dmp	xmrig
behavioral2/memory/4668-38-0x00007FF7CE970000-0x00007FF7CECC1000-memory.dmp	xmrig
behavioral2/memory/3084-104-0x00007FF645450000-0x00007FF6457A1000-memory.dmp	xmrig
behavioral2/memory/2928-110-0x00007FF6606F0000-0x00007FF660A41000-memory.dmp	xmrig
behavioral2/memory/3652-114-0x00007FF7EC910000-0x00007FF7ECC61000-memory.dmp	xmrig
behavioral2/memory/684-118-0x00007FF708AA0000-0x00007FF708DF1000-memory.dmp	xmrig
behavioral2/memory/3544-121-0x00007FF6553F0000-0x00007FF655741000-memory.dmp	xmrig
behavioral2/memory/4636-122-0x00007FF6E8740000-0x00007FF6E8A91000-memory.dmp	xmrig
behavioral2/memory/4500-120-0x00007FF7025D0000-0x00007FF702921000-memory.dmp	xmrig
behavioral2/memory/1988-119-0x00007FF7108B0000-0x00007FF710C01000-memory.dmp	xmrig
behavioral2/memory/1336-117-0x00007FF7E9B30000-0x00007FF7E9E81000-memory.dmp	xmrig
behavioral2/memory/1292-116-0x00007FF796010000-0x00007FF796361000-memory.dmp	xmrig
behavioral2/memory/1136-115-0x00007FF7B1290000-0x00007FF7B15E1000-memory.dmp	xmrig
behavioral2/memory/644-111-0x00007FF76E1F0000-0x00007FF76E541000-memory.dmp	xmrig
behavioral2/memory/2112-109-0x00007FF7D2F10000-0x00007FF7D3261000-memory.dmp	xmrig
behavioral2/memory/1636-107-0x00007FF694690000-0x00007FF6949E1000-memory.dmp	xmrig
behavioral2/memory/1920-130-0x00007FF705220000-0x00007FF705571000-memory.dmp	xmrig
behavioral2/memory/2128-126-0x00007FF7FAC40000-0x00007FF7FAF91000-memory.dmp	xmrig
behavioral2/memory/824-125-0x00007FF782E40000-0x00007FF783191000-memory.dmp	xmrig
behavioral2/memory/2352-132-0x00007FF745450000-0x00007FF7457A1000-memory.dmp	xmrig
behavioral2/memory/924-143-0x00007FF7B7DB0000-0x00007FF7B8101000-memory.dmp	xmrig
behavioral2/memory/824-150-0x00007FF782E40000-0x00007FF783191000-memory.dmp	xmrig
behavioral2/memory/824-151-0x00007FF782E40000-0x00007FF783191000-memory.dmp	xmrig
behavioral2/memory/2128-201-0x00007FF7FAC40000-0x00007FF7FAF91000-memory.dmp	xmrig
behavioral2/memory/3264-203-0x00007FF75FF20000-0x00007FF760271000-memory.dmp	xmrig
behavioral2/memory/1920-205-0x00007FF705220000-0x00007FF705571000-memory.dmp	xmrig
behavioral2/memory/2612-207-0x00007FF681A90000-0x00007FF681DE1000-memory.dmp	xmrig
behavioral2/memory/2352-209-0x00007FF745450000-0x00007FF7457A1000-memory.dmp	xmrig
behavioral2/memory/4668-211-0x00007FF7CE970000-0x00007FF7CECC1000-memory.dmp	xmrig
behavioral2/memory/3084-216-0x00007FF645450000-0x00007FF6457A1000-memory.dmp	xmrig
behavioral2/memory/1636-218-0x00007FF694690000-0x00007FF6949E1000-memory.dmp	xmrig
behavioral2/memory/2112-220-0x00007FF7D2F10000-0x00007FF7D3261000-memory.dmp	xmrig
behavioral2/memory/2928-222-0x00007FF6606F0000-0x00007FF660A41000-memory.dmp	xmrig
behavioral2/memory/644-224-0x00007FF76E1F0000-0x00007FF76E541000-memory.dmp	xmrig
behavioral2/memory/3652-226-0x00007FF7EC910000-0x00007FF7ECC61000-memory.dmp	xmrig
behavioral2/memory/1136-228-0x00007FF7B1290000-0x00007FF7B15E1000-memory.dmp	xmrig
behavioral2/memory/1292-230-0x00007FF796010000-0x00007FF796361000-memory.dmp	xmrig
behavioral2/memory/1336-232-0x00007FF7E9B30000-0x00007FF7E9E81000-memory.dmp	xmrig
behavioral2/memory/684-234-0x00007FF708AA0000-0x00007FF708DF1000-memory.dmp	xmrig
behavioral2/memory/1988-238-0x00007FF7108B0000-0x00007FF710C01000-memory.dmp	xmrig
behavioral2/memory/4500-240-0x00007FF7025D0000-0x00007FF702921000-memory.dmp	xmrig
behavioral2/memory/3544-242-0x00007FF6553F0000-0x00007FF655741000-memory.dmp	xmrig
behavioral2/memory/4636-244-0x00007FF6E8740000-0x00007FF6E8A91000-memory.dmp	xmrig
behavioral2/memory/924-248-0x00007FF7B7DB0000-0x00007FF7B8101000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2128	fVKCyBj.exe
3264	HLVcAcX.exe
1920	oOEXFsG.exe
2612	SDsXGXi.exe
2352	RuFlsmO.exe
4668	DnGPQBr.exe
3084	EoNAvHi.exe
1636	ppsbyIr.exe
2112	VVPALZb.exe
2928	znrweZs.exe
644	eXifUEA.exe
3652	bPmyCxe.exe
1136	TNVVsqo.exe
1292	jPNUhGR.exe
1336	gNlGPaH.exe
684	uIcQPdm.exe
1988	YqsdzXh.exe
4500	uuupOPd.exe
3544	TXKSSwv.exe
4636	fNtKSho.exe
924	guBELRe.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/824-0-0x00007FF782E40000-0x00007FF783191000-memory.dmp	upx
behavioral2/files/0x0008000000023257-5.dat	upx
behavioral2/memory/2128-7-0x00007FF7FAC40000-0x00007FF7FAF91000-memory.dmp	upx
behavioral2/files/0x000800000002325c-12.dat	upx
behavioral2/files/0x000700000002325d-10.dat	upx
behavioral2/memory/3264-14-0x00007FF75FF20000-0x00007FF760271000-memory.dmp	upx
behavioral2/memory/1920-18-0x00007FF705220000-0x00007FF705571000-memory.dmp	upx
behavioral2/files/0x000700000002325e-24.dat	upx
behavioral2/memory/2612-26-0x00007FF681A90000-0x00007FF681DE1000-memory.dmp	upx
behavioral2/files/0x000800000002325a-28.dat	upx
behavioral2/memory/2352-29-0x00007FF745450000-0x00007FF7457A1000-memory.dmp	upx
behavioral2/files/0x0007000000023260-36.dat	upx
behavioral2/memory/4668-38-0x00007FF7CE970000-0x00007FF7CECC1000-memory.dmp	upx
behavioral2/files/0x0007000000023261-42.dat	upx
behavioral2/files/0x0007000000023262-47.dat	upx
behavioral2/files/0x0007000000023263-52.dat	upx
behavioral2/files/0x0007000000023264-57.dat	upx
behavioral2/files/0x0007000000023265-62.dat	upx
behavioral2/files/0x0007000000023266-67.dat	upx
behavioral2/files/0x0007000000023267-71.dat	upx
behavioral2/files/0x0007000000023268-77.dat	upx
behavioral2/files/0x0007000000023269-81.dat	upx
behavioral2/files/0x000700000002326a-87.dat	upx
behavioral2/files/0x000700000002326b-92.dat	upx
behavioral2/files/0x000700000002326c-97.dat	upx
behavioral2/files/0x000700000002326d-102.dat	upx
behavioral2/memory/3084-104-0x00007FF645450000-0x00007FF6457A1000-memory.dmp	upx
behavioral2/memory/2928-110-0x00007FF6606F0000-0x00007FF660A41000-memory.dmp	upx
behavioral2/memory/3652-114-0x00007FF7EC910000-0x00007FF7ECC61000-memory.dmp	upx
behavioral2/memory/684-118-0x00007FF708AA0000-0x00007FF708DF1000-memory.dmp	upx
behavioral2/memory/3544-121-0x00007FF6553F0000-0x00007FF655741000-memory.dmp	upx
behavioral2/memory/4636-122-0x00007FF6E8740000-0x00007FF6E8A91000-memory.dmp	upx
behavioral2/memory/4500-120-0x00007FF7025D0000-0x00007FF702921000-memory.dmp	upx
behavioral2/memory/1988-119-0x00007FF7108B0000-0x00007FF710C01000-memory.dmp	upx
behavioral2/memory/1336-117-0x00007FF7E9B30000-0x00007FF7E9E81000-memory.dmp	upx
behavioral2/memory/1292-116-0x00007FF796010000-0x00007FF796361000-memory.dmp	upx
behavioral2/memory/1136-115-0x00007FF7B1290000-0x00007FF7B15E1000-memory.dmp	upx
behavioral2/files/0x000700000002326e-112.dat	upx
behavioral2/memory/644-111-0x00007FF76E1F0000-0x00007FF76E541000-memory.dmp	upx
behavioral2/memory/2112-109-0x00007FF7D2F10000-0x00007FF7D3261000-memory.dmp	upx
behavioral2/memory/1636-107-0x00007FF694690000-0x00007FF6949E1000-memory.dmp	upx
behavioral2/files/0x000700000002326f-124.dat	upx
behavioral2/memory/1920-130-0x00007FF705220000-0x00007FF705571000-memory.dmp	upx
behavioral2/memory/2128-126-0x00007FF7FAC40000-0x00007FF7FAF91000-memory.dmp	upx
behavioral2/memory/824-125-0x00007FF782E40000-0x00007FF783191000-memory.dmp	upx
behavioral2/memory/2352-132-0x00007FF745450000-0x00007FF7457A1000-memory.dmp	upx
behavioral2/memory/924-143-0x00007FF7B7DB0000-0x00007FF7B8101000-memory.dmp	upx
behavioral2/memory/824-150-0x00007FF782E40000-0x00007FF783191000-memory.dmp	upx
behavioral2/memory/824-151-0x00007FF782E40000-0x00007FF783191000-memory.dmp	upx
behavioral2/memory/2128-201-0x00007FF7FAC40000-0x00007FF7FAF91000-memory.dmp	upx
behavioral2/memory/3264-203-0x00007FF75FF20000-0x00007FF760271000-memory.dmp	upx
behavioral2/memory/1920-205-0x00007FF705220000-0x00007FF705571000-memory.dmp	upx
behavioral2/memory/2612-207-0x00007FF681A90000-0x00007FF681DE1000-memory.dmp	upx
behavioral2/memory/2352-209-0x00007FF745450000-0x00007FF7457A1000-memory.dmp	upx
behavioral2/memory/4668-211-0x00007FF7CE970000-0x00007FF7CECC1000-memory.dmp	upx
behavioral2/memory/3084-216-0x00007FF645450000-0x00007FF6457A1000-memory.dmp	upx
behavioral2/memory/1636-218-0x00007FF694690000-0x00007FF6949E1000-memory.dmp	upx
behavioral2/memory/2112-220-0x00007FF7D2F10000-0x00007FF7D3261000-memory.dmp	upx
behavioral2/memory/2928-222-0x00007FF6606F0000-0x00007FF660A41000-memory.dmp	upx
behavioral2/memory/644-224-0x00007FF76E1F0000-0x00007FF76E541000-memory.dmp	upx
behavioral2/memory/3652-226-0x00007FF7EC910000-0x00007FF7ECC61000-memory.dmp	upx
behavioral2/memory/1136-228-0x00007FF7B1290000-0x00007FF7B15E1000-memory.dmp	upx
behavioral2/memory/1292-230-0x00007FF796010000-0x00007FF796361000-memory.dmp	upx
behavioral2/memory/1336-232-0x00007FF7E9B30000-0x00007FF7E9E81000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\fVKCyBj.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jPNUhGR.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YqsdzXh.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TXKSSwv.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SDsXGXi.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EoNAvHi.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ppsbyIr.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eXifUEA.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TNVVsqo.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fNtKSho.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HLVcAcX.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oOEXFsG.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RuFlsmO.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VVPALZb.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\znrweZs.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gNlGPaH.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uuupOPd.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DnGPQBr.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bPmyCxe.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uIcQPdm.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\guBELRe.exe	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2128	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	91
PID 824 wrote to memory of 2128	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	91
PID 824 wrote to memory of 3264	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	92
PID 824 wrote to memory of 3264	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	92
PID 824 wrote to memory of 1920	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	93
PID 824 wrote to memory of 1920	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	93
PID 824 wrote to memory of 2612	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	94
PID 824 wrote to memory of 2612	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	94
PID 824 wrote to memory of 2352	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	95
PID 824 wrote to memory of 2352	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	95
PID 824 wrote to memory of 4668	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	96
PID 824 wrote to memory of 4668	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	96
PID 824 wrote to memory of 3084	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	97
PID 824 wrote to memory of 3084	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	97
PID 824 wrote to memory of 1636	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	98
PID 824 wrote to memory of 1636	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	98
PID 824 wrote to memory of 2112	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	99
PID 824 wrote to memory of 2112	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	99
PID 824 wrote to memory of 2928	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	100
PID 824 wrote to memory of 2928	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	100
PID 824 wrote to memory of 644	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	101
PID 824 wrote to memory of 644	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	101
PID 824 wrote to memory of 3652	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	102
PID 824 wrote to memory of 3652	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	102
PID 824 wrote to memory of 1136	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	103
PID 824 wrote to memory of 1136	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	103
PID 824 wrote to memory of 1292	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	104
PID 824 wrote to memory of 1292	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	104
PID 824 wrote to memory of 1336	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	105
PID 824 wrote to memory of 1336	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	105
PID 824 wrote to memory of 684	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	106
PID 824 wrote to memory of 684	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	106
PID 824 wrote to memory of 1988	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	107
PID 824 wrote to memory of 1988	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	107
PID 824 wrote to memory of 4500	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	108
PID 824 wrote to memory of 4500	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	108
PID 824 wrote to memory of 3544	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	109
PID 824 wrote to memory of 3544	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	109
PID 824 wrote to memory of 4636	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	110
PID 824 wrote to memory of 4636	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	110
PID 824 wrote to memory of 924	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	111
PID 824 wrote to memory of 924	824	2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe	111

C:\Users\Admin\AppData\Local\Temp\2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_dbdb46463a64e885d36daf22f44f3e93_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\System\fVKCyBj.exe
  C:\Windows\System\fVKCyBj.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\HLVcAcX.exe
  C:\Windows\System\HLVcAcX.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\oOEXFsG.exe
  C:\Windows\System\oOEXFsG.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\SDsXGXi.exe
  C:\Windows\System\SDsXGXi.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\RuFlsmO.exe
  C:\Windows\System\RuFlsmO.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\DnGPQBr.exe
  C:\Windows\System\DnGPQBr.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\EoNAvHi.exe
  C:\Windows\System\EoNAvHi.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\ppsbyIr.exe
  C:\Windows\System\ppsbyIr.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\VVPALZb.exe
  C:\Windows\System\VVPALZb.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\znrweZs.exe
  C:\Windows\System\znrweZs.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\eXifUEA.exe
  C:\Windows\System\eXifUEA.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\bPmyCxe.exe
  C:\Windows\System\bPmyCxe.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\TNVVsqo.exe
  C:\Windows\System\TNVVsqo.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\jPNUhGR.exe
  C:\Windows\System\jPNUhGR.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\gNlGPaH.exe
  C:\Windows\System\gNlGPaH.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\uIcQPdm.exe
  C:\Windows\System\uIcQPdm.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\YqsdzXh.exe
  C:\Windows\System\YqsdzXh.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\uuupOPd.exe
  C:\Windows\System\uuupOPd.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\TXKSSwv.exe
  C:\Windows\System\TXKSSwv.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\fNtKSho.exe
  C:\Windows\System\fNtKSho.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\guBELRe.exe
  C:\Windows\System\guBELRe.exe
  2⤵
  - Executes dropped EXE
  PID:924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:60

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DnGPQBr.exe

Path C:\Windows\System\DnGPQBr.exe
Size 5.2MB
SHA256 0d72964f75adf4213ddfa5444e7f3122547fe9f61979d6b49b007855c2d81c90
MD5 f2ddce00f7834fa27ac1a18ab3a7e019
SHA1 c457c8a158567f377ce67271bcf8d4852fe32057
SHA512 96a70fc7c5b48bacd4bda34cf0d927eca724ff46266f7c8a570023e8207bffc8b639a2d6180483c186cb3afd009fb0c163296920b531c1ee165311ee88d98f4c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lB:RWWBibf56utgpPFotBER/mQ32lUV
MD5 SHA1 SHA512 SSDEEP

Submit Download

EoNAvHi.exe

Path C:\Windows\System\EoNAvHi.exe
Size 5.2MB
SHA256 43b4a0824da6e986a881e304d7e93124d76ef2d896dbc977054a62363484c046
MD5 1b69109c2451f6e745df1684ac62a247
SHA1 b7e36fc32384a2b5fd7d38d47a8fd8c4278c1f40
SHA512 1f6cd83455b1973c69dba2a0a457bfed44ff94e4ef47d05b583d2addeef64626f15ef6a8d304799b209c96b2568857d5aa8efaa26e998e3078cc05df91a8cc15
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lR:RWWBibf56utgpPFotBER/mQ32lUt
MD5 SHA1 SHA512 SSDEEP

Submit Download

HLVcAcX.exe

Path C:\Windows\System\HLVcAcX.exe
Size 5.2MB
SHA256 b5ebba03c718f9ef896919adc7311621fb5eeafe6284b4ac328ccd9cdd892905
MD5 a2946a0b0dbf7a4ac23ccc73530010c1
SHA1 fb367c40abb92d0f7f4db2704817673ba80bf8bf
SHA512 17d30431776d64a5f59e7307367e88f06dae4917d4c3b5c75cb1363e65d7a37d4b555a89edff20bf69a0d1b5154ef16b1672efe9c875dc83d78119a1622b017d
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibf56utgpPFotBER/mQ32lUG
MD5 SHA1 SHA512 SSDEEP

Submit Download

RuFlsmO.exe

Path C:\Windows\System\RuFlsmO.exe
Size 5.2MB
SHA256 56ed32ef914146c1b33cf73857ff92525cf72c4dfff5afca7c3e06297920f5d8
MD5 628a9861b18c62c1c422b6e247a2a5a1
SHA1 05aad97322728fa68803244d18009b6192c212ad
SHA512 bd03bd17d68068e887e35917bf81fdf71986e850c90cb33cfc1f463744f09990844f9169b8a40af0c1e9d97a4abc9e04991bd917840a97684ded06668720107e
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lj:RWWBibf56utgpPFotBER/mQ32lUH
MD5 SHA1 SHA512 SSDEEP

Submit Download

SDsXGXi.exe

Path C:\Windows\System\SDsXGXi.exe
Size 5.2MB
SHA256 0d201671223be7a87b614f9658072332aa5cf15d6e764afe5f724e560652a355
MD5 ac2490ec781ea6517cde0d6d048c3550
SHA1 44b0057183359ad21635007ce7f9c07b85537b90
SHA512 daf066f5a012dcb12dc9a3a991c0e38f04f0e1b8538e80611dccb13165e43cb4da807741e1953467d8be56ae2b30029824e145ba0d1a341a67da1a5205cd2868
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lUJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TNVVsqo.exe

Path C:\Windows\System\TNVVsqo.exe
Size 5.2MB
SHA256 f77b098b8028d2fc5e51c3da4ccc1bb5b8458430a57ae3512beda00d3802f150
MD5 68cfd2ac81b259fff2c94a248c4cc2c9
SHA1 e3cb8e4d5acbb00df8450665414348825f0b3cc1
SHA512 9115f62da00ac7259693d26402d1a35ba5aef75d8622afbb02970b7905cc7428edb64bffd853a2f2afacd18736c930337597ef6e39774ac36f93efb0117574de
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibf56utgpPFotBER/mQ32lUK
MD5 SHA1 SHA512 SSDEEP

Submit Download

TXKSSwv.exe

Path C:\Windows\System\TXKSSwv.exe
Size 5.2MB
SHA256 ff1c615e5fcbaafc29a5b0bbcae8003018437bdba788878c06a18634bfaeb49d
MD5 3baeb732b89165092c443ee8d061b145
SHA1 07bbd8861b2d56408c6f8319096c87ff6669c89d
SHA512 feef8ca9a8964bb62717d3acd415e893c967e5dc872b857b41136ec34edc183263443049c4ea7b52988303ba8c927a9f1604865e38e50d67ead6b451d59ab408
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lU5
MD5 SHA1 SHA512 SSDEEP

Submit Download

VVPALZb.exe

Path C:\Windows\System\VVPALZb.exe
Size 5.2MB
SHA256 9099cd5f96e5734cc9f0dbf3782879a66f1416c98d33c9ef1949b5359ef2f950
MD5 dc6301ea31196d4c900d6b941ff67e5c
SHA1 c444fb5213a9678e04a6a2a50c44fe1c3d0baf3c
SHA512 0930171c20d8e26657c584ebc68f53428f317a1d1c49f5eb81259fdbd3105ca6f14aff4d24c24d61827bab7787e8f82556fe955b1d6a86affa62092f12e2628a
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lT:RWWBibf56utgpPFotBER/mQ32lUH
MD5 SHA1 SHA512 SSDEEP

Submit Download

YqsdzXh.exe

Path C:\Windows\System\YqsdzXh.exe
Size 5.2MB
SHA256 f208083d7f91eda74d05567873294fa6820f8a36fb582677a8ca0640df221d76
MD5 5eb5a81f77cacc89b8dadfe5dbbce73d
SHA1 dc508167e0b7d4da0cc25c7dbc17df574ceeb6d1
SHA512 47277da64fe35468badaa4bccfe8791d8651a0fb0c421b75f534ecd8078c982cdcc462c319ff9cf5dbb8128593de2a00ab0d99d323db3250806d5dc2b875bc9f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lk:RWWBibf56utgpPFotBER/mQ32lUI
MD5 SHA1 SHA512 SSDEEP

Submit Download

bPmyCxe.exe

Path C:\Windows\System\bPmyCxe.exe
Size 5.2MB
SHA256 1f67c42fe31276ac0a5fcf8d8c1d8b3080018031332191f22120f888fb21cfd5
MD5 7ca776c2cf8d69eff4c20e14275f6d74
SHA1 21e0f148c6ce29911e9e488fb9fb212b2dcfd5e5
SHA512 9d1cd5321bae1c3e82bb61cbadd1e15e0d6f9c8053a5b556014f04bc77c227929aa1f7b61442f7c66f5b7fc8b29421866cc47ceb711f0e2ea4dab762164fabff
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBibf56utgpPFotBER/mQ32lU9
MD5 SHA1 SHA512 SSDEEP

Submit Download

eXifUEA.exe

Path C:\Windows\System\eXifUEA.exe
Size 5.2MB
SHA256 b950c3e96bcaa043f8f019b1691040487bc00f1d8bc5d80898db87e7cb241660
MD5 16cc7967cfc41d77899b162d4ac7e3de
SHA1 8e2969c4738229d7e47df4e746d699d29c6f152e
SHA512 e10ea04f5c047d61846465254a961976a4a3b1e51a6e782ad64251c8805fd19f08fb348e9d91fe51496eec216f0f2b6f5b3be3285ebabd370e7accec1f1fbeeb
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibf56utgpPFotBER/mQ32lUy
MD5 SHA1 SHA512 SSDEEP

Submit Download

fNtKSho.exe

Path C:\Windows\System\fNtKSho.exe
Size 5.2MB
SHA256 56663d3deebf1b747377c6cc0ebea44d5c22c08641c85da331f1a1fd1c43a96b
MD5 1f2c7a8831cdc38d767c4039bc1748f0
SHA1 1e300f8516f2e4278206768be3fec96e7ced890e
SHA512 ca565c4eca51c0083effa724c8ced7025f29727b8d47f70d4b61a4489fbc5bcdc28139bf3f9c0f3fe736419ebb0d1edc9f92a75e4dbea8d4b3fb39f6c08f228d
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBibf56utgpPFotBER/mQ32lUH
MD5 SHA1 SHA512 SSDEEP

Submit Download

fVKCyBj.exe

Path C:\Windows\System\fVKCyBj.exe
Size 5.2MB
SHA256 e35f813728dc7b25a4388efeeedd4c7f20bd0f15ebafef808f0444043d9afd20
MD5 25056e6a76efa85c0c2536db2b9c80f5
SHA1 dd147adb522c2a2e92ed610bd1c38748f1e95c64
SHA512 fd040da931ae6a60565aab2b6d7bfdd4d2c7d42bd24f268eb9362081635bdded76c43e467d56826d6c6aaad345eceedbd3cb3415611573ecd7758bffb5a59abd
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lP:RWWBibf56utgpPFotBER/mQ32lUL
MD5 SHA1 SHA512 SSDEEP

Submit Download

gNlGPaH.exe

Path C:\Windows\System\gNlGPaH.exe
Size 5.2MB
SHA256 5043bf5c71956d7b06b94493214b414bdc388db93258000398d7c7583e9db3ed
MD5 32d0bb49be116c84fb63ddb9056b1ec4
SHA1 a22a7f748a63b1d15b48c9a0454752db7d2dc112
SHA512 be014c168eb4beca800c7480ae9f63eaf74ad79693908c85ad0ec20d9a985b28a4597c62fe1d18e3d45c6909329d640b1e0a1e716eaf9a784bd604e16930cb17
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l1:RWWBibf56utgpPFotBER/mQ32lUB
MD5 SHA1 SHA512 SSDEEP

Submit Download

guBELRe.exe

Path C:\Windows\System\guBELRe.exe
Size 5.2MB
SHA256 fc838349d91197fd9e7b10bb274cbe2e0b83e951c11c0a18f9cceacc6810ff43
MD5 957bd37f38190c2ee5336fb30a029508
SHA1 58281b39bafd7ba6876dec24705d52c2d812a192
SHA512 bfa74b3ae2c9532f03f72918a3e136965cf6edffdd2792c8f7ea5a7d7a8aeabb38d5476da69ca583a2cd403e4b39a1de02db8ba2aff1f4e88ad2b8efc10047a8
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

jPNUhGR.exe

Path C:\Windows\System\jPNUhGR.exe
Size 5.2MB
SHA256 58a2c2db46e6552ca837a8e6485c91d34c6922cec38b24f5058a82a9f3bc8526
MD5 272aa38d92be9467ea7e90dc4d4607c4
SHA1 0a7d2c28816efb6316e20d6eb5a3cfb80d194b87
SHA512 ef185ad7a05a0f653e548d66bacba3752a8c9c0a69ec99eed03377ab6f6d3fedab18e12c3228f336f604c918254b3cd3ea99fa09b333641f8a010c8ee1f11c8f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lk:RWWBibf56utgpPFotBER/mQ32lUw
MD5 SHA1 SHA512 SSDEEP

Submit Download

oOEXFsG.exe

Path C:\Windows\System\oOEXFsG.exe
Size 5.2MB
SHA256 4d8549116da2f12bb6b8b85e964a6ade3cd397041a8fa22c826bf24bbe54213b
MD5 d1b121d24a06b7e82eba9f1312148b46
SHA1 2b6ae343c8aea47a3d8e97e2fdec4fa5edf436f1
SHA512 61cd303f60c240406e0d7454e325a1032399a815a94b7e2e2155ebb0e5fe847c8a4113dde1dbbca37c659561f7af3acde6dc3cf34f8a579619c0bbf849d0fcfa
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l8:RWWBibf56utgpPFotBER/mQ32lUw
MD5 SHA1 SHA512 SSDEEP

Submit Download

ppsbyIr.exe

Path C:\Windows\System\ppsbyIr.exe
Size 5.2MB
SHA256 3d10ed4387add5e59b654bc8b1b4b4493faeba79d193e9cdf3d87f2041dc0150
MD5 5919b16777945a04dba6116958c191c7
SHA1 41c665ec2ec22b768f1ff760e221ebe6f8689f04
SHA512 4c1f5b104f0377691b90563f29cd3bfe753c43b6af51c627feaf83e72621d3446f4fb14e09950bd0b1cf7c4af8b4494dfcb33bf738b4a13fbae7481ed27cd295
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lc:RWWBibf56utgpPFotBER/mQ32lUQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

uIcQPdm.exe

Path C:\Windows\System\uIcQPdm.exe
Size 5.2MB
SHA256 f0e431ee9694ac9f9b086036d055959eb56734a510adbd1f200ef8c02128709f
MD5 629222eaa80001c5c91c3c318ffa5926
SHA1 e5f6bc4f9d095a62bbdd3cb1c588445e341953a7
SHA512 76fa22d5bae2e574c8e1b668c3e99e1efdef6f7dddfa9fd4669e4b81c1c381644589ea387befe29172f8bdd10a55b2712a31e1c7f3179ca9d919ababbd658507
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lM:RWWBibf56utgpPFotBER/mQ32lUA
MD5 SHA1 SHA512 SSDEEP

Submit Download

uuupOPd.exe

Path C:\Windows\System\uuupOPd.exe
Size 5.2MB
SHA256 32d3c3d1d744012dd8eb9c5e1133b0aca9a63f5a2430ddc26870f4f837646887
MD5 916f79e1f2236b0097eef80f18283b16
SHA1 277516a8d07d09954f897239c076190ded07ae3d
SHA512 e5338d13dec101149f415b357ec788cedb87fbef7016375d9ec2e2e49ff098017a7f95d9a6e0e58d881daea7dadbc1ddeefe8f89bd725e5e654bd1f0c9d567fb
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ln:RWWBibf56utgpPFotBER/mQ32lUT
MD5 SHA1 SHA512 SSDEEP

Submit Download

znrweZs.exe

Path C:\Windows\System\znrweZs.exe
Size 5.2MB
SHA256 8b83c870a3b1863c1e5eb8d511765536de82c9176fd4f57a35437e3ae00d0724
MD5 ec4061d2696e4432e45ad27cac97636b
SHA1 c6ef53a09d46e7d8121c15bbc175652d883609f0
SHA512 ef94d8332bd5c6b069905316efb8b38f7e8b658df3bec8df780b50c62c80ab6ecab838d162a74ba92c523f05b4575a94290657aa76d2bed0789c551729f89af3
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lS:RWWBibf56utgpPFotBER/mQ32lUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/644-224-0x00007FF76E1F0000-0x00007FF76E541000-memory.dmp

Download

memory/644-111-0x00007FF76E1F0000-0x00007FF76E541000-memory.dmp

Download

memory/684-118-0x00007FF708AA0000-0x00007FF708DF1000-memory.dmp

Download

memory/684-234-0x00007FF708AA0000-0x00007FF708DF1000-memory.dmp

Download

memory/824-125-0x00007FF782E40000-0x00007FF783191000-memory.dmp

Download

memory/824-1-0x000001C261410000-0x000001C261420000-memory.dmp

Download

memory/824-150-0x00007FF782E40000-0x00007FF783191000-memory.dmp

Download

memory/824-0-0x00007FF782E40000-0x00007FF783191000-memory.dmp

Download

memory/824-151-0x00007FF782E40000-0x00007FF783191000-memory.dmp

Download

memory/924-248-0x00007FF7B7DB0000-0x00007FF7B8101000-memory.dmp

Download

memory/924-143-0x00007FF7B7DB0000-0x00007FF7B8101000-memory.dmp

Download

memory/1136-115-0x00007FF7B1290000-0x00007FF7B15E1000-memory.dmp

Download

memory/1136-228-0x00007FF7B1290000-0x00007FF7B15E1000-memory.dmp

Download

memory/1292-230-0x00007FF796010000-0x00007FF796361000-memory.dmp

Download

memory/1292-116-0x00007FF796010000-0x00007FF796361000-memory.dmp

Download

memory/1336-117-0x00007FF7E9B30000-0x00007FF7E9E81000-memory.dmp

Download

memory/1336-232-0x00007FF7E9B30000-0x00007FF7E9E81000-memory.dmp

Download

memory/1636-218-0x00007FF694690000-0x00007FF6949E1000-memory.dmp

Download

memory/1636-107-0x00007FF694690000-0x00007FF6949E1000-memory.dmp

Download

memory/1920-205-0x00007FF705220000-0x00007FF705571000-memory.dmp

Download

memory/1920-130-0x00007FF705220000-0x00007FF705571000-memory.dmp

Download

memory/1920-18-0x00007FF705220000-0x00007FF705571000-memory.dmp

Download

memory/1988-119-0x00007FF7108B0000-0x00007FF710C01000-memory.dmp

Download

memory/1988-238-0x00007FF7108B0000-0x00007FF710C01000-memory.dmp

Download

memory/2112-109-0x00007FF7D2F10000-0x00007FF7D3261000-memory.dmp

Download

memory/2112-220-0x00007FF7D2F10000-0x00007FF7D3261000-memory.dmp

Download

memory/2128-201-0x00007FF7FAC40000-0x00007FF7FAF91000-memory.dmp

Download

memory/2128-7-0x00007FF7FAC40000-0x00007FF7FAF91000-memory.dmp

Download

memory/2128-126-0x00007FF7FAC40000-0x00007FF7FAF91000-memory.dmp

Download

memory/2352-29-0x00007FF745450000-0x00007FF7457A1000-memory.dmp

Download

memory/2352-209-0x00007FF745450000-0x00007FF7457A1000-memory.dmp

Download

memory/2352-132-0x00007FF745450000-0x00007FF7457A1000-memory.dmp

Download

memory/2612-26-0x00007FF681A90000-0x00007FF681DE1000-memory.dmp

Download

memory/2612-207-0x00007FF681A90000-0x00007FF681DE1000-memory.dmp

Download

memory/2928-110-0x00007FF6606F0000-0x00007FF660A41000-memory.dmp

Download

memory/2928-222-0x00007FF6606F0000-0x00007FF660A41000-memory.dmp

Download

memory/3084-216-0x00007FF645450000-0x00007FF6457A1000-memory.dmp

Download

memory/3084-104-0x00007FF645450000-0x00007FF6457A1000-memory.dmp

Download

memory/3264-203-0x00007FF75FF20000-0x00007FF760271000-memory.dmp

Download

memory/3264-14-0x00007FF75FF20000-0x00007FF760271000-memory.dmp

Download

memory/3544-242-0x00007FF6553F0000-0x00007FF655741000-memory.dmp

Download

memory/3544-121-0x00007FF6553F0000-0x00007FF655741000-memory.dmp

Download

memory/3652-226-0x00007FF7EC910000-0x00007FF7ECC61000-memory.dmp

Download

memory/3652-114-0x00007FF7EC910000-0x00007FF7ECC61000-memory.dmp

Download

memory/4500-240-0x00007FF7025D0000-0x00007FF702921000-memory.dmp

Download

memory/4500-120-0x00007FF7025D0000-0x00007FF702921000-memory.dmp

Download

memory/4636-122-0x00007FF6E8740000-0x00007FF6E8A91000-memory.dmp

Download

memory/4636-244-0x00007FF6E8740000-0x00007FF6E8A91000-memory.dmp

Download

memory/4668-38-0x00007FF7CE970000-0x00007FF7CECC1000-memory.dmp

Download

memory/4668-211-0x00007FF7CE970000-0x00007FF7CECC1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads