cobaltstrike | f1309518287aa8a382d365feaa0119802e679d8d45126cc2ad6ff7fa180f9498

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240527-eegmdafb5z
SHA256 f1309518287aa8a382d365feaa0119802e679d8d45126cc2ad6ff7fa180f9498
MD5 69aa1b678637578c28b026fc142bed53
SHA1 00c6b01c2e44bf6a8630fedf88b0fb500941c7ef
SHA512 89624b35ece41e1d22336e7c0822f36aaa36309f660ad66d99f26f3cbc40f6dd3b518e8918880a72bfac0de349fdb3aa1c3618e1a064bad8368af3ca7ac53006
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000800000002340e-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023413-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023412-13.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002340f-23.dat	cobalt_reflective_dll
behavioral2/files/0x0003000000021ebc-31.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023372-35.dat	cobalt_reflective_dll
behavioral2/files/0x0003000000021e1b-43.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023369-48.dat	cobalt_reflective_dll
behavioral2/files/0x000a00000002336f-54.dat	cobalt_reflective_dll
behavioral2/files/0x000c000000023370-57.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023414-67.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023415-71.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-79.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023418-84.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023419-89.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341a-106.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341e-122.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341d-123.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341b-119.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341c-113.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341f-129.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000800000002340e-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023413-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023412-13.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002340f-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0003000000021ebc-31.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a000000023372-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0003000000021e1b-43.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a000000023369-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a00000002336f-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c000000023370-57.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023414-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023415-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023418-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023419-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341a-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341e-122.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341d-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341b-119.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341c-113.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341f-129.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4776-0-0x00007FF6759B0000-0x00007FF675D04000-memory.dmp	UPX
behavioral2/files/0x000800000002340e-4.dat	UPX
behavioral2/memory/4884-8-0x00007FF607020000-0x00007FF607374000-memory.dmp	UPX
behavioral2/files/0x0007000000023413-10.dat	UPX
behavioral2/memory/544-12-0x00007FF732C60000-0x00007FF732FB4000-memory.dmp	UPX
behavioral2/files/0x0007000000023412-13.dat	UPX
behavioral2/files/0x000800000002340f-23.dat	UPX
behavioral2/memory/3452-20-0x00007FF6E9F20000-0x00007FF6EA274000-memory.dmp	UPX
behavioral2/memory/2780-25-0x00007FF6825F0000-0x00007FF682944000-memory.dmp	UPX
behavioral2/files/0x0003000000021ebc-31.dat	UPX
behavioral2/memory/2108-30-0x00007FF6140D0000-0x00007FF614424000-memory.dmp	UPX
behavioral2/files/0x000a000000023372-35.dat	UPX
behavioral2/files/0x0003000000021e1b-43.dat	UPX
behavioral2/memory/2292-42-0x00007FF601250000-0x00007FF6015A4000-memory.dmp	UPX
behavioral2/files/0x000a000000023369-48.dat	UPX
behavioral2/memory/2980-36-0x00007FF68A680000-0x00007FF68A9D4000-memory.dmp	UPX
behavioral2/files/0x000a00000002336f-54.dat	UPX
behavioral2/files/0x000c000000023370-57.dat	UPX
behavioral2/memory/2648-61-0x00007FF7CADA0000-0x00007FF7CB0F4000-memory.dmp	UPX
behavioral2/files/0x0007000000023414-67.dat	UPX
behavioral2/memory/3428-69-0x00007FF672CA0000-0x00007FF672FF4000-memory.dmp	UPX
behavioral2/memory/4776-66-0x00007FF6759B0000-0x00007FF675D04000-memory.dmp	UPX
behavioral2/memory/4984-59-0x00007FF71B640000-0x00007FF71B994000-memory.dmp	UPX
behavioral2/memory/5108-50-0x00007FF7CAF70000-0x00007FF7CB2C4000-memory.dmp	UPX
behavioral2/files/0x0007000000023415-71.dat	UPX
behavioral2/memory/456-76-0x00007FF6F8160000-0x00007FF6F84B4000-memory.dmp	UPX
behavioral2/memory/4884-73-0x00007FF607020000-0x00007FF607374000-memory.dmp	UPX
behavioral2/files/0x0007000000023417-79.dat	UPX
behavioral2/files/0x0007000000023418-84.dat	UPX
behavioral2/memory/544-81-0x00007FF732C60000-0x00007FF732FB4000-memory.dmp	UPX
behavioral2/files/0x0007000000023419-89.dat	UPX
behavioral2/memory/4068-101-0x00007FF737870000-0x00007FF737BC4000-memory.dmp	UPX
behavioral2/files/0x000700000002341a-106.dat	UPX
behavioral2/memory/1396-109-0x00007FF63B8A0000-0x00007FF63BBF4000-memory.dmp	UPX
behavioral2/memory/2108-116-0x00007FF6140D0000-0x00007FF614424000-memory.dmp	UPX
behavioral2/files/0x000700000002341e-122.dat	UPX
behavioral2/files/0x000700000002341d-123.dat	UPX
behavioral2/memory/3808-121-0x00007FF62DF20000-0x00007FF62E274000-memory.dmp	UPX
behavioral2/files/0x000700000002341b-119.dat	UPX
behavioral2/memory/4920-115-0x00007FF752160000-0x00007FF7524B4000-memory.dmp	UPX
behavioral2/files/0x000700000002341c-113.dat	UPX
behavioral2/memory/3868-104-0x00007FF6229A0000-0x00007FF622CF4000-memory.dmp	UPX
behavioral2/memory/760-100-0x00007FF784C20000-0x00007FF784F74000-memory.dmp	UPX
behavioral2/memory/2780-98-0x00007FF6825F0000-0x00007FF682944000-memory.dmp	UPX
behavioral2/memory/3904-95-0x00007FF671F10000-0x00007FF672264000-memory.dmp	UPX
behavioral2/memory/2980-130-0x00007FF68A680000-0x00007FF68A9D4000-memory.dmp	UPX
behavioral2/files/0x000700000002341f-129.dat	UPX
behavioral2/memory/752-132-0x00007FF63B3A0000-0x00007FF63B6F4000-memory.dmp	UPX
behavioral2/memory/4424-133-0x00007FF733EE0000-0x00007FF734234000-memory.dmp	UPX
behavioral2/memory/2292-134-0x00007FF601250000-0x00007FF6015A4000-memory.dmp	UPX
behavioral2/memory/2648-135-0x00007FF7CADA0000-0x00007FF7CB0F4000-memory.dmp	UPX
behavioral2/memory/456-136-0x00007FF6F8160000-0x00007FF6F84B4000-memory.dmp	UPX
behavioral2/memory/3868-137-0x00007FF6229A0000-0x00007FF622CF4000-memory.dmp	UPX
behavioral2/memory/1396-138-0x00007FF63B8A0000-0x00007FF63BBF4000-memory.dmp	UPX
behavioral2/memory/4920-139-0x00007FF752160000-0x00007FF7524B4000-memory.dmp	UPX
behavioral2/memory/4884-140-0x00007FF607020000-0x00007FF607374000-memory.dmp	UPX
behavioral2/memory/544-141-0x00007FF732C60000-0x00007FF732FB4000-memory.dmp	UPX
behavioral2/memory/3452-142-0x00007FF6E9F20000-0x00007FF6EA274000-memory.dmp	UPX
behavioral2/memory/2780-143-0x00007FF6825F0000-0x00007FF682944000-memory.dmp	UPX
behavioral2/memory/2108-144-0x00007FF6140D0000-0x00007FF614424000-memory.dmp	UPX
behavioral2/memory/2980-145-0x00007FF68A680000-0x00007FF68A9D4000-memory.dmp	UPX
behavioral2/memory/2292-146-0x00007FF601250000-0x00007FF6015A4000-memory.dmp	UPX
behavioral2/memory/5108-147-0x00007FF7CAF70000-0x00007FF7CB2C4000-memory.dmp	UPX
behavioral2/memory/4984-148-0x00007FF71B640000-0x00007FF71B994000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4776-0-0x00007FF6759B0000-0x00007FF675D04000-memory.dmp	xmrig
behavioral2/files/0x000800000002340e-4.dat	xmrig
behavioral2/memory/4884-8-0x00007FF607020000-0x00007FF607374000-memory.dmp	xmrig
behavioral2/files/0x0007000000023413-10.dat	xmrig
behavioral2/memory/544-12-0x00007FF732C60000-0x00007FF732FB4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023412-13.dat	xmrig
behavioral2/files/0x000800000002340f-23.dat	xmrig
behavioral2/memory/3452-20-0x00007FF6E9F20000-0x00007FF6EA274000-memory.dmp	xmrig
behavioral2/memory/2780-25-0x00007FF6825F0000-0x00007FF682944000-memory.dmp	xmrig
behavioral2/files/0x0003000000021ebc-31.dat	xmrig
behavioral2/memory/2108-30-0x00007FF6140D0000-0x00007FF614424000-memory.dmp	xmrig
behavioral2/files/0x000a000000023372-35.dat	xmrig
behavioral2/files/0x0003000000021e1b-43.dat	xmrig
behavioral2/memory/2292-42-0x00007FF601250000-0x00007FF6015A4000-memory.dmp	xmrig
behavioral2/files/0x000a000000023369-48.dat	xmrig
behavioral2/memory/2980-36-0x00007FF68A680000-0x00007FF68A9D4000-memory.dmp	xmrig
behavioral2/files/0x000a00000002336f-54.dat	xmrig
behavioral2/files/0x000c000000023370-57.dat	xmrig
behavioral2/memory/2648-61-0x00007FF7CADA0000-0x00007FF7CB0F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-67.dat	xmrig
behavioral2/memory/3428-69-0x00007FF672CA0000-0x00007FF672FF4000-memory.dmp	xmrig
behavioral2/memory/4776-66-0x00007FF6759B0000-0x00007FF675D04000-memory.dmp	xmrig
behavioral2/memory/4984-59-0x00007FF71B640000-0x00007FF71B994000-memory.dmp	xmrig
behavioral2/memory/5108-50-0x00007FF7CAF70000-0x00007FF7CB2C4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023415-71.dat	xmrig
behavioral2/memory/456-76-0x00007FF6F8160000-0x00007FF6F84B4000-memory.dmp	xmrig
behavioral2/memory/4884-73-0x00007FF607020000-0x00007FF607374000-memory.dmp	xmrig
behavioral2/files/0x0007000000023417-79.dat	xmrig
behavioral2/files/0x0007000000023418-84.dat	xmrig
behavioral2/memory/544-81-0x00007FF732C60000-0x00007FF732FB4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023419-89.dat	xmrig
behavioral2/memory/4068-101-0x00007FF737870000-0x00007FF737BC4000-memory.dmp	xmrig
behavioral2/files/0x000700000002341a-106.dat	xmrig
behavioral2/memory/1396-109-0x00007FF63B8A0000-0x00007FF63BBF4000-memory.dmp	xmrig
behavioral2/memory/2108-116-0x00007FF6140D0000-0x00007FF614424000-memory.dmp	xmrig
behavioral2/files/0x000700000002341e-122.dat	xmrig
behavioral2/files/0x000700000002341d-123.dat	xmrig
behavioral2/memory/3808-121-0x00007FF62DF20000-0x00007FF62E274000-memory.dmp	xmrig
behavioral2/files/0x000700000002341b-119.dat	xmrig
behavioral2/memory/4920-115-0x00007FF752160000-0x00007FF7524B4000-memory.dmp	xmrig
behavioral2/files/0x000700000002341c-113.dat	xmrig
behavioral2/memory/3868-104-0x00007FF6229A0000-0x00007FF622CF4000-memory.dmp	xmrig
behavioral2/memory/760-100-0x00007FF784C20000-0x00007FF784F74000-memory.dmp	xmrig
behavioral2/memory/2780-98-0x00007FF6825F0000-0x00007FF682944000-memory.dmp	xmrig
behavioral2/memory/3904-95-0x00007FF671F10000-0x00007FF672264000-memory.dmp	xmrig
behavioral2/memory/2980-130-0x00007FF68A680000-0x00007FF68A9D4000-memory.dmp	xmrig
behavioral2/files/0x000700000002341f-129.dat	xmrig
behavioral2/memory/752-132-0x00007FF63B3A0000-0x00007FF63B6F4000-memory.dmp	xmrig
behavioral2/memory/4424-133-0x00007FF733EE0000-0x00007FF734234000-memory.dmp	xmrig
behavioral2/memory/2292-134-0x00007FF601250000-0x00007FF6015A4000-memory.dmp	xmrig
behavioral2/memory/2648-135-0x00007FF7CADA0000-0x00007FF7CB0F4000-memory.dmp	xmrig
behavioral2/memory/456-136-0x00007FF6F8160000-0x00007FF6F84B4000-memory.dmp	xmrig
behavioral2/memory/3868-137-0x00007FF6229A0000-0x00007FF622CF4000-memory.dmp	xmrig
behavioral2/memory/1396-138-0x00007FF63B8A0000-0x00007FF63BBF4000-memory.dmp	xmrig
behavioral2/memory/4920-139-0x00007FF752160000-0x00007FF7524B4000-memory.dmp	xmrig
behavioral2/memory/4884-140-0x00007FF607020000-0x00007FF607374000-memory.dmp	xmrig
behavioral2/memory/544-141-0x00007FF732C60000-0x00007FF732FB4000-memory.dmp	xmrig
behavioral2/memory/3452-142-0x00007FF6E9F20000-0x00007FF6EA274000-memory.dmp	xmrig
behavioral2/memory/2780-143-0x00007FF6825F0000-0x00007FF682944000-memory.dmp	xmrig
behavioral2/memory/2108-144-0x00007FF6140D0000-0x00007FF614424000-memory.dmp	xmrig
behavioral2/memory/2980-145-0x00007FF68A680000-0x00007FF68A9D4000-memory.dmp	xmrig
behavioral2/memory/2292-146-0x00007FF601250000-0x00007FF6015A4000-memory.dmp	xmrig
behavioral2/memory/5108-147-0x00007FF7CAF70000-0x00007FF7CB2C4000-memory.dmp	xmrig
behavioral2/memory/4984-148-0x00007FF71B640000-0x00007FF71B994000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4884	KIXIsVO.exe
544	cBubopG.exe
3452	PnRTCnk.exe
2780	VaAiaQU.exe
2108	LtOKLTJ.exe
2980	IIgMMQS.exe
2292	JIUVgNG.exe
5108	kwmCJxM.exe
4984	wBqGgKn.exe
2648	PQmBFTR.exe
3428	prqcnQw.exe
456	ltxnrow.exe
3904	oKOgIfW.exe
760	JXNlayt.exe
4068	iwcOVuF.exe
3868	yMiyGWm.exe
3808	GyqldMu.exe
1396	VvmzbRn.exe
4920	fLvpTLo.exe
752	iNMDxqF.exe
4424	XElfPmE.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4776-0-0x00007FF6759B0000-0x00007FF675D04000-memory.dmp	upx
behavioral2/files/0x000800000002340e-4.dat	upx
behavioral2/memory/4884-8-0x00007FF607020000-0x00007FF607374000-memory.dmp	upx
behavioral2/files/0x0007000000023413-10.dat	upx
behavioral2/memory/544-12-0x00007FF732C60000-0x00007FF732FB4000-memory.dmp	upx
behavioral2/files/0x0007000000023412-13.dat	upx
behavioral2/files/0x000800000002340f-23.dat	upx
behavioral2/memory/3452-20-0x00007FF6E9F20000-0x00007FF6EA274000-memory.dmp	upx
behavioral2/memory/2780-25-0x00007FF6825F0000-0x00007FF682944000-memory.dmp	upx
behavioral2/files/0x0003000000021ebc-31.dat	upx
behavioral2/memory/2108-30-0x00007FF6140D0000-0x00007FF614424000-memory.dmp	upx
behavioral2/files/0x000a000000023372-35.dat	upx
behavioral2/files/0x0003000000021e1b-43.dat	upx
behavioral2/memory/2292-42-0x00007FF601250000-0x00007FF6015A4000-memory.dmp	upx
behavioral2/files/0x000a000000023369-48.dat	upx
behavioral2/memory/2980-36-0x00007FF68A680000-0x00007FF68A9D4000-memory.dmp	upx
behavioral2/files/0x000a00000002336f-54.dat	upx
behavioral2/files/0x000c000000023370-57.dat	upx
behavioral2/memory/2648-61-0x00007FF7CADA0000-0x00007FF7CB0F4000-memory.dmp	upx
behavioral2/files/0x0007000000023414-67.dat	upx
behavioral2/memory/3428-69-0x00007FF672CA0000-0x00007FF672FF4000-memory.dmp	upx
behavioral2/memory/4776-66-0x00007FF6759B0000-0x00007FF675D04000-memory.dmp	upx
behavioral2/memory/4984-59-0x00007FF71B640000-0x00007FF71B994000-memory.dmp	upx
behavioral2/memory/5108-50-0x00007FF7CAF70000-0x00007FF7CB2C4000-memory.dmp	upx
behavioral2/files/0x0007000000023415-71.dat	upx
behavioral2/memory/456-76-0x00007FF6F8160000-0x00007FF6F84B4000-memory.dmp	upx
behavioral2/memory/4884-73-0x00007FF607020000-0x00007FF607374000-memory.dmp	upx
behavioral2/files/0x0007000000023417-79.dat	upx
behavioral2/files/0x0007000000023418-84.dat	upx
behavioral2/memory/544-81-0x00007FF732C60000-0x00007FF732FB4000-memory.dmp	upx
behavioral2/files/0x0007000000023419-89.dat	upx
behavioral2/memory/4068-101-0x00007FF737870000-0x00007FF737BC4000-memory.dmp	upx
behavioral2/files/0x000700000002341a-106.dat	upx
behavioral2/memory/1396-109-0x00007FF63B8A0000-0x00007FF63BBF4000-memory.dmp	upx
behavioral2/memory/2108-116-0x00007FF6140D0000-0x00007FF614424000-memory.dmp	upx
behavioral2/files/0x000700000002341e-122.dat	upx
behavioral2/files/0x000700000002341d-123.dat	upx
behavioral2/memory/3808-121-0x00007FF62DF20000-0x00007FF62E274000-memory.dmp	upx
behavioral2/files/0x000700000002341b-119.dat	upx
behavioral2/memory/4920-115-0x00007FF752160000-0x00007FF7524B4000-memory.dmp	upx
behavioral2/files/0x000700000002341c-113.dat	upx
behavioral2/memory/3868-104-0x00007FF6229A0000-0x00007FF622CF4000-memory.dmp	upx
behavioral2/memory/760-100-0x00007FF784C20000-0x00007FF784F74000-memory.dmp	upx
behavioral2/memory/2780-98-0x00007FF6825F0000-0x00007FF682944000-memory.dmp	upx
behavioral2/memory/3904-95-0x00007FF671F10000-0x00007FF672264000-memory.dmp	upx
behavioral2/memory/2980-130-0x00007FF68A680000-0x00007FF68A9D4000-memory.dmp	upx
behavioral2/files/0x000700000002341f-129.dat	upx
behavioral2/memory/752-132-0x00007FF63B3A0000-0x00007FF63B6F4000-memory.dmp	upx
behavioral2/memory/4424-133-0x00007FF733EE0000-0x00007FF734234000-memory.dmp	upx
behavioral2/memory/2292-134-0x00007FF601250000-0x00007FF6015A4000-memory.dmp	upx
behavioral2/memory/2648-135-0x00007FF7CADA0000-0x00007FF7CB0F4000-memory.dmp	upx
behavioral2/memory/456-136-0x00007FF6F8160000-0x00007FF6F84B4000-memory.dmp	upx
behavioral2/memory/3868-137-0x00007FF6229A0000-0x00007FF622CF4000-memory.dmp	upx
behavioral2/memory/1396-138-0x00007FF63B8A0000-0x00007FF63BBF4000-memory.dmp	upx
behavioral2/memory/4920-139-0x00007FF752160000-0x00007FF7524B4000-memory.dmp	upx
behavioral2/memory/4884-140-0x00007FF607020000-0x00007FF607374000-memory.dmp	upx
behavioral2/memory/544-141-0x00007FF732C60000-0x00007FF732FB4000-memory.dmp	upx
behavioral2/memory/3452-142-0x00007FF6E9F20000-0x00007FF6EA274000-memory.dmp	upx
behavioral2/memory/2780-143-0x00007FF6825F0000-0x00007FF682944000-memory.dmp	upx
behavioral2/memory/2108-144-0x00007FF6140D0000-0x00007FF614424000-memory.dmp	upx
behavioral2/memory/2980-145-0x00007FF68A680000-0x00007FF68A9D4000-memory.dmp	upx
behavioral2/memory/2292-146-0x00007FF601250000-0x00007FF6015A4000-memory.dmp	upx
behavioral2/memory/5108-147-0x00007FF7CAF70000-0x00007FF7CB2C4000-memory.dmp	upx
behavioral2/memory/4984-148-0x00007FF71B640000-0x00007FF71B994000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\oKOgIfW.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XElfPmE.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kwmCJxM.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wBqGgKn.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PQmBFTR.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yMiyGWm.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\cBubopG.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VaAiaQU.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JXNlayt.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VvmzbRn.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iNMDxqF.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LtOKLTJ.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JIUVgNG.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IIgMMQS.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\prqcnQw.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ltxnrow.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iwcOVuF.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GyqldMu.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fLvpTLo.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KIXIsVO.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PnRTCnk.exe	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4884	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	82
PID 4776 wrote to memory of 4884	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	82
PID 4776 wrote to memory of 544	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	84
PID 4776 wrote to memory of 544	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	84
PID 4776 wrote to memory of 3452	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	85
PID 4776 wrote to memory of 3452	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	85
PID 4776 wrote to memory of 2780	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	88
PID 4776 wrote to memory of 2780	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	88
PID 4776 wrote to memory of 2108	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	89
PID 4776 wrote to memory of 2108	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	89
PID 4776 wrote to memory of 2980	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	90
PID 4776 wrote to memory of 2980	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	90
PID 4776 wrote to memory of 2292	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	91
PID 4776 wrote to memory of 2292	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	91
PID 4776 wrote to memory of 5108	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	92
PID 4776 wrote to memory of 5108	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	92
PID 4776 wrote to memory of 4984	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	93
PID 4776 wrote to memory of 4984	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	93
PID 4776 wrote to memory of 2648	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	94
PID 4776 wrote to memory of 2648	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	94
PID 4776 wrote to memory of 3428	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	95
PID 4776 wrote to memory of 3428	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	95
PID 4776 wrote to memory of 456	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	96
PID 4776 wrote to memory of 456	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	96
PID 4776 wrote to memory of 3904	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	97
PID 4776 wrote to memory of 3904	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	97
PID 4776 wrote to memory of 760	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	98
PID 4776 wrote to memory of 760	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	98
PID 4776 wrote to memory of 4068	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	99
PID 4776 wrote to memory of 4068	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	99
PID 4776 wrote to memory of 3808	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	100
PID 4776 wrote to memory of 3808	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	100
PID 4776 wrote to memory of 1396	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	101
PID 4776 wrote to memory of 1396	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	101
PID 4776 wrote to memory of 3868	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	102
PID 4776 wrote to memory of 3868	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	102
PID 4776 wrote to memory of 4920	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	103
PID 4776 wrote to memory of 4920	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	103
PID 4776 wrote to memory of 752	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	104
PID 4776 wrote to memory of 752	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	104
PID 4776 wrote to memory of 4424	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	105
PID 4776 wrote to memory of 4424	4776	2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe	105

C:\Users\Admin\AppData\Local\Temp\2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_69aa1b678637578c28b026fc142bed53_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\System\KIXIsVO.exe
  C:\Windows\System\KIXIsVO.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\cBubopG.exe
  C:\Windows\System\cBubopG.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\PnRTCnk.exe
  C:\Windows\System\PnRTCnk.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\VaAiaQU.exe
  C:\Windows\System\VaAiaQU.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\LtOKLTJ.exe
  C:\Windows\System\LtOKLTJ.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\IIgMMQS.exe
  C:\Windows\System\IIgMMQS.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\JIUVgNG.exe
  C:\Windows\System\JIUVgNG.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\kwmCJxM.exe
  C:\Windows\System\kwmCJxM.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\wBqGgKn.exe
  C:\Windows\System\wBqGgKn.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\PQmBFTR.exe
  C:\Windows\System\PQmBFTR.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\prqcnQw.exe
  C:\Windows\System\prqcnQw.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\ltxnrow.exe
  C:\Windows\System\ltxnrow.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\oKOgIfW.exe
  C:\Windows\System\oKOgIfW.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\JXNlayt.exe
  C:\Windows\System\JXNlayt.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\iwcOVuF.exe
  C:\Windows\System\iwcOVuF.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\GyqldMu.exe
  C:\Windows\System\GyqldMu.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\VvmzbRn.exe
  C:\Windows\System\VvmzbRn.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\yMiyGWm.exe
  C:\Windows\System\yMiyGWm.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\fLvpTLo.exe
  C:\Windows\System\fLvpTLo.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\iNMDxqF.exe
  C:\Windows\System\iNMDxqF.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\XElfPmE.exe
  C:\Windows\System\XElfPmE.exe
  2⤵
  - Executes dropped EXE
  PID:4424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

GyqldMu.exe

Path C:\Windows\System\GyqldMu.exe
Size 5.9MB
SHA256 fccda9474d5a517adf0b40a1a6b14dd846153ff621fcefdec5291ecce02cd781
MD5 cafef5eae02b4ac3f551db1f9f1db9cc
SHA1 9046b4eb41de9c908060b6232a8dd96dc2f5efe9
SHA512 9ebf35517b263a1b64a2c5efb6c0cbaee3b09b3f04af14b7fb51bf25c84fe4dc95728cf40324e5d2f59aa7bcdb501ad1baee2a16ebf3c3f1614f4e47b34cdc63
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

IIgMMQS.exe

Path C:\Windows\System\IIgMMQS.exe
Size 5.9MB
SHA256 58532ccf753cff699c32db6fc9999c98fcb479ac4472aa407f2be549b638c651
MD5 b48b2201e1af7b9ae94b71901466ab7b
SHA1 f5eceea203a763aec9f0708f568477ac21a5162b
SHA512 051d075e9981247705c2ffaea10f4abdc1a06c4256a049e164ebbd0cd92f66cea66b0632c93aaa2c0d4e6c23badd19aa44374e7f9c83e793c650b4e65c645696
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

JIUVgNG.exe

Path C:\Windows\System\JIUVgNG.exe
Size 5.9MB
SHA256 9292ea2f27fe23dbaf2a5503b741a19c3da5c8f64d2eaaf1abc79be35292a31c
MD5 a16ceecb91fac1deeda6c846d8acf32d
SHA1 516c6b1a30bb053168d31f9c5227596743c357f5
SHA512 256397c9dedcde651af42f17963780a1e310c4b8f634785b74b59355573358f85ffb9b6ab939b63421636148d45264851f954871a3e55e8989476466e0c90d4b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

JXNlayt.exe

Path C:\Windows\System\JXNlayt.exe
Size 5.9MB
SHA256 99f139bfca4023790f9171a1764f0e4412c544a1a8fd32c00dbff7d1badae919
MD5 aec960fa9f46800e97fcb3f0bf30e026
SHA1 7d852b5851b64ddf6ce29dc38caaaa0c151f525c
SHA512 c5ed4adb536de5bd0a01809092e40cad89c5f9e76fe514ee725f71f6fbc4b3d5bfe9b622cdeab297c92436fcc846a71e8732212219105a32a8da607a7097ca5d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

KIXIsVO.exe

Path C:\Windows\System\KIXIsVO.exe
Size 5.9MB
SHA256 283c1ba04431fecf16a0f4814d7981452b5b97ad48359d038427ae3550e8b866
MD5 053d6e89157e09dc79e380a35a38c2d3
SHA1 1d387b2385c3533b0d495006e8954adbc01776c7
SHA512 85758bc59056c0a7315e2295317cfd45fce86c49f6840411947f5caf15642e94ccd55c2ad767711a5acc53a269cd604f6295cda17adb64fa90c24bcc57bba430
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

LtOKLTJ.exe

Path C:\Windows\System\LtOKLTJ.exe
Size 5.9MB
SHA256 1a045f6204a305d9467d77041bb7dee66b2dd1663bb01b08973acf11e98f2111
MD5 e320d433187e0e6694638ebd2cab7087
SHA1 97a9c2fe97a01bac6c8458d826c11640bc020e98
SHA512 d16a52a5f9d15daa693d17b6ad9caa245f779be72cf66ebaaf368e2d8e990579fb2c6e24a398cb9ee1062eac89c468117af2692a2e2c0e24142ecbf4d46d1dd4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

PQmBFTR.exe

Path C:\Windows\System\PQmBFTR.exe
Size 5.9MB
SHA256 1ef1cd6a3864084308fac6f473a939fb3552d646d928b1ec6dfa7ec78a3c31cb
MD5 6eb3192e80e2cde0d01ad7217f722766
SHA1 b5590ffdd656bc969f4c297cb47d632ea6312dec
SHA512 b0d67f1ae714bd7ef61877759bdbc835ced75e552ba799f7f5e7e347f971d5414ee0736a4ac374be0ea40783f31f090f461aad030f485046d75006a2d2408ffb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

PnRTCnk.exe

Path C:\Windows\System\PnRTCnk.exe
Size 5.9MB
SHA256 10897004dbd732263c7d8a2e176b8e03619f95d4d10ca00317149847bcbeb015
MD5 8edbbbb7cd395a096ceccff7da53dec3
SHA1 1dcccca096995544dfb7954be0d877d4393238a8
SHA512 3749b7456c179c709be6eeca21d366d23335a27119be8bcfea67c98474ceccce5ba4246d3d93723a5ffd4f927dbe1e0209aa47ba8e5e3812326be999aecb6c38
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:Q+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

VaAiaQU.exe

Path C:\Windows\System\VaAiaQU.exe
Size 5.9MB
SHA256 b1107647e92db2a4ca1ae4377ff3fc02bee57cac645f07b4486b6501482785a3
MD5 c8d8a0a32f1b35e492c93ee8e55f907f
SHA1 18d50ff3eb76ba7e74bad4b02ee3fa9f6f744ab8
SHA512 b24a5ef688fa0be89bf146f6e63ef6df7159eaa2a1a6c48ca698a21652af70a1b73468e1c0d0b63e1b20b5938a5c24ddb1a6c351ed71a74786693c7fc479e932
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:Q+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

VvmzbRn.exe

Path C:\Windows\System\VvmzbRn.exe
Size 5.9MB
SHA256 4cf6ff8f38c478eb2949ac5c107db50593d35d38d1bd21eb09bc7ed0cce91d56
MD5 448c54cd4a733aae29bbb0fc6c7ab0cb
SHA1 dd93d50598032a3d949cce032b08ed3dc102a81b
SHA512 81f65ecc8e475ba9c145dc74c130295963f37cbf7f57828506ec670412dbb20860ab25642cbba291aa081de0117f6bc6e71822b30a697dc14272cfd02f032ade
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

XElfPmE.exe

Path C:\Windows\System\XElfPmE.exe
Size 5.9MB
SHA256 8d6dab8182e832b012744d678b9e234a9646ec5cf4977e4d3eab5742d5f2ad69
MD5 b8ef2fd886cb4203bc36c8fd7d5d1efc
SHA1 1c27c3a411de4164d2da4cb14582efcd4329ab71
SHA512 08b478fcc85b8b9b80556e67f6b8b8fe7f0dcfc3f3e8d06a4720ed7226a598cb35f018fd318012178fe10a245004b975d4e64a8867e2a2fee684eeb15b984792
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

cBubopG.exe

Path C:\Windows\System\cBubopG.exe
Size 5.9MB
SHA256 61c44ba6cb777be3c04aaa64cd7a44dfaac5c18f1f73ac0b6b11020acf3e02d5
MD5 b6d4e5f550d87612cda6eb9e1309d501
SHA1 8dca5e0d391d0f818dc0560275e1b3ab92971629
SHA512 34e26132c979f0d99da3a44a5208dc53b9f7bb4f7ad0661492c385debb4b083840dbbc1854786c84d7d1c5f334cccb7096580092ff2455a2ccfe9c8947056310
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

fLvpTLo.exe

Path C:\Windows\System\fLvpTLo.exe
Size 5.9MB
SHA256 235090a16e45ca20b377b5bff075ce494a3cf29d190a01a606b73b5a1a4b6e6e
MD5 9fbe8cc2ef19debc72c39947532d6358
SHA1 9f4e57aad8a0ed4249dc39842ec7860b19645e6b
SHA512 0ea7730359d24a8dbce6b0f963567f96cb10579852288ab9d7ae9de1f95ae3abd9231c607b490c82370758fec6ada317a6f9ebcae70e215642beb2d8effea865
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

iNMDxqF.exe

Path C:\Windows\System\iNMDxqF.exe
Size 5.9MB
SHA256 2443560737188de4ec3cd154b2d4b4eb2dd2712752fb17bdf7408cfc2d40c49d
MD5 d15315b72201f6d0abe312a2c1377b1c
SHA1 b4c509b73b88f1dc67b19af8f0c02501f4ba92ad
SHA512 47374fc98c7f1661d2b6d58de5d0a64b97ab7e0f91b0d27db59dd25cb276a02de2af40a763222630126433464d4dceb53b66058eba790cbe2ba0e82e247facf1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

iwcOVuF.exe

Path C:\Windows\System\iwcOVuF.exe
Size 5.9MB
SHA256 cbbf321ac36b90f5b24b7d8238b3289a12027543657d7b06112f31fa90982704
MD5 56251fcaefdca2d60920158e18b8d29e
SHA1 b1914a9e6526797c3f08951d8a39b73e249834cc
SHA512 e68a51f6ee47aa63ebf1e0c8ff158ee21a20021ba5aa9f4887bbc13431ed60bc5e5a932aa2c38ef9f0d32c64bccced7cc4f994f422cc948c68a4b1792950d56e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

kwmCJxM.exe

Path C:\Windows\System\kwmCJxM.exe
Size 5.9MB
SHA256 3b71770c59350cfe818b36e67f47d8ce837958a50a2fa6b381d0fbb82183a847
MD5 4fa5ddf48d3a6906ec4ea7264a776cb1
SHA1 18d1725316bfc898e20ec4839538119e57519b40
SHA512 92b8dd76f0032bfe1170b0db04d5aa96c83c0eb133be571d9e94edcb6bad0e06f81df61b33985eeea994ba7bedb982d2e9f62173e34a726457a4653cc4d4e7a9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

ltxnrow.exe

Path C:\Windows\System\ltxnrow.exe
Size 5.9MB
SHA256 6576c6030d9f685435e2da3e2d26092fab0ed6766fb390e85f46b81ccee60612
MD5 1ec7bf50d2d52e338e524af772947a8b
SHA1 eaa7523d18b003afa99323e1afbab1f37d0eefd2
SHA512 e642ca45c05572a47c4920438f5d876ff352aa8c7f4018883b6298285b41ab02c2e787f563d00124007c1d2203830b02344263c7df9f3a60d293d7f0bad55faf
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

oKOgIfW.exe

Path C:\Windows\System\oKOgIfW.exe
Size 5.9MB
SHA256 6214c9becb552e376844e2cef2cf9fd7a152bcd3c6459278abcc79223851957a
MD5 a6b6fb837147f9bcd31188c7ea5f5805
SHA1 641173e9d10b33176eee92bd3fec9009ea20aa7f
SHA512 8b37fcfd73db4a445fd949803bf3d6a8cd89ee111a7c25a20e8cda16aa1a0e8e925adb020b2fef2b715ed2738d1fabb1e57191f5af8ba672f945468318fb39b3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

prqcnQw.exe

Path C:\Windows\System\prqcnQw.exe
Size 5.9MB
SHA256 2f21d05a80ae3cad4ff3a35abc4f000a67eedba32fa31ad9ba39708ed1be277a
MD5 cb5d65c6b1b21143f84df18f05621ba4
SHA1 d9e14ffb683dd946262f1e10d044cbdea30dfda6
SHA512 c7a28f7a1c35c72914618ad1ad3622ece117f7ec4292f24195e55f5f5367e6330d8c458ffd0124f759cc99f9f50e68981ce45cc11ef510c56a25f5d5a078a432
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

wBqGgKn.exe

Path C:\Windows\System\wBqGgKn.exe
Size 5.9MB
SHA256 6f94cdfb93a9562fdc66a64f8a6d8777a53eb4d99cb22ce60a882345da9efe10
MD5 d31ff11c99391985f7cbe4f5d6874dfe
SHA1 b24dfb0efeb896358e4cca867d8cd79ec0f4698e
SHA512 045266eecf5e85ca7f469df3c1e3265d896a1dc6636626345ab9ac9e2913334c4ccd2be974d01e23e1120ba74a9ce1787f214f902ae31e422258300848f07b76
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

yMiyGWm.exe

Path C:\Windows\System\yMiyGWm.exe
Size 5.9MB
SHA256 cbdbb5a7cc11e6b55a8e9d74d94dbb1faa3ffde83b84707b1f575aaba17d6156
MD5 0608b4c6b27832eb27ca188402609ec5
SHA1 b1215ca32c2e64171a1f8f3a986dcbe83c1a48f8
SHA512 94bfd8aa6a37f528cf59ce29cbc7b275b1c9f72fc5a10b2412e032dc07c1f026003dc8a47dc9a4e267d8b4b334dc182c10e59d961644c2e03ca1fca7416b9ac6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/456-136-0x00007FF6F8160000-0x00007FF6F84B4000-memory.dmp

Download

memory/456-76-0x00007FF6F8160000-0x00007FF6F84B4000-memory.dmp

Download

memory/456-151-0x00007FF6F8160000-0x00007FF6F84B4000-memory.dmp

Download

memory/544-12-0x00007FF732C60000-0x00007FF732FB4000-memory.dmp

Download

memory/544-81-0x00007FF732C60000-0x00007FF732FB4000-memory.dmp

Download

memory/544-141-0x00007FF732C60000-0x00007FF732FB4000-memory.dmp

Download

memory/752-132-0x00007FF63B3A0000-0x00007FF63B6F4000-memory.dmp

Download

memory/752-159-0x00007FF63B3A0000-0x00007FF63B6F4000-memory.dmp

Download

memory/760-100-0x00007FF784C20000-0x00007FF784F74000-memory.dmp

Download

memory/760-153-0x00007FF784C20000-0x00007FF784F74000-memory.dmp

Download

memory/1396-157-0x00007FF63B8A0000-0x00007FF63BBF4000-memory.dmp

Download

memory/1396-109-0x00007FF63B8A0000-0x00007FF63BBF4000-memory.dmp

Download

memory/1396-138-0x00007FF63B8A0000-0x00007FF63BBF4000-memory.dmp

Download

memory/2108-144-0x00007FF6140D0000-0x00007FF614424000-memory.dmp

Download

memory/2108-30-0x00007FF6140D0000-0x00007FF614424000-memory.dmp

Download

memory/2108-116-0x00007FF6140D0000-0x00007FF614424000-memory.dmp

Download

memory/2292-42-0x00007FF601250000-0x00007FF6015A4000-memory.dmp

Download

memory/2292-134-0x00007FF601250000-0x00007FF6015A4000-memory.dmp

Download

memory/2292-146-0x00007FF601250000-0x00007FF6015A4000-memory.dmp

Download

memory/2648-61-0x00007FF7CADA0000-0x00007FF7CB0F4000-memory.dmp

Download

memory/2648-135-0x00007FF7CADA0000-0x00007FF7CB0F4000-memory.dmp

Download

memory/2648-149-0x00007FF7CADA0000-0x00007FF7CB0F4000-memory.dmp

Download

memory/2780-25-0x00007FF6825F0000-0x00007FF682944000-memory.dmp

Download

memory/2780-143-0x00007FF6825F0000-0x00007FF682944000-memory.dmp

Download

memory/2780-98-0x00007FF6825F0000-0x00007FF682944000-memory.dmp

Download

memory/2980-130-0x00007FF68A680000-0x00007FF68A9D4000-memory.dmp

Download

memory/2980-145-0x00007FF68A680000-0x00007FF68A9D4000-memory.dmp

Download

memory/2980-36-0x00007FF68A680000-0x00007FF68A9D4000-memory.dmp

Download

memory/3428-69-0x00007FF672CA0000-0x00007FF672FF4000-memory.dmp

Download

memory/3428-150-0x00007FF672CA0000-0x00007FF672FF4000-memory.dmp

Download

memory/3452-20-0x00007FF6E9F20000-0x00007FF6EA274000-memory.dmp

Download

memory/3452-142-0x00007FF6E9F20000-0x00007FF6EA274000-memory.dmp

Download

memory/3808-121-0x00007FF62DF20000-0x00007FF62E274000-memory.dmp

Download

memory/3808-156-0x00007FF62DF20000-0x00007FF62E274000-memory.dmp

Download

memory/3868-155-0x00007FF6229A0000-0x00007FF622CF4000-memory.dmp

Download

memory/3868-137-0x00007FF6229A0000-0x00007FF622CF4000-memory.dmp

Download

memory/3868-104-0x00007FF6229A0000-0x00007FF622CF4000-memory.dmp

Download

memory/3904-152-0x00007FF671F10000-0x00007FF672264000-memory.dmp

Download

memory/3904-95-0x00007FF671F10000-0x00007FF672264000-memory.dmp

Download

memory/4068-101-0x00007FF737870000-0x00007FF737BC4000-memory.dmp

Download

memory/4068-154-0x00007FF737870000-0x00007FF737BC4000-memory.dmp

Download

memory/4424-133-0x00007FF733EE0000-0x00007FF734234000-memory.dmp

Download

memory/4424-160-0x00007FF733EE0000-0x00007FF734234000-memory.dmp

Download

memory/4776-0-0x00007FF6759B0000-0x00007FF675D04000-memory.dmp

Download

memory/4776-66-0x00007FF6759B0000-0x00007FF675D04000-memory.dmp

Download

memory/4776-1-0x0000016AFE0A0000-0x0000016AFE0B0000-memory.dmp

Download

memory/4884-8-0x00007FF607020000-0x00007FF607374000-memory.dmp

Download

memory/4884-73-0x00007FF607020000-0x00007FF607374000-memory.dmp

Download

memory/4884-140-0x00007FF607020000-0x00007FF607374000-memory.dmp

Download

memory/4920-115-0x00007FF752160000-0x00007FF7524B4000-memory.dmp

Download

memory/4920-158-0x00007FF752160000-0x00007FF7524B4000-memory.dmp

Download

memory/4920-139-0x00007FF752160000-0x00007FF7524B4000-memory.dmp

Download

memory/4984-59-0x00007FF71B640000-0x00007FF71B994000-memory.dmp

Download

memory/4984-148-0x00007FF71B640000-0x00007FF71B994000-memory.dmp

Download

memory/5108-50-0x00007FF7CAF70000-0x00007FF7CB2C4000-memory.dmp

Download

memory/5108-147-0x00007FF7CAF70000-0x00007FF7CB2C4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads