cobaltstrike | a37dfed9e6f606b7bac6f7aff22b4624e4f670c00a8abc2b229dca8477271bcc

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240527-js5zcaea38
SHA256 a37dfed9e6f606b7bac6f7aff22b4624e4f670c00a8abc2b229dca8477271bcc
MD5 ceed0bb40210f6312bb3f6a08cada978
SHA1 0f97b465422a87a370ff35b027e0c00d23959198
SHA512 b8106ba352cd6ea9a55cf01541f881cfd0dd2374255c1120215fa0465558602c36845634ea63075684e6f3a13d7c340262ae6ac909358891d4bdf77538f004b5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023413-5.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023414-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023415-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023416-23.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-29.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023418-34.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023419-41.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341a-47.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341b-55.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341e-82.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341f-90.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023420-94.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023421-102.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023422-108.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023424-114.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023425-119.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023423-110.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341d-86.dat	cobalt_reflective_dll
behavioral2/files/0x0003000000022978-78.dat	cobalt_reflective_dll
behavioral2/files/0x0005000000022ac6-72.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341c-68.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023413-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023414-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023415-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023416-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023418-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023419-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341a-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341b-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341e-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341f-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023420-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023421-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023422-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023424-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023425-119.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023423-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341d-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0003000000022978-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0005000000022ac6-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341c-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4556-0-0x00007FF718500000-0x00007FF718854000-memory.dmp	UPX
behavioral2/files/0x0008000000023413-5.dat	UPX
behavioral2/memory/3492-6-0x00007FF74FA10000-0x00007FF74FD64000-memory.dmp	UPX
behavioral2/files/0x0007000000023414-11.dat	UPX
behavioral2/files/0x0007000000023415-10.dat	UPX
behavioral2/memory/1396-14-0x00007FF6F7700000-0x00007FF6F7A54000-memory.dmp	UPX
behavioral2/memory/3160-18-0x00007FF627840000-0x00007FF627B94000-memory.dmp	UPX
behavioral2/files/0x0007000000023416-23.dat	UPX
behavioral2/files/0x0007000000023417-29.dat	UPX
behavioral2/files/0x0007000000023418-34.dat	UPX
behavioral2/memory/4924-35-0x00007FF79BE00000-0x00007FF79C154000-memory.dmp	UPX
behavioral2/files/0x0007000000023419-41.dat	UPX
behavioral2/memory/4536-44-0x00007FF603AC0000-0x00007FF603E14000-memory.dmp	UPX
behavioral2/files/0x000700000002341a-47.dat	UPX
behavioral2/memory/2188-48-0x00007FF71F8B0000-0x00007FF71FC04000-memory.dmp	UPX
behavioral2/memory/4384-43-0x00007FF6AC030000-0x00007FF6AC384000-memory.dmp	UPX
behavioral2/memory/3572-24-0x00007FF646650000-0x00007FF6469A4000-memory.dmp	UPX
behavioral2/files/0x000700000002341b-55.dat	UPX
behavioral2/memory/4280-71-0x00007FF6E1600000-0x00007FF6E1954000-memory.dmp	UPX
behavioral2/memory/3904-75-0x00007FF6BB680000-0x00007FF6BB9D4000-memory.dmp	UPX
behavioral2/files/0x000700000002341e-82.dat	UPX
behavioral2/files/0x000700000002341f-90.dat	UPX
behavioral2/files/0x0007000000023420-94.dat	UPX
behavioral2/files/0x0007000000023421-102.dat	UPX
behavioral2/files/0x0007000000023422-108.dat	UPX
behavioral2/files/0x0007000000023424-114.dat	UPX
behavioral2/files/0x0007000000023425-119.dat	UPX
behavioral2/files/0x0007000000023423-110.dat	UPX
behavioral2/files/0x000700000002341d-86.dat	UPX
behavioral2/memory/892-85-0x00007FF71C790000-0x00007FF71CAE4000-memory.dmp	UPX
behavioral2/memory/3492-81-0x00007FF74FA10000-0x00007FF74FD64000-memory.dmp	UPX
behavioral2/files/0x0003000000022978-78.dat	UPX
behavioral2/files/0x0005000000022ac6-72.dat	UPX
behavioral2/files/0x000700000002341c-68.dat	UPX
behavioral2/memory/4556-63-0x00007FF718500000-0x00007FF718854000-memory.dmp	UPX
behavioral2/memory/3552-58-0x00007FF6E7360000-0x00007FF6E76B4000-memory.dmp	UPX
behavioral2/memory/3472-121-0x00007FF62BD30000-0x00007FF62C084000-memory.dmp	UPX
behavioral2/memory/4136-122-0x00007FF65ABB0000-0x00007FF65AF04000-memory.dmp	UPX
behavioral2/memory/3124-123-0x00007FF643D20000-0x00007FF644074000-memory.dmp	UPX
behavioral2/memory/752-124-0x00007FF6C9120000-0x00007FF6C9474000-memory.dmp	UPX
behavioral2/memory/1280-125-0x00007FF7896F0000-0x00007FF789A44000-memory.dmp	UPX
behavioral2/memory/2076-126-0x00007FF7E82F0000-0x00007FF7E8644000-memory.dmp	UPX
behavioral2/memory/4948-127-0x00007FF7C2D00000-0x00007FF7C3054000-memory.dmp	UPX
behavioral2/memory/4312-128-0x00007FF6B2CF0000-0x00007FF6B3044000-memory.dmp	UPX
behavioral2/memory/3160-130-0x00007FF627840000-0x00007FF627B94000-memory.dmp	UPX
behavioral2/memory/396-129-0x00007FF6537C0000-0x00007FF653B14000-memory.dmp	UPX
behavioral2/memory/3572-131-0x00007FF646650000-0x00007FF6469A4000-memory.dmp	UPX
behavioral2/memory/4384-132-0x00007FF6AC030000-0x00007FF6AC384000-memory.dmp	UPX
behavioral2/memory/2188-133-0x00007FF71F8B0000-0x00007FF71FC04000-memory.dmp	UPX
behavioral2/memory/3552-134-0x00007FF6E7360000-0x00007FF6E76B4000-memory.dmp	UPX
behavioral2/memory/4280-135-0x00007FF6E1600000-0x00007FF6E1954000-memory.dmp	UPX
behavioral2/memory/3904-136-0x00007FF6BB680000-0x00007FF6BB9D4000-memory.dmp	UPX
behavioral2/memory/3492-137-0x00007FF74FA10000-0x00007FF74FD64000-memory.dmp	UPX
behavioral2/memory/1396-138-0x00007FF6F7700000-0x00007FF6F7A54000-memory.dmp	UPX
behavioral2/memory/3160-139-0x00007FF627840000-0x00007FF627B94000-memory.dmp	UPX
behavioral2/memory/3572-140-0x00007FF646650000-0x00007FF6469A4000-memory.dmp	UPX
behavioral2/memory/4924-141-0x00007FF79BE00000-0x00007FF79C154000-memory.dmp	UPX
behavioral2/memory/4384-142-0x00007FF6AC030000-0x00007FF6AC384000-memory.dmp	UPX
behavioral2/memory/4536-143-0x00007FF603AC0000-0x00007FF603E14000-memory.dmp	UPX
behavioral2/memory/2188-144-0x00007FF71F8B0000-0x00007FF71FC04000-memory.dmp	UPX
behavioral2/memory/3552-145-0x00007FF6E7360000-0x00007FF6E76B4000-memory.dmp	UPX
behavioral2/memory/4280-146-0x00007FF6E1600000-0x00007FF6E1954000-memory.dmp	UPX
behavioral2/memory/4136-147-0x00007FF65ABB0000-0x00007FF65AF04000-memory.dmp	UPX
behavioral2/memory/892-149-0x00007FF71C790000-0x00007FF71CAE4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4556-0-0x00007FF718500000-0x00007FF718854000-memory.dmp	xmrig
behavioral2/files/0x0008000000023413-5.dat	xmrig
behavioral2/memory/3492-6-0x00007FF74FA10000-0x00007FF74FD64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-11.dat	xmrig
behavioral2/files/0x0007000000023415-10.dat	xmrig
behavioral2/memory/1396-14-0x00007FF6F7700000-0x00007FF6F7A54000-memory.dmp	xmrig
behavioral2/memory/3160-18-0x00007FF627840000-0x00007FF627B94000-memory.dmp	xmrig
behavioral2/files/0x0007000000023416-23.dat	xmrig
behavioral2/files/0x0007000000023417-29.dat	xmrig
behavioral2/files/0x0007000000023418-34.dat	xmrig
behavioral2/memory/4924-35-0x00007FF79BE00000-0x00007FF79C154000-memory.dmp	xmrig
behavioral2/files/0x0007000000023419-41.dat	xmrig
behavioral2/memory/4536-44-0x00007FF603AC0000-0x00007FF603E14000-memory.dmp	xmrig
behavioral2/files/0x000700000002341a-47.dat	xmrig
behavioral2/memory/2188-48-0x00007FF71F8B0000-0x00007FF71FC04000-memory.dmp	xmrig
behavioral2/memory/4384-43-0x00007FF6AC030000-0x00007FF6AC384000-memory.dmp	xmrig
behavioral2/memory/3572-24-0x00007FF646650000-0x00007FF6469A4000-memory.dmp	xmrig
behavioral2/files/0x000700000002341b-55.dat	xmrig
behavioral2/memory/4280-71-0x00007FF6E1600000-0x00007FF6E1954000-memory.dmp	xmrig
behavioral2/memory/3904-75-0x00007FF6BB680000-0x00007FF6BB9D4000-memory.dmp	xmrig
behavioral2/files/0x000700000002341e-82.dat	xmrig
behavioral2/files/0x000700000002341f-90.dat	xmrig
behavioral2/files/0x0007000000023420-94.dat	xmrig
behavioral2/files/0x0007000000023421-102.dat	xmrig
behavioral2/files/0x0007000000023422-108.dat	xmrig
behavioral2/files/0x0007000000023424-114.dat	xmrig
behavioral2/files/0x0007000000023425-119.dat	xmrig
behavioral2/files/0x0007000000023423-110.dat	xmrig
behavioral2/files/0x000700000002341d-86.dat	xmrig
behavioral2/memory/892-85-0x00007FF71C790000-0x00007FF71CAE4000-memory.dmp	xmrig
behavioral2/memory/3492-81-0x00007FF74FA10000-0x00007FF74FD64000-memory.dmp	xmrig
behavioral2/files/0x0003000000022978-78.dat	xmrig
behavioral2/files/0x0005000000022ac6-72.dat	xmrig
behavioral2/files/0x000700000002341c-68.dat	xmrig
behavioral2/memory/4556-63-0x00007FF718500000-0x00007FF718854000-memory.dmp	xmrig
behavioral2/memory/3552-58-0x00007FF6E7360000-0x00007FF6E76B4000-memory.dmp	xmrig
behavioral2/memory/3472-121-0x00007FF62BD30000-0x00007FF62C084000-memory.dmp	xmrig
behavioral2/memory/4136-122-0x00007FF65ABB0000-0x00007FF65AF04000-memory.dmp	xmrig
behavioral2/memory/3124-123-0x00007FF643D20000-0x00007FF644074000-memory.dmp	xmrig
behavioral2/memory/752-124-0x00007FF6C9120000-0x00007FF6C9474000-memory.dmp	xmrig
behavioral2/memory/1280-125-0x00007FF7896F0000-0x00007FF789A44000-memory.dmp	xmrig
behavioral2/memory/2076-126-0x00007FF7E82F0000-0x00007FF7E8644000-memory.dmp	xmrig
behavioral2/memory/4948-127-0x00007FF7C2D00000-0x00007FF7C3054000-memory.dmp	xmrig
behavioral2/memory/4312-128-0x00007FF6B2CF0000-0x00007FF6B3044000-memory.dmp	xmrig
behavioral2/memory/3160-130-0x00007FF627840000-0x00007FF627B94000-memory.dmp	xmrig
behavioral2/memory/396-129-0x00007FF6537C0000-0x00007FF653B14000-memory.dmp	xmrig
behavioral2/memory/3572-131-0x00007FF646650000-0x00007FF6469A4000-memory.dmp	xmrig
behavioral2/memory/4384-132-0x00007FF6AC030000-0x00007FF6AC384000-memory.dmp	xmrig
behavioral2/memory/2188-133-0x00007FF71F8B0000-0x00007FF71FC04000-memory.dmp	xmrig
behavioral2/memory/3552-134-0x00007FF6E7360000-0x00007FF6E76B4000-memory.dmp	xmrig
behavioral2/memory/4280-135-0x00007FF6E1600000-0x00007FF6E1954000-memory.dmp	xmrig
behavioral2/memory/3904-136-0x00007FF6BB680000-0x00007FF6BB9D4000-memory.dmp	xmrig
behavioral2/memory/3492-137-0x00007FF74FA10000-0x00007FF74FD64000-memory.dmp	xmrig
behavioral2/memory/1396-138-0x00007FF6F7700000-0x00007FF6F7A54000-memory.dmp	xmrig
behavioral2/memory/3160-139-0x00007FF627840000-0x00007FF627B94000-memory.dmp	xmrig
behavioral2/memory/3572-140-0x00007FF646650000-0x00007FF6469A4000-memory.dmp	xmrig
behavioral2/memory/4924-141-0x00007FF79BE00000-0x00007FF79C154000-memory.dmp	xmrig
behavioral2/memory/4384-142-0x00007FF6AC030000-0x00007FF6AC384000-memory.dmp	xmrig
behavioral2/memory/4536-143-0x00007FF603AC0000-0x00007FF603E14000-memory.dmp	xmrig
behavioral2/memory/2188-144-0x00007FF71F8B0000-0x00007FF71FC04000-memory.dmp	xmrig
behavioral2/memory/3552-145-0x00007FF6E7360000-0x00007FF6E76B4000-memory.dmp	xmrig
behavioral2/memory/4280-146-0x00007FF6E1600000-0x00007FF6E1954000-memory.dmp	xmrig
behavioral2/memory/4136-147-0x00007FF65ABB0000-0x00007FF65AF04000-memory.dmp	xmrig
behavioral2/memory/892-149-0x00007FF71C790000-0x00007FF71CAE4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3492	IlsURCt.exe
1396	KviqvkO.exe
3160	yOZtTye.exe
3572	ApohCMl.exe
4924	yeQbING.exe
4384	HUrBWaO.exe
4536	yuubTVm.exe
2188	LlZLJaq.exe
3552	hmxiGir.exe
4280	usxQJdN.exe
3904	smwtYGM.exe
892	XlTOFxD.exe
3472	RgOBfZI.exe
4136	GmqtIAc.exe
3124	jCwCFxD.exe
396	wDwMbpW.exe
752	IEnjhyb.exe
1280	hJDEtOy.exe
2076	QKcnYxi.exe
4948	gVrEXCX.exe
4312	cYQXuAs.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4556-0-0x00007FF718500000-0x00007FF718854000-memory.dmp	upx
behavioral2/files/0x0008000000023413-5.dat	upx
behavioral2/memory/3492-6-0x00007FF74FA10000-0x00007FF74FD64000-memory.dmp	upx
behavioral2/files/0x0007000000023414-11.dat	upx
behavioral2/files/0x0007000000023415-10.dat	upx
behavioral2/memory/1396-14-0x00007FF6F7700000-0x00007FF6F7A54000-memory.dmp	upx
behavioral2/memory/3160-18-0x00007FF627840000-0x00007FF627B94000-memory.dmp	upx
behavioral2/files/0x0007000000023416-23.dat	upx
behavioral2/files/0x0007000000023417-29.dat	upx
behavioral2/files/0x0007000000023418-34.dat	upx
behavioral2/memory/4924-35-0x00007FF79BE00000-0x00007FF79C154000-memory.dmp	upx
behavioral2/files/0x0007000000023419-41.dat	upx
behavioral2/memory/4536-44-0x00007FF603AC0000-0x00007FF603E14000-memory.dmp	upx
behavioral2/files/0x000700000002341a-47.dat	upx
behavioral2/memory/2188-48-0x00007FF71F8B0000-0x00007FF71FC04000-memory.dmp	upx
behavioral2/memory/4384-43-0x00007FF6AC030000-0x00007FF6AC384000-memory.dmp	upx
behavioral2/memory/3572-24-0x00007FF646650000-0x00007FF6469A4000-memory.dmp	upx
behavioral2/files/0x000700000002341b-55.dat	upx
behavioral2/memory/4280-71-0x00007FF6E1600000-0x00007FF6E1954000-memory.dmp	upx
behavioral2/memory/3904-75-0x00007FF6BB680000-0x00007FF6BB9D4000-memory.dmp	upx
behavioral2/files/0x000700000002341e-82.dat	upx
behavioral2/files/0x000700000002341f-90.dat	upx
behavioral2/files/0x0007000000023420-94.dat	upx
behavioral2/files/0x0007000000023421-102.dat	upx
behavioral2/files/0x0007000000023422-108.dat	upx
behavioral2/files/0x0007000000023424-114.dat	upx
behavioral2/files/0x0007000000023425-119.dat	upx
behavioral2/files/0x0007000000023423-110.dat	upx
behavioral2/files/0x000700000002341d-86.dat	upx
behavioral2/memory/892-85-0x00007FF71C790000-0x00007FF71CAE4000-memory.dmp	upx
behavioral2/memory/3492-81-0x00007FF74FA10000-0x00007FF74FD64000-memory.dmp	upx
behavioral2/files/0x0003000000022978-78.dat	upx
behavioral2/files/0x0005000000022ac6-72.dat	upx
behavioral2/files/0x000700000002341c-68.dat	upx
behavioral2/memory/4556-63-0x00007FF718500000-0x00007FF718854000-memory.dmp	upx
behavioral2/memory/3552-58-0x00007FF6E7360000-0x00007FF6E76B4000-memory.dmp	upx
behavioral2/memory/3472-121-0x00007FF62BD30000-0x00007FF62C084000-memory.dmp	upx
behavioral2/memory/4136-122-0x00007FF65ABB0000-0x00007FF65AF04000-memory.dmp	upx
behavioral2/memory/3124-123-0x00007FF643D20000-0x00007FF644074000-memory.dmp	upx
behavioral2/memory/752-124-0x00007FF6C9120000-0x00007FF6C9474000-memory.dmp	upx
behavioral2/memory/1280-125-0x00007FF7896F0000-0x00007FF789A44000-memory.dmp	upx
behavioral2/memory/2076-126-0x00007FF7E82F0000-0x00007FF7E8644000-memory.dmp	upx
behavioral2/memory/4948-127-0x00007FF7C2D00000-0x00007FF7C3054000-memory.dmp	upx
behavioral2/memory/4312-128-0x00007FF6B2CF0000-0x00007FF6B3044000-memory.dmp	upx
behavioral2/memory/3160-130-0x00007FF627840000-0x00007FF627B94000-memory.dmp	upx
behavioral2/memory/396-129-0x00007FF6537C0000-0x00007FF653B14000-memory.dmp	upx
behavioral2/memory/3572-131-0x00007FF646650000-0x00007FF6469A4000-memory.dmp	upx
behavioral2/memory/4384-132-0x00007FF6AC030000-0x00007FF6AC384000-memory.dmp	upx
behavioral2/memory/2188-133-0x00007FF71F8B0000-0x00007FF71FC04000-memory.dmp	upx
behavioral2/memory/3552-134-0x00007FF6E7360000-0x00007FF6E76B4000-memory.dmp	upx
behavioral2/memory/4280-135-0x00007FF6E1600000-0x00007FF6E1954000-memory.dmp	upx
behavioral2/memory/3904-136-0x00007FF6BB680000-0x00007FF6BB9D4000-memory.dmp	upx
behavioral2/memory/3492-137-0x00007FF74FA10000-0x00007FF74FD64000-memory.dmp	upx
behavioral2/memory/1396-138-0x00007FF6F7700000-0x00007FF6F7A54000-memory.dmp	upx
behavioral2/memory/3160-139-0x00007FF627840000-0x00007FF627B94000-memory.dmp	upx
behavioral2/memory/3572-140-0x00007FF646650000-0x00007FF6469A4000-memory.dmp	upx
behavioral2/memory/4924-141-0x00007FF79BE00000-0x00007FF79C154000-memory.dmp	upx
behavioral2/memory/4384-142-0x00007FF6AC030000-0x00007FF6AC384000-memory.dmp	upx
behavioral2/memory/4536-143-0x00007FF603AC0000-0x00007FF603E14000-memory.dmp	upx
behavioral2/memory/2188-144-0x00007FF71F8B0000-0x00007FF71FC04000-memory.dmp	upx
behavioral2/memory/3552-145-0x00007FF6E7360000-0x00007FF6E76B4000-memory.dmp	upx
behavioral2/memory/4280-146-0x00007FF6E1600000-0x00007FF6E1954000-memory.dmp	upx
behavioral2/memory/4136-147-0x00007FF65ABB0000-0x00007FF65AF04000-memory.dmp	upx
behavioral2/memory/892-149-0x00007FF71C790000-0x00007FF71CAE4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\KviqvkO.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XlTOFxD.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IEnjhyb.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gVrEXCX.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\cYQXuAs.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yuubTVm.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\smwtYGM.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RgOBfZI.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GmqtIAc.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QKcnYxi.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jCwCFxD.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hJDEtOy.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IlsURCt.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ApohCMl.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LlZLJaq.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hmxiGir.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\usxQJdN.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yOZtTye.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yeQbING.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HUrBWaO.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wDwMbpW.exe	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 3492	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	84
PID 4556 wrote to memory of 3492	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	84
PID 4556 wrote to memory of 1396	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	85
PID 4556 wrote to memory of 1396	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	85
PID 4556 wrote to memory of 3160	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	86
PID 4556 wrote to memory of 3160	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	86
PID 4556 wrote to memory of 3572	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	89
PID 4556 wrote to memory of 3572	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	89
PID 4556 wrote to memory of 4924	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	90
PID 4556 wrote to memory of 4924	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	90
PID 4556 wrote to memory of 4384	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	91
PID 4556 wrote to memory of 4384	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	91
PID 4556 wrote to memory of 4536	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	92
PID 4556 wrote to memory of 4536	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	92
PID 4556 wrote to memory of 2188	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	93
PID 4556 wrote to memory of 2188	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	93
PID 4556 wrote to memory of 3552	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	94
PID 4556 wrote to memory of 3552	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	94
PID 4556 wrote to memory of 4280	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	96
PID 4556 wrote to memory of 4280	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	96
PID 4556 wrote to memory of 3904	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	97
PID 4556 wrote to memory of 3904	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	97
PID 4556 wrote to memory of 892	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	98
PID 4556 wrote to memory of 892	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	98
PID 4556 wrote to memory of 3472	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	99
PID 4556 wrote to memory of 3472	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	99
PID 4556 wrote to memory of 4136	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	100
PID 4556 wrote to memory of 4136	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	100
PID 4556 wrote to memory of 3124	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	101
PID 4556 wrote to memory of 3124	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	101
PID 4556 wrote to memory of 396	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	102
PID 4556 wrote to memory of 396	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	102
PID 4556 wrote to memory of 752	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	103
PID 4556 wrote to memory of 752	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	103
PID 4556 wrote to memory of 1280	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	104
PID 4556 wrote to memory of 1280	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	104
PID 4556 wrote to memory of 2076	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	105
PID 4556 wrote to memory of 2076	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	105
PID 4556 wrote to memory of 4948	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	106
PID 4556 wrote to memory of 4948	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	106
PID 4556 wrote to memory of 4312	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	107
PID 4556 wrote to memory of 4312	4556	2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe	107

C:\Users\Admin\AppData\Local\Temp\2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_ceed0bb40210f6312bb3f6a08cada978_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\System\IlsURCt.exe
  C:\Windows\System\IlsURCt.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\KviqvkO.exe
  C:\Windows\System\KviqvkO.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\yOZtTye.exe
  C:\Windows\System\yOZtTye.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\ApohCMl.exe
  C:\Windows\System\ApohCMl.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\yeQbING.exe
  C:\Windows\System\yeQbING.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\HUrBWaO.exe
  C:\Windows\System\HUrBWaO.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\yuubTVm.exe
  C:\Windows\System\yuubTVm.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\LlZLJaq.exe
  C:\Windows\System\LlZLJaq.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\hmxiGir.exe
  C:\Windows\System\hmxiGir.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\usxQJdN.exe
  C:\Windows\System\usxQJdN.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\smwtYGM.exe
  C:\Windows\System\smwtYGM.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\XlTOFxD.exe
  C:\Windows\System\XlTOFxD.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\RgOBfZI.exe
  C:\Windows\System\RgOBfZI.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\GmqtIAc.exe
  C:\Windows\System\GmqtIAc.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\jCwCFxD.exe
  C:\Windows\System\jCwCFxD.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\wDwMbpW.exe
  C:\Windows\System\wDwMbpW.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\IEnjhyb.exe
  C:\Windows\System\IEnjhyb.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\hJDEtOy.exe
  C:\Windows\System\hJDEtOy.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\QKcnYxi.exe
  C:\Windows\System\QKcnYxi.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\gVrEXCX.exe
  C:\Windows\System\gVrEXCX.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\cYQXuAs.exe
  C:\Windows\System\cYQXuAs.exe
  2⤵
  - Executes dropped EXE
  PID:4312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ApohCMl.exe

Path C:\Windows\System\ApohCMl.exe
Size 5.9MB
SHA256 c2b0c1a7b370e492c73779d56a8050dd059b79a6065aa6d525193c216d58997d
MD5 618a089da8cca8332a497cee0d7b98e3
SHA1 d544d85223b9f9a64bca7260c1533c9bd08d5c75
SHA512 c55010f0dd7bee9702dfdaa6e29c47a561fa9a4ad3e8ffbaa228feaa12aec820fa530cf9a186593cdad7a851a8ee0577c37f79bbe9c0b1c3509917021e738bc0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

GmqtIAc.exe

Path C:\Windows\System\GmqtIAc.exe
Size 5.9MB
SHA256 f95b6f947fa65a4f0de0be49e86243f72e404530dc2fe40aa4ac2a6cf3f0b8d2
MD5 7375041ae60843593e4a8dcd382913e3
SHA1 b3782381d443504cb4ac539945d7d1920af40f98
SHA512 8baa59c04f160f0153437b6c2ecf02755218519e78465a314ed277e86ec29a0ace4942a8788de7107a58c5423343b8066bbdc54df38bd867688ff93b73b640cd
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

HUrBWaO.exe

Path C:\Windows\System\HUrBWaO.exe
Size 5.9MB
SHA256 6deee6f2c8780ded875b6518b565f932d68782a445373279b55639098d8d9954
MD5 8d86580fdabc8e3511873e727945dd44
SHA1 99fc6e74759ce916579306c626f6d96bc4d9b3de
SHA512 7e52a3b038fca3679a80ebdf00d96280647913d105d4d6e1f38668a654c377f4b59a8e91ba0fab92f67208a34fad0a3e29a5c567d3ed91ceff9c354401c63aac
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

IEnjhyb.exe

Path C:\Windows\System\IEnjhyb.exe
Size 5.9MB
SHA256 9c50270c95816532ff0102f02627862d174930c657baa704cd2c5f945340faf3
MD5 701e9ae6d34837aa2fdb24b6844e66cd
SHA1 3c9737029232d4598231c55b729b39e7daecb4b9
SHA512 d80cbedd5113de0169bbd60c5fd0a58c16a9360529f1daa59694f36aff3b7efb681261d5a782e03e5a324a8a495b551eb2476c82b7640780182ec2f5e8f43364
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

IlsURCt.exe

Path C:\Windows\System\IlsURCt.exe
Size 5.9MB
SHA256 fa8cded9711cb7dd55f7106e25b8fa7869c47db655a57b6460f4fdc4e6940f5b
MD5 7aa7330ddb2de752ca7dc18b2956fe36
SHA1 f8fc8d77ff133d8d14db4ec5f767bedf7f8b96e0
SHA512 0bbf98c6039b65ba5352ed40f483a69ca718a86979c6759b5ef116a4a1b105164e7b5e6670054c7fe8d7bf8a9b5fc1655507f5b20288107087c8d1accd97aee2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:Q+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

KviqvkO.exe

Path C:\Windows\System\KviqvkO.exe
Size 5.9MB
SHA256 fc51146496c0889acdd960c40fafdf1cc65c1dce56ab3dba800e5d3ae4f9b9e7
MD5 ebc218ae3c1e4bfcefed1d6b70daf92e
SHA1 b27ed56cbd2bb6124653dbeeb860dba9afa6cda9
SHA512 7fac5dd3afa061a7ebeb65aa9700887f4da09d57cf84a0436815f59aa5f8cae54cf2963855be9938ad60718cd50e110a41919f69c3495ea326955b1e3920495d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

LlZLJaq.exe

Path C:\Windows\System\LlZLJaq.exe
Size 5.9MB
SHA256 fb014375ea924637c4280b7c647a83b13f15e683501f09b5e6438e1edc4da0b6
MD5 1052ef49928f374858627a8aff3ba182
SHA1 d3afb0f0c01d14a57613742480d6fa84b837ebe0
SHA512 b0db9c2c83d54dcb5633599e17cd1d9277937af84e47d8b2d0084935ed3bd2a245bf3baf1e706283482ce47d0e4450e2351a960421e6ca826cb52a31e14c5cff
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

QKcnYxi.exe

Path C:\Windows\System\QKcnYxi.exe
Size 5.9MB
SHA256 54e6569c776be4f25c82d2e47481dfad56e1f167a7151bd425f2860a5f6026e4
MD5 91dd69d4288b7fb1e0e82e6fbfdce4ab
SHA1 e7b7fe66cac161854196e53e8330abfc93077872
SHA512 f586cd648fd90757b5d45b4673fe5ab6181b71466a4206215b9de2c8cfc8dbf598dce29436447447acf4c48393bf339fe84b49e905e9f695ff72b1aade41d21e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:Q+856utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

RgOBfZI.exe

Path C:\Windows\System\RgOBfZI.exe
Size 5.9MB
SHA256 8da81faf5864bc494111260ab68bb8c8a1a315f5236998d0afffd6324f74b5db
MD5 f950d2a9984b81400845974ccb1487c7
SHA1 1e383e7bc90cb5d989ff520c899cbbb0688d0ee6
SHA512 344e5e75dfe081b6651cf16352c5689395075dec1c5e4ad136b7b74a03df9838e874ecb0a8f4f3a5cc1b663b85895ae147a4b44c391132014db8efc8291e9a68
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

XlTOFxD.exe

Path C:\Windows\System\XlTOFxD.exe
Size 5.9MB
SHA256 afe5b059bce71e1fa82f7ccbfa9b4f99b2211dd399a074f0bfca4113dd694a90
MD5 de5a866c1d13e4a07bd2ca41a02cca63
SHA1 15578d43a49967554d8f2a37433c83eb9361209b
SHA512 a54d5f46fd706b295c973ba3d19f851e468c8887fb8c36f790a0e7bca71c951ffc8a4933486720ff08edacbfd5bffc358ed938991febb0c2673721417aa76896
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

cYQXuAs.exe

Path C:\Windows\System\cYQXuAs.exe
Size 5.9MB
SHA256 e1b732074b2f34a460e56cb1c0732c5fdc381b2d6ec3bdedd0c8e72ee70aff07
MD5 e59100941e9e741ee5d7ab71a9c72514
SHA1 37daf8c1a077c22a13bdc2641954c4a5eed85471
SHA512 434bacf368e9fadc6fd3f9f2ae18942ac769670315374c7ad95b8f07b224d9c02c534f85f2ef55e62802aa138fe58cbd9030cd6f93980b298f9cb58485d97073
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

gVrEXCX.exe

Path C:\Windows\System\gVrEXCX.exe
Size 5.9MB
SHA256 3bb9f00445528504e256b0669efb4354ab059a060caeff729d3fd61e61c70c39
MD5 e515ce71cee934be0548f53e953a071c
SHA1 0d2d9bc2d282c2a1d800249430d1c8549c1d9421
SHA512 c2a3d1b0ac6d5e9f92a793e1d9cf19b7c15ff8fac3e3047f523f9355db2500a681ce2a227e6b0d76aa1adc414823643ab993b9fc2fdba6a7c0abd3043d0f3125
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

hJDEtOy.exe

Path C:\Windows\System\hJDEtOy.exe
Size 5.9MB
SHA256 b311e778e694ed745b0972958b01bde9625851e9cfb72a9d2bd9da9b20adb464
MD5 77dfb23fdcde449b57773769327be81d
SHA1 fce86ca67b253b1a8bfbe12cc76b028c574ae188
SHA512 9883d1ebe390db202a1b1b3c8a82062b53664cedbde310067718c07e31e5b34e416ca63ef42d75b58bad63ff7667071d3973d59c557dba0f59a67129bea79f36
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:Q+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

hmxiGir.exe

Path C:\Windows\System\hmxiGir.exe
Size 5.9MB
SHA256 692ee7e2e6bbc10bc7f96a790943e3a92b4f40058e82ccf329b48f43cb7ef695
MD5 1d49f0eed79db616398ca820ebeb3e5c
SHA1 d7e6c0ab6271960183e8f024f1258bc6928bfabc
SHA512 28512057389ba94b23dd9f00f64c2cc7b583bd669415e97b1625b77d744bd604e2dfddcfd2e8b5994ef6900913b028ea674483767325a43d2f6719f0edecb1c7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

jCwCFxD.exe

Path C:\Windows\System\jCwCFxD.exe
Size 5.9MB
SHA256 b303f70219151ccf1a603886b908a6ca0eef6c394e36b3ddfce19754893aa4e0
MD5 3cc1448be4758eb130993d5808c3c8aa
SHA1 b4ec7d4989eee2f23f85d9f72f64140169a51834
SHA512 32f9fdc889eae69c90a38136148095d3c214f292966b999a2f18cbbda48af58d40b7f31d9eb69a6f00ba2cc3a8490fdc00e9c62eb77b02bc6172d9d61ce5f4ec
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

smwtYGM.exe

Path C:\Windows\System\smwtYGM.exe
Size 5.9MB
SHA256 637efe25096755576a0b01534b4075018096e867c201f7056f16b8434a34b48a
MD5 df382b774ceefaf48c1a6d68cdc73185
SHA1 c6446b7aa4a9e9d3ca94dcc113cdd75b38c47ff0
SHA512 3ccb5ea85c51159b3c640839e5c8d7aec6f3b79066e28994432037deea5a2c15a6564f9a21334ffdaa48a5916ee01ddd6a777c315fd797aceb3d874c51a4df2e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

usxQJdN.exe

Path C:\Windows\System\usxQJdN.exe
Size 5.9MB
SHA256 250778d6bbc0fd106c847388344374f8f27bc8fc024b7f2249e4fdb146b6a3c5
MD5 36d3d047be0089044f996ba564d43c51
SHA1 c667984c1d7735762db5e5e6d2dfe7e7dcb6c4f0
SHA512 68d99a02c9e573613566cc4f0dc74f1fc40ec953b62f13c01a1f05e059056ecc40a54be5ce28fe8a6cd0059f264f32fd7a66e16169bb8053e79b6ad0e5fd2584
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

wDwMbpW.exe

Path C:\Windows\System\wDwMbpW.exe
Size 5.9MB
SHA256 81cb02144158d26b3614195c3cb38976977cee541c561aa29d8685fa18e2e145
MD5 2b232a0da98a216cf2cbbd82f82e11b9
SHA1 0da2c23a2a31cfa7a524ebc3f96a0d656c8a1d57
SHA512 e7994a2bf24c1e7838b3e3dbba97f233ed5c35ca7a639eb61d6df8fbfeca502d52a2341c45fd222f426f65dfb36fc0cf034b79b9f5778a3050759dceccf13fef
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:Q+856utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

yOZtTye.exe

Path C:\Windows\System\yOZtTye.exe
Size 5.9MB
SHA256 db27b87d01fdad210adb3dc3882c5f66d2cbd695a59425ed24a221b957e1f449
MD5 cdb53f2e8219f6747847ff2ecd43780f
SHA1 6c9d2543e58b5aa168fa29f4f9aea7ba691f7403
SHA512 80ec3ec0681ba3a17a7093fa00b6e52fa2384d09ae203ca625acc87531cbc412eb762c36594adaf85fd0ede2ae281e3432fcffd09b1af7dc4c64529cddeb0571
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

yeQbING.exe

Path C:\Windows\System\yeQbING.exe
Size 5.9MB
SHA256 fb90c6ec2d3acaf44a0c8e1532ab893a31701d2120afb86ea9647bd8a04812d1
MD5 a4aa9dae4caaa1a63fb8e96659fa87ba
SHA1 2017c7f26542573b89ef79be530e90bfe0adb8d3
SHA512 5403befeaf078a6aad6a9a1f950c922b384c143d0372da265656524adeacdef4a749bab359833e7ce155e6d153d34df31f94de58ff402cbfca842f739c531a45
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:Q+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

yuubTVm.exe

Path C:\Windows\System\yuubTVm.exe
Size 5.9MB
SHA256 9254178bcd28bd79c0f614a55f725769b297b71636c466551f7a3eb85e177f87
MD5 f0557f82677cc37888b41600faf516ce
SHA1 f8f778f3150cf7356ea7d6d848f5e11bd6d73b8d
SHA512 20e981f2cda21257741ce5c865c4af5ae4177e42ccf483da1c26e9e86186cd6d4faab469d700f847949e22e1dee3eb54b176446703b97815887cde91bb4a7e67
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/396-129-0x00007FF6537C0000-0x00007FF653B14000-memory.dmp

Download

memory/396-155-0x00007FF6537C0000-0x00007FF653B14000-memory.dmp

Download

memory/752-124-0x00007FF6C9120000-0x00007FF6C9474000-memory.dmp

Download

memory/752-153-0x00007FF6C9120000-0x00007FF6C9474000-memory.dmp

Download

memory/892-85-0x00007FF71C790000-0x00007FF71CAE4000-memory.dmp

Download

memory/892-149-0x00007FF71C790000-0x00007FF71CAE4000-memory.dmp

Download

memory/1280-125-0x00007FF7896F0000-0x00007FF789A44000-memory.dmp

Download

memory/1280-152-0x00007FF7896F0000-0x00007FF789A44000-memory.dmp

Download

memory/1396-138-0x00007FF6F7700000-0x00007FF6F7A54000-memory.dmp

Download

memory/1396-14-0x00007FF6F7700000-0x00007FF6F7A54000-memory.dmp

Download

memory/2076-126-0x00007FF7E82F0000-0x00007FF7E8644000-memory.dmp

Download

memory/2076-151-0x00007FF7E82F0000-0x00007FF7E8644000-memory.dmp

Download

memory/2188-133-0x00007FF71F8B0000-0x00007FF71FC04000-memory.dmp

Download

memory/2188-48-0x00007FF71F8B0000-0x00007FF71FC04000-memory.dmp

Download

memory/2188-144-0x00007FF71F8B0000-0x00007FF71FC04000-memory.dmp

Download

memory/3124-154-0x00007FF643D20000-0x00007FF644074000-memory.dmp

Download

memory/3124-123-0x00007FF643D20000-0x00007FF644074000-memory.dmp

Download

memory/3160-139-0x00007FF627840000-0x00007FF627B94000-memory.dmp

Download

memory/3160-18-0x00007FF627840000-0x00007FF627B94000-memory.dmp

Download

memory/3160-130-0x00007FF627840000-0x00007FF627B94000-memory.dmp

Download

memory/3472-121-0x00007FF62BD30000-0x00007FF62C084000-memory.dmp

Download

memory/3472-150-0x00007FF62BD30000-0x00007FF62C084000-memory.dmp

Download

memory/3492-81-0x00007FF74FA10000-0x00007FF74FD64000-memory.dmp

Download

memory/3492-137-0x00007FF74FA10000-0x00007FF74FD64000-memory.dmp

Download

memory/3492-6-0x00007FF74FA10000-0x00007FF74FD64000-memory.dmp

Download

memory/3552-58-0x00007FF6E7360000-0x00007FF6E76B4000-memory.dmp

Download

memory/3552-134-0x00007FF6E7360000-0x00007FF6E76B4000-memory.dmp

Download

memory/3552-145-0x00007FF6E7360000-0x00007FF6E76B4000-memory.dmp

Download

memory/3572-24-0x00007FF646650000-0x00007FF6469A4000-memory.dmp

Download

memory/3572-131-0x00007FF646650000-0x00007FF6469A4000-memory.dmp

Download

memory/3572-140-0x00007FF646650000-0x00007FF6469A4000-memory.dmp

Download

memory/3904-75-0x00007FF6BB680000-0x00007FF6BB9D4000-memory.dmp

Download

memory/3904-136-0x00007FF6BB680000-0x00007FF6BB9D4000-memory.dmp

Download

memory/3904-148-0x00007FF6BB680000-0x00007FF6BB9D4000-memory.dmp

Download

memory/4136-147-0x00007FF65ABB0000-0x00007FF65AF04000-memory.dmp

Download

memory/4136-122-0x00007FF65ABB0000-0x00007FF65AF04000-memory.dmp

Download

memory/4280-135-0x00007FF6E1600000-0x00007FF6E1954000-memory.dmp

Download

memory/4280-71-0x00007FF6E1600000-0x00007FF6E1954000-memory.dmp

Download

memory/4280-146-0x00007FF6E1600000-0x00007FF6E1954000-memory.dmp

Download

memory/4312-156-0x00007FF6B2CF0000-0x00007FF6B3044000-memory.dmp

Download

memory/4312-128-0x00007FF6B2CF0000-0x00007FF6B3044000-memory.dmp

Download

memory/4384-142-0x00007FF6AC030000-0x00007FF6AC384000-memory.dmp

Download

memory/4384-43-0x00007FF6AC030000-0x00007FF6AC384000-memory.dmp

Download

memory/4384-132-0x00007FF6AC030000-0x00007FF6AC384000-memory.dmp

Download

memory/4536-143-0x00007FF603AC0000-0x00007FF603E14000-memory.dmp

Download

memory/4536-44-0x00007FF603AC0000-0x00007FF603E14000-memory.dmp

Download

memory/4556-63-0x00007FF718500000-0x00007FF718854000-memory.dmp

Download

memory/4556-0-0x00007FF718500000-0x00007FF718854000-memory.dmp

Download

memory/4556-1-0x0000018FD94C0000-0x0000018FD94D0000-memory.dmp

Download

memory/4924-141-0x00007FF79BE00000-0x00007FF79C154000-memory.dmp

Download

memory/4924-35-0x00007FF79BE00000-0x00007FF79C154000-memory.dmp

Download

memory/4948-157-0x00007FF7C2D00000-0x00007FF7C3054000-memory.dmp

Download

memory/4948-127-0x00007FF7C2D00000-0x00007FF7C3054000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads