cobaltstrike | 761aff84a77b75c1864cdbe2f9708a0a178bdc5deff4f81e32864f4016daab24

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240527-mtbzfahf85
SHA256 761aff84a77b75c1864cdbe2f9708a0a178bdc5deff4f81e32864f4016daab24
MD5 8cc2e0c98ec51f670a85de8642e51491
SHA1 5f620496cdce4982398a27643cf762c03cce7ad5
SHA512 0baf88156ac5f53378ac0d710c20706e7593cc1634ff5d115d02c301a8f590e23b8c4ce0cbb02bfbb18ff93c4440448e93830556edb02d8f9dfde1e076ff5517
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000800000002341f-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023424-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023423-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023426-27.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023427-33.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023428-38.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023429-48.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342a-52.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342b-55.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342c-66.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342e-72.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023430-80.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023433-101.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023435-110.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023436-112.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023434-106.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023432-96.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023431-90.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342f-82.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342d-70.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023425-26.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000800000002341f-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023424-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023423-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023426-27.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023427-33.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023428-38.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023429-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342a-52.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342b-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342c-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342e-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023430-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023433-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023435-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023436-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023434-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023432-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023431-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342f-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342d-70.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023425-26.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/224-0-0x00007FF7A4BB0000-0x00007FF7A4F04000-memory.dmp	UPX
behavioral2/files/0x000800000002341f-4.dat	UPX
behavioral2/memory/2572-9-0x00007FF7E0190000-0x00007FF7E04E4000-memory.dmp	UPX
behavioral2/files/0x0007000000023424-11.dat	UPX
behavioral2/files/0x0007000000023423-10.dat	UPX
behavioral2/files/0x0007000000023426-27.dat	UPX
behavioral2/files/0x0007000000023427-33.dat	UPX
behavioral2/files/0x0007000000023428-38.dat	UPX
behavioral2/files/0x0007000000023429-48.dat	UPX
behavioral2/files/0x000700000002342a-52.dat	UPX
behavioral2/files/0x000700000002342b-55.dat	UPX
behavioral2/files/0x000700000002342c-66.dat	UPX
behavioral2/files/0x000700000002342e-72.dat	UPX
behavioral2/files/0x0007000000023430-80.dat	UPX
behavioral2/files/0x0007000000023433-101.dat	UPX
behavioral2/files/0x0007000000023435-110.dat	UPX
behavioral2/files/0x0007000000023436-112.dat	UPX
behavioral2/files/0x0007000000023434-106.dat	UPX
behavioral2/files/0x0007000000023432-96.dat	UPX
behavioral2/files/0x0007000000023431-90.dat	UPX
behavioral2/files/0x000700000002342f-82.dat	UPX
behavioral2/files/0x000700000002342d-70.dat	UPX
behavioral2/memory/1412-44-0x00007FF6B7EA0000-0x00007FF6B81F4000-memory.dmp	UPX
behavioral2/memory/4904-41-0x00007FF64C230000-0x00007FF64C584000-memory.dmp	UPX
behavioral2/memory/4900-39-0x00007FF686650000-0x00007FF6869A4000-memory.dmp	UPX
behavioral2/memory/2468-31-0x00007FF62A710000-0x00007FF62AA64000-memory.dmp	UPX
behavioral2/files/0x0007000000023425-26.dat	UPX
behavioral2/memory/2096-22-0x00007FF739790000-0x00007FF739AE4000-memory.dmp	UPX
behavioral2/memory/3700-12-0x00007FF60A520000-0x00007FF60A874000-memory.dmp	UPX
behavioral2/memory/4648-114-0x00007FF7878F0000-0x00007FF787C44000-memory.dmp	UPX
behavioral2/memory/2092-115-0x00007FF792E60000-0x00007FF7931B4000-memory.dmp	UPX
behavioral2/memory/5016-116-0x00007FF6BB140000-0x00007FF6BB494000-memory.dmp	UPX
behavioral2/memory/2428-117-0x00007FF74D1F0000-0x00007FF74D544000-memory.dmp	UPX
behavioral2/memory/4620-118-0x00007FF7FF880000-0x00007FF7FFBD4000-memory.dmp	UPX
behavioral2/memory/5044-119-0x00007FF69E5C0000-0x00007FF69E914000-memory.dmp	UPX
behavioral2/memory/2088-120-0x00007FF6D33C0000-0x00007FF6D3714000-memory.dmp	UPX
behavioral2/memory/3668-122-0x00007FF79B280000-0x00007FF79B5D4000-memory.dmp	UPX
behavioral2/memory/4612-121-0x00007FF612EB0000-0x00007FF613204000-memory.dmp	UPX
behavioral2/memory/452-123-0x00007FF742730000-0x00007FF742A84000-memory.dmp	UPX
behavioral2/memory/1304-125-0x00007FF60D160000-0x00007FF60D4B4000-memory.dmp	UPX
behavioral2/memory/980-126-0x00007FF7BA050000-0x00007FF7BA3A4000-memory.dmp	UPX
behavioral2/memory/4296-127-0x00007FF63F990000-0x00007FF63FCE4000-memory.dmp	UPX
behavioral2/memory/1108-124-0x00007FF61DEE0000-0x00007FF61E234000-memory.dmp	UPX
behavioral2/memory/2572-128-0x00007FF7E0190000-0x00007FF7E04E4000-memory.dmp	UPX
behavioral2/memory/224-129-0x00007FF7A4BB0000-0x00007FF7A4F04000-memory.dmp	UPX
behavioral2/memory/3700-130-0x00007FF60A520000-0x00007FF60A874000-memory.dmp	UPX
behavioral2/memory/2468-131-0x00007FF62A710000-0x00007FF62AA64000-memory.dmp	UPX
behavioral2/memory/4904-132-0x00007FF64C230000-0x00007FF64C584000-memory.dmp	UPX
behavioral2/memory/2572-133-0x00007FF7E0190000-0x00007FF7E04E4000-memory.dmp	UPX
behavioral2/memory/3700-134-0x00007FF60A520000-0x00007FF60A874000-memory.dmp	UPX
behavioral2/memory/2096-135-0x00007FF739790000-0x00007FF739AE4000-memory.dmp	UPX
behavioral2/memory/4900-136-0x00007FF686650000-0x00007FF6869A4000-memory.dmp	UPX
behavioral2/memory/2468-137-0x00007FF62A710000-0x00007FF62AA64000-memory.dmp	UPX
behavioral2/memory/4904-138-0x00007FF64C230000-0x00007FF64C584000-memory.dmp	UPX
behavioral2/memory/1412-139-0x00007FF6B7EA0000-0x00007FF6B81F4000-memory.dmp	UPX
behavioral2/memory/2092-140-0x00007FF792E60000-0x00007FF7931B4000-memory.dmp	UPX
behavioral2/memory/5044-141-0x00007FF69E5C0000-0x00007FF69E914000-memory.dmp	UPX
behavioral2/memory/4620-143-0x00007FF7FF880000-0x00007FF7FFBD4000-memory.dmp	UPX
behavioral2/memory/2428-144-0x00007FF74D1F0000-0x00007FF74D544000-memory.dmp	UPX
behavioral2/memory/2088-146-0x00007FF6D33C0000-0x00007FF6D3714000-memory.dmp	UPX
behavioral2/memory/5016-145-0x00007FF6BB140000-0x00007FF6BB494000-memory.dmp	UPX
behavioral2/memory/4648-142-0x00007FF7878F0000-0x00007FF787C44000-memory.dmp	UPX
behavioral2/memory/4296-148-0x00007FF63F990000-0x00007FF63FCE4000-memory.dmp	UPX
behavioral2/memory/452-152-0x00007FF742730000-0x00007FF742A84000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/224-0-0x00007FF7A4BB0000-0x00007FF7A4F04000-memory.dmp	xmrig
behavioral2/files/0x000800000002341f-4.dat	xmrig
behavioral2/memory/2572-9-0x00007FF7E0190000-0x00007FF7E04E4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023424-11.dat	xmrig
behavioral2/files/0x0007000000023423-10.dat	xmrig
behavioral2/files/0x0007000000023426-27.dat	xmrig
behavioral2/files/0x0007000000023427-33.dat	xmrig
behavioral2/files/0x0007000000023428-38.dat	xmrig
behavioral2/files/0x0007000000023429-48.dat	xmrig
behavioral2/files/0x000700000002342a-52.dat	xmrig
behavioral2/files/0x000700000002342b-55.dat	xmrig
behavioral2/files/0x000700000002342c-66.dat	xmrig
behavioral2/files/0x000700000002342e-72.dat	xmrig
behavioral2/files/0x0007000000023430-80.dat	xmrig
behavioral2/files/0x0007000000023433-101.dat	xmrig
behavioral2/files/0x0007000000023435-110.dat	xmrig
behavioral2/files/0x0007000000023436-112.dat	xmrig
behavioral2/files/0x0007000000023434-106.dat	xmrig
behavioral2/files/0x0007000000023432-96.dat	xmrig
behavioral2/files/0x0007000000023431-90.dat	xmrig
behavioral2/files/0x000700000002342f-82.dat	xmrig
behavioral2/files/0x000700000002342d-70.dat	xmrig
behavioral2/memory/1412-44-0x00007FF6B7EA0000-0x00007FF6B81F4000-memory.dmp	xmrig
behavioral2/memory/4904-41-0x00007FF64C230000-0x00007FF64C584000-memory.dmp	xmrig
behavioral2/memory/4900-39-0x00007FF686650000-0x00007FF6869A4000-memory.dmp	xmrig
behavioral2/memory/2468-31-0x00007FF62A710000-0x00007FF62AA64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023425-26.dat	xmrig
behavioral2/memory/2096-22-0x00007FF739790000-0x00007FF739AE4000-memory.dmp	xmrig
behavioral2/memory/3700-12-0x00007FF60A520000-0x00007FF60A874000-memory.dmp	xmrig
behavioral2/memory/4648-114-0x00007FF7878F0000-0x00007FF787C44000-memory.dmp	xmrig
behavioral2/memory/2092-115-0x00007FF792E60000-0x00007FF7931B4000-memory.dmp	xmrig
behavioral2/memory/5016-116-0x00007FF6BB140000-0x00007FF6BB494000-memory.dmp	xmrig
behavioral2/memory/2428-117-0x00007FF74D1F0000-0x00007FF74D544000-memory.dmp	xmrig
behavioral2/memory/4620-118-0x00007FF7FF880000-0x00007FF7FFBD4000-memory.dmp	xmrig
behavioral2/memory/5044-119-0x00007FF69E5C0000-0x00007FF69E914000-memory.dmp	xmrig
behavioral2/memory/2088-120-0x00007FF6D33C0000-0x00007FF6D3714000-memory.dmp	xmrig
behavioral2/memory/3668-122-0x00007FF79B280000-0x00007FF79B5D4000-memory.dmp	xmrig
behavioral2/memory/4612-121-0x00007FF612EB0000-0x00007FF613204000-memory.dmp	xmrig
behavioral2/memory/452-123-0x00007FF742730000-0x00007FF742A84000-memory.dmp	xmrig
behavioral2/memory/1304-125-0x00007FF60D160000-0x00007FF60D4B4000-memory.dmp	xmrig
behavioral2/memory/980-126-0x00007FF7BA050000-0x00007FF7BA3A4000-memory.dmp	xmrig
behavioral2/memory/4296-127-0x00007FF63F990000-0x00007FF63FCE4000-memory.dmp	xmrig
behavioral2/memory/1108-124-0x00007FF61DEE0000-0x00007FF61E234000-memory.dmp	xmrig
behavioral2/memory/2572-128-0x00007FF7E0190000-0x00007FF7E04E4000-memory.dmp	xmrig
behavioral2/memory/224-129-0x00007FF7A4BB0000-0x00007FF7A4F04000-memory.dmp	xmrig
behavioral2/memory/3700-130-0x00007FF60A520000-0x00007FF60A874000-memory.dmp	xmrig
behavioral2/memory/2468-131-0x00007FF62A710000-0x00007FF62AA64000-memory.dmp	xmrig
behavioral2/memory/4904-132-0x00007FF64C230000-0x00007FF64C584000-memory.dmp	xmrig
behavioral2/memory/2572-133-0x00007FF7E0190000-0x00007FF7E04E4000-memory.dmp	xmrig
behavioral2/memory/3700-134-0x00007FF60A520000-0x00007FF60A874000-memory.dmp	xmrig
behavioral2/memory/2096-135-0x00007FF739790000-0x00007FF739AE4000-memory.dmp	xmrig
behavioral2/memory/4900-136-0x00007FF686650000-0x00007FF6869A4000-memory.dmp	xmrig
behavioral2/memory/2468-137-0x00007FF62A710000-0x00007FF62AA64000-memory.dmp	xmrig
behavioral2/memory/4904-138-0x00007FF64C230000-0x00007FF64C584000-memory.dmp	xmrig
behavioral2/memory/1412-139-0x00007FF6B7EA0000-0x00007FF6B81F4000-memory.dmp	xmrig
behavioral2/memory/2092-140-0x00007FF792E60000-0x00007FF7931B4000-memory.dmp	xmrig
behavioral2/memory/5044-141-0x00007FF69E5C0000-0x00007FF69E914000-memory.dmp	xmrig
behavioral2/memory/4620-143-0x00007FF7FF880000-0x00007FF7FFBD4000-memory.dmp	xmrig
behavioral2/memory/2428-144-0x00007FF74D1F0000-0x00007FF74D544000-memory.dmp	xmrig
behavioral2/memory/2088-146-0x00007FF6D33C0000-0x00007FF6D3714000-memory.dmp	xmrig
behavioral2/memory/5016-145-0x00007FF6BB140000-0x00007FF6BB494000-memory.dmp	xmrig
behavioral2/memory/4648-142-0x00007FF7878F0000-0x00007FF787C44000-memory.dmp	xmrig
behavioral2/memory/4296-148-0x00007FF63F990000-0x00007FF63FCE4000-memory.dmp	xmrig
behavioral2/memory/452-152-0x00007FF742730000-0x00007FF742A84000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2572	RbhfUFW.exe
3700	Gpaumvc.exe
2096	STxfRha.exe
2468	EemFCRU.exe
4900	EspahYg.exe
1412	CGUBSrh.exe
4904	bHcvjaK.exe
4648	fEGIClu.exe
2092	XQoHhvT.exe
5016	rgzxIIv.exe
2428	wSrcOaI.exe
4620	pipuISA.exe
5044	KOuPDFQ.exe
2088	eluYSJJ.exe
4612	puSBHAs.exe
3668	UNAsczd.exe
452	egnFbtg.exe
1108	JBiCfTy.exe
1304	tJDgmyM.exe
980	nrqjJeo.exe
4296	tPhjPUO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/224-0-0x00007FF7A4BB0000-0x00007FF7A4F04000-memory.dmp	upx
behavioral2/files/0x000800000002341f-4.dat	upx
behavioral2/memory/2572-9-0x00007FF7E0190000-0x00007FF7E04E4000-memory.dmp	upx
behavioral2/files/0x0007000000023424-11.dat	upx
behavioral2/files/0x0007000000023423-10.dat	upx
behavioral2/files/0x0007000000023426-27.dat	upx
behavioral2/files/0x0007000000023427-33.dat	upx
behavioral2/files/0x0007000000023428-38.dat	upx
behavioral2/files/0x0007000000023429-48.dat	upx
behavioral2/files/0x000700000002342a-52.dat	upx
behavioral2/files/0x000700000002342b-55.dat	upx
behavioral2/files/0x000700000002342c-66.dat	upx
behavioral2/files/0x000700000002342e-72.dat	upx
behavioral2/files/0x0007000000023430-80.dat	upx
behavioral2/files/0x0007000000023433-101.dat	upx
behavioral2/files/0x0007000000023435-110.dat	upx
behavioral2/files/0x0007000000023436-112.dat	upx
behavioral2/files/0x0007000000023434-106.dat	upx
behavioral2/files/0x0007000000023432-96.dat	upx
behavioral2/files/0x0007000000023431-90.dat	upx
behavioral2/files/0x000700000002342f-82.dat	upx
behavioral2/files/0x000700000002342d-70.dat	upx
behavioral2/memory/1412-44-0x00007FF6B7EA0000-0x00007FF6B81F4000-memory.dmp	upx
behavioral2/memory/4904-41-0x00007FF64C230000-0x00007FF64C584000-memory.dmp	upx
behavioral2/memory/4900-39-0x00007FF686650000-0x00007FF6869A4000-memory.dmp	upx
behavioral2/memory/2468-31-0x00007FF62A710000-0x00007FF62AA64000-memory.dmp	upx
behavioral2/files/0x0007000000023425-26.dat	upx
behavioral2/memory/2096-22-0x00007FF739790000-0x00007FF739AE4000-memory.dmp	upx
behavioral2/memory/3700-12-0x00007FF60A520000-0x00007FF60A874000-memory.dmp	upx
behavioral2/memory/4648-114-0x00007FF7878F0000-0x00007FF787C44000-memory.dmp	upx
behavioral2/memory/2092-115-0x00007FF792E60000-0x00007FF7931B4000-memory.dmp	upx
behavioral2/memory/5016-116-0x00007FF6BB140000-0x00007FF6BB494000-memory.dmp	upx
behavioral2/memory/2428-117-0x00007FF74D1F0000-0x00007FF74D544000-memory.dmp	upx
behavioral2/memory/4620-118-0x00007FF7FF880000-0x00007FF7FFBD4000-memory.dmp	upx
behavioral2/memory/5044-119-0x00007FF69E5C0000-0x00007FF69E914000-memory.dmp	upx
behavioral2/memory/2088-120-0x00007FF6D33C0000-0x00007FF6D3714000-memory.dmp	upx
behavioral2/memory/3668-122-0x00007FF79B280000-0x00007FF79B5D4000-memory.dmp	upx
behavioral2/memory/4612-121-0x00007FF612EB0000-0x00007FF613204000-memory.dmp	upx
behavioral2/memory/452-123-0x00007FF742730000-0x00007FF742A84000-memory.dmp	upx
behavioral2/memory/1304-125-0x00007FF60D160000-0x00007FF60D4B4000-memory.dmp	upx
behavioral2/memory/980-126-0x00007FF7BA050000-0x00007FF7BA3A4000-memory.dmp	upx
behavioral2/memory/4296-127-0x00007FF63F990000-0x00007FF63FCE4000-memory.dmp	upx
behavioral2/memory/1108-124-0x00007FF61DEE0000-0x00007FF61E234000-memory.dmp	upx
behavioral2/memory/2572-128-0x00007FF7E0190000-0x00007FF7E04E4000-memory.dmp	upx
behavioral2/memory/224-129-0x00007FF7A4BB0000-0x00007FF7A4F04000-memory.dmp	upx
behavioral2/memory/3700-130-0x00007FF60A520000-0x00007FF60A874000-memory.dmp	upx
behavioral2/memory/2468-131-0x00007FF62A710000-0x00007FF62AA64000-memory.dmp	upx
behavioral2/memory/4904-132-0x00007FF64C230000-0x00007FF64C584000-memory.dmp	upx
behavioral2/memory/2572-133-0x00007FF7E0190000-0x00007FF7E04E4000-memory.dmp	upx
behavioral2/memory/3700-134-0x00007FF60A520000-0x00007FF60A874000-memory.dmp	upx
behavioral2/memory/2096-135-0x00007FF739790000-0x00007FF739AE4000-memory.dmp	upx
behavioral2/memory/4900-136-0x00007FF686650000-0x00007FF6869A4000-memory.dmp	upx
behavioral2/memory/2468-137-0x00007FF62A710000-0x00007FF62AA64000-memory.dmp	upx
behavioral2/memory/4904-138-0x00007FF64C230000-0x00007FF64C584000-memory.dmp	upx
behavioral2/memory/1412-139-0x00007FF6B7EA0000-0x00007FF6B81F4000-memory.dmp	upx
behavioral2/memory/2092-140-0x00007FF792E60000-0x00007FF7931B4000-memory.dmp	upx
behavioral2/memory/5044-141-0x00007FF69E5C0000-0x00007FF69E914000-memory.dmp	upx
behavioral2/memory/4620-143-0x00007FF7FF880000-0x00007FF7FFBD4000-memory.dmp	upx
behavioral2/memory/2428-144-0x00007FF74D1F0000-0x00007FF74D544000-memory.dmp	upx
behavioral2/memory/2088-146-0x00007FF6D33C0000-0x00007FF6D3714000-memory.dmp	upx
behavioral2/memory/5016-145-0x00007FF6BB140000-0x00007FF6BB494000-memory.dmp	upx
behavioral2/memory/4648-142-0x00007FF7878F0000-0x00007FF787C44000-memory.dmp	upx
behavioral2/memory/4296-148-0x00007FF63F990000-0x00007FF63FCE4000-memory.dmp	upx
behavioral2/memory/452-152-0x00007FF742730000-0x00007FF742A84000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\KOuPDFQ.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eluYSJJ.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\puSBHAs.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RbhfUFW.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EspahYg.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rgzxIIv.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pipuISA.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\egnFbtg.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nrqjJeo.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bHcvjaK.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\STxfRha.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EemFCRU.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CGUBSrh.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wSrcOaI.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UNAsczd.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JBiCfTy.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tJDgmyM.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tPhjPUO.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\Gpaumvc.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fEGIClu.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XQoHhvT.exe	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 2572	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	84
PID 224 wrote to memory of 2572	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	84
PID 224 wrote to memory of 3700	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	85
PID 224 wrote to memory of 3700	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	85
PID 224 wrote to memory of 2096	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	86
PID 224 wrote to memory of 2096	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	86
PID 224 wrote to memory of 2468	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	87
PID 224 wrote to memory of 2468	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	87
PID 224 wrote to memory of 4900	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	88
PID 224 wrote to memory of 4900	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	88
PID 224 wrote to memory of 1412	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	89
PID 224 wrote to memory of 1412	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	89
PID 224 wrote to memory of 4904	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	90
PID 224 wrote to memory of 4904	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	90
PID 224 wrote to memory of 4648	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	91
PID 224 wrote to memory of 4648	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	91
PID 224 wrote to memory of 2092	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	92
PID 224 wrote to memory of 2092	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	92
PID 224 wrote to memory of 5016	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	93
PID 224 wrote to memory of 5016	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	93
PID 224 wrote to memory of 2428	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	94
PID 224 wrote to memory of 2428	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	94
PID 224 wrote to memory of 4620	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	95
PID 224 wrote to memory of 4620	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	95
PID 224 wrote to memory of 5044	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	96
PID 224 wrote to memory of 5044	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	96
PID 224 wrote to memory of 2088	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	97
PID 224 wrote to memory of 2088	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	97
PID 224 wrote to memory of 4612	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	98
PID 224 wrote to memory of 4612	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	98
PID 224 wrote to memory of 3668	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	99
PID 224 wrote to memory of 3668	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	99
PID 224 wrote to memory of 452	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	100
PID 224 wrote to memory of 452	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	100
PID 224 wrote to memory of 1108	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	101
PID 224 wrote to memory of 1108	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	101
PID 224 wrote to memory of 1304	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	102
PID 224 wrote to memory of 1304	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	102
PID 224 wrote to memory of 980	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	103
PID 224 wrote to memory of 980	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	103
PID 224 wrote to memory of 4296	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	104
PID 224 wrote to memory of 4296	224	2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe	104

C:\Users\Admin\AppData\Local\Temp\2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_8cc2e0c98ec51f670a85de8642e51491_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\System\RbhfUFW.exe
  C:\Windows\System\RbhfUFW.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\Gpaumvc.exe
  C:\Windows\System\Gpaumvc.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\STxfRha.exe
  C:\Windows\System\STxfRha.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\EemFCRU.exe
  C:\Windows\System\EemFCRU.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\EspahYg.exe
  C:\Windows\System\EspahYg.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\CGUBSrh.exe
  C:\Windows\System\CGUBSrh.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\bHcvjaK.exe
  C:\Windows\System\bHcvjaK.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\fEGIClu.exe
  C:\Windows\System\fEGIClu.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\XQoHhvT.exe
  C:\Windows\System\XQoHhvT.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\rgzxIIv.exe
  C:\Windows\System\rgzxIIv.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\wSrcOaI.exe
  C:\Windows\System\wSrcOaI.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\pipuISA.exe
  C:\Windows\System\pipuISA.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\KOuPDFQ.exe
  C:\Windows\System\KOuPDFQ.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\eluYSJJ.exe
  C:\Windows\System\eluYSJJ.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\puSBHAs.exe
  C:\Windows\System\puSBHAs.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\UNAsczd.exe
  C:\Windows\System\UNAsczd.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\egnFbtg.exe
  C:\Windows\System\egnFbtg.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\JBiCfTy.exe
  C:\Windows\System\JBiCfTy.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\tJDgmyM.exe
  C:\Windows\System\tJDgmyM.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\nrqjJeo.exe
  C:\Windows\System\nrqjJeo.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\tPhjPUO.exe
  C:\Windows\System\tPhjPUO.exe
  2⤵
  - Executes dropped EXE
  PID:4296

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CGUBSrh.exe

Path C:\Windows\System\CGUBSrh.exe
Size 5.9MB
SHA256 9a128cfeb6351d6c96c36b0ee4a67f3c5edfaf0602cf15dddb322cc14ff0634d
MD5 a5b25cbc71a11edfe794bd0eb6cbcd06
SHA1 959b63a9c0d15220abc9d7359d8b6893f50394ab
SHA512 437d55b047f575ecfbcc4f63486bbaed9b4a9f6cce3249454ecf8cea85e1c7c714a7d3e5d985f8928082802f2a618ee2a73ea42165f40015652b42d993294a09
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

EemFCRU.exe

Path C:\Windows\System\EemFCRU.exe
Size 5.9MB
SHA256 eb9cd94f30dbe22d06ee4239769773be6b3fd71304c00e38cd94c7d12d4c7339
MD5 609ccff887a4a0eadc18d164e8975773
SHA1 cf0e0e12061556a5cf04f63bda16cd3a2c7932fd
SHA512 22988f191ae65f1ded760be8129cbc2b80cc26b735c0310b4730e24544a8cec6e42223859612f0e48ca031d1103d3979a30b02504df20d472ee7effc4a28bbec
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

EspahYg.exe

Path C:\Windows\System\EspahYg.exe
Size 5.9MB
SHA256 5ab8918b52d2406d4df6968a7ea8239dc2c14cae67ceede0bb5e5b62b479e37e
MD5 db5fabc4fd3c40ee782cf7f1fdba2df7
SHA1 6ac684a0cb3818389b9d5123bab6cafceb4d57ac
SHA512 3c4b5d15228001f32d919bca20630d4d1c08cddb347ea9454d4db4e14214c3874e021fe1b785ab64aec8274d40b64192ef216a78581c6d2575945d505f4fa5b0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gpaumvc.exe

Path C:\Windows\System\Gpaumvc.exe
Size 5.9MB
SHA256 7902c044610cb132fa61627b05607b38e530e274dbf7dec6f71b74a70c4daebe
MD5 555ea934e6998c73ed25eedea30a8636
SHA1 6f4fb07ceeff96dd6165c35620061514116e2dcc
SHA512 39478c49c66711314aa1db286dcfcb5d26bcb1e9135418a7e80410009d4d8274004dea0c2e69f1ea93f79dfafd4a32335322a21973f1cdac71cd5935fb00f3ae
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

JBiCfTy.exe

Path C:\Windows\System\JBiCfTy.exe
Size 5.9MB
SHA256 3b34f93b45e53add96f31a06de9be79a425bf4d054ce9d23f657fa080ab49686
MD5 52ebb183b0e861b783905c687df1502a
SHA1 4757d09304b168b2c3ad9b523f9a79db9ef9a7d5
SHA512 ea5ebedeb0152f05bcf42baeeb0f6a9942f3035ac1beb9fa6fadcfe672632a5223ab93f0b8d41e88508487c7bad649852465d315a9bc93009755c22c729204a1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

KOuPDFQ.exe

Path C:\Windows\System\KOuPDFQ.exe
Size 5.9MB
SHA256 91c66f1c02ee76c0ab96ada0bc7539a682c490fdf466e1c90feaf94787c7fc56
MD5 0bf62d47ed9796902c964a798c9517ac
SHA1 fbdd6847a73444d27bc3a95fd77ef586fd4e0ab8
SHA512 66746d64a2663ef45223d1b15351565d4939980c1fea8a95cd3b64a7ea22a46ba3020574a6ad0f54c7cc987befdf574c0e04858d63d5b64b634ce3116b0ee0e6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

RbhfUFW.exe

Path C:\Windows\System\RbhfUFW.exe
Size 5.9MB
SHA256 77bdab37471b0ea26830571de11d91d24f51bd7cf6b9225dc967da6bd528fe2a
MD5 e8a297c724d8b02e5292e264dc3f7e9f
SHA1 ee5a5060cde1637b473c328c9089bce94d38a8ba
SHA512 0a7862f386f9608a7e73e45d60b0a2f4eb310d6311e4cddda10cda8bbfe743951098e16dc73e4412a506cda51350484ad800a9e9b7c454d6cd0f28280ac08ebe
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

STxfRha.exe

Path C:\Windows\System\STxfRha.exe
Size 5.9MB
SHA256 4731c0a81f53987c4be3eb20ee130c402d83b2492bd70c71918543aed21ee4e9
MD5 d7a8712d2f3a9a82015df9cdfe5963a1
SHA1 08f7baeea1b928813335f732648b58d12dbf92a4
SHA512 86cd427c64796f1fb22b30c3f4a02baa375f4882490226fbc75e842db179730197ad7a4fd42058ae00ad6a92d7352f9b84858156e215e293b068fb04ff953e2d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

UNAsczd.exe

Path C:\Windows\System\UNAsczd.exe
Size 5.9MB
SHA256 9a3e6e558ce1f3cb97800c6cff0963bfc6cc97082e6e88215d133c6012c123c0
MD5 e796847c4a266d1cb3900898c6889af6
SHA1 bd01447c918b3fc047f31acfc40e3fd43f91811d
SHA512 146d50871ba3b79344c41f355fd49b69e56db4962bf1363842ec6d809504e40bf866a4024d6a7ab29b7d36b7b3b7b5100d6c927a54888ce2c8baddd6076c36de
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

XQoHhvT.exe

Path C:\Windows\System\XQoHhvT.exe
Size 5.9MB
SHA256 849dd73f6a6d9d64dfe310aa24c0257ad1206e65e96e64de0b664843ed6b5b48
MD5 9f2f5d7edcc39b8a84c0b22676c508c2
SHA1 dfd620f01529ed1d89091affca05c12fe4c09462
SHA512 94428b7d739b6f58f640ca83121ac3f5f29b93bd900a991dd48b0534008b153fc23b5dbb799d964e6b60f39c27cf9cea8a26d9a2ab5b8e7c50baa8a1cb88f6af
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

bHcvjaK.exe

Path C:\Windows\System\bHcvjaK.exe
Size 5.9MB
SHA256 db99cdbce6a69fe832d35507e792f5f2e899a1112a2d5671ce3d9175bb6e0963
MD5 11a63972e7f78d8f3d1d7f88c79dece9
SHA1 2fe52fc9f8fe514a84c0d5b8a53de654f2fe4f78
SHA512 17b79d3680da31bf904a594b244ed218bb3912483992f2bf8148f7df2114fd5dae05e3f154236ac3efc72da9b2136d01173d6f3c972847bb6a7e598d72cd403b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

egnFbtg.exe

Path C:\Windows\System\egnFbtg.exe
Size 5.9MB
SHA256 281a8fde5ad8848d29bc62c14db281f557c98531d5962bee16cfc0f28d85a60e
MD5 b3b00d1db51e49cda483facbcfa7ae17
SHA1 e95ccacca8303321c893b7a6f5d3bbe0d161a976
SHA512 cb444cfb95d920967ba6b3902cdeabb755c7a5f6ff3b5d46f2cf2cc0a75d2dc1b8df81fbbb5e548e13f3c88adc019ffaf4f8effac73a7820b6a3fc8d215eb5c0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

eluYSJJ.exe

Path C:\Windows\System\eluYSJJ.exe
Size 5.9MB
SHA256 38c1a31f42eddaf059dbc8152384550267815fc4c5c74765f71e04e8ff8e845f
MD5 782998e6cf631f434ab0d7258397ad31
SHA1 6b305427de9176823a248c9da3b0fc5225307b86
SHA512 854214749b5394399273a512d8864017b942e72ca472c3f56932e38b52fceaab9774810ae8fdbc98dca4be44b102ec33f6914259e139083a350c94abadd62dc8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

fEGIClu.exe

Path C:\Windows\System\fEGIClu.exe
Size 5.9MB
SHA256 1dc9f3ad2ca963bfd9c9a7ff7fa200d62162211defd748e235d9f8eb782fc1f0
MD5 558b1fa28c6f7ce07038848cd842f309
SHA1 3a95989622487c513bd41f54e9ee2beca0f0725d
SHA512 2abb9d36896bc0b1f5ebf84ab02a1e99d949dfcbb5e45b13314e31725ffe1e64d3312aed5a7d1aaa760b66d6c5fc31d8328631f637a8d2dd7299074bddace3d4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

nrqjJeo.exe

Path C:\Windows\System\nrqjJeo.exe
Size 5.9MB
SHA256 1a4655b9aeed21389202e714cb3208782184651a96b45beea7a3a8222926899e
MD5 b9279e1a1e59a36b7a65d5efbdd1dfe1
SHA1 4d0b712d0c1781812c54695a73d573fc18530bfe
SHA512 bb74bd0140e00f6c5221a5772ffe3661240e3e44437802644e84323081f6ad56f86713b55e87b307fce386482afb213d5c887c7231e3c51b0fd334c7b8687bf2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

pipuISA.exe

Path C:\Windows\System\pipuISA.exe
Size 5.9MB
SHA256 dd4307c02c95a0748aeb15c4b34c59e7db8911e805988350a826304d9262e1e9
MD5 b47ff474db843429a390f396ffdff176
SHA1 c4830e74fed0720a4da5c9bd5c1ff2ff3bf9a749
SHA512 c489885b2949561d9444228ba849ba3b99ad74214de5eb4f789a85479fe825639edb332eba8ff3ff6fae0ef3a3f9376f42e67dd4c0de575ffd65d1b3aa313d24
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

puSBHAs.exe

Path C:\Windows\System\puSBHAs.exe
Size 5.9MB
SHA256 455a36b3005c575027063c824f2703995693409d2f20f653917bbcafdfd9b355
MD5 0a2340ed7a057f77ed6d38a03652a241
SHA1 4be8f1fd055417f1092cce5eab90e8b90460e89e
SHA512 581f5c1a1f21391a0d7f0b11e606e61e50001871db391044ac4407fadf258ad43a45fa55b27615b3ba9ef064fb354f5c438a12901434f8f84ae6846e46045dba
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

rgzxIIv.exe

Path C:\Windows\System\rgzxIIv.exe
Size 5.9MB
SHA256 4f5fddf135f98af5ad53ba62cbed045ee0d7e5230a0026f96810d4ca12c8d76c
MD5 43b7f45d97834f0e49922ec2d01ea54c
SHA1 a722b89562ec389a614f7384df14c9b5d0e748b1
SHA512 fb4a9abf16faa7e8fc284baf532d7755ed6675343cb3b2f3981c2b77ff6144999730923043534edc6dadf9d55d2517ead8f2727697c416eeab7b4c7ca39e8330
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

tJDgmyM.exe

Path C:\Windows\System\tJDgmyM.exe
Size 5.9MB
SHA256 b3483d2e7e059aff140ab8174899466068c337ef98349d88a94d8657b5920fb2
MD5 d23b867635c11afd3140874a5628db54
SHA1 50ce14c608598325b470a110b4218b4e52fe1610
SHA512 bbe975f097f5f63b4ad0f35e28ffc9a2968ce134e85bbeb25b68ebfcd201bfd38e7936e396eaab72402e26308a417fbed03977351aa928ff01b1e84c5b44dbab
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

tPhjPUO.exe

Path C:\Windows\System\tPhjPUO.exe
Size 5.9MB
SHA256 979c6dd1f51d8f45217f64de3372091efeaa3d639560e0b0074ca24f0791dc71
MD5 ae2bcdd22127fe0db93d7fe0dcffbe1d
SHA1 33d8001d535fc256648a5caa210b1a7db52420ed
SHA512 24c83919405c976b2aeecb643ede2e6b3b62caa1386a676c1bb4f59a9aacb84f8a3036d5f43b8d8aa050bd25bf510040ced57bbc0d9fea18c7f521b78a982542
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

wSrcOaI.exe

Path C:\Windows\System\wSrcOaI.exe
Size 5.9MB
SHA256 28c5d23db65226f165ff01b4fd8cbaf9e98ea176562592d14c2fbaac48a03aef
MD5 9d34d65cd23b977e41b742f7709de909
SHA1 8c86d29fc90f1c202e585d653dedbd3223579edd
SHA512 f296d8ca2d7fa872e3df6835fdc067b24f76453e5cc09489b50016ac4850c7072ada8e1a05b0c3d64138f0ffea337f9eff676bc700686a80d718c3e9f9ec2a4b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-0-0x00007FF7A4BB0000-0x00007FF7A4F04000-memory.dmp

Download

memory/224-129-0x00007FF7A4BB0000-0x00007FF7A4F04000-memory.dmp

Download

memory/224-1-0x00000232855C0000-0x00000232855D0000-memory.dmp

Download

memory/452-152-0x00007FF742730000-0x00007FF742A84000-memory.dmp

Download

memory/452-123-0x00007FF742730000-0x00007FF742A84000-memory.dmp

Download

memory/980-149-0x00007FF7BA050000-0x00007FF7BA3A4000-memory.dmp

Download

memory/980-126-0x00007FF7BA050000-0x00007FF7BA3A4000-memory.dmp

Download

memory/1108-124-0x00007FF61DEE0000-0x00007FF61E234000-memory.dmp

Download

memory/1108-151-0x00007FF61DEE0000-0x00007FF61E234000-memory.dmp

Download

memory/1304-150-0x00007FF60D160000-0x00007FF60D4B4000-memory.dmp

Download

memory/1304-125-0x00007FF60D160000-0x00007FF60D4B4000-memory.dmp

Download

memory/1412-44-0x00007FF6B7EA0000-0x00007FF6B81F4000-memory.dmp

Download

memory/1412-139-0x00007FF6B7EA0000-0x00007FF6B81F4000-memory.dmp

Download

memory/2088-146-0x00007FF6D33C0000-0x00007FF6D3714000-memory.dmp

Download

memory/2088-120-0x00007FF6D33C0000-0x00007FF6D3714000-memory.dmp

Download

memory/2092-140-0x00007FF792E60000-0x00007FF7931B4000-memory.dmp

Download

memory/2092-115-0x00007FF792E60000-0x00007FF7931B4000-memory.dmp

Download

memory/2096-22-0x00007FF739790000-0x00007FF739AE4000-memory.dmp

Download

memory/2096-135-0x00007FF739790000-0x00007FF739AE4000-memory.dmp

Download

memory/2428-144-0x00007FF74D1F0000-0x00007FF74D544000-memory.dmp

Download

memory/2428-117-0x00007FF74D1F0000-0x00007FF74D544000-memory.dmp

Download

memory/2468-31-0x00007FF62A710000-0x00007FF62AA64000-memory.dmp

Download

memory/2468-137-0x00007FF62A710000-0x00007FF62AA64000-memory.dmp

Download

memory/2468-131-0x00007FF62A710000-0x00007FF62AA64000-memory.dmp

Download

memory/2572-128-0x00007FF7E0190000-0x00007FF7E04E4000-memory.dmp

Download

memory/2572-9-0x00007FF7E0190000-0x00007FF7E04E4000-memory.dmp

Download

memory/2572-133-0x00007FF7E0190000-0x00007FF7E04E4000-memory.dmp

Download

memory/3668-122-0x00007FF79B280000-0x00007FF79B5D4000-memory.dmp

Download

memory/3668-153-0x00007FF79B280000-0x00007FF79B5D4000-memory.dmp

Download

memory/3700-134-0x00007FF60A520000-0x00007FF60A874000-memory.dmp

Download

memory/3700-130-0x00007FF60A520000-0x00007FF60A874000-memory.dmp

Download

memory/3700-12-0x00007FF60A520000-0x00007FF60A874000-memory.dmp

Download

memory/4296-148-0x00007FF63F990000-0x00007FF63FCE4000-memory.dmp

Download

memory/4296-127-0x00007FF63F990000-0x00007FF63FCE4000-memory.dmp

Download

memory/4612-121-0x00007FF612EB0000-0x00007FF613204000-memory.dmp

Download

memory/4612-147-0x00007FF612EB0000-0x00007FF613204000-memory.dmp

Download

memory/4620-118-0x00007FF7FF880000-0x00007FF7FFBD4000-memory.dmp

Download

memory/4620-143-0x00007FF7FF880000-0x00007FF7FFBD4000-memory.dmp

Download

memory/4648-142-0x00007FF7878F0000-0x00007FF787C44000-memory.dmp

Download

memory/4648-114-0x00007FF7878F0000-0x00007FF787C44000-memory.dmp

Download

memory/4900-136-0x00007FF686650000-0x00007FF6869A4000-memory.dmp

Download

memory/4900-39-0x00007FF686650000-0x00007FF6869A4000-memory.dmp

Download

memory/4904-138-0x00007FF64C230000-0x00007FF64C584000-memory.dmp

Download

memory/4904-132-0x00007FF64C230000-0x00007FF64C584000-memory.dmp

Download

memory/4904-41-0x00007FF64C230000-0x00007FF64C584000-memory.dmp

Download

memory/5016-145-0x00007FF6BB140000-0x00007FF6BB494000-memory.dmp

Download

memory/5016-116-0x00007FF6BB140000-0x00007FF6BB494000-memory.dmp

Download

memory/5044-119-0x00007FF69E5C0000-0x00007FF69E914000-memory.dmp

Download

memory/5044-141-0x00007FF69E5C0000-0x00007FF69E914000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads