cobaltstrike | 29089adfda9ccc2019f7014ac91026460787cb6528012b4129ab46326f939974

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 14:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240527-r5raqaha92
SHA256 29089adfda9ccc2019f7014ac91026460787cb6528012b4129ab46326f939974
MD5 6e739e13df605eff6af51703cd532593
SHA1 3f508097d19fe5fae0337e6910d8f101506a6aa2
SHA512 ac97b17085cf35b342c99cd4445de24e6e60ddbd2073c68d99c2270b49093347315355e17ee388cfe29f7fda4d65ae0390f1338a6a622133dc70872638851bb1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000600000002326f-6.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d2-12.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d3-16.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d4-23.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d5-29.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d6-33.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d7-40.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d8-47.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d9-55.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233da-60.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233db-64.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233dd-77.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e2-103.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e5-114.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e4-112.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e3-108.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e1-97.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e0-93.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233df-87.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233de-83.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233dc-73.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000600000002326f-6.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d2-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d3-16.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d4-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d5-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d6-33.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d7-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d8-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d9-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233da-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233db-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233dd-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e2-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e5-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e4-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e3-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e1-97.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e0-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233df-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233de-83.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233dc-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3620-0-0x00007FF614BB0000-0x00007FF614F04000-memory.dmp	UPX
behavioral2/files/0x000600000002326f-6.dat	UPX
behavioral2/files/0x00070000000233d2-12.dat	UPX
behavioral2/files/0x00070000000233d3-16.dat	UPX
behavioral2/files/0x00070000000233d4-23.dat	UPX
behavioral2/files/0x00070000000233d5-29.dat	UPX
behavioral2/files/0x00070000000233d6-33.dat	UPX
behavioral2/memory/3692-34-0x00007FF716160000-0x00007FF7164B4000-memory.dmp	UPX
behavioral2/files/0x00070000000233d7-40.dat	UPX
behavioral2/files/0x00070000000233d8-47.dat	UPX
behavioral2/memory/736-53-0x00007FF7CB3D0000-0x00007FF7CB724000-memory.dmp	UPX
behavioral2/files/0x00070000000233d9-55.dat	UPX
behavioral2/memory/836-54-0x00007FF6FA0E0000-0x00007FF6FA434000-memory.dmp	UPX
behavioral2/files/0x00070000000233da-60.dat	UPX
behavioral2/files/0x00070000000233db-64.dat	UPX
behavioral2/files/0x00070000000233dd-77.dat	UPX
behavioral2/files/0x00070000000233e2-103.dat	UPX
behavioral2/files/0x00070000000233e5-114.dat	UPX
behavioral2/files/0x00070000000233e4-112.dat	UPX
behavioral2/files/0x00070000000233e3-108.dat	UPX
behavioral2/files/0x00070000000233e1-97.dat	UPX
behavioral2/files/0x00070000000233e0-93.dat	UPX
behavioral2/files/0x00070000000233df-87.dat	UPX
behavioral2/files/0x00070000000233de-83.dat	UPX
behavioral2/files/0x00070000000233dc-73.dat	UPX
behavioral2/memory/4216-41-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp	UPX
behavioral2/memory/3028-35-0x00007FF628FF0000-0x00007FF629344000-memory.dmp	UPX
behavioral2/memory/4204-24-0x00007FF7065E0000-0x00007FF706934000-memory.dmp	UPX
behavioral2/memory/2852-18-0x00007FF74DC80000-0x00007FF74DFD4000-memory.dmp	UPX
behavioral2/memory/4176-17-0x00007FF60C920000-0x00007FF60CC74000-memory.dmp	UPX
behavioral2/memory/4496-11-0x00007FF767BE0000-0x00007FF767F34000-memory.dmp	UPX
behavioral2/memory/2040-119-0x00007FF7C1ED0000-0x00007FF7C2224000-memory.dmp	UPX
behavioral2/memory/1600-118-0x00007FF6EA460000-0x00007FF6EA7B4000-memory.dmp	UPX
behavioral2/memory/1788-117-0x00007FF627B40000-0x00007FF627E94000-memory.dmp	UPX
behavioral2/memory/2320-116-0x00007FF7E5B70000-0x00007FF7E5EC4000-memory.dmp	UPX
behavioral2/memory/2336-121-0x00007FF7CB4E0000-0x00007FF7CB834000-memory.dmp	UPX
behavioral2/memory/2088-120-0x00007FF7A4B10000-0x00007FF7A4E64000-memory.dmp	UPX
behavioral2/memory/1628-122-0x00007FF63EE60000-0x00007FF63F1B4000-memory.dmp	UPX
behavioral2/memory/3768-123-0x00007FF7814F0000-0x00007FF781844000-memory.dmp	UPX
behavioral2/memory/3508-124-0x00007FF6F6F80000-0x00007FF6F72D4000-memory.dmp	UPX
behavioral2/memory/4776-125-0x00007FF66EC80000-0x00007FF66EFD4000-memory.dmp	UPX
behavioral2/memory/3896-127-0x00007FF7435F0000-0x00007FF743944000-memory.dmp	UPX
behavioral2/memory/5060-126-0x00007FF762570000-0x00007FF7628C4000-memory.dmp	UPX
behavioral2/memory/3620-128-0x00007FF614BB0000-0x00007FF614F04000-memory.dmp	UPX
behavioral2/memory/4176-129-0x00007FF60C920000-0x00007FF60CC74000-memory.dmp	UPX
behavioral2/memory/2852-130-0x00007FF74DC80000-0x00007FF74DFD4000-memory.dmp	UPX
behavioral2/memory/4204-131-0x00007FF7065E0000-0x00007FF706934000-memory.dmp	UPX
behavioral2/memory/3028-132-0x00007FF628FF0000-0x00007FF629344000-memory.dmp	UPX
behavioral2/memory/4216-133-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp	UPX
behavioral2/memory/836-134-0x00007FF6FA0E0000-0x00007FF6FA434000-memory.dmp	UPX
behavioral2/memory/4496-135-0x00007FF767BE0000-0x00007FF767F34000-memory.dmp	UPX
behavioral2/memory/4176-136-0x00007FF60C920000-0x00007FF60CC74000-memory.dmp	UPX
behavioral2/memory/2852-137-0x00007FF74DC80000-0x00007FF74DFD4000-memory.dmp	UPX
behavioral2/memory/3692-138-0x00007FF716160000-0x00007FF7164B4000-memory.dmp	UPX
behavioral2/memory/4204-139-0x00007FF7065E0000-0x00007FF706934000-memory.dmp	UPX
behavioral2/memory/3028-140-0x00007FF628FF0000-0x00007FF629344000-memory.dmp	UPX
behavioral2/memory/736-142-0x00007FF7CB3D0000-0x00007FF7CB724000-memory.dmp	UPX
behavioral2/memory/4216-141-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp	UPX
behavioral2/memory/836-143-0x00007FF6FA0E0000-0x00007FF6FA434000-memory.dmp	UPX
behavioral2/memory/2320-144-0x00007FF7E5B70000-0x00007FF7E5EC4000-memory.dmp	UPX
behavioral2/memory/1788-145-0x00007FF627B40000-0x00007FF627E94000-memory.dmp	UPX
behavioral2/memory/1600-146-0x00007FF6EA460000-0x00007FF6EA7B4000-memory.dmp	UPX
behavioral2/memory/2040-147-0x00007FF7C1ED0000-0x00007FF7C2224000-memory.dmp	UPX
behavioral2/memory/1628-148-0x00007FF63EE60000-0x00007FF63F1B4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3620-0-0x00007FF614BB0000-0x00007FF614F04000-memory.dmp	xmrig
behavioral2/files/0x000600000002326f-6.dat	xmrig
behavioral2/files/0x00070000000233d2-12.dat	xmrig
behavioral2/files/0x00070000000233d3-16.dat	xmrig
behavioral2/files/0x00070000000233d4-23.dat	xmrig
behavioral2/files/0x00070000000233d5-29.dat	xmrig
behavioral2/files/0x00070000000233d6-33.dat	xmrig
behavioral2/memory/3692-34-0x00007FF716160000-0x00007FF7164B4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d7-40.dat	xmrig
behavioral2/files/0x00070000000233d8-47.dat	xmrig
behavioral2/memory/736-53-0x00007FF7CB3D0000-0x00007FF7CB724000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d9-55.dat	xmrig
behavioral2/memory/836-54-0x00007FF6FA0E0000-0x00007FF6FA434000-memory.dmp	xmrig
behavioral2/files/0x00070000000233da-60.dat	xmrig
behavioral2/files/0x00070000000233db-64.dat	xmrig
behavioral2/files/0x00070000000233dd-77.dat	xmrig
behavioral2/files/0x00070000000233e2-103.dat	xmrig
behavioral2/files/0x00070000000233e5-114.dat	xmrig
behavioral2/files/0x00070000000233e4-112.dat	xmrig
behavioral2/files/0x00070000000233e3-108.dat	xmrig
behavioral2/files/0x00070000000233e1-97.dat	xmrig
behavioral2/files/0x00070000000233e0-93.dat	xmrig
behavioral2/files/0x00070000000233df-87.dat	xmrig
behavioral2/files/0x00070000000233de-83.dat	xmrig
behavioral2/files/0x00070000000233dc-73.dat	xmrig
behavioral2/memory/4216-41-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp	xmrig
behavioral2/memory/3028-35-0x00007FF628FF0000-0x00007FF629344000-memory.dmp	xmrig
behavioral2/memory/4204-24-0x00007FF7065E0000-0x00007FF706934000-memory.dmp	xmrig
behavioral2/memory/2852-18-0x00007FF74DC80000-0x00007FF74DFD4000-memory.dmp	xmrig
behavioral2/memory/4176-17-0x00007FF60C920000-0x00007FF60CC74000-memory.dmp	xmrig
behavioral2/memory/4496-11-0x00007FF767BE0000-0x00007FF767F34000-memory.dmp	xmrig
behavioral2/memory/2040-119-0x00007FF7C1ED0000-0x00007FF7C2224000-memory.dmp	xmrig
behavioral2/memory/1600-118-0x00007FF6EA460000-0x00007FF6EA7B4000-memory.dmp	xmrig
behavioral2/memory/1788-117-0x00007FF627B40000-0x00007FF627E94000-memory.dmp	xmrig
behavioral2/memory/2320-116-0x00007FF7E5B70000-0x00007FF7E5EC4000-memory.dmp	xmrig
behavioral2/memory/2336-121-0x00007FF7CB4E0000-0x00007FF7CB834000-memory.dmp	xmrig
behavioral2/memory/2088-120-0x00007FF7A4B10000-0x00007FF7A4E64000-memory.dmp	xmrig
behavioral2/memory/1628-122-0x00007FF63EE60000-0x00007FF63F1B4000-memory.dmp	xmrig
behavioral2/memory/3768-123-0x00007FF7814F0000-0x00007FF781844000-memory.dmp	xmrig
behavioral2/memory/3508-124-0x00007FF6F6F80000-0x00007FF6F72D4000-memory.dmp	xmrig
behavioral2/memory/4776-125-0x00007FF66EC80000-0x00007FF66EFD4000-memory.dmp	xmrig
behavioral2/memory/3896-127-0x00007FF7435F0000-0x00007FF743944000-memory.dmp	xmrig
behavioral2/memory/5060-126-0x00007FF762570000-0x00007FF7628C4000-memory.dmp	xmrig
behavioral2/memory/3620-128-0x00007FF614BB0000-0x00007FF614F04000-memory.dmp	xmrig
behavioral2/memory/4176-129-0x00007FF60C920000-0x00007FF60CC74000-memory.dmp	xmrig
behavioral2/memory/2852-130-0x00007FF74DC80000-0x00007FF74DFD4000-memory.dmp	xmrig
behavioral2/memory/4204-131-0x00007FF7065E0000-0x00007FF706934000-memory.dmp	xmrig
behavioral2/memory/3028-132-0x00007FF628FF0000-0x00007FF629344000-memory.dmp	xmrig
behavioral2/memory/4216-133-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp	xmrig
behavioral2/memory/836-134-0x00007FF6FA0E0000-0x00007FF6FA434000-memory.dmp	xmrig
behavioral2/memory/4496-135-0x00007FF767BE0000-0x00007FF767F34000-memory.dmp	xmrig
behavioral2/memory/4176-136-0x00007FF60C920000-0x00007FF60CC74000-memory.dmp	xmrig
behavioral2/memory/2852-137-0x00007FF74DC80000-0x00007FF74DFD4000-memory.dmp	xmrig
behavioral2/memory/3692-138-0x00007FF716160000-0x00007FF7164B4000-memory.dmp	xmrig
behavioral2/memory/4204-139-0x00007FF7065E0000-0x00007FF706934000-memory.dmp	xmrig
behavioral2/memory/3028-140-0x00007FF628FF0000-0x00007FF629344000-memory.dmp	xmrig
behavioral2/memory/736-142-0x00007FF7CB3D0000-0x00007FF7CB724000-memory.dmp	xmrig
behavioral2/memory/4216-141-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp	xmrig
behavioral2/memory/836-143-0x00007FF6FA0E0000-0x00007FF6FA434000-memory.dmp	xmrig
behavioral2/memory/2320-144-0x00007FF7E5B70000-0x00007FF7E5EC4000-memory.dmp	xmrig
behavioral2/memory/1788-145-0x00007FF627B40000-0x00007FF627E94000-memory.dmp	xmrig
behavioral2/memory/1600-146-0x00007FF6EA460000-0x00007FF6EA7B4000-memory.dmp	xmrig
behavioral2/memory/2040-147-0x00007FF7C1ED0000-0x00007FF7C2224000-memory.dmp	xmrig
behavioral2/memory/1628-148-0x00007FF63EE60000-0x00007FF63F1B4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4496	aiSytPT.exe
4176	IszOJlx.exe
2852	cVsONLf.exe
4204	bpiFwaQ.exe
3692	zuUkjEX.exe
3028	kXEhVIU.exe
4216	DZiXTSF.exe
736	DiBCDDI.exe
836	VLhLiTO.exe
2320	PgGfBin.exe
1788	hSdRUct.exe
1600	GYJyTUc.exe
2040	YJkvXXR.exe
2088	NdlaDrd.exe
2336	aIpMIYd.exe
1628	KazkJaU.exe
3768	ObCPFxy.exe
3508	rPdHRQw.exe
4776	ckpWaJk.exe
5060	ShDFkdk.exe
3896	AjQNvta.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3620-0-0x00007FF614BB0000-0x00007FF614F04000-memory.dmp	upx
behavioral2/files/0x000600000002326f-6.dat	upx
behavioral2/files/0x00070000000233d2-12.dat	upx
behavioral2/files/0x00070000000233d3-16.dat	upx
behavioral2/files/0x00070000000233d4-23.dat	upx
behavioral2/files/0x00070000000233d5-29.dat	upx
behavioral2/files/0x00070000000233d6-33.dat	upx
behavioral2/memory/3692-34-0x00007FF716160000-0x00007FF7164B4000-memory.dmp	upx
behavioral2/files/0x00070000000233d7-40.dat	upx
behavioral2/files/0x00070000000233d8-47.dat	upx
behavioral2/memory/736-53-0x00007FF7CB3D0000-0x00007FF7CB724000-memory.dmp	upx
behavioral2/files/0x00070000000233d9-55.dat	upx
behavioral2/memory/836-54-0x00007FF6FA0E0000-0x00007FF6FA434000-memory.dmp	upx
behavioral2/files/0x00070000000233da-60.dat	upx
behavioral2/files/0x00070000000233db-64.dat	upx
behavioral2/files/0x00070000000233dd-77.dat	upx
behavioral2/files/0x00070000000233e2-103.dat	upx
behavioral2/files/0x00070000000233e5-114.dat	upx
behavioral2/files/0x00070000000233e4-112.dat	upx
behavioral2/files/0x00070000000233e3-108.dat	upx
behavioral2/files/0x00070000000233e1-97.dat	upx
behavioral2/files/0x00070000000233e0-93.dat	upx
behavioral2/files/0x00070000000233df-87.dat	upx
behavioral2/files/0x00070000000233de-83.dat	upx
behavioral2/files/0x00070000000233dc-73.dat	upx
behavioral2/memory/4216-41-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp	upx
behavioral2/memory/3028-35-0x00007FF628FF0000-0x00007FF629344000-memory.dmp	upx
behavioral2/memory/4204-24-0x00007FF7065E0000-0x00007FF706934000-memory.dmp	upx
behavioral2/memory/2852-18-0x00007FF74DC80000-0x00007FF74DFD4000-memory.dmp	upx
behavioral2/memory/4176-17-0x00007FF60C920000-0x00007FF60CC74000-memory.dmp	upx
behavioral2/memory/4496-11-0x00007FF767BE0000-0x00007FF767F34000-memory.dmp	upx
behavioral2/memory/2040-119-0x00007FF7C1ED0000-0x00007FF7C2224000-memory.dmp	upx
behavioral2/memory/1600-118-0x00007FF6EA460000-0x00007FF6EA7B4000-memory.dmp	upx
behavioral2/memory/1788-117-0x00007FF627B40000-0x00007FF627E94000-memory.dmp	upx
behavioral2/memory/2320-116-0x00007FF7E5B70000-0x00007FF7E5EC4000-memory.dmp	upx
behavioral2/memory/2336-121-0x00007FF7CB4E0000-0x00007FF7CB834000-memory.dmp	upx
behavioral2/memory/2088-120-0x00007FF7A4B10000-0x00007FF7A4E64000-memory.dmp	upx
behavioral2/memory/1628-122-0x00007FF63EE60000-0x00007FF63F1B4000-memory.dmp	upx
behavioral2/memory/3768-123-0x00007FF7814F0000-0x00007FF781844000-memory.dmp	upx
behavioral2/memory/3508-124-0x00007FF6F6F80000-0x00007FF6F72D4000-memory.dmp	upx
behavioral2/memory/4776-125-0x00007FF66EC80000-0x00007FF66EFD4000-memory.dmp	upx
behavioral2/memory/3896-127-0x00007FF7435F0000-0x00007FF743944000-memory.dmp	upx
behavioral2/memory/5060-126-0x00007FF762570000-0x00007FF7628C4000-memory.dmp	upx
behavioral2/memory/3620-128-0x00007FF614BB0000-0x00007FF614F04000-memory.dmp	upx
behavioral2/memory/4176-129-0x00007FF60C920000-0x00007FF60CC74000-memory.dmp	upx
behavioral2/memory/2852-130-0x00007FF74DC80000-0x00007FF74DFD4000-memory.dmp	upx
behavioral2/memory/4204-131-0x00007FF7065E0000-0x00007FF706934000-memory.dmp	upx
behavioral2/memory/3028-132-0x00007FF628FF0000-0x00007FF629344000-memory.dmp	upx
behavioral2/memory/4216-133-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp	upx
behavioral2/memory/836-134-0x00007FF6FA0E0000-0x00007FF6FA434000-memory.dmp	upx
behavioral2/memory/4496-135-0x00007FF767BE0000-0x00007FF767F34000-memory.dmp	upx
behavioral2/memory/4176-136-0x00007FF60C920000-0x00007FF60CC74000-memory.dmp	upx
behavioral2/memory/2852-137-0x00007FF74DC80000-0x00007FF74DFD4000-memory.dmp	upx
behavioral2/memory/3692-138-0x00007FF716160000-0x00007FF7164B4000-memory.dmp	upx
behavioral2/memory/4204-139-0x00007FF7065E0000-0x00007FF706934000-memory.dmp	upx
behavioral2/memory/3028-140-0x00007FF628FF0000-0x00007FF629344000-memory.dmp	upx
behavioral2/memory/736-142-0x00007FF7CB3D0000-0x00007FF7CB724000-memory.dmp	upx
behavioral2/memory/4216-141-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp	upx
behavioral2/memory/836-143-0x00007FF6FA0E0000-0x00007FF6FA434000-memory.dmp	upx
behavioral2/memory/2320-144-0x00007FF7E5B70000-0x00007FF7E5EC4000-memory.dmp	upx
behavioral2/memory/1788-145-0x00007FF627B40000-0x00007FF627E94000-memory.dmp	upx
behavioral2/memory/1600-146-0x00007FF6EA460000-0x00007FF6EA7B4000-memory.dmp	upx
behavioral2/memory/2040-147-0x00007FF7C1ED0000-0x00007FF7C2224000-memory.dmp	upx
behavioral2/memory/1628-148-0x00007FF63EE60000-0x00007FF63F1B4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\hSdRUct.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GYJyTUc.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NdlaDrd.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aiSytPT.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bpiFwaQ.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DZiXTSF.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VLhLiTO.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PgGfBin.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KazkJaU.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ObCPFxy.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\cVsONLf.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zuUkjEX.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aIpMIYd.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rPdHRQw.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IszOJlx.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kXEhVIU.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DiBCDDI.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ckpWaJk.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YJkvXXR.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ShDFkdk.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AjQNvta.exe	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 4496	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	83
PID 3620 wrote to memory of 4496	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	83
PID 3620 wrote to memory of 4176	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	84
PID 3620 wrote to memory of 4176	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	84
PID 3620 wrote to memory of 2852	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	85
PID 3620 wrote to memory of 2852	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	85
PID 3620 wrote to memory of 4204	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	86
PID 3620 wrote to memory of 4204	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	86
PID 3620 wrote to memory of 3692	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	87
PID 3620 wrote to memory of 3692	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	87
PID 3620 wrote to memory of 3028	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	88
PID 3620 wrote to memory of 3028	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	88
PID 3620 wrote to memory of 4216	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	89
PID 3620 wrote to memory of 4216	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	89
PID 3620 wrote to memory of 736	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	90
PID 3620 wrote to memory of 736	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	90
PID 3620 wrote to memory of 836	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	91
PID 3620 wrote to memory of 836	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	91
PID 3620 wrote to memory of 2320	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	92
PID 3620 wrote to memory of 2320	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	92
PID 3620 wrote to memory of 1788	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	93
PID 3620 wrote to memory of 1788	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	93
PID 3620 wrote to memory of 1600	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	94
PID 3620 wrote to memory of 1600	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	94
PID 3620 wrote to memory of 2040	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	95
PID 3620 wrote to memory of 2040	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	95
PID 3620 wrote to memory of 2088	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	96
PID 3620 wrote to memory of 2088	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	96
PID 3620 wrote to memory of 2336	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	97
PID 3620 wrote to memory of 2336	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	97
PID 3620 wrote to memory of 1628	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	98
PID 3620 wrote to memory of 1628	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	98
PID 3620 wrote to memory of 3768	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	99
PID 3620 wrote to memory of 3768	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	99
PID 3620 wrote to memory of 3508	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	100
PID 3620 wrote to memory of 3508	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	100
PID 3620 wrote to memory of 4776	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	101
PID 3620 wrote to memory of 4776	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	101
PID 3620 wrote to memory of 5060	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	102
PID 3620 wrote to memory of 5060	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	102
PID 3620 wrote to memory of 3896	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	103
PID 3620 wrote to memory of 3896	3620	2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe	103

C:\Users\Admin\AppData\Local\Temp\2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_6e739e13df605eff6af51703cd532593_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\System\aiSytPT.exe
  C:\Windows\System\aiSytPT.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\IszOJlx.exe
  C:\Windows\System\IszOJlx.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\cVsONLf.exe
  C:\Windows\System\cVsONLf.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\bpiFwaQ.exe
  C:\Windows\System\bpiFwaQ.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\zuUkjEX.exe
  C:\Windows\System\zuUkjEX.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\kXEhVIU.exe
  C:\Windows\System\kXEhVIU.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\DZiXTSF.exe
  C:\Windows\System\DZiXTSF.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\DiBCDDI.exe
  C:\Windows\System\DiBCDDI.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\VLhLiTO.exe
  C:\Windows\System\VLhLiTO.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\PgGfBin.exe
  C:\Windows\System\PgGfBin.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\hSdRUct.exe
  C:\Windows\System\hSdRUct.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\GYJyTUc.exe
  C:\Windows\System\GYJyTUc.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\YJkvXXR.exe
  C:\Windows\System\YJkvXXR.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\NdlaDrd.exe
  C:\Windows\System\NdlaDrd.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\aIpMIYd.exe
  C:\Windows\System\aIpMIYd.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\KazkJaU.exe
  C:\Windows\System\KazkJaU.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\ObCPFxy.exe
  C:\Windows\System\ObCPFxy.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\rPdHRQw.exe
  C:\Windows\System\rPdHRQw.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\ckpWaJk.exe
  C:\Windows\System\ckpWaJk.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\ShDFkdk.exe
  C:\Windows\System\ShDFkdk.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\AjQNvta.exe
  C:\Windows\System\AjQNvta.exe
  2⤵
  - Executes dropped EXE
  PID:3896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AjQNvta.exe

Path C:\Windows\System\AjQNvta.exe
Size 5.9MB
SHA256 84ee245c04bdbaaaed721e270d07c17168c678ecb5f55746cb9abe4871ffd1f9
MD5 a6404b5624c96636a58309b0dea046fd
SHA1 e5eb8a638ee66e2817887ffd1a8ac04e0634b07e
SHA512 1346b931611a0f7096e0696ec0631e516586c1a6692642d815eaff84fb608e3ac7dfff40fd64dec1278db63611024edd7bb5a19f050f5891587a6d708866cbe0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

DZiXTSF.exe

Path C:\Windows\System\DZiXTSF.exe
Size 5.9MB
SHA256 25adcb89c2834414fcc1dba818b14fa3194dc36a0e79609d08b6229398e7a08d
MD5 288246f679cb46fff20bd0fdd19e78cd
SHA1 483180eacedbc00eb78faeb6ccba90ea621d5555
SHA512 7ff2a1fb905c03938472c922642a76e785fb16afb90a203fb9d86902382af5385e8311d6af1b7957422cd45e1b70834e88159de90de655c1d563326c3c7d92b4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:Q+856utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiBCDDI.exe

Path C:\Windows\System\DiBCDDI.exe
Size 5.9MB
SHA256 676b9839ca5a903bea84b753ca13d98ff01f9c9328508ccfb21ef318177de079
MD5 395d0667200fe08041fa57cbdd4e7377
SHA1 0387498c52f6c85d660cbbc54923e8080d6b8ead
SHA512 410df5ae65de69c99adb244f949628feebfda0f7bf68a5ee578372dc0184d8370d227d29e9e09bc92be0ede8b412f55cb5e9a79175fd91dc2b6f86fd90ce7624
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

GYJyTUc.exe

Path C:\Windows\System\GYJyTUc.exe
Size 5.9MB
SHA256 48f80a524dad7ea609273e55c580c886226fbf36909255ad4b04823f6b76fa09
MD5 81f717dcf456e207ab7e85d54e5f4f61
SHA1 8e1eae9b0a5b76faef15e09661d8510651b3bae5
SHA512 cdc4bd334db9863ba61fe4e025af80eb1179f1966683513ce9433c6799eecf3b4c9292a8a3970bfb9d62d862229dbeea2659c0b04324e245753dffa43d469cb4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

IszOJlx.exe

Path C:\Windows\System\IszOJlx.exe
Size 5.9MB
SHA256 42bf858b7d07a47add2cb2d8c46d7121a2ba63e91747a7edd77bfbcba08ade50
MD5 1795ca7a83de0eed0bb9fbca6f3391a4
SHA1 73de916c926b226c5f774861c89f766684280d27
SHA512 407c6e79f5f25a1be09b18b852cff88d40fe121286296f7534fa92aab91400536dba1c96ce873da428cadd112059c308edb9107c429b7c6e5ee49766abcce2f3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

KazkJaU.exe

Path C:\Windows\System\KazkJaU.exe
Size 5.9MB
SHA256 a8ddb0c2f1b9dbd0944682d7c007866b52eebe5ad84da15799a55bab58381b64
MD5 bc14d87c599d97efa448896b79d549d8
SHA1 48630b571efb2545226a294a0b9f5ba341fd8658
SHA512 2741833a909149f8e333d193411f7dc78617d3791b9b48d84dca15ce8263bc4889d8327bd2d8622a3df95300ef78c70546178ab38b91acb6bee461083b2ffeb1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

NdlaDrd.exe

Path C:\Windows\System\NdlaDrd.exe
Size 5.9MB
SHA256 5affeeb7f5eddbe9a1acaf29a45dc2ef3711ad3612c40fa1542afc80b02bc280
MD5 c70c5f84316c38de4d1b0feb79718d1e
SHA1 587d5480b8ef1e131d5bf3035aa0767ac96e11a9
SHA512 ba7f265f7f7091ac807ae37d9e2697fd17095e4dfed211b1683fe6f43a6986b281dbf7cabfa745cd34b99b57736fc4f29e28a1cd3195b0f8ad8b9c47a1145c11
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

ObCPFxy.exe

Path C:\Windows\System\ObCPFxy.exe
Size 5.9MB
SHA256 aaf76b8d151773a65a51d638a77bd39f4d29e1de568421c9cdbeb2f426bdc95d
MD5 e7f9ac1e55551858dd1b7d19f794d30e
SHA1 d0d82edeb13b43b4a9ba71e405567afe8c1f7fde
SHA512 e96f32e665c6e4c666ef9da039ae856343439bae547c505c950fa26bee57393ad4592859339223bed896bd89cb7f9f02df5f86c63e5fe82d9244748744dd4def
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

PgGfBin.exe

Path C:\Windows\System\PgGfBin.exe
Size 5.9MB
SHA256 70297e01457c5e1fe678b5b52ea937bb1e3946d90a5a15ae27e335c1b6e80a53
MD5 9d8ec1cb9b0103f73cb1446664c68a8c
SHA1 918a3587d3ace622cbc88716d314e873eeb9d0ed
SHA512 2cf939b8c6719e463104fcbe7a39e2cbe55663266133fc74549ef53835c11e14bcbef85c04e736bf0a3cb7a5e4938644b9b520b5d3cc204d1cc88db5cb306393
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

ShDFkdk.exe

Path C:\Windows\System\ShDFkdk.exe
Size 5.9MB
SHA256 4473afe1fe65174ee8888e521b970a1d7fa5f147ae39289f40a9e577166dfb20
MD5 02f6ad2fc1f2c5ce246f1b938ea50d65
SHA1 6eee2ac11edcc6cdd0f5136c35e24d63f2421a5c
SHA512 e64bf6d6c394140ba6f05ddc9655d829c1a429acf8d8ba47677b52ab0119efd9baee76a1645efc0615037357c0bce44f4bd8c8a274557e54c8cfdcab7dae64f5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

VLhLiTO.exe

Path C:\Windows\System\VLhLiTO.exe
Size 5.9MB
SHA256 f98157c57ab52be38ae793c2248ca547d15de03767bc57c6d4f9250f6f2c1975
MD5 676dcc2c5ab0b4c31a9ca010f8576da7
SHA1 64dffa1791a17a1ec635ffe329a165defe2a4ab6
SHA512 e4cdd9570687b43123d649660ba0f94ac7ad1d2538656e6187ca09654272f89d5ad01175ff5331284407ed62262635c626be6d4886334f2801831e254499765d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

YJkvXXR.exe

Path C:\Windows\System\YJkvXXR.exe
Size 5.9MB
SHA256 e217fb0875d8e2728faaba78dd65b5da0a2bf75d0ea291f29d372399ad69defa
MD5 37b39072ade586b69e4a6ad77e127b81
SHA1 7a67e7723de234df30e94a1f3a66b584ff75d947
SHA512 82f2b9eb3d7f6a979005029924eaa294ea6ecad819154fcc1389bebd3677d829c4b9d3785eaa657b891b95d41cef28c90e635eec366d513246689dacbc97915d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

aIpMIYd.exe

Path C:\Windows\System\aIpMIYd.exe
Size 5.9MB
SHA256 3803b841591956e5d01c38f7e5ab324b0b767f66cd3b9ec84ed374d23c67ecde
MD5 8b220ca41db0f1f9af4dcd40c2f8c578
SHA1 174158d42a66348d68222923d3905ccabe1b5830
SHA512 ba4c60a127a55048af5294b07375e9a8fa1308df85e4237e642941ffcd3657422fd005dd368c62d6858f470d685cfe88b3cc1dae7c0b6623eaa59916d079ee64
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

aiSytPT.exe

Path C:\Windows\System\aiSytPT.exe
Size 5.9MB
SHA256 feec9f828d91406aaf9656cb1b5302e0d2de5ba802721aaf875dd0cb88246039
MD5 5723fda9d7980b35901f33394e521c52
SHA1 ed1d478a73a00d4bf2742e6df9f32a1ebea3674f
SHA512 10c1587ce4f36a6e3ba9d3e9beff1e9a8e14985d4a226a1d5ab931987d6399cf899c0138681c6a69f09e788dc89904a413ab92d0a4a9056f0022f30fb1628c11
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

bpiFwaQ.exe

Path C:\Windows\System\bpiFwaQ.exe
Size 5.9MB
SHA256 743c7dc3a2758b4cfc17c8365cb82352c0c24ec7fb70d1b9be45b87c2126cee7
MD5 e7a97a3338e0c0a00a6106632cecf69c
SHA1 01039da8b97264dae4c017f36faf4648561d6006
SHA512 71149f5d8caf0051427a2bee480ae79e79039fd1bbd8e63aa1d1b9ecd9858dce561a73c7824929530ac9d0373f8202552eb1981044d05f030fa62bbac34ccaa2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

cVsONLf.exe

Path C:\Windows\System\cVsONLf.exe
Size 5.9MB
SHA256 6da00698d8de42d42e9525eafc56d3803046e74fbfac5028ce3c23927d8e4bb3
MD5 9c11ae9636ccc54398e2b38352d4b47d
SHA1 95c942d7a11915d5668d20a478b0cbab1759e8de
SHA512 ed43a1610986b97e16b3fc6a9514e270d2d0492d630c06719398fc9a6cb9c5ea7bce03a08f38745551e3f61e0d831ebb4950d5f277df4834c9ceea890bbb1726
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

ckpWaJk.exe

Path C:\Windows\System\ckpWaJk.exe
Size 5.9MB
SHA256 a06271210b0aed91b3d93069f92289da1ba1544b0ffa2315759040916e80bfa0
MD5 9b51d606c3a535eee4b94951e9195810
SHA1 a62077bac71f1c51b0f1643242360c7073e0ef2b
SHA512 16ad13d183e1d1ca0b7be0f9b72594cc98ae9e870afc90e39705d810a4850b93db4fd4de2a1fa9528698edb73456130038f751c781fa44b0758a4f772ea31834
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

hSdRUct.exe

Path C:\Windows\System\hSdRUct.exe
Size 5.9MB
SHA256 f4416d81a2da5769a6b038882dcffb1fda245dc436ec599544730980f863706b
MD5 4583546ae8043fe30ed6ab6db565a71a
SHA1 1fe4c28020e26e9c832a8a1059f6a82a4f27b3af
SHA512 90ae28cf0db09661efd8464c1420f1bc4b6228e4b3589d689510f86925395931860948da50af0db2bb1602b6e32408e6274e55ddeabad902b4c76a65824819ba
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

kXEhVIU.exe

Path C:\Windows\System\kXEhVIU.exe
Size 5.9MB
SHA256 5ef11662838b1c19b50fbe2c6bbdf96e3ae7ec5433fcbd3b343059a4be902e9d
MD5 b1980cf7949567f43441b367cb216aa9
SHA1 a6015fbb059f795d514cf401fc9c00d0a068c475
SHA512 12aed8dc6eb733a763b235b4a7db34a8e7ddccfd07969927ab71f44c21de9aa4260ee6efe4338b6485179df31e3360083f66f70a22d75187fa96eeba43ce5387
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

rPdHRQw.exe

Path C:\Windows\System\rPdHRQw.exe
Size 5.9MB
SHA256 172cfcd1ba5efdd246d4b49b2f0cfe50d7174183760f26d8f102e550ec34ea32
MD5 2886f68ffa602a37c472373c7db90bc0
SHA1 7198bedff0f342806687fd0365eadf3707ec30f8
SHA512 9f8891edf31df776cbe726829fede20583e2327aaa2fb6c9db8fa27748c8e613d4ef94c1590bbb9459cddda51b4b11517396ed4bbb907abfae76f7fe99b75057
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

zuUkjEX.exe

Path C:\Windows\System\zuUkjEX.exe
Size 5.9MB
SHA256 fcd59933dc42bc5bae393397d4032a52929eb8651ab1d51ae3db1d5a8ed9f6ec
MD5 2c2330c9bfe3818709ce28a2a1a54d32
SHA1 236503904a3a520db73018e16b0ecdd7a6b9437c
SHA512 08f80faf988d9f808705573478c85ff58e56387623448f2d75118baf97e0265b59d5e6212c1bd2d5f7fbfb057960831fb5a7b450d1793a7e92d2041f68d794f7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/736-53-0x00007FF7CB3D0000-0x00007FF7CB724000-memory.dmp

Download

memory/736-142-0x00007FF7CB3D0000-0x00007FF7CB724000-memory.dmp

Download

memory/836-54-0x00007FF6FA0E0000-0x00007FF6FA434000-memory.dmp

Download

memory/836-143-0x00007FF6FA0E0000-0x00007FF6FA434000-memory.dmp

Download

memory/836-134-0x00007FF6FA0E0000-0x00007FF6FA434000-memory.dmp

Download

memory/1600-118-0x00007FF6EA460000-0x00007FF6EA7B4000-memory.dmp

Download

memory/1600-146-0x00007FF6EA460000-0x00007FF6EA7B4000-memory.dmp

Download

memory/1628-148-0x00007FF63EE60000-0x00007FF63F1B4000-memory.dmp

Download

memory/1628-122-0x00007FF63EE60000-0x00007FF63F1B4000-memory.dmp

Download

memory/1788-117-0x00007FF627B40000-0x00007FF627E94000-memory.dmp

Download

memory/1788-145-0x00007FF627B40000-0x00007FF627E94000-memory.dmp

Download

memory/2040-147-0x00007FF7C1ED0000-0x00007FF7C2224000-memory.dmp

Download

memory/2040-119-0x00007FF7C1ED0000-0x00007FF7C2224000-memory.dmp

Download

memory/2088-150-0x00007FF7A4B10000-0x00007FF7A4E64000-memory.dmp

Download

memory/2088-120-0x00007FF7A4B10000-0x00007FF7A4E64000-memory.dmp

Download

memory/2320-116-0x00007FF7E5B70000-0x00007FF7E5EC4000-memory.dmp

Download

memory/2320-144-0x00007FF7E5B70000-0x00007FF7E5EC4000-memory.dmp

Download

memory/2336-149-0x00007FF7CB4E0000-0x00007FF7CB834000-memory.dmp

Download

memory/2336-121-0x00007FF7CB4E0000-0x00007FF7CB834000-memory.dmp

Download

memory/2852-130-0x00007FF74DC80000-0x00007FF74DFD4000-memory.dmp

Download

memory/2852-137-0x00007FF74DC80000-0x00007FF74DFD4000-memory.dmp

Download

memory/2852-18-0x00007FF74DC80000-0x00007FF74DFD4000-memory.dmp

Download

memory/3028-35-0x00007FF628FF0000-0x00007FF629344000-memory.dmp

Download

memory/3028-140-0x00007FF628FF0000-0x00007FF629344000-memory.dmp

Download

memory/3028-132-0x00007FF628FF0000-0x00007FF629344000-memory.dmp

Download

memory/3508-155-0x00007FF6F6F80000-0x00007FF6F72D4000-memory.dmp

Download

memory/3508-124-0x00007FF6F6F80000-0x00007FF6F72D4000-memory.dmp

Download

memory/3620-128-0x00007FF614BB0000-0x00007FF614F04000-memory.dmp

Download

memory/3620-1-0x000001C8C03B0000-0x000001C8C03C0000-memory.dmp

Download

memory/3620-0-0x00007FF614BB0000-0x00007FF614F04000-memory.dmp

Download

memory/3692-138-0x00007FF716160000-0x00007FF7164B4000-memory.dmp

Download

memory/3692-34-0x00007FF716160000-0x00007FF7164B4000-memory.dmp

Download

memory/3768-151-0x00007FF7814F0000-0x00007FF781844000-memory.dmp

Download

memory/3768-123-0x00007FF7814F0000-0x00007FF781844000-memory.dmp

Download

memory/3896-152-0x00007FF7435F0000-0x00007FF743944000-memory.dmp

Download

memory/3896-127-0x00007FF7435F0000-0x00007FF743944000-memory.dmp

Download

memory/4176-129-0x00007FF60C920000-0x00007FF60CC74000-memory.dmp

Download

memory/4176-136-0x00007FF60C920000-0x00007FF60CC74000-memory.dmp

Download

memory/4176-17-0x00007FF60C920000-0x00007FF60CC74000-memory.dmp

Download

memory/4204-131-0x00007FF7065E0000-0x00007FF706934000-memory.dmp

Download

memory/4204-24-0x00007FF7065E0000-0x00007FF706934000-memory.dmp

Download

memory/4204-139-0x00007FF7065E0000-0x00007FF706934000-memory.dmp

Download

memory/4216-41-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp

Download

memory/4216-133-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp

Download

memory/4216-141-0x00007FF67F960000-0x00007FF67FCB4000-memory.dmp

Download

memory/4496-135-0x00007FF767BE0000-0x00007FF767F34000-memory.dmp

Download

memory/4496-11-0x00007FF767BE0000-0x00007FF767F34000-memory.dmp

Download

memory/4776-154-0x00007FF66EC80000-0x00007FF66EFD4000-memory.dmp

Download

memory/4776-125-0x00007FF66EC80000-0x00007FF66EFD4000-memory.dmp

Download

memory/5060-153-0x00007FF762570000-0x00007FF7628C4000-memory.dmp

Download

memory/5060-126-0x00007FF762570000-0x00007FF7628C4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads