cobaltstrike | 451e7d32777061de43a5fb3d3c982ba801cb3ea62fac22d71af49dc52715c2b9

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240527-wcjsdsca7x
SHA256 451e7d32777061de43a5fb3d3c982ba801cb3ea62fac22d71af49dc52715c2b9
MD5 0dc5c534051e7224201d3edf5f7cf8c2
SHA1 5274c39b8e2b6434bac9a14cd4af3e6c50c32755
SHA512 1dbf345548151c6d689b2e73c8a57fee7362d0db4c1e76bcfdd098904568c82b7aad8ec88613b153a3b3d21019b80ed394a4c53e549d627ed70799caa73fcfa7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00090000000233ed-4.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f2-10.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f1-12.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f3-20.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f4-30.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f5-34.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000233ee-41.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f6-47.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f7-53.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f8-60.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f9-65.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fc-75.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fe-86.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ff-89.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023401-99.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023400-104.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fd-97.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fb-79.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023402-116.dat	cobalt_reflective_dll
behavioral2/files/0x0011000000016964-120.dat	cobalt_reflective_dll
behavioral2/files/0x000a00000002334e-128.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233ed-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f2-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f1-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f3-20.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f4-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f5-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00080000000233ee-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f6-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f7-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f8-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f9-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fc-75.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fe-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ff-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023401-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023400-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fd-97.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fb-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023402-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0011000000016964-120.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a00000002334e-128.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1948-0-0x00007FF6DE490000-0x00007FF6DE7E4000-memory.dmp	UPX
behavioral2/files/0x00090000000233ed-4.dat	UPX
behavioral2/memory/4920-8-0x00007FF7CE470000-0x00007FF7CE7C4000-memory.dmp	UPX
behavioral2/files/0x00070000000233f2-10.dat	UPX
behavioral2/files/0x00070000000233f1-12.dat	UPX
behavioral2/memory/3372-15-0x00007FF66B150000-0x00007FF66B4A4000-memory.dmp	UPX
behavioral2/files/0x00070000000233f3-20.dat	UPX
behavioral2/memory/4020-19-0x00007FF7BD9D0000-0x00007FF7BDD24000-memory.dmp	UPX
behavioral2/memory/1676-29-0x00007FF72C810000-0x00007FF72CB64000-memory.dmp	UPX
behavioral2/files/0x00070000000233f4-30.dat	UPX
behavioral2/memory/1724-28-0x00007FF672A60000-0x00007FF672DB4000-memory.dmp	UPX
behavioral2/files/0x00070000000233f5-34.dat	UPX
behavioral2/memory/448-38-0x00007FF7191A0000-0x00007FF7194F4000-memory.dmp	UPX
behavioral2/files/0x00080000000233ee-41.dat	UPX
behavioral2/memory/3688-42-0x00007FF62B2D0000-0x00007FF62B624000-memory.dmp	UPX
behavioral2/files/0x00070000000233f6-47.dat	UPX
behavioral2/memory/1460-48-0x00007FF70A400000-0x00007FF70A754000-memory.dmp	UPX
behavioral2/files/0x00070000000233f7-53.dat	UPX
behavioral2/memory/3116-58-0x00007FF715430000-0x00007FF715784000-memory.dmp	UPX
behavioral2/files/0x00070000000233f8-60.dat	UPX
behavioral2/files/0x00070000000233f9-65.dat	UPX
behavioral2/files/0x00070000000233fc-75.dat	UPX
behavioral2/memory/2600-81-0x00007FF6F54F0000-0x00007FF6F5844000-memory.dmp	UPX
behavioral2/files/0x00070000000233fe-86.dat	UPX
behavioral2/files/0x00070000000233ff-89.dat	UPX
behavioral2/files/0x0007000000023401-99.dat	UPX
behavioral2/files/0x0007000000023400-104.dat	UPX
behavioral2/memory/4020-111-0x00007FF7BD9D0000-0x00007FF7BDD24000-memory.dmp	UPX
behavioral2/memory/5080-112-0x00007FF6E3E40000-0x00007FF6E4194000-memory.dmp	UPX
behavioral2/memory/3744-110-0x00007FF7FBFB0000-0x00007FF7FC304000-memory.dmp	UPX
behavioral2/memory/2320-103-0x00007FF786740000-0x00007FF786A94000-memory.dmp	UPX
behavioral2/memory/1692-100-0x00007FF7A1A60000-0x00007FF7A1DB4000-memory.dmp	UPX
behavioral2/files/0x00070000000233fd-97.dat	UPX
behavioral2/memory/5024-94-0x00007FF677AB0000-0x00007FF677E04000-memory.dmp	UPX
behavioral2/memory/3372-93-0x00007FF66B150000-0x00007FF66B4A4000-memory.dmp	UPX
behavioral2/files/0x00070000000233fb-79.dat	UPX
behavioral2/memory/3216-76-0x00007FF780350000-0x00007FF7806A4000-memory.dmp	UPX
behavioral2/memory/3992-70-0x00007FF6179B0000-0x00007FF617D04000-memory.dmp	UPX
behavioral2/memory/1948-67-0x00007FF6DE490000-0x00007FF6DE7E4000-memory.dmp	UPX
behavioral2/memory/2676-64-0x00007FF7F97D0000-0x00007FF7F9B24000-memory.dmp	UPX
behavioral2/files/0x0007000000023402-116.dat	UPX
behavioral2/files/0x0011000000016964-120.dat	UPX
behavioral2/memory/1676-119-0x00007FF72C810000-0x00007FF72CB64000-memory.dmp	UPX
behavioral2/memory/2440-124-0x00007FF773C20000-0x00007FF773F74000-memory.dmp	UPX
behavioral2/files/0x000a00000002334e-128.dat	UPX
behavioral2/memory/3688-131-0x00007FF62B2D0000-0x00007FF62B624000-memory.dmp	UPX
behavioral2/memory/2276-132-0x00007FF773580000-0x00007FF7738D4000-memory.dmp	UPX
behavioral2/memory/1216-127-0x00007FF629AC0000-0x00007FF629E14000-memory.dmp	UPX
behavioral2/memory/1460-133-0x00007FF70A400000-0x00007FF70A754000-memory.dmp	UPX
behavioral2/memory/3116-134-0x00007FF715430000-0x00007FF715784000-memory.dmp	UPX
behavioral2/memory/3992-135-0x00007FF6179B0000-0x00007FF617D04000-memory.dmp	UPX
behavioral2/memory/3216-136-0x00007FF780350000-0x00007FF7806A4000-memory.dmp	UPX
behavioral2/memory/2600-137-0x00007FF6F54F0000-0x00007FF6F5844000-memory.dmp	UPX
behavioral2/memory/1692-138-0x00007FF7A1A60000-0x00007FF7A1DB4000-memory.dmp	UPX
behavioral2/memory/5024-139-0x00007FF677AB0000-0x00007FF677E04000-memory.dmp	UPX
behavioral2/memory/2320-140-0x00007FF786740000-0x00007FF786A94000-memory.dmp	UPX
behavioral2/memory/3744-141-0x00007FF7FBFB0000-0x00007FF7FC304000-memory.dmp	UPX
behavioral2/memory/2440-142-0x00007FF773C20000-0x00007FF773F74000-memory.dmp	UPX
behavioral2/memory/4920-143-0x00007FF7CE470000-0x00007FF7CE7C4000-memory.dmp	UPX
behavioral2/memory/3372-144-0x00007FF66B150000-0x00007FF66B4A4000-memory.dmp	UPX
behavioral2/memory/1724-145-0x00007FF672A60000-0x00007FF672DB4000-memory.dmp	UPX
behavioral2/memory/4020-146-0x00007FF7BD9D0000-0x00007FF7BDD24000-memory.dmp	UPX
behavioral2/memory/1676-147-0x00007FF72C810000-0x00007FF72CB64000-memory.dmp	UPX
behavioral2/memory/448-148-0x00007FF7191A0000-0x00007FF7194F4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1948-0-0x00007FF6DE490000-0x00007FF6DE7E4000-memory.dmp	xmrig
behavioral2/files/0x00090000000233ed-4.dat	xmrig
behavioral2/memory/4920-8-0x00007FF7CE470000-0x00007FF7CE7C4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f2-10.dat	xmrig
behavioral2/files/0x00070000000233f1-12.dat	xmrig
behavioral2/memory/3372-15-0x00007FF66B150000-0x00007FF66B4A4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f3-20.dat	xmrig
behavioral2/memory/4020-19-0x00007FF7BD9D0000-0x00007FF7BDD24000-memory.dmp	xmrig
behavioral2/memory/1676-29-0x00007FF72C810000-0x00007FF72CB64000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f4-30.dat	xmrig
behavioral2/memory/1724-28-0x00007FF672A60000-0x00007FF672DB4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f5-34.dat	xmrig
behavioral2/memory/448-38-0x00007FF7191A0000-0x00007FF7194F4000-memory.dmp	xmrig
behavioral2/files/0x00080000000233ee-41.dat	xmrig
behavioral2/memory/3688-42-0x00007FF62B2D0000-0x00007FF62B624000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f6-47.dat	xmrig
behavioral2/memory/1460-48-0x00007FF70A400000-0x00007FF70A754000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f7-53.dat	xmrig
behavioral2/memory/3116-58-0x00007FF715430000-0x00007FF715784000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f8-60.dat	xmrig
behavioral2/files/0x00070000000233f9-65.dat	xmrig
behavioral2/files/0x00070000000233fc-75.dat	xmrig
behavioral2/memory/2600-81-0x00007FF6F54F0000-0x00007FF6F5844000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fe-86.dat	xmrig
behavioral2/files/0x00070000000233ff-89.dat	xmrig
behavioral2/files/0x0007000000023401-99.dat	xmrig
behavioral2/files/0x0007000000023400-104.dat	xmrig
behavioral2/memory/4020-111-0x00007FF7BD9D0000-0x00007FF7BDD24000-memory.dmp	xmrig
behavioral2/memory/5080-112-0x00007FF6E3E40000-0x00007FF6E4194000-memory.dmp	xmrig
behavioral2/memory/3744-110-0x00007FF7FBFB0000-0x00007FF7FC304000-memory.dmp	xmrig
behavioral2/memory/2320-103-0x00007FF786740000-0x00007FF786A94000-memory.dmp	xmrig
behavioral2/memory/1692-100-0x00007FF7A1A60000-0x00007FF7A1DB4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fd-97.dat	xmrig
behavioral2/memory/5024-94-0x00007FF677AB0000-0x00007FF677E04000-memory.dmp	xmrig
behavioral2/memory/3372-93-0x00007FF66B150000-0x00007FF66B4A4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fb-79.dat	xmrig
behavioral2/memory/3216-76-0x00007FF780350000-0x00007FF7806A4000-memory.dmp	xmrig
behavioral2/memory/3992-70-0x00007FF6179B0000-0x00007FF617D04000-memory.dmp	xmrig
behavioral2/memory/1948-67-0x00007FF6DE490000-0x00007FF6DE7E4000-memory.dmp	xmrig
behavioral2/memory/2676-64-0x00007FF7F97D0000-0x00007FF7F9B24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023402-116.dat	xmrig
behavioral2/files/0x0011000000016964-120.dat	xmrig
behavioral2/memory/1676-119-0x00007FF72C810000-0x00007FF72CB64000-memory.dmp	xmrig
behavioral2/memory/2440-124-0x00007FF773C20000-0x00007FF773F74000-memory.dmp	xmrig
behavioral2/files/0x000a00000002334e-128.dat	xmrig
behavioral2/memory/3688-131-0x00007FF62B2D0000-0x00007FF62B624000-memory.dmp	xmrig
behavioral2/memory/2276-132-0x00007FF773580000-0x00007FF7738D4000-memory.dmp	xmrig
behavioral2/memory/1216-127-0x00007FF629AC0000-0x00007FF629E14000-memory.dmp	xmrig
behavioral2/memory/1460-133-0x00007FF70A400000-0x00007FF70A754000-memory.dmp	xmrig
behavioral2/memory/3116-134-0x00007FF715430000-0x00007FF715784000-memory.dmp	xmrig
behavioral2/memory/3992-135-0x00007FF6179B0000-0x00007FF617D04000-memory.dmp	xmrig
behavioral2/memory/3216-136-0x00007FF780350000-0x00007FF7806A4000-memory.dmp	xmrig
behavioral2/memory/2600-137-0x00007FF6F54F0000-0x00007FF6F5844000-memory.dmp	xmrig
behavioral2/memory/1692-138-0x00007FF7A1A60000-0x00007FF7A1DB4000-memory.dmp	xmrig
behavioral2/memory/5024-139-0x00007FF677AB0000-0x00007FF677E04000-memory.dmp	xmrig
behavioral2/memory/2320-140-0x00007FF786740000-0x00007FF786A94000-memory.dmp	xmrig
behavioral2/memory/3744-141-0x00007FF7FBFB0000-0x00007FF7FC304000-memory.dmp	xmrig
behavioral2/memory/2440-142-0x00007FF773C20000-0x00007FF773F74000-memory.dmp	xmrig
behavioral2/memory/4920-143-0x00007FF7CE470000-0x00007FF7CE7C4000-memory.dmp	xmrig
behavioral2/memory/3372-144-0x00007FF66B150000-0x00007FF66B4A4000-memory.dmp	xmrig
behavioral2/memory/1724-145-0x00007FF672A60000-0x00007FF672DB4000-memory.dmp	xmrig
behavioral2/memory/4020-146-0x00007FF7BD9D0000-0x00007FF7BDD24000-memory.dmp	xmrig
behavioral2/memory/1676-147-0x00007FF72C810000-0x00007FF72CB64000-memory.dmp	xmrig
behavioral2/memory/448-148-0x00007FF7191A0000-0x00007FF7194F4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4920	UbugkRm.exe
3372	YuwWpJG.exe
4020	qWtqFDe.exe
1724	MXNIrBa.exe
1676	gSKSOVQ.exe
448	QRTuytW.exe
3688	xFYDQPB.exe
1460	ixQyWzp.exe
3116	amZaCWm.exe
2676	pHmTovq.exe
3992	hoibZht.exe
3216	JModeYO.exe
2600	BvzBwUc.exe
5024	ImjuDzu.exe
1692	OACEDIS.exe
3744	huVnOnA.exe
5080	uaEzJfB.exe
2320	YcEHKJU.exe
2440	aZuYHoW.exe
1216	jshZuNz.exe
2276	TtDXnQN.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1948-0-0x00007FF6DE490000-0x00007FF6DE7E4000-memory.dmp	upx
behavioral2/files/0x00090000000233ed-4.dat	upx
behavioral2/memory/4920-8-0x00007FF7CE470000-0x00007FF7CE7C4000-memory.dmp	upx
behavioral2/files/0x00070000000233f2-10.dat	upx
behavioral2/files/0x00070000000233f1-12.dat	upx
behavioral2/memory/3372-15-0x00007FF66B150000-0x00007FF66B4A4000-memory.dmp	upx
behavioral2/files/0x00070000000233f3-20.dat	upx
behavioral2/memory/4020-19-0x00007FF7BD9D0000-0x00007FF7BDD24000-memory.dmp	upx
behavioral2/memory/1676-29-0x00007FF72C810000-0x00007FF72CB64000-memory.dmp	upx
behavioral2/files/0x00070000000233f4-30.dat	upx
behavioral2/memory/1724-28-0x00007FF672A60000-0x00007FF672DB4000-memory.dmp	upx
behavioral2/files/0x00070000000233f5-34.dat	upx
behavioral2/memory/448-38-0x00007FF7191A0000-0x00007FF7194F4000-memory.dmp	upx
behavioral2/files/0x00080000000233ee-41.dat	upx
behavioral2/memory/3688-42-0x00007FF62B2D0000-0x00007FF62B624000-memory.dmp	upx
behavioral2/files/0x00070000000233f6-47.dat	upx
behavioral2/memory/1460-48-0x00007FF70A400000-0x00007FF70A754000-memory.dmp	upx
behavioral2/files/0x00070000000233f7-53.dat	upx
behavioral2/memory/3116-58-0x00007FF715430000-0x00007FF715784000-memory.dmp	upx
behavioral2/files/0x00070000000233f8-60.dat	upx
behavioral2/files/0x00070000000233f9-65.dat	upx
behavioral2/files/0x00070000000233fc-75.dat	upx
behavioral2/memory/2600-81-0x00007FF6F54F0000-0x00007FF6F5844000-memory.dmp	upx
behavioral2/files/0x00070000000233fe-86.dat	upx
behavioral2/files/0x00070000000233ff-89.dat	upx
behavioral2/files/0x0007000000023401-99.dat	upx
behavioral2/files/0x0007000000023400-104.dat	upx
behavioral2/memory/4020-111-0x00007FF7BD9D0000-0x00007FF7BDD24000-memory.dmp	upx
behavioral2/memory/5080-112-0x00007FF6E3E40000-0x00007FF6E4194000-memory.dmp	upx
behavioral2/memory/3744-110-0x00007FF7FBFB0000-0x00007FF7FC304000-memory.dmp	upx
behavioral2/memory/2320-103-0x00007FF786740000-0x00007FF786A94000-memory.dmp	upx
behavioral2/memory/1692-100-0x00007FF7A1A60000-0x00007FF7A1DB4000-memory.dmp	upx
behavioral2/files/0x00070000000233fd-97.dat	upx
behavioral2/memory/5024-94-0x00007FF677AB0000-0x00007FF677E04000-memory.dmp	upx
behavioral2/memory/3372-93-0x00007FF66B150000-0x00007FF66B4A4000-memory.dmp	upx
behavioral2/files/0x00070000000233fb-79.dat	upx
behavioral2/memory/3216-76-0x00007FF780350000-0x00007FF7806A4000-memory.dmp	upx
behavioral2/memory/3992-70-0x00007FF6179B0000-0x00007FF617D04000-memory.dmp	upx
behavioral2/memory/1948-67-0x00007FF6DE490000-0x00007FF6DE7E4000-memory.dmp	upx
behavioral2/memory/2676-64-0x00007FF7F97D0000-0x00007FF7F9B24000-memory.dmp	upx
behavioral2/files/0x0007000000023402-116.dat	upx
behavioral2/files/0x0011000000016964-120.dat	upx
behavioral2/memory/1676-119-0x00007FF72C810000-0x00007FF72CB64000-memory.dmp	upx
behavioral2/memory/2440-124-0x00007FF773C20000-0x00007FF773F74000-memory.dmp	upx
behavioral2/files/0x000a00000002334e-128.dat	upx
behavioral2/memory/3688-131-0x00007FF62B2D0000-0x00007FF62B624000-memory.dmp	upx
behavioral2/memory/2276-132-0x00007FF773580000-0x00007FF7738D4000-memory.dmp	upx
behavioral2/memory/1216-127-0x00007FF629AC0000-0x00007FF629E14000-memory.dmp	upx
behavioral2/memory/1460-133-0x00007FF70A400000-0x00007FF70A754000-memory.dmp	upx
behavioral2/memory/3116-134-0x00007FF715430000-0x00007FF715784000-memory.dmp	upx
behavioral2/memory/3992-135-0x00007FF6179B0000-0x00007FF617D04000-memory.dmp	upx
behavioral2/memory/3216-136-0x00007FF780350000-0x00007FF7806A4000-memory.dmp	upx
behavioral2/memory/2600-137-0x00007FF6F54F0000-0x00007FF6F5844000-memory.dmp	upx
behavioral2/memory/1692-138-0x00007FF7A1A60000-0x00007FF7A1DB4000-memory.dmp	upx
behavioral2/memory/5024-139-0x00007FF677AB0000-0x00007FF677E04000-memory.dmp	upx
behavioral2/memory/2320-140-0x00007FF786740000-0x00007FF786A94000-memory.dmp	upx
behavioral2/memory/3744-141-0x00007FF7FBFB0000-0x00007FF7FC304000-memory.dmp	upx
behavioral2/memory/2440-142-0x00007FF773C20000-0x00007FF773F74000-memory.dmp	upx
behavioral2/memory/4920-143-0x00007FF7CE470000-0x00007FF7CE7C4000-memory.dmp	upx
behavioral2/memory/3372-144-0x00007FF66B150000-0x00007FF66B4A4000-memory.dmp	upx
behavioral2/memory/1724-145-0x00007FF672A60000-0x00007FF672DB4000-memory.dmp	upx
behavioral2/memory/4020-146-0x00007FF7BD9D0000-0x00007FF7BDD24000-memory.dmp	upx
behavioral2/memory/1676-147-0x00007FF72C810000-0x00007FF72CB64000-memory.dmp	upx
behavioral2/memory/448-148-0x00007FF7191A0000-0x00007FF7194F4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\pHmTovq.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hoibZht.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OACEDIS.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jshZuNz.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UbugkRm.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qWtqFDe.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MXNIrBa.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QRTuytW.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BvzBwUc.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ImjuDzu.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YcEHKJU.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YuwWpJG.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gSKSOVQ.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\amZaCWm.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aZuYHoW.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uaEzJfB.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TtDXnQN.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xFYDQPB.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ixQyWzp.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JModeYO.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\huVnOnA.exe	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 4920	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	83
PID 1948 wrote to memory of 4920	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	83
PID 1948 wrote to memory of 3372	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	84
PID 1948 wrote to memory of 3372	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	84
PID 1948 wrote to memory of 4020	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	85
PID 1948 wrote to memory of 4020	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	85
PID 1948 wrote to memory of 1724	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	86
PID 1948 wrote to memory of 1724	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	86
PID 1948 wrote to memory of 1676	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	87
PID 1948 wrote to memory of 1676	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	87
PID 1948 wrote to memory of 448	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	88
PID 1948 wrote to memory of 448	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	88
PID 1948 wrote to memory of 3688	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	89
PID 1948 wrote to memory of 3688	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	89
PID 1948 wrote to memory of 1460	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	90
PID 1948 wrote to memory of 1460	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	90
PID 1948 wrote to memory of 3116	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	91
PID 1948 wrote to memory of 3116	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	91
PID 1948 wrote to memory of 2676	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	94
PID 1948 wrote to memory of 2676	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	94
PID 1948 wrote to memory of 3992	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	95
PID 1948 wrote to memory of 3992	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	95
PID 1948 wrote to memory of 3216	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	96
PID 1948 wrote to memory of 3216	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	96
PID 1948 wrote to memory of 2600	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	97
PID 1948 wrote to memory of 2600	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	97
PID 1948 wrote to memory of 5024	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	98
PID 1948 wrote to memory of 5024	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	98
PID 1948 wrote to memory of 1692	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	99
PID 1948 wrote to memory of 1692	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	99
PID 1948 wrote to memory of 3744	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	100
PID 1948 wrote to memory of 3744	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	100
PID 1948 wrote to memory of 5080	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	101
PID 1948 wrote to memory of 5080	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	101
PID 1948 wrote to memory of 2320	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	102
PID 1948 wrote to memory of 2320	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	102
PID 1948 wrote to memory of 2440	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	104
PID 1948 wrote to memory of 2440	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	104
PID 1948 wrote to memory of 1216	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	105
PID 1948 wrote to memory of 1216	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	105
PID 1948 wrote to memory of 2276	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	106
PID 1948 wrote to memory of 2276	1948	2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe	106

C:\Users\Admin\AppData\Local\Temp\2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_0dc5c534051e7224201d3edf5f7cf8c2_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\System\UbugkRm.exe
  C:\Windows\System\UbugkRm.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\YuwWpJG.exe
  C:\Windows\System\YuwWpJG.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\qWtqFDe.exe
  C:\Windows\System\qWtqFDe.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\MXNIrBa.exe
  C:\Windows\System\MXNIrBa.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\gSKSOVQ.exe
  C:\Windows\System\gSKSOVQ.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\QRTuytW.exe
  C:\Windows\System\QRTuytW.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\xFYDQPB.exe
  C:\Windows\System\xFYDQPB.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\ixQyWzp.exe
  C:\Windows\System\ixQyWzp.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\amZaCWm.exe
  C:\Windows\System\amZaCWm.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\pHmTovq.exe
  C:\Windows\System\pHmTovq.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\hoibZht.exe
  C:\Windows\System\hoibZht.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\JModeYO.exe
  C:\Windows\System\JModeYO.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\BvzBwUc.exe
  C:\Windows\System\BvzBwUc.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\ImjuDzu.exe
  C:\Windows\System\ImjuDzu.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\OACEDIS.exe
  C:\Windows\System\OACEDIS.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\huVnOnA.exe
  C:\Windows\System\huVnOnA.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\uaEzJfB.exe
  C:\Windows\System\uaEzJfB.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\YcEHKJU.exe
  C:\Windows\System\YcEHKJU.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\aZuYHoW.exe
  C:\Windows\System\aZuYHoW.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\jshZuNz.exe
  C:\Windows\System\jshZuNz.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\TtDXnQN.exe
  C:\Windows\System\TtDXnQN.exe
  2⤵
  - Executes dropped EXE
  PID:2276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BvzBwUc.exe

Path C:\Windows\System\BvzBwUc.exe
Size 5.9MB
SHA256 02b4703bc115c963bbef3e57d2f79490664ff7a2f66dbf70aea4ebfad1a22647
MD5 ab8535111834b686ac580d135a925193
SHA1 f60dcffe53d8c03ffb530bf09935b07e8efede7e
SHA512 341e07766735ada3a290b7b91885fa2bd46392986ed163ca68009adb09a9bf9de7649d2bb32ff476086d7698c82f946d21b957e3dc28e892c0110c393cc2c4d0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImjuDzu.exe

Path C:\Windows\System\ImjuDzu.exe
Size 5.9MB
SHA256 6562e7834fbd11502dc53903ccf4a63fada01eee0e834d7a91b8749f2bbd618e
MD5 39da6152117572cf24068341085269ae
SHA1 2c65aecb80f076cb9bb5a896f918ad824790aac7
SHA512 57a691b62338442ec08e683b2ef8da6fd25ebc93a8a70d32b08646ceb2db8821629e5d56114c7d3c633d8af22fa192e230df45b739792cec1bd0d6d569ed3623
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

JModeYO.exe

Path C:\Windows\System\JModeYO.exe
Size 5.9MB
SHA256 e5157659d5a1cf155ee341252b0da08795849c5111acfa4083918fd5e49f89e4
MD5 c61f845b1b89422dd6dc563f52b3a422
SHA1 e1813e32b3fcfd6e9e14d5ee7f68947b4a67c2de
SHA512 781f3ade96e55a9d23cea2aba26e9a8bd3e24f76fd3ef935dd6cb41a7f1191d840512333ae1fb9101ea184427c029ca8409d1466f0ff47dccb5f869b83d6676b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

MXNIrBa.exe

Path C:\Windows\System\MXNIrBa.exe
Size 5.9MB
SHA256 dcd60d045af229ce7c527052c6dd4e9989a9317261f91488e55aa3870bf69477
MD5 bba0da8100853b0cadf89b4f75a8c503
SHA1 a535d1fc4906d0f6f5bcba95295ce7fa4caa9e1b
SHA512 200576a96ed9731c4a0f33049510526054671e9e8f331d8aac175fb3f4608d7089c974349fdc895594a21ba5558fcacddbd1b386ceab36341282bb1570c84038
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

OACEDIS.exe

Path C:\Windows\System\OACEDIS.exe
Size 5.9MB
SHA256 5a739eb0a14c00bada179527f4472abc8a207aa1c4b1b0b1fc5d816fdccb3a1c
MD5 864917b5ff3f46dd4beb4868a966a2b8
SHA1 8aad7b855b81d494908e744365389044ae07acb1
SHA512 15c84fa37d369dcbb3b98cd6c3a84ae6cacd6c4cc41eef0def1e10d67dea67a5415aec50b648ddf5823deaf01a62bbb95d6b9ca99593bf1bcded6e0920f2e1f3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:Q+856utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

QRTuytW.exe

Path C:\Windows\System\QRTuytW.exe
Size 5.9MB
SHA256 6af66b95603dbc3fcd3fe892a4df20b8d9bb0595bca93449c6faf033e9d76fde
MD5 6d58af3cb61a270cb1a151182282ed22
SHA1 56b47f888f10872d1237126bc4f694bb691cae79
SHA512 84da1769a4368d3ffd5e5cb23f3ac65f1d57e9fecdf73a4c30c22dbd8248c0f1f1dadad324eb93f7c7a4e12a6355f87ac175c163a7013fea90e1871b87b9a993
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

TtDXnQN.exe

Path C:\Windows\System\TtDXnQN.exe
Size 5.9MB
SHA256 741516b914c5a4ea3ce70cf1b4938a9e8684870eb4f97209a9e7bdc470b843b1
MD5 86c5ec9f1cf0e225487e97247df78d7f
SHA1 96c9ee94263c3c582d5cf06bb9e09e71214ea564
SHA512 99e065c79da2878b22bde648199227b5037564ecf919ea01b694ba1251a0ccc5df8860bd21ee51814585cbafd0ceeed4850d5a6c259af05858c3b176c5a44b0c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

UbugkRm.exe

Path C:\Windows\System\UbugkRm.exe
Size 5.9MB
SHA256 13886a270d7c6f618014fc1b6f8a0e00077f0a24ad4b235d50d8f626e32ee0be
MD5 f61f4daebd054c93f45a34b7e536e3b2
SHA1 e8cbd2512d750217af9c0a27d58e3f1ad06a10ca
SHA512 f10ea7c14d241b9832da3b0de68b9cadbb1aabdf823a8108d13f679755c084194b1ee9f0175bda4a1ed74b4722b010c969640a3b3df7adf6bde117af0674619f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

YcEHKJU.exe

Path C:\Windows\System\YcEHKJU.exe
Size 5.9MB
SHA256 de803301db08b8766427d384d90464d18c95e871993e5b07343f29c8ba0d0801
MD5 129f8a495c73edd351bba5089d2f3afd
SHA1 57446de12e822943ce2d2eb1dc11a8388812fdc2
SHA512 eb5d01432176630f7354ae147a50599ff9ee49f794e6cf0a161028009807152b50c7333895255274bafe2b0a7b5c4a68fcfcf4375ac21a4e2e27d63b216571f7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

YuwWpJG.exe

Path C:\Windows\System\YuwWpJG.exe
Size 5.9MB
SHA256 73b74fe59cc8cbf7c6bb99e86a72d51ec10f9cae76e67777b4d9e911bc77f582
MD5 e4ce478b503cf783b05bd64f2d2f7f4d
SHA1 79b10d1aa8360a14b3534ec32d6aa7a2e767405b
SHA512 53ca42051feda10e6a7604171e74749f9a4aa895aaa30f0460cc355ba8f1d75ad705c5e10b011abd9b6c3589a235ef431157b20f37efb2a57896bcc0361e9150
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

aZuYHoW.exe

Path C:\Windows\System\aZuYHoW.exe
Size 5.9MB
SHA256 30c7ff47aea130fa8bce34e74e60365f117ec828ea9d4dd9ff9213524ef7372a
MD5 9a7fe9d5662a18f7fcc154b76b39c45f
SHA1 813af5677004d10a7f259bfdcfb0e1b0ddfab589
SHA512 7dd8a4eb29e9a37003e704eb39958315da2a208e88293fc18acced30efb2a4cc67295564ebf0795f30daadafed78abaa0533e229f0b5f9beedcf1dccc7d9e2cf
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

amZaCWm.exe

Path C:\Windows\System\amZaCWm.exe
Size 5.9MB
SHA256 bf924592e508396975860351d6c2c2d2263188980edf889ce3e0dcb8e0d531d6
MD5 d6918215bdf2736dd94e695c9506fd89
SHA1 3d006686a0662136d87f45d622b961a62107cc8c
SHA512 6bc3c07ac602a8513e89140b25000287fa895141704dc82a37009547d6200a2956870059aaa989dc4693ea13f243499c3927cc61f83a841dff9b71bcaa089725
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

gSKSOVQ.exe

Path C:\Windows\System\gSKSOVQ.exe
Size 5.9MB
SHA256 b2ddc793941481fa4b8f2d8dc6d59b3fc8824d57b8b85ee68214b9073ebe9abf
MD5 3946e974172c54348ee06d41380fec37
SHA1 7a534d3aab18a67bee96ad212188497675339e08
SHA512 78278eb9f9117db29a1b09a241eee3635422f1ae5d495cc8fe5f254bd4ee3666cfe19b96aaad0119fcdbce896a20a814661f2cfe33d031894f99dea4cf639b5e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

hoibZht.exe

Path C:\Windows\System\hoibZht.exe
Size 5.9MB
SHA256 036012641e87b2e642b9cd92e317bbabcd7cebdac913d1a8d54ed751ac1e5d3b
MD5 1921f1a7fcb84cc5affb7f916499b863
SHA1 9cea40aa1b322e2875498d765e3da4cb1fae0a31
SHA512 34df64ffcb931c800b2ddbe508eaf5cf6a6d01f1d55c084f403d0fc9906d1a0f99a077a350846214c3bc5d1e852572f5547d7be56b851dd4f3811f564f7a8eee
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

huVnOnA.exe

Path C:\Windows\System\huVnOnA.exe
Size 5.9MB
SHA256 db4fcb8b1a1a8f0c4dde0b349112728a9725459febcfc559c5cc2191fcf3671c
MD5 ab432deb4ba114e460a69750a980acf2
SHA1 bf58a6cea329ef4ae8066d981028df9a72b8f963
SHA512 74dfcdfb1f0b54cd263bd3a53163a8837ff43e0401dbf874106d57705304751d73868c50900fa3f2d962e07b5f728ffc56ed3da5769ec01e598ec96eab1073fa
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

ixQyWzp.exe

Path C:\Windows\System\ixQyWzp.exe
Size 5.9MB
SHA256 a4213efd66b2b43187e00601175b7c5fe19462223d378c0f750dce81528c280a
MD5 e16699fb3526a0b9c85b9327c6bc4821
SHA1 9fdf7727167f45c08d2832d218be378dc03afa2e
SHA512 513f79bb80968cc71c6a929d7ae6a7fc4c5cb1b1222c19f0df8fb65a2ec5fa1f593dbc84648130cbc4b4d964d9ce8a682610f79ca6819d32f6b67f9003d64d80
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

jshZuNz.exe

Path C:\Windows\System\jshZuNz.exe
Size 5.9MB
SHA256 c077fedd51d13a8b6d7f57153271f82d6ac3d6c4a8e6bb83e952d109d48f39c1
MD5 5fd3da96539d8186a78959c37185f007
SHA1 63900ef848052550555f473555a02f6bc7047767
SHA512 b48210dd55258602ca9547e7f39a90ebf9e6c9e9bce1aa989c4e6b528c13435259fd950d4f1a06b66cd417f7088ad9a832a4be50671f47162d5891cad3ef67ac
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

pHmTovq.exe

Path C:\Windows\System\pHmTovq.exe
Size 5.9MB
SHA256 ff92aa350f7a9e695cac7936f8b69fd4647e8658f4e4d5f82d539e420fff01dc
MD5 d11e3815a815edd08e0c98c936f234d5
SHA1 5067e9bbc171c9d8ef03733450963fa54cbe6060
SHA512 70bad11e17ab96a8ed519ccfbea216fbadeefbc8c90ba9326729b22e627fb9c6f113ba90dd2768111d08a0cfae247a46d756340b3876952e6a73daceae84fdec
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

qWtqFDe.exe

Path C:\Windows\System\qWtqFDe.exe
Size 5.9MB
SHA256 d232c4175aaf69ad5e3f28966c71ad67e035684dfb4929a50ca26d4245f2c2f5
MD5 85c5497de04831248e726938a53a19d1
SHA1 7e8ef731c0d08398035b2c6d9fc48d2accd03bf7
SHA512 1618edeb9a698a847080445ae0a8c388814a8d776a4569bccf34b228907bdbd2218f365b73a31448c0c1fa4f9cc35f4783410432e474820828244a1ed140c5cc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

uaEzJfB.exe

Path C:\Windows\System\uaEzJfB.exe
Size 5.9MB
SHA256 659f2a0d881bdb242beaf682c0ddb6f36dfefc7c999b1d334c0ecca9a8d06ffa
MD5 b1bab5c19c283ba3cdb8eb1677ee304a
SHA1 37899b8bcfac8bbe72980071812165393b39aba4
SHA512 a2549d5227433fb61a2eb2f4b34a62d1b51c90cd4ba30645fcd4a0797a8510a6829f3b3c01ec77cc9f05727ce213160c3890676df096f483fdbea22cba4542aa
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

xFYDQPB.exe

Path C:\Windows\System\xFYDQPB.exe
Size 5.9MB
SHA256 b00b83361ec8f9623a777499444ac49e62d955dc7b0c73aee2968c6d3cf43def
MD5 6f234a640267d836c5c0911c7205b5a3
SHA1 5dc0c48ab788bcfb53a0703979bedca4e317e8e8
SHA512 14efc04f5853af25591700a0dcbc8ec1917ec1de4ce49df458c60464945d5d2bf4feef16a74c50ce0558176b56382fe3d12eff1ebcd28888eb7f0d3aacbb4c01
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/448-38-0x00007FF7191A0000-0x00007FF7194F4000-memory.dmp

Download

memory/448-148-0x00007FF7191A0000-0x00007FF7194F4000-memory.dmp

Download

memory/1216-161-0x00007FF629AC0000-0x00007FF629E14000-memory.dmp

Download

memory/1216-127-0x00007FF629AC0000-0x00007FF629E14000-memory.dmp

Download

memory/1460-133-0x00007FF70A400000-0x00007FF70A754000-memory.dmp

Download

memory/1460-150-0x00007FF70A400000-0x00007FF70A754000-memory.dmp

Download

memory/1460-48-0x00007FF70A400000-0x00007FF70A754000-memory.dmp

Download

memory/1676-29-0x00007FF72C810000-0x00007FF72CB64000-memory.dmp

Download

memory/1676-147-0x00007FF72C810000-0x00007FF72CB64000-memory.dmp

Download

memory/1676-119-0x00007FF72C810000-0x00007FF72CB64000-memory.dmp

Download

memory/1692-138-0x00007FF7A1A60000-0x00007FF7A1DB4000-memory.dmp

Download

memory/1692-100-0x00007FF7A1A60000-0x00007FF7A1DB4000-memory.dmp

Download

memory/1692-157-0x00007FF7A1A60000-0x00007FF7A1DB4000-memory.dmp

Download

memory/1724-28-0x00007FF672A60000-0x00007FF672DB4000-memory.dmp

Download

memory/1724-145-0x00007FF672A60000-0x00007FF672DB4000-memory.dmp

Download

memory/1948-67-0x00007FF6DE490000-0x00007FF6DE7E4000-memory.dmp

Download

memory/1948-0-0x00007FF6DE490000-0x00007FF6DE7E4000-memory.dmp

Download

memory/1948-1-0x0000025892DC0000-0x0000025892DD0000-memory.dmp

Download

memory/2276-132-0x00007FF773580000-0x00007FF7738D4000-memory.dmp

Download

memory/2276-163-0x00007FF773580000-0x00007FF7738D4000-memory.dmp

Download

memory/2320-140-0x00007FF786740000-0x00007FF786A94000-memory.dmp

Download

memory/2320-103-0x00007FF786740000-0x00007FF786A94000-memory.dmp

Download

memory/2320-160-0x00007FF786740000-0x00007FF786A94000-memory.dmp

Download

memory/2440-162-0x00007FF773C20000-0x00007FF773F74000-memory.dmp

Download

memory/2440-124-0x00007FF773C20000-0x00007FF773F74000-memory.dmp

Download

memory/2440-142-0x00007FF773C20000-0x00007FF773F74000-memory.dmp

Download

memory/2600-155-0x00007FF6F54F0000-0x00007FF6F5844000-memory.dmp

Download

memory/2600-137-0x00007FF6F54F0000-0x00007FF6F5844000-memory.dmp

Download

memory/2600-81-0x00007FF6F54F0000-0x00007FF6F5844000-memory.dmp

Download

memory/2676-152-0x00007FF7F97D0000-0x00007FF7F9B24000-memory.dmp

Download

memory/2676-64-0x00007FF7F97D0000-0x00007FF7F9B24000-memory.dmp

Download

memory/3116-151-0x00007FF715430000-0x00007FF715784000-memory.dmp

Download

memory/3116-58-0x00007FF715430000-0x00007FF715784000-memory.dmp

Download

memory/3116-134-0x00007FF715430000-0x00007FF715784000-memory.dmp

Download

memory/3216-136-0x00007FF780350000-0x00007FF7806A4000-memory.dmp

Download

memory/3216-154-0x00007FF780350000-0x00007FF7806A4000-memory.dmp

Download

memory/3216-76-0x00007FF780350000-0x00007FF7806A4000-memory.dmp

Download

memory/3372-93-0x00007FF66B150000-0x00007FF66B4A4000-memory.dmp

Download

memory/3372-15-0x00007FF66B150000-0x00007FF66B4A4000-memory.dmp

Download

memory/3372-144-0x00007FF66B150000-0x00007FF66B4A4000-memory.dmp

Download

memory/3688-131-0x00007FF62B2D0000-0x00007FF62B624000-memory.dmp

Download

memory/3688-149-0x00007FF62B2D0000-0x00007FF62B624000-memory.dmp

Download

memory/3688-42-0x00007FF62B2D0000-0x00007FF62B624000-memory.dmp

Download

memory/3744-159-0x00007FF7FBFB0000-0x00007FF7FC304000-memory.dmp

Download

memory/3744-110-0x00007FF7FBFB0000-0x00007FF7FC304000-memory.dmp

Download

memory/3744-141-0x00007FF7FBFB0000-0x00007FF7FC304000-memory.dmp

Download

memory/3992-70-0x00007FF6179B0000-0x00007FF617D04000-memory.dmp

Download

memory/3992-153-0x00007FF6179B0000-0x00007FF617D04000-memory.dmp

Download

memory/3992-135-0x00007FF6179B0000-0x00007FF617D04000-memory.dmp

Download

memory/4020-111-0x00007FF7BD9D0000-0x00007FF7BDD24000-memory.dmp

Download

memory/4020-19-0x00007FF7BD9D0000-0x00007FF7BDD24000-memory.dmp

Download

memory/4020-146-0x00007FF7BD9D0000-0x00007FF7BDD24000-memory.dmp

Download

memory/4920-143-0x00007FF7CE470000-0x00007FF7CE7C4000-memory.dmp

Download

memory/4920-8-0x00007FF7CE470000-0x00007FF7CE7C4000-memory.dmp

Download

memory/5024-139-0x00007FF677AB0000-0x00007FF677E04000-memory.dmp

Download

memory/5024-94-0x00007FF677AB0000-0x00007FF677E04000-memory.dmp

Download

memory/5024-156-0x00007FF677AB0000-0x00007FF677E04000-memory.dmp

Download

memory/5080-158-0x00007FF6E3E40000-0x00007FF6E4194000-memory.dmp

Download

memory/5080-112-0x00007FF6E3E40000-0x00007FF6E4194000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads