cobaltstrike | 90afe90f27b1149d6b310fdb4d6576f0adae4db71bf7a4db09fd8857402cc9d4

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240527-werwsadb89
SHA256 90afe90f27b1149d6b310fdb4d6576f0adae4db71bf7a4db09fd8857402cc9d4
MD5 22d9fffe619827242ac149c810a173d5
SHA1 7018427189e84e5f3e9a0751f1cfe4a3523a8ff5
SHA512 c9dd946654ecb7c765853ffd4267004d02066a96349cf4b0b235dd388b0030e232e37e144aaa99304b1549303f0a0d547ecb57914f1121f9ff2a0bdd205c1fca
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023410-5.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023411-12.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023412-16.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023413-24.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002340e-29.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023415-35.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023416-39.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-43.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023418-53.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023419-60.dat	cobalt_reflective_dll
behavioral2/files/0x0010000000009f7c-66.dat	cobalt_reflective_dll
behavioral2/files/0x000400000001e41b-71.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002297b-79.dat	cobalt_reflective_dll
behavioral2/files/0x000500000002297c-85.dat	cobalt_reflective_dll
behavioral2/files/0x0004000000022aae-93.dat	cobalt_reflective_dll
behavioral2/files/0x000b0000000232ae-99.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341a-105.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341b-113.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341c-119.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341e-127.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341d-130.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023410-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023411-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023412-16.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023413-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002340e-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023415-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023416-39.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-43.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023418-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023419-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0010000000009f7c-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000400000001e41b-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002297b-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000500000002297c-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0004000000022aae-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b0000000232ae-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341a-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341b-113.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341c-119.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341e-127.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341d-130.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3400-0-0x00007FF63F740000-0x00007FF63FA94000-memory.dmp	UPX
behavioral2/files/0x0008000000023410-5.dat	UPX
behavioral2/memory/4340-8-0x00007FF620DD0000-0x00007FF621124000-memory.dmp	UPX
behavioral2/files/0x0007000000023411-12.dat	UPX
behavioral2/files/0x0007000000023412-16.dat	UPX
behavioral2/memory/4432-13-0x00007FF6961F0000-0x00007FF696544000-memory.dmp	UPX
behavioral2/memory/4620-20-0x00007FF66A4F0000-0x00007FF66A844000-memory.dmp	UPX
behavioral2/files/0x0007000000023413-24.dat	UPX
behavioral2/files/0x000800000002340e-29.dat	UPX
behavioral2/memory/1276-26-0x00007FF71AB10000-0x00007FF71AE64000-memory.dmp	UPX
behavioral2/memory/3580-30-0x00007FF75B4F0000-0x00007FF75B844000-memory.dmp	UPX
behavioral2/files/0x0007000000023415-35.dat	UPX
behavioral2/files/0x0007000000023416-39.dat	UPX
behavioral2/files/0x0007000000023417-43.dat	UPX
behavioral2/files/0x0007000000023418-53.dat	UPX
behavioral2/memory/4984-54-0x00007FF71DC50000-0x00007FF71DFA4000-memory.dmp	UPX
behavioral2/memory/4756-50-0x00007FF6DEAE0000-0x00007FF6DEE34000-memory.dmp	UPX
behavioral2/memory/4744-40-0x00007FF64A560000-0x00007FF64A8B4000-memory.dmp	UPX
behavioral2/memory/3920-36-0x00007FF7B5DF0000-0x00007FF7B6144000-memory.dmp	UPX
behavioral2/memory/3400-62-0x00007FF63F740000-0x00007FF63FA94000-memory.dmp	UPX
behavioral2/files/0x0007000000023419-60.dat	UPX
behavioral2/files/0x0010000000009f7c-66.dat	UPX
behavioral2/files/0x000400000001e41b-71.dat	UPX
behavioral2/memory/2788-63-0x00007FF69DFF0000-0x00007FF69E344000-memory.dmp	UPX
behavioral2/memory/4340-74-0x00007FF620DD0000-0x00007FF621124000-memory.dmp	UPX
behavioral2/memory/3108-76-0x00007FF7B0370000-0x00007FF7B06C4000-memory.dmp	UPX
behavioral2/files/0x000800000002297b-79.dat	UPX
behavioral2/memory/4432-80-0x00007FF6961F0000-0x00007FF696544000-memory.dmp	UPX
behavioral2/files/0x000500000002297c-85.dat	UPX
behavioral2/memory/4004-83-0x00007FF7A80A0000-0x00007FF7A83F4000-memory.dmp	UPX
behavioral2/memory/5100-75-0x00007FF7577E0000-0x00007FF757B34000-memory.dmp	UPX
behavioral2/files/0x0004000000022aae-93.dat	UPX
behavioral2/memory/4888-89-0x00007FF773BF0000-0x00007FF773F44000-memory.dmp	UPX
behavioral2/files/0x000b0000000232ae-99.dat	UPX
behavioral2/files/0x000700000002341a-105.dat	UPX
behavioral2/memory/3580-101-0x00007FF75B4F0000-0x00007FF75B844000-memory.dmp	UPX
behavioral2/memory/1528-95-0x00007FF7CDB30000-0x00007FF7CDE84000-memory.dmp	UPX
behavioral2/memory/548-107-0x00007FF653940000-0x00007FF653C94000-memory.dmp	UPX
behavioral2/memory/3920-108-0x00007FF7B5DF0000-0x00007FF7B6144000-memory.dmp	UPX
behavioral2/files/0x000700000002341b-113.dat	UPX
behavioral2/memory/5116-116-0x00007FF6EE300000-0x00007FF6EE654000-memory.dmp	UPX
behavioral2/memory/4744-115-0x00007FF64A560000-0x00007FF64A8B4000-memory.dmp	UPX
behavioral2/memory/2868-110-0x00007FF68CBA0000-0x00007FF68CEF4000-memory.dmp	UPX
behavioral2/files/0x000700000002341c-119.dat	UPX
behavioral2/files/0x000700000002341e-127.dat	UPX
behavioral2/files/0x000700000002341d-130.dat	UPX
behavioral2/memory/560-124-0x00007FF6A3F00000-0x00007FF6A4254000-memory.dmp	UPX
behavioral2/memory/4984-132-0x00007FF71DC50000-0x00007FF71DFA4000-memory.dmp	UPX
behavioral2/memory/2192-133-0x00007FF760070000-0x00007FF7603C4000-memory.dmp	UPX
behavioral2/memory/2384-134-0x00007FF614EC0000-0x00007FF615214000-memory.dmp	UPX
behavioral2/memory/4004-135-0x00007FF7A80A0000-0x00007FF7A83F4000-memory.dmp	UPX
behavioral2/memory/4340-136-0x00007FF620DD0000-0x00007FF621124000-memory.dmp	UPX
behavioral2/memory/4432-137-0x00007FF6961F0000-0x00007FF696544000-memory.dmp	UPX
behavioral2/memory/4620-138-0x00007FF66A4F0000-0x00007FF66A844000-memory.dmp	UPX
behavioral2/memory/1276-139-0x00007FF71AB10000-0x00007FF71AE64000-memory.dmp	UPX
behavioral2/memory/3580-140-0x00007FF75B4F0000-0x00007FF75B844000-memory.dmp	UPX
behavioral2/memory/3920-141-0x00007FF7B5DF0000-0x00007FF7B6144000-memory.dmp	UPX
behavioral2/memory/4756-142-0x00007FF6DEAE0000-0x00007FF6DEE34000-memory.dmp	UPX
behavioral2/memory/4744-143-0x00007FF64A560000-0x00007FF64A8B4000-memory.dmp	UPX
behavioral2/memory/4984-144-0x00007FF71DC50000-0x00007FF71DFA4000-memory.dmp	UPX
behavioral2/memory/2788-145-0x00007FF69DFF0000-0x00007FF69E344000-memory.dmp	UPX
behavioral2/memory/3108-146-0x00007FF7B0370000-0x00007FF7B06C4000-memory.dmp	UPX
behavioral2/memory/5100-147-0x00007FF7577E0000-0x00007FF757B34000-memory.dmp	UPX
behavioral2/memory/4888-148-0x00007FF773BF0000-0x00007FF773F44000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3400-0-0x00007FF63F740000-0x00007FF63FA94000-memory.dmp	xmrig
behavioral2/files/0x0008000000023410-5.dat	xmrig
behavioral2/memory/4340-8-0x00007FF620DD0000-0x00007FF621124000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-12.dat	xmrig
behavioral2/files/0x0007000000023412-16.dat	xmrig
behavioral2/memory/4432-13-0x00007FF6961F0000-0x00007FF696544000-memory.dmp	xmrig
behavioral2/memory/4620-20-0x00007FF66A4F0000-0x00007FF66A844000-memory.dmp	xmrig
behavioral2/files/0x0007000000023413-24.dat	xmrig
behavioral2/files/0x000800000002340e-29.dat	xmrig
behavioral2/memory/1276-26-0x00007FF71AB10000-0x00007FF71AE64000-memory.dmp	xmrig
behavioral2/memory/3580-30-0x00007FF75B4F0000-0x00007FF75B844000-memory.dmp	xmrig
behavioral2/files/0x0007000000023415-35.dat	xmrig
behavioral2/files/0x0007000000023416-39.dat	xmrig
behavioral2/files/0x0007000000023417-43.dat	xmrig
behavioral2/files/0x0007000000023418-53.dat	xmrig
behavioral2/memory/4984-54-0x00007FF71DC50000-0x00007FF71DFA4000-memory.dmp	xmrig
behavioral2/memory/4756-50-0x00007FF6DEAE0000-0x00007FF6DEE34000-memory.dmp	xmrig
behavioral2/memory/4744-40-0x00007FF64A560000-0x00007FF64A8B4000-memory.dmp	xmrig
behavioral2/memory/3920-36-0x00007FF7B5DF0000-0x00007FF7B6144000-memory.dmp	xmrig
behavioral2/memory/3400-62-0x00007FF63F740000-0x00007FF63FA94000-memory.dmp	xmrig
behavioral2/files/0x0007000000023419-60.dat	xmrig
behavioral2/files/0x0010000000009f7c-66.dat	xmrig
behavioral2/files/0x000400000001e41b-71.dat	xmrig
behavioral2/memory/2788-63-0x00007FF69DFF0000-0x00007FF69E344000-memory.dmp	xmrig
behavioral2/memory/4340-74-0x00007FF620DD0000-0x00007FF621124000-memory.dmp	xmrig
behavioral2/memory/3108-76-0x00007FF7B0370000-0x00007FF7B06C4000-memory.dmp	xmrig
behavioral2/files/0x000800000002297b-79.dat	xmrig
behavioral2/memory/4432-80-0x00007FF6961F0000-0x00007FF696544000-memory.dmp	xmrig
behavioral2/files/0x000500000002297c-85.dat	xmrig
behavioral2/memory/4004-83-0x00007FF7A80A0000-0x00007FF7A83F4000-memory.dmp	xmrig
behavioral2/memory/5100-75-0x00007FF7577E0000-0x00007FF757B34000-memory.dmp	xmrig
behavioral2/files/0x0004000000022aae-93.dat	xmrig
behavioral2/memory/4888-89-0x00007FF773BF0000-0x00007FF773F44000-memory.dmp	xmrig
behavioral2/files/0x000b0000000232ae-99.dat	xmrig
behavioral2/files/0x000700000002341a-105.dat	xmrig
behavioral2/memory/3580-101-0x00007FF75B4F0000-0x00007FF75B844000-memory.dmp	xmrig
behavioral2/memory/1528-95-0x00007FF7CDB30000-0x00007FF7CDE84000-memory.dmp	xmrig
behavioral2/memory/548-107-0x00007FF653940000-0x00007FF653C94000-memory.dmp	xmrig
behavioral2/memory/3920-108-0x00007FF7B5DF0000-0x00007FF7B6144000-memory.dmp	xmrig
behavioral2/files/0x000700000002341b-113.dat	xmrig
behavioral2/memory/5116-116-0x00007FF6EE300000-0x00007FF6EE654000-memory.dmp	xmrig
behavioral2/memory/4744-115-0x00007FF64A560000-0x00007FF64A8B4000-memory.dmp	xmrig
behavioral2/memory/2868-110-0x00007FF68CBA0000-0x00007FF68CEF4000-memory.dmp	xmrig
behavioral2/files/0x000700000002341c-119.dat	xmrig
behavioral2/files/0x000700000002341e-127.dat	xmrig
behavioral2/files/0x000700000002341d-130.dat	xmrig
behavioral2/memory/560-124-0x00007FF6A3F00000-0x00007FF6A4254000-memory.dmp	xmrig
behavioral2/memory/4984-132-0x00007FF71DC50000-0x00007FF71DFA4000-memory.dmp	xmrig
behavioral2/memory/2192-133-0x00007FF760070000-0x00007FF7603C4000-memory.dmp	xmrig
behavioral2/memory/2384-134-0x00007FF614EC0000-0x00007FF615214000-memory.dmp	xmrig
behavioral2/memory/4004-135-0x00007FF7A80A0000-0x00007FF7A83F4000-memory.dmp	xmrig
behavioral2/memory/4340-136-0x00007FF620DD0000-0x00007FF621124000-memory.dmp	xmrig
behavioral2/memory/4432-137-0x00007FF6961F0000-0x00007FF696544000-memory.dmp	xmrig
behavioral2/memory/4620-138-0x00007FF66A4F0000-0x00007FF66A844000-memory.dmp	xmrig
behavioral2/memory/1276-139-0x00007FF71AB10000-0x00007FF71AE64000-memory.dmp	xmrig
behavioral2/memory/3580-140-0x00007FF75B4F0000-0x00007FF75B844000-memory.dmp	xmrig
behavioral2/memory/3920-141-0x00007FF7B5DF0000-0x00007FF7B6144000-memory.dmp	xmrig
behavioral2/memory/4756-142-0x00007FF6DEAE0000-0x00007FF6DEE34000-memory.dmp	xmrig
behavioral2/memory/4744-143-0x00007FF64A560000-0x00007FF64A8B4000-memory.dmp	xmrig
behavioral2/memory/4984-144-0x00007FF71DC50000-0x00007FF71DFA4000-memory.dmp	xmrig
behavioral2/memory/2788-145-0x00007FF69DFF0000-0x00007FF69E344000-memory.dmp	xmrig
behavioral2/memory/3108-146-0x00007FF7B0370000-0x00007FF7B06C4000-memory.dmp	xmrig
behavioral2/memory/5100-147-0x00007FF7577E0000-0x00007FF757B34000-memory.dmp	xmrig
behavioral2/memory/4888-148-0x00007FF773BF0000-0x00007FF773F44000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4340	LvvWgSw.exe
4432	ymsifIU.exe
4620	IWkVJXe.exe
1276	uixCkSD.exe
3580	emYCNOO.exe
3920	xEhawcY.exe
4744	nYbmntG.exe
4756	odgCNpa.exe
4984	TiXHcgC.exe
2788	vLiaSrd.exe
5100	WanRapI.exe
3108	epdWgUs.exe
4004	knVZYNm.exe
4888	KpmoaJP.exe
1528	cVxagOT.exe
548	AVliJju.exe
2868	vpXhHbE.exe
5116	RALOkaH.exe
560	qmiRLaA.exe
2192	raOvBev.exe
2384	mXxiaQk.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3400-0-0x00007FF63F740000-0x00007FF63FA94000-memory.dmp	upx
behavioral2/files/0x0008000000023410-5.dat	upx
behavioral2/memory/4340-8-0x00007FF620DD0000-0x00007FF621124000-memory.dmp	upx
behavioral2/files/0x0007000000023411-12.dat	upx
behavioral2/files/0x0007000000023412-16.dat	upx
behavioral2/memory/4432-13-0x00007FF6961F0000-0x00007FF696544000-memory.dmp	upx
behavioral2/memory/4620-20-0x00007FF66A4F0000-0x00007FF66A844000-memory.dmp	upx
behavioral2/files/0x0007000000023413-24.dat	upx
behavioral2/files/0x000800000002340e-29.dat	upx
behavioral2/memory/1276-26-0x00007FF71AB10000-0x00007FF71AE64000-memory.dmp	upx
behavioral2/memory/3580-30-0x00007FF75B4F0000-0x00007FF75B844000-memory.dmp	upx
behavioral2/files/0x0007000000023415-35.dat	upx
behavioral2/files/0x0007000000023416-39.dat	upx
behavioral2/files/0x0007000000023417-43.dat	upx
behavioral2/files/0x0007000000023418-53.dat	upx
behavioral2/memory/4984-54-0x00007FF71DC50000-0x00007FF71DFA4000-memory.dmp	upx
behavioral2/memory/4756-50-0x00007FF6DEAE0000-0x00007FF6DEE34000-memory.dmp	upx
behavioral2/memory/4744-40-0x00007FF64A560000-0x00007FF64A8B4000-memory.dmp	upx
behavioral2/memory/3920-36-0x00007FF7B5DF0000-0x00007FF7B6144000-memory.dmp	upx
behavioral2/memory/3400-62-0x00007FF63F740000-0x00007FF63FA94000-memory.dmp	upx
behavioral2/files/0x0007000000023419-60.dat	upx
behavioral2/files/0x0010000000009f7c-66.dat	upx
behavioral2/files/0x000400000001e41b-71.dat	upx
behavioral2/memory/2788-63-0x00007FF69DFF0000-0x00007FF69E344000-memory.dmp	upx
behavioral2/memory/4340-74-0x00007FF620DD0000-0x00007FF621124000-memory.dmp	upx
behavioral2/memory/3108-76-0x00007FF7B0370000-0x00007FF7B06C4000-memory.dmp	upx
behavioral2/files/0x000800000002297b-79.dat	upx
behavioral2/memory/4432-80-0x00007FF6961F0000-0x00007FF696544000-memory.dmp	upx
behavioral2/files/0x000500000002297c-85.dat	upx
behavioral2/memory/4004-83-0x00007FF7A80A0000-0x00007FF7A83F4000-memory.dmp	upx
behavioral2/memory/5100-75-0x00007FF7577E0000-0x00007FF757B34000-memory.dmp	upx
behavioral2/files/0x0004000000022aae-93.dat	upx
behavioral2/memory/4888-89-0x00007FF773BF0000-0x00007FF773F44000-memory.dmp	upx
behavioral2/files/0x000b0000000232ae-99.dat	upx
behavioral2/files/0x000700000002341a-105.dat	upx
behavioral2/memory/3580-101-0x00007FF75B4F0000-0x00007FF75B844000-memory.dmp	upx
behavioral2/memory/1528-95-0x00007FF7CDB30000-0x00007FF7CDE84000-memory.dmp	upx
behavioral2/memory/548-107-0x00007FF653940000-0x00007FF653C94000-memory.dmp	upx
behavioral2/memory/3920-108-0x00007FF7B5DF0000-0x00007FF7B6144000-memory.dmp	upx
behavioral2/files/0x000700000002341b-113.dat	upx
behavioral2/memory/5116-116-0x00007FF6EE300000-0x00007FF6EE654000-memory.dmp	upx
behavioral2/memory/4744-115-0x00007FF64A560000-0x00007FF64A8B4000-memory.dmp	upx
behavioral2/memory/2868-110-0x00007FF68CBA0000-0x00007FF68CEF4000-memory.dmp	upx
behavioral2/files/0x000700000002341c-119.dat	upx
behavioral2/files/0x000700000002341e-127.dat	upx
behavioral2/files/0x000700000002341d-130.dat	upx
behavioral2/memory/560-124-0x00007FF6A3F00000-0x00007FF6A4254000-memory.dmp	upx
behavioral2/memory/4984-132-0x00007FF71DC50000-0x00007FF71DFA4000-memory.dmp	upx
behavioral2/memory/2192-133-0x00007FF760070000-0x00007FF7603C4000-memory.dmp	upx
behavioral2/memory/2384-134-0x00007FF614EC0000-0x00007FF615214000-memory.dmp	upx
behavioral2/memory/4004-135-0x00007FF7A80A0000-0x00007FF7A83F4000-memory.dmp	upx
behavioral2/memory/4340-136-0x00007FF620DD0000-0x00007FF621124000-memory.dmp	upx
behavioral2/memory/4432-137-0x00007FF6961F0000-0x00007FF696544000-memory.dmp	upx
behavioral2/memory/4620-138-0x00007FF66A4F0000-0x00007FF66A844000-memory.dmp	upx
behavioral2/memory/1276-139-0x00007FF71AB10000-0x00007FF71AE64000-memory.dmp	upx
behavioral2/memory/3580-140-0x00007FF75B4F0000-0x00007FF75B844000-memory.dmp	upx
behavioral2/memory/3920-141-0x00007FF7B5DF0000-0x00007FF7B6144000-memory.dmp	upx
behavioral2/memory/4756-142-0x00007FF6DEAE0000-0x00007FF6DEE34000-memory.dmp	upx
behavioral2/memory/4744-143-0x00007FF64A560000-0x00007FF64A8B4000-memory.dmp	upx
behavioral2/memory/4984-144-0x00007FF71DC50000-0x00007FF71DFA4000-memory.dmp	upx
behavioral2/memory/2788-145-0x00007FF69DFF0000-0x00007FF69E344000-memory.dmp	upx
behavioral2/memory/3108-146-0x00007FF7B0370000-0x00007FF7B06C4000-memory.dmp	upx
behavioral2/memory/5100-147-0x00007FF7577E0000-0x00007FF757B34000-memory.dmp	upx
behavioral2/memory/4888-148-0x00007FF773BF0000-0x00007FF773F44000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\WanRapI.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\cVxagOT.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\raOvBev.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IWkVJXe.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\emYCNOO.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nYbmntG.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\odgCNpa.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TiXHcgC.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vLiaSrd.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KpmoaJP.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AVliJju.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LvvWgSw.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ymsifIU.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RALOkaH.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qmiRLaA.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xEhawcY.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mXxiaQk.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\knVZYNm.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vpXhHbE.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uixCkSD.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\epdWgUs.exe	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 4340	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	82
PID 3400 wrote to memory of 4340	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	82
PID 3400 wrote to memory of 4432	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	83
PID 3400 wrote to memory of 4432	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	83
PID 3400 wrote to memory of 4620	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	84
PID 3400 wrote to memory of 4620	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	84
PID 3400 wrote to memory of 1276	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	85
PID 3400 wrote to memory of 1276	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	85
PID 3400 wrote to memory of 3580	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	89
PID 3400 wrote to memory of 3580	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	89
PID 3400 wrote to memory of 3920	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	90
PID 3400 wrote to memory of 3920	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	90
PID 3400 wrote to memory of 4744	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	91
PID 3400 wrote to memory of 4744	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	91
PID 3400 wrote to memory of 4756	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	92
PID 3400 wrote to memory of 4756	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	92
PID 3400 wrote to memory of 4984	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	93
PID 3400 wrote to memory of 4984	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	93
PID 3400 wrote to memory of 2788	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	94
PID 3400 wrote to memory of 2788	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	94
PID 3400 wrote to memory of 5100	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	95
PID 3400 wrote to memory of 5100	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	95
PID 3400 wrote to memory of 3108	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	96
PID 3400 wrote to memory of 3108	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	96
PID 3400 wrote to memory of 4004	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	97
PID 3400 wrote to memory of 4004	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	97
PID 3400 wrote to memory of 4888	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	98
PID 3400 wrote to memory of 4888	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	98
PID 3400 wrote to memory of 1528	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	99
PID 3400 wrote to memory of 1528	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	99
PID 3400 wrote to memory of 548	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	101
PID 3400 wrote to memory of 548	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	101
PID 3400 wrote to memory of 2868	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	103
PID 3400 wrote to memory of 2868	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	103
PID 3400 wrote to memory of 5116	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	104
PID 3400 wrote to memory of 5116	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	104
PID 3400 wrote to memory of 560	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	105
PID 3400 wrote to memory of 560	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	105
PID 3400 wrote to memory of 2384	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	107
PID 3400 wrote to memory of 2384	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	107
PID 3400 wrote to memory of 2192	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	108
PID 3400 wrote to memory of 2192	3400	2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe	108

C:\Users\Admin\AppData\Local\Temp\2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_22d9fffe619827242ac149c810a173d5_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\System\LvvWgSw.exe
  C:\Windows\System\LvvWgSw.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\ymsifIU.exe
  C:\Windows\System\ymsifIU.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\IWkVJXe.exe
  C:\Windows\System\IWkVJXe.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\uixCkSD.exe
  C:\Windows\System\uixCkSD.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\emYCNOO.exe
  C:\Windows\System\emYCNOO.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\xEhawcY.exe
  C:\Windows\System\xEhawcY.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\nYbmntG.exe
  C:\Windows\System\nYbmntG.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\odgCNpa.exe
  C:\Windows\System\odgCNpa.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\TiXHcgC.exe
  C:\Windows\System\TiXHcgC.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\vLiaSrd.exe
  C:\Windows\System\vLiaSrd.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\WanRapI.exe
  C:\Windows\System\WanRapI.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\epdWgUs.exe
  C:\Windows\System\epdWgUs.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\knVZYNm.exe
  C:\Windows\System\knVZYNm.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\KpmoaJP.exe
  C:\Windows\System\KpmoaJP.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\cVxagOT.exe
  C:\Windows\System\cVxagOT.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\AVliJju.exe
  C:\Windows\System\AVliJju.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\vpXhHbE.exe
  C:\Windows\System\vpXhHbE.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\RALOkaH.exe
  C:\Windows\System\RALOkaH.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\qmiRLaA.exe
  C:\Windows\System\qmiRLaA.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\mXxiaQk.exe
  C:\Windows\System\mXxiaQk.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\raOvBev.exe
  C:\Windows\System\raOvBev.exe
  2⤵
  - Executes dropped EXE
  PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AVliJju.exe

Path C:\Windows\System\AVliJju.exe
Size 5.9MB
SHA256 358056f6eb6c60fc558e22713f240d9ebc7fd643122158c802a01673900f7246
MD5 cb6b2a994f807c9c1a2a717da852b87a
SHA1 c56bfd1fe3fa0046f79416f4a1de4f8508d6af9d
SHA512 0f717812d93bd1e8f7d5a28dafa9be2a76e13b24d4d7e388e286a8b2607f4344b2a66e2d6d5450eb343fbf6a4f7eb723e6b9f138b7cdd9c922c5b53c36264663
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

IWkVJXe.exe

Path C:\Windows\System\IWkVJXe.exe
Size 5.9MB
SHA256 8ad30c7f93857d0559d6466c81392d2316fd7c0624879380ec2d48a294a21b72
MD5 f9d476eb7b27b5523b15aebd3b8184bf
SHA1 799db6a001941670257aa662dad784f647aa4a83
SHA512 3c1a07e5f9078c2c571742bf440982cda9a82e5b3705d940bfdf36d611bd20098b43c56cf7857b76f7671fe4c30085918db8ebe00c8e0129ec424967f4cc8b5d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

KpmoaJP.exe

Path C:\Windows\System\KpmoaJP.exe
Size 5.9MB
SHA256 dc5992370a7cf205aab25797394ee11ca8088505bcb57b693515f574690d7466
MD5 7b46ef080abf0e334ead43e5464bfa46
SHA1 2b203dcbc174ef4440191b3e4954f2f501ee6c85
SHA512 eae0736637a7b3807c97b6ec0ee93e40ca4ee3fdbdf6487c2862609b7b2c5d58065bdd625491808e541fadd97121ee198e60db00e295a646b655a993f6d17739
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

LvvWgSw.exe

Path C:\Windows\System\LvvWgSw.exe
Size 5.9MB
SHA256 2da3096c7226df5be3871d49371fb157cf6e105c642654407d5c8788404d0eab
MD5 be807dded96e51e6ed0edbff2998ddd9
SHA1 beb79010f287926f3fdb212fad43114f2d189ff5
SHA512 1a7ba3d942f34f97985f25333446b26b88c9de0c19f75930ede676abb342e5b154dc2326533f900cc9a4458a4c0c7a1482e9ff5814beadeab48e0a6707c4446d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

RALOkaH.exe

Path C:\Windows\System\RALOkaH.exe
Size 5.9MB
SHA256 b9845a931d156458f88392776b16bb37d6c742eb04daebabd9a8036732f7d71c
MD5 e9e0a4bdbb2fe637fbcae7f321901aa2
SHA1 755f9b065c52cf2c1ffc8b2f484581a0529cc158
SHA512 ff954d6ad53af4b256258b57f6329775dd5cbfb55d979c56f9a7450ed1b110604c8eafdde13b036ca2fddc27c09dd284904425f19274af6e99a3a24817960818
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

TiXHcgC.exe

Path C:\Windows\System\TiXHcgC.exe
Size 5.9MB
SHA256 a98a84a94fe9cbb095fff25fc91f61de8b1b788fbd477de915ef5ff8d8c8f6df
MD5 bd976d4fb489b8d82b17f86ad7b190f9
SHA1 a0ab927ab3ef061d3af7d8c6c8c24dcd65450461
SHA512 1ed0986ceb19d9d1dd1776abd4c0f072f2bfcaa54868c22a661d8b4a0e27b9d2aa7e8672406b3074e6971d9e176652120512af1769f110a80b704348059a86cc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

WanRapI.exe

Path C:\Windows\System\WanRapI.exe
Size 5.9MB
SHA256 a353c20d9593856038b933caffc92281b39c746958d8e6c888d480dda270cc6f
MD5 11884af191417abf54140bcee2e7d141
SHA1 e145935419985d0aa0f42d65531745f18df5052f
SHA512 7596129fb5285df0b8976b15dc31259bee9d6ec3c6e4c0fdafe4b27b77c276dc6613e2d18ed0fe35fc0516b0c96dae36a29c69cb3fe8b440d8666838c2d80d41
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

cVxagOT.exe

Path C:\Windows\System\cVxagOT.exe
Size 5.9MB
SHA256 3afdb723846d06384e043075f1e440178e815b5a5faa8dc0d9c7f9e4ba515bdf
MD5 b6d7b69556e21212e0f6fd5eab597e47
SHA1 77a14f045869a01e2a3fdac5af5900c359dd6128
SHA512 01dec0015c1036697e34e8af98fe2b49b3da519bd676b1baa9b61b0f47bbb3838d2284a142b053ed24cb05e32c86ebb6a932fbbedfbdfdedaf3feb79cbcb8f2f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

emYCNOO.exe

Path C:\Windows\System\emYCNOO.exe
Size 5.9MB
SHA256 41fb031f555f17abef48a69903a2c426336b02e9c8ecb712cbd60027f4701684
MD5 dca3e670206884fb9b72792f75ac2d76
SHA1 463d4398e4892ba50e8e9a38f474e77095e2ed41
SHA512 c9fad8077185556367bb6f82f348680ba9f13c20282dc3d1193bc5b300b8e2a524b2afac20fa1e7c2caf969bc69df36f99ff0c55afa7544a8c58ec21596cc96e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

epdWgUs.exe

Path C:\Windows\System\epdWgUs.exe
Size 5.9MB
SHA256 a9215201b4a3e078e5aa81d02048748c65ceef0b798cb0efa6bf9c1ad2db2725
MD5 5eb7ae3aafdabb4b6c90f78c309dfd66
SHA1 9dddab5cd7b8ad83f664504411157358dd29805d
SHA512 a96f68e64b99b86d923e2a5e2d8db6eeb343aae68cffb8948d9bc83f89a42c48b1c565319ff148f5bb5c614de3e5c2e9715ca9eeae306cdd9d95adc0ee67337b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

knVZYNm.exe

Path C:\Windows\System\knVZYNm.exe
Size 5.9MB
SHA256 0fb6f133bfb48491c77688db1c42d6037879c27fba54688a5e9968b71d97fa88
MD5 0cabec53c426e594a1e039df976d7388
SHA1 492ecdfff2c6487eb8db125d1b23487dad7b8ab9
SHA512 993babed94339bfa5dfaf4c27accdefb24d7d73f714c7fef759de235f43768745b10e165a678f794225bb032b7eb91cf715f9cacef6b98a9c57f3b72aa543570
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

mXxiaQk.exe

Path C:\Windows\System\mXxiaQk.exe
Size 5.9MB
SHA256 595153710737b107cc8d08a7b03773d580149b2fd4353bc60ab35d7f82d3bb76
MD5 9e9b6387007a00539e005665518c1387
SHA1 00366c1e09f9f6a7684d17725271303dc7bbe462
SHA512 15d603b77005ca5eb9f211093e51a5eab4ab25daeb2be37a0daa4162fccf91d10dec6c2ab23e3544623e8c7fceee7be136b087f9ccbd675937fb75e71f6f47aa
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

nYbmntG.exe

Path C:\Windows\System\nYbmntG.exe
Size 5.9MB
SHA256 bb754751495360904166521f045661caa95b6d101a259c62296f5614e77f0337
MD5 8c29e199660b8b233d5f7abd303f4276
SHA1 ec9e50c4da20735fce6be9b7814350f7044b9fd3
SHA512 8499bf6efa023bd8a59113c3c0b76479baf4d421994c4ffda4587b55c31b78c360bce585279d7d079363ba0db4e85a67ca56fc8190bf029f70adcc5b78cb1aaa
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

odgCNpa.exe

Path C:\Windows\System\odgCNpa.exe
Size 5.9MB
SHA256 a5e99aefd0f2b96b398eaf400d039ea4d4fc6ae424c96675c71fb5e88bf3d48a
MD5 d8bff8ae4a68d928c555bd2ae4c2eee9
SHA1 31792e4c0f96c032f06c753c9a9db149fcb06e3c
SHA512 7bccc84cf3a1ab7e8d4d56d007f42d7c57b3ecee2f13abfa00cbef3fd08e3c534066875bdbe590a9fdb04f7320df7e574797732ffa1162bb79377833c7eb2690
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:Q+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

qmiRLaA.exe

Path C:\Windows\System\qmiRLaA.exe
Size 5.9MB
SHA256 c49644b350e28feeaa952abb5fa655abd16c86ad9aca9c3c8adc64bc6fe194c9
MD5 4ebfa2f2fd0eb2c8a90f9505ec015d49
SHA1 86776edcd6d7ea0efd89f7fb37d8a301b2975d6b
SHA512 584f63890d13d158c99b30afca54e812e2772aac7ca7dc8ddfb342a40cbe16e14a028012859c3179adb329cd96ecab6ecde80600d02566343f533c13a8645d5c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

raOvBev.exe

Path C:\Windows\System\raOvBev.exe
Size 5.9MB
SHA256 4564e578b458d13afa9ff5a70c7b33372fbe60530971eb09c976c7c543f2ab2c
MD5 38eaea56e1c0a9dbd8cefc3508b72090
SHA1 7c2a5f740ef4f58ac7d5fba9913691d875a7b454
SHA512 e1d7714d32c7a2dac0f069fe7be2a0c69ff34f4d46b7367f36213288abd5bf184f67aee9641e47587e19cf21f575a91c5a69cb2d5394f20f7657e358725d3c43
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:Q+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

uixCkSD.exe

Path C:\Windows\System\uixCkSD.exe
Size 5.9MB
SHA256 add5b33ca3fc4999f44603535c5293b0b91e07fe51257baa6a1fb59f8c6667cc
MD5 be75fa4185f6031657bc82901b61f507
SHA1 b9e00a4bab0bfe2c492fa261d64dba44a024b103
SHA512 45e66d08047179ef88095d9563a2ba7722cf6d1a955c3d76fdd1dd0db5d1154e1391648877104200016b6dbffac80d153b940743050445036c68a39d40414718
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

vLiaSrd.exe

Path C:\Windows\System\vLiaSrd.exe
Size 5.9MB
SHA256 a8d2c0bd80a39a0a4ec5fd84e947342c7f88d091cd7d97e7cf98f76ec42e1243
MD5 6a06c365bf9c3031bf516e14a621f450
SHA1 34dcb0680cedd525709e15d15b83b43b07b683ab
SHA512 61f8487a1a4effad275809b5504336d66f164ada234f8e52616dacd10cf0e14893cbb28a99750f7024f5f670de123b045d85a9d79d98251af11268273087eeee
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

vpXhHbE.exe

Path C:\Windows\System\vpXhHbE.exe
Size 5.9MB
SHA256 da039db718904083eaa76d365063ba07964d2f928208c9a95a7cccd9b6aa58b3
MD5 c678cefa72154028cbfeb955bce4ea0b
SHA1 50a98f2739a4f6e37b27fc9ba4206c5280c9e917
SHA512 1168cae5f4da04b88e21751375ce73e879328ce4be3b174573e2210392c314096ad4f2a63152ad2f06ef58e86b1d391766ce50b4bb370daaf6a2eb9766e80d29
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

xEhawcY.exe

Path C:\Windows\System\xEhawcY.exe
Size 5.9MB
SHA256 a10a366a6ed8812e9aa7355e189a43b0ae394d3942994de153887da7f3352079
MD5 61e51ace7cb67ac6dc789fac5ce5ad67
SHA1 33a60c32d9608fed8d071b45b9409f885a1ccacd
SHA512 e50996a98736e5eb6a6bce3f8b5a8c634bb323cebe2c8c63b15275c6b60b4b45cf7af94910631f7c66db85395c75cc6ab803bbccb0c0356c71591c6a987dac02
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

ymsifIU.exe

Path C:\Windows\System\ymsifIU.exe
Size 5.9MB
SHA256 4f9c367cce32a77c77040c1d38e02982735c6a8aaf13792bfa34e51d3e7a3e51
MD5 1e65ccb144e7271b997854400d4820a0
SHA1 04bfa33e0d213357a110e6af5110955f9c9d4105
SHA512 ca818752d41eebc2e6fbe1fbf4f38f2090acd133029bcf48a4b540a0ed7e6aeb6509e890e05f5b1e73f6119a06a0fae5e6921745236a5e0d3ff6438f09d6cdd0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/548-107-0x00007FF653940000-0x00007FF653C94000-memory.dmp

Download

memory/548-151-0x00007FF653940000-0x00007FF653C94000-memory.dmp

Download

memory/560-154-0x00007FF6A3F00000-0x00007FF6A4254000-memory.dmp

Download

memory/560-124-0x00007FF6A3F00000-0x00007FF6A4254000-memory.dmp

Download

memory/1276-26-0x00007FF71AB10000-0x00007FF71AE64000-memory.dmp

Download

memory/1276-139-0x00007FF71AB10000-0x00007FF71AE64000-memory.dmp

Download

memory/1528-95-0x00007FF7CDB30000-0x00007FF7CDE84000-memory.dmp

Download

memory/1528-150-0x00007FF7CDB30000-0x00007FF7CDE84000-memory.dmp

Download

memory/2192-133-0x00007FF760070000-0x00007FF7603C4000-memory.dmp

Download

memory/2192-155-0x00007FF760070000-0x00007FF7603C4000-memory.dmp

Download

memory/2384-156-0x00007FF614EC0000-0x00007FF615214000-memory.dmp

Download

memory/2384-134-0x00007FF614EC0000-0x00007FF615214000-memory.dmp

Download

memory/2788-63-0x00007FF69DFF0000-0x00007FF69E344000-memory.dmp

Download

memory/2788-145-0x00007FF69DFF0000-0x00007FF69E344000-memory.dmp

Download

memory/2868-110-0x00007FF68CBA0000-0x00007FF68CEF4000-memory.dmp

Download

memory/2868-152-0x00007FF68CBA0000-0x00007FF68CEF4000-memory.dmp

Download

memory/3108-146-0x00007FF7B0370000-0x00007FF7B06C4000-memory.dmp

Download

memory/3108-76-0x00007FF7B0370000-0x00007FF7B06C4000-memory.dmp

Download

memory/3400-1-0x00000271716E0000-0x00000271716F0000-memory.dmp

Download

memory/3400-62-0x00007FF63F740000-0x00007FF63FA94000-memory.dmp

Download

memory/3400-0-0x00007FF63F740000-0x00007FF63FA94000-memory.dmp

Download

memory/3580-30-0x00007FF75B4F0000-0x00007FF75B844000-memory.dmp

Download

memory/3580-140-0x00007FF75B4F0000-0x00007FF75B844000-memory.dmp

Download

memory/3580-101-0x00007FF75B4F0000-0x00007FF75B844000-memory.dmp

Download

memory/3920-108-0x00007FF7B5DF0000-0x00007FF7B6144000-memory.dmp

Download

memory/3920-141-0x00007FF7B5DF0000-0x00007FF7B6144000-memory.dmp

Download

memory/3920-36-0x00007FF7B5DF0000-0x00007FF7B6144000-memory.dmp

Download

memory/4004-149-0x00007FF7A80A0000-0x00007FF7A83F4000-memory.dmp

Download

memory/4004-83-0x00007FF7A80A0000-0x00007FF7A83F4000-memory.dmp

Download

memory/4004-135-0x00007FF7A80A0000-0x00007FF7A83F4000-memory.dmp

Download

memory/4340-8-0x00007FF620DD0000-0x00007FF621124000-memory.dmp

Download

memory/4340-74-0x00007FF620DD0000-0x00007FF621124000-memory.dmp

Download

memory/4340-136-0x00007FF620DD0000-0x00007FF621124000-memory.dmp

Download

memory/4432-137-0x00007FF6961F0000-0x00007FF696544000-memory.dmp

Download

memory/4432-80-0x00007FF6961F0000-0x00007FF696544000-memory.dmp

Download

memory/4432-13-0x00007FF6961F0000-0x00007FF696544000-memory.dmp

Download

memory/4620-20-0x00007FF66A4F0000-0x00007FF66A844000-memory.dmp

Download

memory/4620-138-0x00007FF66A4F0000-0x00007FF66A844000-memory.dmp

Download

memory/4744-40-0x00007FF64A560000-0x00007FF64A8B4000-memory.dmp

Download

memory/4744-115-0x00007FF64A560000-0x00007FF64A8B4000-memory.dmp

Download

memory/4744-143-0x00007FF64A560000-0x00007FF64A8B4000-memory.dmp

Download

memory/4756-142-0x00007FF6DEAE0000-0x00007FF6DEE34000-memory.dmp

Download

memory/4756-50-0x00007FF6DEAE0000-0x00007FF6DEE34000-memory.dmp

Download

memory/4888-89-0x00007FF773BF0000-0x00007FF773F44000-memory.dmp

Download

memory/4888-148-0x00007FF773BF0000-0x00007FF773F44000-memory.dmp

Download

memory/4984-54-0x00007FF71DC50000-0x00007FF71DFA4000-memory.dmp

Download

memory/4984-132-0x00007FF71DC50000-0x00007FF71DFA4000-memory.dmp

Download

memory/4984-144-0x00007FF71DC50000-0x00007FF71DFA4000-memory.dmp

Download

memory/5100-147-0x00007FF7577E0000-0x00007FF757B34000-memory.dmp

Download

memory/5100-75-0x00007FF7577E0000-0x00007FF757B34000-memory.dmp

Download

memory/5116-153-0x00007FF6EE300000-0x00007FF6EE654000-memory.dmp

Download

memory/5116-116-0x00007FF6EE300000-0x00007FF6EE654000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads