cobaltstrike | c79fd3ac1d655660c81b97555f9f887a00378c3644fc9997b96eca43085a7ad2

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 19:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240527-x8hqmsgd66
SHA256 c79fd3ac1d655660c81b97555f9f887a00378c3644fc9997b96eca43085a7ad2
MD5 4ba83645890dc6332c5cd9e15b035491
SHA1 fd966d99237a06f43ef749767ec049eeeb494f18
SHA512 b9cb177bdd4586481b1c781cd784f6ac695079ca66298a6a32b9fa805e52914d30449236f24b5033787ab5e897e1cd3edba4a35b13db8466074458863e3aa4f7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000900000002297e-5.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023494-7.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023493-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023495-23.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023499-43.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349b-59.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349c-64.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349d-70.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a0-80.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a5-120.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023490-116.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a4-114.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a1-107.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a3-101.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a2-99.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349f-78.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349e-74.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349a-54.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023498-50.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023496-36.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023497-31.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000900000002297e-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023494-7.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023493-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023495-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023499-43.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349b-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349c-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349d-70.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000234a0-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000234a5-120.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023490-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000234a4-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000234a1-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000234a3-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000234a2-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349f-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349e-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349a-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023498-50.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023496-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023497-31.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1608-0-0x00007FF7518D0000-0x00007FF751C24000-memory.dmp	UPX
behavioral2/files/0x000900000002297e-5.dat	UPX
behavioral2/files/0x0007000000023494-7.dat	UPX
behavioral2/files/0x0007000000023493-10.dat	UPX
behavioral2/files/0x0007000000023495-23.dat	UPX
behavioral2/memory/2388-25-0x00007FF64CA30000-0x00007FF64CD84000-memory.dmp	UPX
behavioral2/memory/2672-38-0x00007FF607560000-0x00007FF6078B4000-memory.dmp	UPX
behavioral2/files/0x0007000000023499-43.dat	UPX
behavioral2/files/0x000700000002349b-59.dat	UPX
behavioral2/files/0x000700000002349c-64.dat	UPX
behavioral2/files/0x000700000002349d-70.dat	UPX
behavioral2/files/0x00070000000234a0-80.dat	UPX
behavioral2/memory/1828-93-0x00007FF689680000-0x00007FF6899D4000-memory.dmp	UPX
behavioral2/memory/1612-97-0x00007FF76DA80000-0x00007FF76DDD4000-memory.dmp	UPX
behavioral2/memory/4548-112-0x00007FF771740000-0x00007FF771A94000-memory.dmp	UPX
behavioral2/memory/5056-123-0x00007FF7775A0000-0x00007FF7778F4000-memory.dmp	UPX
behavioral2/memory/2256-127-0x00007FF6CF860000-0x00007FF6CFBB4000-memory.dmp	UPX
behavioral2/memory/1760-126-0x00007FF6621F0000-0x00007FF662544000-memory.dmp	UPX
behavioral2/memory/2360-125-0x00007FF6D2460000-0x00007FF6D27B4000-memory.dmp	UPX
behavioral2/memory/4616-124-0x00007FF69D070000-0x00007FF69D3C4000-memory.dmp	UPX
behavioral2/memory/4928-122-0x00007FF70C680000-0x00007FF70C9D4000-memory.dmp	UPX
behavioral2/files/0x00070000000234a5-120.dat	UPX
behavioral2/memory/4988-119-0x00007FF69BFC0000-0x00007FF69C314000-memory.dmp	UPX
behavioral2/memory/2064-118-0x00007FF647380000-0x00007FF6476D4000-memory.dmp	UPX
behavioral2/files/0x0008000000023490-116.dat	UPX
behavioral2/files/0x00070000000234a4-114.dat	UPX
behavioral2/memory/2316-113-0x00007FF7954C0000-0x00007FF795814000-memory.dmp	UPX
behavioral2/memory/3516-110-0x00007FF7C24B0000-0x00007FF7C2804000-memory.dmp	UPX
behavioral2/files/0x00070000000234a1-107.dat	UPX
behavioral2/memory/4008-103-0x00007FF6E1C30000-0x00007FF6E1F84000-memory.dmp	UPX
behavioral2/files/0x00070000000234a3-101.dat	UPX
behavioral2/files/0x00070000000234a2-99.dat	UPX
behavioral2/memory/2060-92-0x00007FF6626C0000-0x00007FF662A14000-memory.dmp	UPX
behavioral2/memory/2556-87-0x00007FF761110000-0x00007FF761464000-memory.dmp	UPX
behavioral2/files/0x000700000002349f-78.dat	UPX
behavioral2/files/0x000700000002349e-74.dat	UPX
behavioral2/files/0x000700000002349a-54.dat	UPX
behavioral2/files/0x0007000000023498-50.dat	UPX
behavioral2/files/0x0007000000023496-36.dat	UPX
behavioral2/files/0x0007000000023497-31.dat	UPX
behavioral2/memory/4316-28-0x00007FF6F8BA0000-0x00007FF6F8EF4000-memory.dmp	UPX
behavioral2/memory/3500-21-0x00007FF735A10000-0x00007FF735D64000-memory.dmp	UPX
behavioral2/memory/3008-9-0x00007FF60B6D0000-0x00007FF60BA24000-memory.dmp	UPX
behavioral2/memory/1608-128-0x00007FF7518D0000-0x00007FF751C24000-memory.dmp	UPX
behavioral2/memory/3008-129-0x00007FF60B6D0000-0x00007FF60BA24000-memory.dmp	UPX
behavioral2/memory/4316-130-0x00007FF6F8BA0000-0x00007FF6F8EF4000-memory.dmp	UPX
behavioral2/memory/3500-131-0x00007FF735A10000-0x00007FF735D64000-memory.dmp	UPX
behavioral2/memory/3008-132-0x00007FF60B6D0000-0x00007FF60BA24000-memory.dmp	UPX
behavioral2/memory/2556-134-0x00007FF761110000-0x00007FF761464000-memory.dmp	UPX
behavioral2/memory/2672-135-0x00007FF607560000-0x00007FF6078B4000-memory.dmp	UPX
behavioral2/memory/4316-133-0x00007FF6F8BA0000-0x00007FF6F8EF4000-memory.dmp	UPX
behavioral2/memory/2388-136-0x00007FF64CA30000-0x00007FF64CD84000-memory.dmp	UPX
behavioral2/memory/4616-140-0x00007FF69D070000-0x00007FF69D3C4000-memory.dmp	UPX
behavioral2/memory/2060-141-0x00007FF6626C0000-0x00007FF662A14000-memory.dmp	UPX
behavioral2/memory/1828-139-0x00007FF689680000-0x00007FF6899D4000-memory.dmp	UPX
behavioral2/memory/1612-138-0x00007FF76DA80000-0x00007FF76DDD4000-memory.dmp	UPX
behavioral2/memory/4008-137-0x00007FF6E1C30000-0x00007FF6E1F84000-memory.dmp	UPX
behavioral2/memory/3516-142-0x00007FF7C24B0000-0x00007FF7C2804000-memory.dmp	UPX
behavioral2/memory/2064-144-0x00007FF647380000-0x00007FF6476D4000-memory.dmp	UPX
behavioral2/memory/2256-149-0x00007FF6CF860000-0x00007FF6CFBB4000-memory.dmp	UPX
behavioral2/memory/1760-150-0x00007FF6621F0000-0x00007FF662544000-memory.dmp	UPX
behavioral2/memory/4988-148-0x00007FF69BFC0000-0x00007FF69C314000-memory.dmp	UPX
behavioral2/memory/4928-147-0x00007FF70C680000-0x00007FF70C9D4000-memory.dmp	UPX
behavioral2/memory/4548-146-0x00007FF771740000-0x00007FF771A94000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1608-0-0x00007FF7518D0000-0x00007FF751C24000-memory.dmp	xmrig
behavioral2/files/0x000900000002297e-5.dat	xmrig
behavioral2/files/0x0007000000023494-7.dat	xmrig
behavioral2/files/0x0007000000023493-10.dat	xmrig
behavioral2/files/0x0007000000023495-23.dat	xmrig
behavioral2/memory/2388-25-0x00007FF64CA30000-0x00007FF64CD84000-memory.dmp	xmrig
behavioral2/memory/2672-38-0x00007FF607560000-0x00007FF6078B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023499-43.dat	xmrig
behavioral2/files/0x000700000002349b-59.dat	xmrig
behavioral2/files/0x000700000002349c-64.dat	xmrig
behavioral2/files/0x000700000002349d-70.dat	xmrig
behavioral2/files/0x00070000000234a0-80.dat	xmrig
behavioral2/memory/1828-93-0x00007FF689680000-0x00007FF6899D4000-memory.dmp	xmrig
behavioral2/memory/1612-97-0x00007FF76DA80000-0x00007FF76DDD4000-memory.dmp	xmrig
behavioral2/memory/4548-112-0x00007FF771740000-0x00007FF771A94000-memory.dmp	xmrig
behavioral2/memory/5056-123-0x00007FF7775A0000-0x00007FF7778F4000-memory.dmp	xmrig
behavioral2/memory/2256-127-0x00007FF6CF860000-0x00007FF6CFBB4000-memory.dmp	xmrig
behavioral2/memory/1760-126-0x00007FF6621F0000-0x00007FF662544000-memory.dmp	xmrig
behavioral2/memory/2360-125-0x00007FF6D2460000-0x00007FF6D27B4000-memory.dmp	xmrig
behavioral2/memory/4616-124-0x00007FF69D070000-0x00007FF69D3C4000-memory.dmp	xmrig
behavioral2/memory/4928-122-0x00007FF70C680000-0x00007FF70C9D4000-memory.dmp	xmrig
behavioral2/files/0x00070000000234a5-120.dat	xmrig
behavioral2/memory/4988-119-0x00007FF69BFC0000-0x00007FF69C314000-memory.dmp	xmrig
behavioral2/memory/2064-118-0x00007FF647380000-0x00007FF6476D4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023490-116.dat	xmrig
behavioral2/files/0x00070000000234a4-114.dat	xmrig
behavioral2/memory/2316-113-0x00007FF7954C0000-0x00007FF795814000-memory.dmp	xmrig
behavioral2/memory/3516-110-0x00007FF7C24B0000-0x00007FF7C2804000-memory.dmp	xmrig
behavioral2/files/0x00070000000234a1-107.dat	xmrig
behavioral2/memory/4008-103-0x00007FF6E1C30000-0x00007FF6E1F84000-memory.dmp	xmrig
behavioral2/files/0x00070000000234a3-101.dat	xmrig
behavioral2/files/0x00070000000234a2-99.dat	xmrig
behavioral2/memory/2060-92-0x00007FF6626C0000-0x00007FF662A14000-memory.dmp	xmrig
behavioral2/memory/2556-87-0x00007FF761110000-0x00007FF761464000-memory.dmp	xmrig
behavioral2/files/0x000700000002349f-78.dat	xmrig
behavioral2/files/0x000700000002349e-74.dat	xmrig
behavioral2/files/0x000700000002349a-54.dat	xmrig
behavioral2/files/0x0007000000023498-50.dat	xmrig
behavioral2/files/0x0007000000023496-36.dat	xmrig
behavioral2/files/0x0007000000023497-31.dat	xmrig
behavioral2/memory/4316-28-0x00007FF6F8BA0000-0x00007FF6F8EF4000-memory.dmp	xmrig
behavioral2/memory/3500-21-0x00007FF735A10000-0x00007FF735D64000-memory.dmp	xmrig
behavioral2/memory/3008-9-0x00007FF60B6D0000-0x00007FF60BA24000-memory.dmp	xmrig
behavioral2/memory/1608-128-0x00007FF7518D0000-0x00007FF751C24000-memory.dmp	xmrig
behavioral2/memory/3008-129-0x00007FF60B6D0000-0x00007FF60BA24000-memory.dmp	xmrig
behavioral2/memory/4316-130-0x00007FF6F8BA0000-0x00007FF6F8EF4000-memory.dmp	xmrig
behavioral2/memory/3500-131-0x00007FF735A10000-0x00007FF735D64000-memory.dmp	xmrig
behavioral2/memory/3008-132-0x00007FF60B6D0000-0x00007FF60BA24000-memory.dmp	xmrig
behavioral2/memory/2556-134-0x00007FF761110000-0x00007FF761464000-memory.dmp	xmrig
behavioral2/memory/2672-135-0x00007FF607560000-0x00007FF6078B4000-memory.dmp	xmrig
behavioral2/memory/4316-133-0x00007FF6F8BA0000-0x00007FF6F8EF4000-memory.dmp	xmrig
behavioral2/memory/2388-136-0x00007FF64CA30000-0x00007FF64CD84000-memory.dmp	xmrig
behavioral2/memory/4616-140-0x00007FF69D070000-0x00007FF69D3C4000-memory.dmp	xmrig
behavioral2/memory/2060-141-0x00007FF6626C0000-0x00007FF662A14000-memory.dmp	xmrig
behavioral2/memory/1828-139-0x00007FF689680000-0x00007FF6899D4000-memory.dmp	xmrig
behavioral2/memory/1612-138-0x00007FF76DA80000-0x00007FF76DDD4000-memory.dmp	xmrig
behavioral2/memory/4008-137-0x00007FF6E1C30000-0x00007FF6E1F84000-memory.dmp	xmrig
behavioral2/memory/3516-142-0x00007FF7C24B0000-0x00007FF7C2804000-memory.dmp	xmrig
behavioral2/memory/2064-144-0x00007FF647380000-0x00007FF6476D4000-memory.dmp	xmrig
behavioral2/memory/2256-149-0x00007FF6CF860000-0x00007FF6CFBB4000-memory.dmp	xmrig
behavioral2/memory/1760-150-0x00007FF6621F0000-0x00007FF662544000-memory.dmp	xmrig
behavioral2/memory/4988-148-0x00007FF69BFC0000-0x00007FF69C314000-memory.dmp	xmrig
behavioral2/memory/4928-147-0x00007FF70C680000-0x00007FF70C9D4000-memory.dmp	xmrig
behavioral2/memory/4548-146-0x00007FF771740000-0x00007FF771A94000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3008	UvBXtgf.exe
3500	PkwUuAx.exe
2388	kGbzKoU.exe
4316	YusJiCX.exe
2672	egEuGnu.exe
2556	nlzPPRG.exe
4616	pBUxNQK.exe
2060	zpMRlMA.exe
1828	BAbwEqx.exe
1612	RvqOANb.exe
4008	kUOCIJc.exe
3516	KqjYGgW.exe
4548	oRUHwfW.exe
2316	sXFdcEr.exe
2064	EkVCGTn.exe
2360	mzZhNzL.exe
4988	GxdWlHk.exe
4928	ZfCfrDH.exe
1760	nTYtmio.exe
5056	vyXhKHc.exe
2256	EdLXXVS.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1608-0-0x00007FF7518D0000-0x00007FF751C24000-memory.dmp	upx
behavioral2/files/0x000900000002297e-5.dat	upx
behavioral2/files/0x0007000000023494-7.dat	upx
behavioral2/files/0x0007000000023493-10.dat	upx
behavioral2/files/0x0007000000023495-23.dat	upx
behavioral2/memory/2388-25-0x00007FF64CA30000-0x00007FF64CD84000-memory.dmp	upx
behavioral2/memory/2672-38-0x00007FF607560000-0x00007FF6078B4000-memory.dmp	upx
behavioral2/files/0x0007000000023499-43.dat	upx
behavioral2/files/0x000700000002349b-59.dat	upx
behavioral2/files/0x000700000002349c-64.dat	upx
behavioral2/files/0x000700000002349d-70.dat	upx
behavioral2/files/0x00070000000234a0-80.dat	upx
behavioral2/memory/1828-93-0x00007FF689680000-0x00007FF6899D4000-memory.dmp	upx
behavioral2/memory/1612-97-0x00007FF76DA80000-0x00007FF76DDD4000-memory.dmp	upx
behavioral2/memory/4548-112-0x00007FF771740000-0x00007FF771A94000-memory.dmp	upx
behavioral2/memory/5056-123-0x00007FF7775A0000-0x00007FF7778F4000-memory.dmp	upx
behavioral2/memory/2256-127-0x00007FF6CF860000-0x00007FF6CFBB4000-memory.dmp	upx
behavioral2/memory/1760-126-0x00007FF6621F0000-0x00007FF662544000-memory.dmp	upx
behavioral2/memory/2360-125-0x00007FF6D2460000-0x00007FF6D27B4000-memory.dmp	upx
behavioral2/memory/4616-124-0x00007FF69D070000-0x00007FF69D3C4000-memory.dmp	upx
behavioral2/memory/4928-122-0x00007FF70C680000-0x00007FF70C9D4000-memory.dmp	upx
behavioral2/files/0x00070000000234a5-120.dat	upx
behavioral2/memory/4988-119-0x00007FF69BFC0000-0x00007FF69C314000-memory.dmp	upx
behavioral2/memory/2064-118-0x00007FF647380000-0x00007FF6476D4000-memory.dmp	upx
behavioral2/files/0x0008000000023490-116.dat	upx
behavioral2/files/0x00070000000234a4-114.dat	upx
behavioral2/memory/2316-113-0x00007FF7954C0000-0x00007FF795814000-memory.dmp	upx
behavioral2/memory/3516-110-0x00007FF7C24B0000-0x00007FF7C2804000-memory.dmp	upx
behavioral2/files/0x00070000000234a1-107.dat	upx
behavioral2/memory/4008-103-0x00007FF6E1C30000-0x00007FF6E1F84000-memory.dmp	upx
behavioral2/files/0x00070000000234a3-101.dat	upx
behavioral2/files/0x00070000000234a2-99.dat	upx
behavioral2/memory/2060-92-0x00007FF6626C0000-0x00007FF662A14000-memory.dmp	upx
behavioral2/memory/2556-87-0x00007FF761110000-0x00007FF761464000-memory.dmp	upx
behavioral2/files/0x000700000002349f-78.dat	upx
behavioral2/files/0x000700000002349e-74.dat	upx
behavioral2/files/0x000700000002349a-54.dat	upx
behavioral2/files/0x0007000000023498-50.dat	upx
behavioral2/files/0x0007000000023496-36.dat	upx
behavioral2/files/0x0007000000023497-31.dat	upx
behavioral2/memory/4316-28-0x00007FF6F8BA0000-0x00007FF6F8EF4000-memory.dmp	upx
behavioral2/memory/3500-21-0x00007FF735A10000-0x00007FF735D64000-memory.dmp	upx
behavioral2/memory/3008-9-0x00007FF60B6D0000-0x00007FF60BA24000-memory.dmp	upx
behavioral2/memory/1608-128-0x00007FF7518D0000-0x00007FF751C24000-memory.dmp	upx
behavioral2/memory/3008-129-0x00007FF60B6D0000-0x00007FF60BA24000-memory.dmp	upx
behavioral2/memory/4316-130-0x00007FF6F8BA0000-0x00007FF6F8EF4000-memory.dmp	upx
behavioral2/memory/3500-131-0x00007FF735A10000-0x00007FF735D64000-memory.dmp	upx
behavioral2/memory/3008-132-0x00007FF60B6D0000-0x00007FF60BA24000-memory.dmp	upx
behavioral2/memory/2556-134-0x00007FF761110000-0x00007FF761464000-memory.dmp	upx
behavioral2/memory/2672-135-0x00007FF607560000-0x00007FF6078B4000-memory.dmp	upx
behavioral2/memory/4316-133-0x00007FF6F8BA0000-0x00007FF6F8EF4000-memory.dmp	upx
behavioral2/memory/2388-136-0x00007FF64CA30000-0x00007FF64CD84000-memory.dmp	upx
behavioral2/memory/4616-140-0x00007FF69D070000-0x00007FF69D3C4000-memory.dmp	upx
behavioral2/memory/2060-141-0x00007FF6626C0000-0x00007FF662A14000-memory.dmp	upx
behavioral2/memory/1828-139-0x00007FF689680000-0x00007FF6899D4000-memory.dmp	upx
behavioral2/memory/1612-138-0x00007FF76DA80000-0x00007FF76DDD4000-memory.dmp	upx
behavioral2/memory/4008-137-0x00007FF6E1C30000-0x00007FF6E1F84000-memory.dmp	upx
behavioral2/memory/3516-142-0x00007FF7C24B0000-0x00007FF7C2804000-memory.dmp	upx
behavioral2/memory/2064-144-0x00007FF647380000-0x00007FF6476D4000-memory.dmp	upx
behavioral2/memory/2256-149-0x00007FF6CF860000-0x00007FF6CFBB4000-memory.dmp	upx
behavioral2/memory/1760-150-0x00007FF6621F0000-0x00007FF662544000-memory.dmp	upx
behavioral2/memory/4988-148-0x00007FF69BFC0000-0x00007FF69C314000-memory.dmp	upx
behavioral2/memory/4928-147-0x00007FF70C680000-0x00007FF70C9D4000-memory.dmp	upx
behavioral2/memory/4548-146-0x00007FF771740000-0x00007FF771A94000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\UvBXtgf.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kGbzKoU.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YusJiCX.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vyXhKHc.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EdLXXVS.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PkwUuAx.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RvqOANb.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kUOCIJc.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EkVCGTn.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mzZhNzL.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GxdWlHk.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZfCfrDH.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nTYtmio.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nlzPPRG.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pBUxNQK.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KqjYGgW.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\sXFdcEr.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\egEuGnu.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zpMRlMA.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BAbwEqx.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oRUHwfW.exe	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 3008	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	82
PID 1608 wrote to memory of 3008	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	82
PID 1608 wrote to memory of 3500	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	83
PID 1608 wrote to memory of 3500	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	83
PID 1608 wrote to memory of 2388	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	84
PID 1608 wrote to memory of 2388	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	84
PID 1608 wrote to memory of 4316	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	85
PID 1608 wrote to memory of 4316	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	85
PID 1608 wrote to memory of 2556	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	86
PID 1608 wrote to memory of 2556	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	86
PID 1608 wrote to memory of 2672	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	87
PID 1608 wrote to memory of 2672	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	87
PID 1608 wrote to memory of 4616	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	88
PID 1608 wrote to memory of 4616	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	88
PID 1608 wrote to memory of 2060	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	89
PID 1608 wrote to memory of 2060	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	89
PID 1608 wrote to memory of 1828	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	90
PID 1608 wrote to memory of 1828	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	90
PID 1608 wrote to memory of 1612	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	91
PID 1608 wrote to memory of 1612	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	91
PID 1608 wrote to memory of 4008	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	92
PID 1608 wrote to memory of 4008	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	92
PID 1608 wrote to memory of 3516	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	93
PID 1608 wrote to memory of 3516	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	93
PID 1608 wrote to memory of 4548	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	94
PID 1608 wrote to memory of 4548	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	94
PID 1608 wrote to memory of 2316	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	95
PID 1608 wrote to memory of 2316	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	95
PID 1608 wrote to memory of 2064	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	96
PID 1608 wrote to memory of 2064	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	96
PID 1608 wrote to memory of 2360	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	97
PID 1608 wrote to memory of 2360	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	97
PID 1608 wrote to memory of 4988	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	98
PID 1608 wrote to memory of 4988	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	98
PID 1608 wrote to memory of 4928	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	99
PID 1608 wrote to memory of 4928	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	99
PID 1608 wrote to memory of 1760	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	100
PID 1608 wrote to memory of 1760	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	100
PID 1608 wrote to memory of 5056	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	101
PID 1608 wrote to memory of 5056	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	101
PID 1608 wrote to memory of 2256	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	102
PID 1608 wrote to memory of 2256	1608	2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe	102

C:\Users\Admin\AppData\Local\Temp\2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_4ba83645890dc6332c5cd9e15b035491_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\System\UvBXtgf.exe
  C:\Windows\System\UvBXtgf.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\PkwUuAx.exe
  C:\Windows\System\PkwUuAx.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\kGbzKoU.exe
  C:\Windows\System\kGbzKoU.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\YusJiCX.exe
  C:\Windows\System\YusJiCX.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\nlzPPRG.exe
  C:\Windows\System\nlzPPRG.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\egEuGnu.exe
  C:\Windows\System\egEuGnu.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\pBUxNQK.exe
  C:\Windows\System\pBUxNQK.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\zpMRlMA.exe
  C:\Windows\System\zpMRlMA.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\BAbwEqx.exe
  C:\Windows\System\BAbwEqx.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\RvqOANb.exe
  C:\Windows\System\RvqOANb.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\kUOCIJc.exe
  C:\Windows\System\kUOCIJc.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\KqjYGgW.exe
  C:\Windows\System\KqjYGgW.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\oRUHwfW.exe
  C:\Windows\System\oRUHwfW.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\sXFdcEr.exe
  C:\Windows\System\sXFdcEr.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\EkVCGTn.exe
  C:\Windows\System\EkVCGTn.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\mzZhNzL.exe
  C:\Windows\System\mzZhNzL.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\GxdWlHk.exe
  C:\Windows\System\GxdWlHk.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\ZfCfrDH.exe
  C:\Windows\System\ZfCfrDH.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\nTYtmio.exe
  C:\Windows\System\nTYtmio.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\vyXhKHc.exe
  C:\Windows\System\vyXhKHc.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\EdLXXVS.exe
  C:\Windows\System\EdLXXVS.exe
  2⤵
  - Executes dropped EXE
  PID:2256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BAbwEqx.exe

Path C:\Windows\System\BAbwEqx.exe
Size 5.9MB
SHA256 8cda28c1c33b13d99a049484900d860e6df68e968fc7379cc33f476a874d498f
MD5 ab50674e6d4cc0243cd9032b70066b19
SHA1 08333ec08ae46b58eccab9eb1b2d7c56d0b552fe
SHA512 bffff1f7092307a8a8df247795d67ac37cfd6121b7abe40638de4802a17eab6cd923d9952953437e2c07d43e43803b3e05ae21d028693d6269fd79062cc807cf
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

EdLXXVS.exe

Path C:\Windows\System\EdLXXVS.exe
Size 5.9MB
SHA256 82599c751594923ab1a6942d0bdd329a6c197a80cc112beb1bcb906a411ceb34
MD5 a62aa1eb6e6d12aae8820cceefdfbcd7
SHA1 2af4ba446c86d33cfc4da48ff78ea3dbe964251f
SHA512 5df42d4d12619a4cedb8b44b7fe1832a1ae909cdb4e7f832104e5ccad48d9a1b7316ddd47128708b7bcfa4537358ec31d1a94c8040948a9659f55fbbeaae03c0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

EkVCGTn.exe

Path C:\Windows\System\EkVCGTn.exe
Size 5.9MB
SHA256 45e6c0aeb1f46b49bebf436124e9006ef0828f7b8fc772158f9902bc71e996ea
MD5 d5699287cb04be5b1a7fc338ca4238a6
SHA1 d70ab723768e454822c90a3719c15f966817293f
SHA512 84407af0ec61f6d90dbd0546bf041b5249a42308405caf9f18f3215b5fe0a2ca5832ca2a0af8b7a1cecc8e6b5200a5fd4fe332faef0bf75cf66a238fbf0c46e7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

GxdWlHk.exe

Path C:\Windows\System\GxdWlHk.exe
Size 5.9MB
SHA256 958bcf735e40f3140bd0a316d77083dd91314a780aff5c324cff7e00979c3dc5
MD5 d3ccd092698db275e8f2ddbc7270e036
SHA1 ad18116249af9a1a65a0bcf543d3af9550e2bd91
SHA512 17627b3271bb822ca8d6b50e7fd524ceb6383f4f903d97b615a353fd7f0e822e71bb8b2ed295e0ff139991644f438872515f47e9f3e310b905bc959611273347
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:Q+856utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

KqjYGgW.exe

Path C:\Windows\System\KqjYGgW.exe
Size 5.9MB
SHA256 771a9f524a8a9587a2a9dbce457a7a22e70e3c0c6b10dcd52f52fa3a06e8a0d9
MD5 7f8e216f6e2be2bed372b9bcecfb6833
SHA1 7e3cf56bb5cead72a47318891f68015dc420c217
SHA512 005e8910f129c08fcf51a8ad07011974f689517fe0bc6c3b53bb0bced7f8348417e3cb6a635a32c2c5fb84b479cf992e7b900b04ca32f5e1285f7ad4eeb5b9e0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

PkwUuAx.exe

Path C:\Windows\System\PkwUuAx.exe
Size 5.9MB
SHA256 bd3bf6e9d640145e323fb7f1e53609e7d40f5140e1ac69d12e10ed9f5c7fc8ae
MD5 5bbf99c7382cec40592d18be8e8cca9e
SHA1 d88d736dfaa590a8de4d5167eb23115efd6ff78e
SHA512 6b50261370d20f4baf3c08868396de2a68e9bfdd74b41117b7c88597790d00697612441a1851de014c817418a8650cbc53fa90e698142cd987b9828f2065ec21
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

RvqOANb.exe

Path C:\Windows\System\RvqOANb.exe
Size 5.9MB
SHA256 fdc2c30af6886ab9ed8151f63f320cd4e36395d29198bc549a8429f53b9eac5b
MD5 78cfa3dc02f5c8b3189b77f2cd34c7f8
SHA1 b20fdd380a348aae4fef685e199e75d766a682da
SHA512 1f44974cbbaeaba5866617d0b40ac026d6598c9a6f2249438fca52a1b012bb0814b85ff95ee09e19690a64b0751a1382a0fa09583b0f8f551c63e1432367e984
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:Q+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

UvBXtgf.exe

Path C:\Windows\System\UvBXtgf.exe
Size 5.9MB
SHA256 50e73f894fb28c788f0333d6ac2c6f461a450735fcb310b49d9079e1cf48ec7e
MD5 c79f84c7d68a6bb6d86fedd23229eddc
SHA1 3ad3fc1768f8b7d2fe8487a6dbb918d2cd65897d
SHA512 af472c9697d1e99486d3c1eb46c9f9e04787282bf90da41b969d3d09960183f37f944a01adb6a26e3eca6df9bea6a135e32e854fe1c063658c8b7d2480cc62c6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:Q+856utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

YusJiCX.exe

Path C:\Windows\System\YusJiCX.exe
Size 5.9MB
SHA256 40c7cd3c2450ded38641ae0acd90a82115123ee0f3ccfedb8718cfeb4915898a
MD5 2142eae188283880755e7cb5e9c4f0b6
SHA1 333b49d87aad6c5abecf835baf4f75844e6d7568
SHA512 6f593d7b88cbecb63d71d5c7eb20ff7d845791c30ee4837f4c53cf60748a4943c094217364fa5d90fe1995576b4a38ce43b26ae94f052659350bb5c183068d50
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZfCfrDH.exe

Path C:\Windows\System\ZfCfrDH.exe
Size 5.9MB
SHA256 8aae23cc9c0a13b51e0e73a5979c4a0d339a7e9110925c497802ea2ce36be407
MD5 ad3862750b15ef167e194ac361ea4b09
SHA1 be47a83bf826b5685872782bc1a18bffa7112890
SHA512 6e965926a706770fadce7d2f319267496a980ff39acb73e6b9d0d2fdc82941498bd97db284fc3b4ae21f4e875d8675a88fa30f6c2dfb51f4e0130ae6c2aaea70
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:Q+856utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

egEuGnu.exe

Path C:\Windows\System\egEuGnu.exe
Size 5.9MB
SHA256 8affadf522d554146b1289b0043dbca44af9e07ec5ccfce0c8655db647229c43
MD5 f6f2e12313fa52330847e46fd832deb4
SHA1 f0ac2e1f9251235473302c5a351254d4c6217648
SHA512 204f979bd005098150bf6b32d4ce8bd0e5e9166aab27c1f0716be856e3db94783efdf47ca4c3706e29eddf66df4f980aacb45fbd9ce8319cd4f8a0f8a02ae8cb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:Q+856utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

kGbzKoU.exe

Path C:\Windows\System\kGbzKoU.exe
Size 5.9MB
SHA256 b30e885f42cd0a27a70cb0a3bf01d063ab2d6bec25881eaac9e94171dedcdae4
MD5 f5dac879f9c95f7ec1ea229a5768a689
SHA1 1f401629def490e34f1afaf4117bb0124f58bb9f
SHA512 d97ec3c3d121fedc051f1e5b0e762d5ef35bffa2fa01f492055bef7ba1b870fe9c09f1e444376a6fcf4a2f47b4f818ad72971466ebddeb6027cbc857fa61dade
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

kUOCIJc.exe

Path C:\Windows\System\kUOCIJc.exe
Size 5.9MB
SHA256 8686062b0b6114c32882bdcfc36d61b4d4599bfc9ca4552db3b0982476944234
MD5 60f74e2ab0cfe58ecd370212586680d1
SHA1 39801a75339eb004e3c67bb12b7b5351baf02973
SHA512 c02aeedaa3f6aa72db91739cd8f0a8b11bd83ba87f4d4801aa63b14503758fd2b667b2af053ae8c33188e33ec3d38a999f56a6656f53897d852a7708c207a55f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

mzZhNzL.exe

Path C:\Windows\System\mzZhNzL.exe
Size 5.9MB
SHA256 64368d30ccb9e235d4b0032d492c2581b58c0d6486896c4f873367f9701537b4
MD5 a216e294571506f7fe5ba3455dbf95bf
SHA1 47726f7c3fe8f5873c9c307c4cb07762dcb667de
SHA512 57c1b8fab80649e3beed645f309467a75afb3dcedc0becd23c0df88a86bc22234b3c1a1689a771d54618c48b8b4564f2efce943e6eda4fedef202753f7345b1a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

nTYtmio.exe

Path C:\Windows\System\nTYtmio.exe
Size 5.9MB
SHA256 cc032c1339f47ab449f8cd6286107cf935823ed885e4ea0fc683b9e7e407362a
MD5 3c1655859ffa65b2253fff9ac0ba041e
SHA1 cff0897b9c83192b4f10c2db6e981b7e76604107
SHA512 7c10718f3c2b0aefe6e453f1fcf662dcbb5f6cfea0ded82cfbf2e714517bd9fcc41632753420223d4165bc67a8a495f353b6ef91fe9c0a7e95eb6f7a849e257b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

nlzPPRG.exe

Path C:\Windows\System\nlzPPRG.exe
Size 5.9MB
SHA256 5b8bef7bc2a4c1af5f182aa92cc7c7c876adf48ac6730a9c7cfdff9edcec6a7e
MD5 164fb90507141ed2cba6af1db278e974
SHA1 c3b96158cf3aab3ecf9a149a3d0112c2712c338e
SHA512 7446edbe42810ed40c61b90781409d18ddfad6b765221526a4d8797aac4295feba3f2af135dd697e15e6954747fff03ded5322276fd841d95ffec1bf2fdd3969
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

oRUHwfW.exe

Path C:\Windows\System\oRUHwfW.exe
Size 5.9MB
SHA256 327c997cfe92c1f5131a99b17ecc166ffe0fc9eb392a45ec355044ebec0175ef
MD5 cc95bdde96b8ea061701ecb10369d9f4
SHA1 8e12a7d326b9127933f53edf1010d1a5c7f0e34b
SHA512 7198af8433c0a49b2383f611ec8fdd29bc273014f6a9df59cf9535758dec122427ba8566e347278e9f1a18483b195b6568f12a0a1c5842763f4f0b999a126fb4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

pBUxNQK.exe

Path C:\Windows\System\pBUxNQK.exe
Size 5.9MB
SHA256 82e3325c49da5b2838d557c1fda1d2ee6e5e06c81971214a9ecb99789c7bcae3
MD5 8954520afc311fac5c299e97630b1eb3
SHA1 da3785b56bdc707daaf191441ea4c7ba159d9d04
SHA512 759d7f33ac3ffb3d8463a7a9a824aff305d052a07b199db51fc59e373bcad821320e8445dada58660de3eaec47247fbcc9d58fdb7a61efb623c94712b295f0a2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

sXFdcEr.exe

Path C:\Windows\System\sXFdcEr.exe
Size 5.9MB
SHA256 1bfb8a2dadab534e3835274da765ac699a7d847a7946c51e3da7045f94db0151
MD5 03f5a84f37b7cc1f32d5629795df9f5e
SHA1 52c39d5dd38e372dc8afb16b65f176437121c9cc
SHA512 b4d0dfbc41a83ecea76ea80d45a632ef0bd1a95a2ac727fb924297d3b4e7b1346764a28460bd40fb3000e7ff402791ded5b015f285ab40d17f921bae04a8f121
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

vyXhKHc.exe

Path C:\Windows\System\vyXhKHc.exe
Size 5.9MB
SHA256 6e0b01db67ded8b5000eb64cdddddd4da2d73ab321982ff3fb87801de09f8024
MD5 294c55a153466a04448fd40c65f5b26f
SHA1 65fc63f112f1f279d27ee732d3988aa3cdbe6fd1
SHA512 3d3ec7a0cac623c5b2b4031f72ec7faf3d67865b9368cc336ff7d6a177b358cc9b01daadad5e616331ec51319fef9748d089019cd9e8b0314ab88afd1617d410
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:Q+856utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

zpMRlMA.exe

Path C:\Windows\System\zpMRlMA.exe
Size 5.9MB
SHA256 69bf7b4b2aaedcb1ea46c4d4345155fcca801917c3d3d7f688137ecea9857447
MD5 ab74c2db6569da144cb16696734f0bee
SHA1 5323ed9904fd80a36866005cf003b6c3c89f83bd
SHA512 516bfc800f9ae4c37ddbe57579c7ee98e2fc72f485e551e20e36cf8eeaf29f0398daf4f06f55b9abf6e9649999ffe659f74827859e045329064b62ac5fc2e9e5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1608-0-0x00007FF7518D0000-0x00007FF751C24000-memory.dmp

Download

memory/1608-128-0x00007FF7518D0000-0x00007FF751C24000-memory.dmp

Download

memory/1608-1-0x000001E30EF70000-0x000001E30EF80000-memory.dmp

Download

memory/1612-138-0x00007FF76DA80000-0x00007FF76DDD4000-memory.dmp

Download

memory/1612-97-0x00007FF76DA80000-0x00007FF76DDD4000-memory.dmp

Download

memory/1760-126-0x00007FF6621F0000-0x00007FF662544000-memory.dmp

Download

memory/1760-150-0x00007FF6621F0000-0x00007FF662544000-memory.dmp

Download

memory/1828-139-0x00007FF689680000-0x00007FF6899D4000-memory.dmp

Download

memory/1828-93-0x00007FF689680000-0x00007FF6899D4000-memory.dmp

Download

memory/2060-141-0x00007FF6626C0000-0x00007FF662A14000-memory.dmp

Download

memory/2060-92-0x00007FF6626C0000-0x00007FF662A14000-memory.dmp

Download

memory/2064-118-0x00007FF647380000-0x00007FF6476D4000-memory.dmp

Download

memory/2064-144-0x00007FF647380000-0x00007FF6476D4000-memory.dmp

Download

memory/2256-127-0x00007FF6CF860000-0x00007FF6CFBB4000-memory.dmp

Download

memory/2256-149-0x00007FF6CF860000-0x00007FF6CFBB4000-memory.dmp

Download

memory/2316-143-0x00007FF7954C0000-0x00007FF795814000-memory.dmp

Download

memory/2316-113-0x00007FF7954C0000-0x00007FF795814000-memory.dmp

Download

memory/2360-151-0x00007FF6D2460000-0x00007FF6D27B4000-memory.dmp

Download

memory/2360-125-0x00007FF6D2460000-0x00007FF6D27B4000-memory.dmp

Download

memory/2388-25-0x00007FF64CA30000-0x00007FF64CD84000-memory.dmp

Download

memory/2388-136-0x00007FF64CA30000-0x00007FF64CD84000-memory.dmp

Download

memory/2556-134-0x00007FF761110000-0x00007FF761464000-memory.dmp

Download

memory/2556-87-0x00007FF761110000-0x00007FF761464000-memory.dmp

Download

memory/2672-38-0x00007FF607560000-0x00007FF6078B4000-memory.dmp

Download

memory/2672-135-0x00007FF607560000-0x00007FF6078B4000-memory.dmp

Download

memory/3008-9-0x00007FF60B6D0000-0x00007FF60BA24000-memory.dmp

Download

memory/3008-132-0x00007FF60B6D0000-0x00007FF60BA24000-memory.dmp

Download

memory/3008-129-0x00007FF60B6D0000-0x00007FF60BA24000-memory.dmp

Download

memory/3500-21-0x00007FF735A10000-0x00007FF735D64000-memory.dmp

Download

memory/3500-131-0x00007FF735A10000-0x00007FF735D64000-memory.dmp

Download

memory/3516-142-0x00007FF7C24B0000-0x00007FF7C2804000-memory.dmp

Download

memory/3516-110-0x00007FF7C24B0000-0x00007FF7C2804000-memory.dmp

Download

memory/4008-103-0x00007FF6E1C30000-0x00007FF6E1F84000-memory.dmp

Download

memory/4008-137-0x00007FF6E1C30000-0x00007FF6E1F84000-memory.dmp

Download

memory/4316-133-0x00007FF6F8BA0000-0x00007FF6F8EF4000-memory.dmp

Download

memory/4316-130-0x00007FF6F8BA0000-0x00007FF6F8EF4000-memory.dmp

Download

memory/4316-28-0x00007FF6F8BA0000-0x00007FF6F8EF4000-memory.dmp

Download

memory/4548-146-0x00007FF771740000-0x00007FF771A94000-memory.dmp

Download

memory/4548-112-0x00007FF771740000-0x00007FF771A94000-memory.dmp

Download

memory/4616-124-0x00007FF69D070000-0x00007FF69D3C4000-memory.dmp

Download

memory/4616-140-0x00007FF69D070000-0x00007FF69D3C4000-memory.dmp

Download

memory/4928-147-0x00007FF70C680000-0x00007FF70C9D4000-memory.dmp

Download

memory/4928-122-0x00007FF70C680000-0x00007FF70C9D4000-memory.dmp

Download

memory/4988-119-0x00007FF69BFC0000-0x00007FF69C314000-memory.dmp

Download

memory/4988-148-0x00007FF69BFC0000-0x00007FF69C314000-memory.dmp

Download

memory/5056-145-0x00007FF7775A0000-0x00007FF7778F4000-memory.dmp

Download

memory/5056-123-0x00007FF7775A0000-0x00007FF7778F4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads