cobaltstrike | 51b0040631e2b9632ea07319433c66877115bcf4558e2222b4fc3ffaaacb57cb

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240528-a25khaga71
SHA256 51b0040631e2b9632ea07319433c66877115bcf4558e2222b4fc3ffaaacb57cb
MD5 6e1251df6fa3529aa618dba5055ad4f7
SHA1 f4403ca9e3a6f95a5f3dda6501ee08985584f649
SHA512 1ce6bc39d9dbb543313c929a894f167510b09acb6c7e0e72d987fe35e8a1cb609b56a37db911a8801cee86351d8232125222a1e878b590ef843b93e05d36e087
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00080000000233c6-4.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233c7-9.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233c8-11.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233c9-20.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ca-31.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233cd-41.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ce-44.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d0-49.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233cf-72.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d7-102.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d9-115.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d8-120.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d4-111.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d6-109.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d5-106.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d2-100.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d3-97.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000233c4-95.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d1-78.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233cc-61.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233cb-54.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x00080000000233c6-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233c7-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233c8-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233c9-20.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ca-31.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233cd-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ce-44.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d0-49.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233cf-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d7-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d9-115.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d8-120.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d4-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d6-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d5-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d2-100.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d3-97.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00080000000233c4-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d1-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233cc-61.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233cb-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2744-0-0x00007FF6CD680000-0x00007FF6CD9D4000-memory.dmp	UPX
behavioral2/files/0x00080000000233c6-4.dat	UPX
behavioral2/files/0x00070000000233c7-9.dat	UPX
behavioral2/files/0x00070000000233c8-11.dat	UPX
behavioral2/files/0x00070000000233c9-20.dat	UPX
behavioral2/files/0x00070000000233ca-31.dat	UPX
behavioral2/files/0x00070000000233cd-41.dat	UPX
behavioral2/files/0x00070000000233ce-44.dat	UPX
behavioral2/files/0x00070000000233d0-49.dat	UPX
behavioral2/memory/5060-65-0x00007FF7CA490000-0x00007FF7CA7E4000-memory.dmp	UPX
behavioral2/files/0x00070000000233cf-72.dat	UPX
behavioral2/memory/1020-82-0x00007FF7D83D0000-0x00007FF7D8724000-memory.dmp	UPX
behavioral2/files/0x00070000000233d7-102.dat	UPX
behavioral2/files/0x00070000000233d9-115.dat	UPX
behavioral2/memory/2272-124-0x00007FF635CB0000-0x00007FF636004000-memory.dmp	UPX
behavioral2/memory/1528-127-0x00007FF7D3D30000-0x00007FF7D4084000-memory.dmp	UPX
behavioral2/memory/3776-126-0x00007FF7EDC80000-0x00007FF7EDFD4000-memory.dmp	UPX
behavioral2/memory/1276-125-0x00007FF639360000-0x00007FF6396B4000-memory.dmp	UPX
behavioral2/files/0x00070000000233d8-120.dat	UPX
behavioral2/memory/3736-119-0x00007FF7CD590000-0x00007FF7CD8E4000-memory.dmp	UPX
behavioral2/memory/4176-116-0x00007FF6308F0000-0x00007FF630C44000-memory.dmp	UPX
behavioral2/memory/3528-113-0x00007FF6B2B50000-0x00007FF6B2EA4000-memory.dmp	UPX
behavioral2/files/0x00070000000233d4-111.dat	UPX
behavioral2/files/0x00070000000233d6-109.dat	UPX
behavioral2/files/0x00070000000233d5-106.dat	UPX
behavioral2/files/0x00070000000233d2-100.dat	UPX
behavioral2/memory/2924-99-0x00007FF79D900000-0x00007FF79DC54000-memory.dmp	UPX
behavioral2/files/0x00070000000233d3-97.dat	UPX
behavioral2/files/0x00080000000233c4-95.dat	UPX
behavioral2/memory/3048-91-0x00007FF683120000-0x00007FF683474000-memory.dmp	UPX
behavioral2/memory/2156-89-0x00007FF630990000-0x00007FF630CE4000-memory.dmp	UPX
behavioral2/files/0x00070000000233d1-78.dat	UPX
behavioral2/memory/1540-75-0x00007FF6BB3A0000-0x00007FF6BB6F4000-memory.dmp	UPX
behavioral2/files/0x00070000000233cc-61.dat	UPX
behavioral2/memory/2668-57-0x00007FF6EA010000-0x00007FF6EA364000-memory.dmp	UPX
behavioral2/files/0x00070000000233cb-54.dat	UPX
behavioral2/memory/3644-53-0x00007FF6BBE30000-0x00007FF6BC184000-memory.dmp	UPX
behavioral2/memory/3944-48-0x00007FF7D20E0000-0x00007FF7D2434000-memory.dmp	UPX
behavioral2/memory/3592-27-0x00007FF60F680000-0x00007FF60F9D4000-memory.dmp	UPX
behavioral2/memory/3648-23-0x00007FF7233D0000-0x00007FF723724000-memory.dmp	UPX
behavioral2/memory/4992-22-0x00007FF6D3DE0000-0x00007FF6D4134000-memory.dmp	UPX
behavioral2/memory/2400-18-0x00007FF644490000-0x00007FF6447E4000-memory.dmp	UPX
behavioral2/memory/4644-10-0x00007FF7398D0000-0x00007FF739C24000-memory.dmp	UPX
behavioral2/memory/2744-128-0x00007FF6CD680000-0x00007FF6CD9D4000-memory.dmp	UPX
behavioral2/memory/4644-129-0x00007FF7398D0000-0x00007FF739C24000-memory.dmp	UPX
behavioral2/memory/2400-130-0x00007FF644490000-0x00007FF6447E4000-memory.dmp	UPX
behavioral2/memory/4992-131-0x00007FF6D3DE0000-0x00007FF6D4134000-memory.dmp	UPX
behavioral2/memory/3648-132-0x00007FF7233D0000-0x00007FF723724000-memory.dmp	UPX
behavioral2/memory/3592-133-0x00007FF60F680000-0x00007FF60F9D4000-memory.dmp	UPX
behavioral2/memory/3644-134-0x00007FF6BBE30000-0x00007FF6BC184000-memory.dmp	UPX
behavioral2/memory/2668-135-0x00007FF6EA010000-0x00007FF6EA364000-memory.dmp	UPX
behavioral2/memory/3944-136-0x00007FF7D20E0000-0x00007FF7D2434000-memory.dmp	UPX
behavioral2/memory/5060-137-0x00007FF7CA490000-0x00007FF7CA7E4000-memory.dmp	UPX
behavioral2/memory/3048-139-0x00007FF683120000-0x00007FF683474000-memory.dmp	UPX
behavioral2/memory/1540-138-0x00007FF6BB3A0000-0x00007FF6BB6F4000-memory.dmp	UPX
behavioral2/memory/4644-140-0x00007FF7398D0000-0x00007FF739C24000-memory.dmp	UPX
behavioral2/memory/2400-141-0x00007FF644490000-0x00007FF6447E4000-memory.dmp	UPX
behavioral2/memory/4992-142-0x00007FF6D3DE0000-0x00007FF6D4134000-memory.dmp	UPX
behavioral2/memory/3592-144-0x00007FF60F680000-0x00007FF60F9D4000-memory.dmp	UPX
behavioral2/memory/3648-143-0x00007FF7233D0000-0x00007FF723724000-memory.dmp	UPX
behavioral2/memory/3944-145-0x00007FF7D20E0000-0x00007FF7D2434000-memory.dmp	UPX
behavioral2/memory/5060-146-0x00007FF7CA490000-0x00007FF7CA7E4000-memory.dmp	UPX
behavioral2/memory/3644-147-0x00007FF6BBE30000-0x00007FF6BC184000-memory.dmp	UPX
behavioral2/memory/2668-149-0x00007FF6EA010000-0x00007FF6EA364000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2744-0-0x00007FF6CD680000-0x00007FF6CD9D4000-memory.dmp	xmrig
behavioral2/files/0x00080000000233c6-4.dat	xmrig
behavioral2/files/0x00070000000233c7-9.dat	xmrig
behavioral2/files/0x00070000000233c8-11.dat	xmrig
behavioral2/files/0x00070000000233c9-20.dat	xmrig
behavioral2/files/0x00070000000233ca-31.dat	xmrig
behavioral2/files/0x00070000000233cd-41.dat	xmrig
behavioral2/files/0x00070000000233ce-44.dat	xmrig
behavioral2/files/0x00070000000233d0-49.dat	xmrig
behavioral2/memory/5060-65-0x00007FF7CA490000-0x00007FF7CA7E4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233cf-72.dat	xmrig
behavioral2/memory/1020-82-0x00007FF7D83D0000-0x00007FF7D8724000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d7-102.dat	xmrig
behavioral2/files/0x00070000000233d9-115.dat	xmrig
behavioral2/memory/2272-124-0x00007FF635CB0000-0x00007FF636004000-memory.dmp	xmrig
behavioral2/memory/1528-127-0x00007FF7D3D30000-0x00007FF7D4084000-memory.dmp	xmrig
behavioral2/memory/3776-126-0x00007FF7EDC80000-0x00007FF7EDFD4000-memory.dmp	xmrig
behavioral2/memory/1276-125-0x00007FF639360000-0x00007FF6396B4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d8-120.dat	xmrig
behavioral2/memory/3736-119-0x00007FF7CD590000-0x00007FF7CD8E4000-memory.dmp	xmrig
behavioral2/memory/4176-116-0x00007FF6308F0000-0x00007FF630C44000-memory.dmp	xmrig
behavioral2/memory/3528-113-0x00007FF6B2B50000-0x00007FF6B2EA4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d4-111.dat	xmrig
behavioral2/files/0x00070000000233d6-109.dat	xmrig
behavioral2/files/0x00070000000233d5-106.dat	xmrig
behavioral2/files/0x00070000000233d2-100.dat	xmrig
behavioral2/memory/2924-99-0x00007FF79D900000-0x00007FF79DC54000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d3-97.dat	xmrig
behavioral2/files/0x00080000000233c4-95.dat	xmrig
behavioral2/memory/3048-91-0x00007FF683120000-0x00007FF683474000-memory.dmp	xmrig
behavioral2/memory/2156-89-0x00007FF630990000-0x00007FF630CE4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d1-78.dat	xmrig
behavioral2/memory/1540-75-0x00007FF6BB3A0000-0x00007FF6BB6F4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233cc-61.dat	xmrig
behavioral2/memory/2668-57-0x00007FF6EA010000-0x00007FF6EA364000-memory.dmp	xmrig
behavioral2/files/0x00070000000233cb-54.dat	xmrig
behavioral2/memory/3644-53-0x00007FF6BBE30000-0x00007FF6BC184000-memory.dmp	xmrig
behavioral2/memory/3944-48-0x00007FF7D20E0000-0x00007FF7D2434000-memory.dmp	xmrig
behavioral2/memory/3592-27-0x00007FF60F680000-0x00007FF60F9D4000-memory.dmp	xmrig
behavioral2/memory/3648-23-0x00007FF7233D0000-0x00007FF723724000-memory.dmp	xmrig
behavioral2/memory/4992-22-0x00007FF6D3DE0000-0x00007FF6D4134000-memory.dmp	xmrig
behavioral2/memory/2400-18-0x00007FF644490000-0x00007FF6447E4000-memory.dmp	xmrig
behavioral2/memory/4644-10-0x00007FF7398D0000-0x00007FF739C24000-memory.dmp	xmrig
behavioral2/memory/2744-128-0x00007FF6CD680000-0x00007FF6CD9D4000-memory.dmp	xmrig
behavioral2/memory/4644-129-0x00007FF7398D0000-0x00007FF739C24000-memory.dmp	xmrig
behavioral2/memory/2400-130-0x00007FF644490000-0x00007FF6447E4000-memory.dmp	xmrig
behavioral2/memory/4992-131-0x00007FF6D3DE0000-0x00007FF6D4134000-memory.dmp	xmrig
behavioral2/memory/3648-132-0x00007FF7233D0000-0x00007FF723724000-memory.dmp	xmrig
behavioral2/memory/3592-133-0x00007FF60F680000-0x00007FF60F9D4000-memory.dmp	xmrig
behavioral2/memory/3644-134-0x00007FF6BBE30000-0x00007FF6BC184000-memory.dmp	xmrig
behavioral2/memory/2668-135-0x00007FF6EA010000-0x00007FF6EA364000-memory.dmp	xmrig
behavioral2/memory/3944-136-0x00007FF7D20E0000-0x00007FF7D2434000-memory.dmp	xmrig
behavioral2/memory/5060-137-0x00007FF7CA490000-0x00007FF7CA7E4000-memory.dmp	xmrig
behavioral2/memory/3048-139-0x00007FF683120000-0x00007FF683474000-memory.dmp	xmrig
behavioral2/memory/1540-138-0x00007FF6BB3A0000-0x00007FF6BB6F4000-memory.dmp	xmrig
behavioral2/memory/4644-140-0x00007FF7398D0000-0x00007FF739C24000-memory.dmp	xmrig
behavioral2/memory/2400-141-0x00007FF644490000-0x00007FF6447E4000-memory.dmp	xmrig
behavioral2/memory/4992-142-0x00007FF6D3DE0000-0x00007FF6D4134000-memory.dmp	xmrig
behavioral2/memory/3592-144-0x00007FF60F680000-0x00007FF60F9D4000-memory.dmp	xmrig
behavioral2/memory/3648-143-0x00007FF7233D0000-0x00007FF723724000-memory.dmp	xmrig
behavioral2/memory/3944-145-0x00007FF7D20E0000-0x00007FF7D2434000-memory.dmp	xmrig
behavioral2/memory/5060-146-0x00007FF7CA490000-0x00007FF7CA7E4000-memory.dmp	xmrig
behavioral2/memory/3644-147-0x00007FF6BBE30000-0x00007FF6BC184000-memory.dmp	xmrig
behavioral2/memory/2668-149-0x00007FF6EA010000-0x00007FF6EA364000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4644	HBozUnM.exe
2400	DygnOBH.exe
4992	dvwwzpK.exe
3648	tUxrZGf.exe
3592	WsHoRBR.exe
3944	AxexQBI.exe
3644	BuSsTHn.exe
2668	oovXBFD.exe
5060	WEIWkhf.exe
1020	QeCOgVa.exe
2156	GEqCUSF.exe
1540	OZnVqiB.exe
4176	wbuASNh.exe
3048	xKCWgMp.exe
2924	nqZZLNh.exe
3736	QFlLyfh.exe
2272	SqCPSpu.exe
3528	feJUqNQ.exe
1276	yzDJasR.exe
1528	MfSIQHx.exe
3776	idfbwIH.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2744-0-0x00007FF6CD680000-0x00007FF6CD9D4000-memory.dmp	upx
behavioral2/files/0x00080000000233c6-4.dat	upx
behavioral2/files/0x00070000000233c7-9.dat	upx
behavioral2/files/0x00070000000233c8-11.dat	upx
behavioral2/files/0x00070000000233c9-20.dat	upx
behavioral2/files/0x00070000000233ca-31.dat	upx
behavioral2/files/0x00070000000233cd-41.dat	upx
behavioral2/files/0x00070000000233ce-44.dat	upx
behavioral2/files/0x00070000000233d0-49.dat	upx
behavioral2/memory/5060-65-0x00007FF7CA490000-0x00007FF7CA7E4000-memory.dmp	upx
behavioral2/files/0x00070000000233cf-72.dat	upx
behavioral2/memory/1020-82-0x00007FF7D83D0000-0x00007FF7D8724000-memory.dmp	upx
behavioral2/files/0x00070000000233d7-102.dat	upx
behavioral2/files/0x00070000000233d9-115.dat	upx
behavioral2/memory/2272-124-0x00007FF635CB0000-0x00007FF636004000-memory.dmp	upx
behavioral2/memory/1528-127-0x00007FF7D3D30000-0x00007FF7D4084000-memory.dmp	upx
behavioral2/memory/3776-126-0x00007FF7EDC80000-0x00007FF7EDFD4000-memory.dmp	upx
behavioral2/memory/1276-125-0x00007FF639360000-0x00007FF6396B4000-memory.dmp	upx
behavioral2/files/0x00070000000233d8-120.dat	upx
behavioral2/memory/3736-119-0x00007FF7CD590000-0x00007FF7CD8E4000-memory.dmp	upx
behavioral2/memory/4176-116-0x00007FF6308F0000-0x00007FF630C44000-memory.dmp	upx
behavioral2/memory/3528-113-0x00007FF6B2B50000-0x00007FF6B2EA4000-memory.dmp	upx
behavioral2/files/0x00070000000233d4-111.dat	upx
behavioral2/files/0x00070000000233d6-109.dat	upx
behavioral2/files/0x00070000000233d5-106.dat	upx
behavioral2/files/0x00070000000233d2-100.dat	upx
behavioral2/memory/2924-99-0x00007FF79D900000-0x00007FF79DC54000-memory.dmp	upx
behavioral2/files/0x00070000000233d3-97.dat	upx
behavioral2/files/0x00080000000233c4-95.dat	upx
behavioral2/memory/3048-91-0x00007FF683120000-0x00007FF683474000-memory.dmp	upx
behavioral2/memory/2156-89-0x00007FF630990000-0x00007FF630CE4000-memory.dmp	upx
behavioral2/files/0x00070000000233d1-78.dat	upx
behavioral2/memory/1540-75-0x00007FF6BB3A0000-0x00007FF6BB6F4000-memory.dmp	upx
behavioral2/files/0x00070000000233cc-61.dat	upx
behavioral2/memory/2668-57-0x00007FF6EA010000-0x00007FF6EA364000-memory.dmp	upx
behavioral2/files/0x00070000000233cb-54.dat	upx
behavioral2/memory/3644-53-0x00007FF6BBE30000-0x00007FF6BC184000-memory.dmp	upx
behavioral2/memory/3944-48-0x00007FF7D20E0000-0x00007FF7D2434000-memory.dmp	upx
behavioral2/memory/3592-27-0x00007FF60F680000-0x00007FF60F9D4000-memory.dmp	upx
behavioral2/memory/3648-23-0x00007FF7233D0000-0x00007FF723724000-memory.dmp	upx
behavioral2/memory/4992-22-0x00007FF6D3DE0000-0x00007FF6D4134000-memory.dmp	upx
behavioral2/memory/2400-18-0x00007FF644490000-0x00007FF6447E4000-memory.dmp	upx
behavioral2/memory/4644-10-0x00007FF7398D0000-0x00007FF739C24000-memory.dmp	upx
behavioral2/memory/2744-128-0x00007FF6CD680000-0x00007FF6CD9D4000-memory.dmp	upx
behavioral2/memory/4644-129-0x00007FF7398D0000-0x00007FF739C24000-memory.dmp	upx
behavioral2/memory/2400-130-0x00007FF644490000-0x00007FF6447E4000-memory.dmp	upx
behavioral2/memory/4992-131-0x00007FF6D3DE0000-0x00007FF6D4134000-memory.dmp	upx
behavioral2/memory/3648-132-0x00007FF7233D0000-0x00007FF723724000-memory.dmp	upx
behavioral2/memory/3592-133-0x00007FF60F680000-0x00007FF60F9D4000-memory.dmp	upx
behavioral2/memory/3644-134-0x00007FF6BBE30000-0x00007FF6BC184000-memory.dmp	upx
behavioral2/memory/2668-135-0x00007FF6EA010000-0x00007FF6EA364000-memory.dmp	upx
behavioral2/memory/3944-136-0x00007FF7D20E0000-0x00007FF7D2434000-memory.dmp	upx
behavioral2/memory/5060-137-0x00007FF7CA490000-0x00007FF7CA7E4000-memory.dmp	upx
behavioral2/memory/3048-139-0x00007FF683120000-0x00007FF683474000-memory.dmp	upx
behavioral2/memory/1540-138-0x00007FF6BB3A0000-0x00007FF6BB6F4000-memory.dmp	upx
behavioral2/memory/4644-140-0x00007FF7398D0000-0x00007FF739C24000-memory.dmp	upx
behavioral2/memory/2400-141-0x00007FF644490000-0x00007FF6447E4000-memory.dmp	upx
behavioral2/memory/4992-142-0x00007FF6D3DE0000-0x00007FF6D4134000-memory.dmp	upx
behavioral2/memory/3592-144-0x00007FF60F680000-0x00007FF60F9D4000-memory.dmp	upx
behavioral2/memory/3648-143-0x00007FF7233D0000-0x00007FF723724000-memory.dmp	upx
behavioral2/memory/3944-145-0x00007FF7D20E0000-0x00007FF7D2434000-memory.dmp	upx
behavioral2/memory/5060-146-0x00007FF7CA490000-0x00007FF7CA7E4000-memory.dmp	upx
behavioral2/memory/3644-147-0x00007FF6BBE30000-0x00007FF6BC184000-memory.dmp	upx
behavioral2/memory/2668-149-0x00007FF6EA010000-0x00007FF6EA364000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\yzDJasR.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WEIWkhf.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SqCPSpu.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oovXBFD.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QFlLyfh.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MfSIQHx.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\idfbwIH.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WsHoRBR.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BuSsTHn.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GEqCUSF.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QeCOgVa.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OZnVqiB.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xKCWgMp.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\feJUqNQ.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HBozUnM.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AxexQBI.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tUxrZGf.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wbuASNh.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nqZZLNh.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DygnOBH.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dvwwzpK.exe	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 4644	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	83
PID 2744 wrote to memory of 4644	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	83
PID 2744 wrote to memory of 2400	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	84
PID 2744 wrote to memory of 2400	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	84
PID 2744 wrote to memory of 4992	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	85
PID 2744 wrote to memory of 4992	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	85
PID 2744 wrote to memory of 3648	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	86
PID 2744 wrote to memory of 3648	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	86
PID 2744 wrote to memory of 3592	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	87
PID 2744 wrote to memory of 3592	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	87
PID 2744 wrote to memory of 3944	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	88
PID 2744 wrote to memory of 3944	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	88
PID 2744 wrote to memory of 3644	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	89
PID 2744 wrote to memory of 3644	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	89
PID 2744 wrote to memory of 2668	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	90
PID 2744 wrote to memory of 2668	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	90
PID 2744 wrote to memory of 5060	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	91
PID 2744 wrote to memory of 5060	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	91
PID 2744 wrote to memory of 2156	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	92
PID 2744 wrote to memory of 2156	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	92
PID 2744 wrote to memory of 1020	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	93
PID 2744 wrote to memory of 1020	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	93
PID 2744 wrote to memory of 1540	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	94
PID 2744 wrote to memory of 1540	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	94
PID 2744 wrote to memory of 4176	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	95
PID 2744 wrote to memory of 4176	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	95
PID 2744 wrote to memory of 3048	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	96
PID 2744 wrote to memory of 3048	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	96
PID 2744 wrote to memory of 2924	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	97
PID 2744 wrote to memory of 2924	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	97
PID 2744 wrote to memory of 3736	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	98
PID 2744 wrote to memory of 3736	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	98
PID 2744 wrote to memory of 2272	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	99
PID 2744 wrote to memory of 2272	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	99
PID 2744 wrote to memory of 3528	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	100
PID 2744 wrote to memory of 3528	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	100
PID 2744 wrote to memory of 1276	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	101
PID 2744 wrote to memory of 1276	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	101
PID 2744 wrote to memory of 1528	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	102
PID 2744 wrote to memory of 1528	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	102
PID 2744 wrote to memory of 3776	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	103
PID 2744 wrote to memory of 3776	2744	2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe	103

C:\Users\Admin\AppData\Local\Temp\2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-28_6e1251df6fa3529aa618dba5055ad4f7_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\System\HBozUnM.exe
  C:\Windows\System\HBozUnM.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\DygnOBH.exe
  C:\Windows\System\DygnOBH.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\dvwwzpK.exe
  C:\Windows\System\dvwwzpK.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\tUxrZGf.exe
  C:\Windows\System\tUxrZGf.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\WsHoRBR.exe
  C:\Windows\System\WsHoRBR.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\AxexQBI.exe
  C:\Windows\System\AxexQBI.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\BuSsTHn.exe
  C:\Windows\System\BuSsTHn.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\oovXBFD.exe
  C:\Windows\System\oovXBFD.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\WEIWkhf.exe
  C:\Windows\System\WEIWkhf.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\GEqCUSF.exe
  C:\Windows\System\GEqCUSF.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\QeCOgVa.exe
  C:\Windows\System\QeCOgVa.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\OZnVqiB.exe
  C:\Windows\System\OZnVqiB.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\wbuASNh.exe
  C:\Windows\System\wbuASNh.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\xKCWgMp.exe
  C:\Windows\System\xKCWgMp.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\nqZZLNh.exe
  C:\Windows\System\nqZZLNh.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\QFlLyfh.exe
  C:\Windows\System\QFlLyfh.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\SqCPSpu.exe
  C:\Windows\System\SqCPSpu.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\feJUqNQ.exe
  C:\Windows\System\feJUqNQ.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\yzDJasR.exe
  C:\Windows\System\yzDJasR.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\MfSIQHx.exe
  C:\Windows\System\MfSIQHx.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\idfbwIH.exe
  C:\Windows\System\idfbwIH.exe
  2⤵
  - Executes dropped EXE
  PID:3776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AxexQBI.exe

Path C:\Windows\System\AxexQBI.exe
Size 5.9MB
SHA256 963f2fdf9c86ce94f6ffccabdf59627c974ed4fe43aa56affd99cd88dc5b3379
MD5 4c115d874245daf4122e1fcfd68e69c8
SHA1 5034abd4f33f0ce0c39019240eb1dadd85c1f9af
SHA512 37996f90b996401bf991fd708e4e59d2715f4f18fac65628e0c9f062caa6a39986e34e74f75427d26f7f3fbfa1cdab08d6fdd9e17585a240cc9718fd6efb05e3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

BuSsTHn.exe

Path C:\Windows\System\BuSsTHn.exe
Size 5.9MB
SHA256 6341a69c09a8c3f594a843c25c42eb4e59098ca1029bd2e4593c10246bb03eee
MD5 2dcb138d354fc6465ecabdeabb390ab2
SHA1 d1720925c96c4f612eff0bf26c2ae8e7e04bbc02
SHA512 6c52c8299d4776b3087c2636aed69149bf5ad09b20dc30a4b8ec0f73f5855aa4daffbe0e3310bd2e19468029c4daa0bca62e908152f16ca790ea8b87eae434b2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

DygnOBH.exe

Path C:\Windows\System\DygnOBH.exe
Size 5.9MB
SHA256 8e968f7f346114b9f61467ddcf2e63137bf6590724928f72d149dc6c6ce3dd26
MD5 bb0b5c80eec5d37d1fbb38d814a08211
SHA1 8b0fe2417511b3ec15f4edffd938ab9c806aaebe
SHA512 fe160f7d70b5c6286facc0b8b149afcda7aef5ebf66ed015c660f9b83e197c36d05f08a199ce9afc5c60cad77456d7e7d21478db9812ac3d862768e9535ea8b7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

GEqCUSF.exe

Path C:\Windows\System\GEqCUSF.exe
Size 5.9MB
SHA256 fefa4e3b3b4c121a29b2a12af81a4793246dd7c66e6c899b49e4856b6c50a141
MD5 a08ec261386cf799ae4805d4862bfd36
SHA1 825d2a507691b7de440bbf806f6a054b5e31f7e0
SHA512 1a12a096301968af6e7d3ec93d7c2d3d86d8208354d091488d8ed337470101f85734466d8ddd42a238f12dc8389b7b1447936a5f0595c80d0683fc26962aea84
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

HBozUnM.exe

Path C:\Windows\System\HBozUnM.exe
Size 5.9MB
SHA256 78796f0d3e8534ae1cd65bf9722ec18f45509343b682d1c28470323098f8e29b
MD5 c8108b1a70608715666dde03f2b4d403
SHA1 93242ef6fbef363b66e696a74333bced6d331f9a
SHA512 f064d08338b7fd7fc6f885909a3b2b99b7bf8ca7c140ae3c0db75199cf5e156018b0da75adcfb1f2cc8f0dd5dbbac19fe0bca4cb13014852a8921704dc1c96c4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:Q+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

MfSIQHx.exe

Path C:\Windows\System\MfSIQHx.exe
Size 5.9MB
SHA256 9fc1917610bf55246ea24e02393454e17769ea69e2d00ae06e083bc988849bb3
MD5 61ddcbcf11977cd0ba513b87fb26b39c
SHA1 807ad2c91429dac0d4fa6ff477be43ee3de5ce07
SHA512 60f8508642666ff46922eb792dda4b3a0707c0a31126c3626c04637126b8600f9a691569f3b16c5870edf6a61087c756e287ab2b93db1538cb1c25748eba9071
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

OZnVqiB.exe

Path C:\Windows\System\OZnVqiB.exe
Size 5.9MB
SHA256 dc5072dd03a2d279dfa127b3fe573c1f9759c2ef09c04506acd9d255ba0febb0
MD5 7f83a4e7839c89a3ce45dd950b7940f4
SHA1 7fdba6ffebffb22457a353fd05517ab5699412a9
SHA512 fcb569c67d059d357d3665117fc95d7c32bf540f696a5e425945409bfc2f645bc17efbc1036e54527104c8280d9e62885a0e69acfd9adcb7a7827d1c6195ecba
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:Q+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

QFlLyfh.exe

Path C:\Windows\System\QFlLyfh.exe
Size 5.9MB
SHA256 4d51496eedd20c3f2fee65b76540962ec4182ba28a38f8324bec176540993278
MD5 f28664917b1a532f14d45881464721f9
SHA1 05ccf77af8616e2d133ff35e4b3fddb87ac5cfbe
SHA512 e95b575526a5e0e5f16bfe50372b621c3291c7bb6e78213b26999cf688a351cc38677e7fefcb0bc481a16aafec142ffeb690d843fcbb112fbb53faaac418b486
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

QeCOgVa.exe

Path C:\Windows\System\QeCOgVa.exe
Size 5.9MB
SHA256 254153b6b3825ba3fe7c3b4f40a1503b1f0e799257d94739eb24153c0313f603
MD5 9c3823ae3fe64071b9e4764439d1a79c
SHA1 72a2d970f38fb268337e8574ba5b6aa3ffd1cfc7
SHA512 1ffc3237570030c9086e342e5dad21fb35517135deb44dff6f628f68b903152fa456200bf4c0eea4e19ede1dff51d17aab624f53f073aa9d17f7e97500e13ddf
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

SqCPSpu.exe

Path C:\Windows\System\SqCPSpu.exe
Size 5.9MB
SHA256 06c35b345e835ba386af8d00ab6bad33c8ca8f642d4ed6511252aa93dfcf0559
MD5 929ea57babfc607efd5bc06db1a307da
SHA1 38098b69afdaaf64578d02cf64666f76ff4f0d42
SHA512 a08eea6461acab531b234ab3af48f3f7c0675c16543cd4e96af2ccb06d15b1c15b82710ea917debff12a607f85462c24578411cf89b9fdd6b34a038d6d5fde3b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

WEIWkhf.exe

Path C:\Windows\System\WEIWkhf.exe
Size 5.9MB
SHA256 ea21cd692525a1c5008b9b427ed51d0bcad8976a736d1a59a9c227c15cbdcb8b
MD5 7dda26545960e2fa2f2b6b3e152e14ea
SHA1 db61609411e05eed0d1d2a28c31df36257aaeb24
SHA512 cce752b5dbfe92d78fa396ee82f7c9919f7d13f8dbd82a990171047b8298578046c25be9d798fa805a4a185b7c5851bef6e20de0cb00e21725e47de39979063a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

WsHoRBR.exe

Path C:\Windows\System\WsHoRBR.exe
Size 5.9MB
SHA256 92dde5fc125e477f0d02d31af6e0dea5840b403c9eb18c96f38243ba83111675
MD5 92dc33d784cf9f5dab4c123d0ab94194
SHA1 2d4fe5a5a8f712b91db4bd3cb5a9c2497b157c8c
SHA512 a480f482880b8e193635ba17360a71b945fd6914f5c849ed0b01297f3a2b66b133e7426210b087805a68e0357be08139b3ee8cc9efb7b7d87bbffc392f51b1a8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

dvwwzpK.exe

Path C:\Windows\System\dvwwzpK.exe
Size 5.9MB
SHA256 741bd387db375a0fda19abefdb037783947563729c63001bbc9f49ea2959bcfb
MD5 6bd26b76b3875f60ef2b72971dd7661c
SHA1 6993531d9a92cd3692918b4810d54d3a2bd66127
SHA512 3edb99ad37020054413ba997cb6bd1d6f16644d5587181e0ada57855faae77783a78bdc1e2e3155794064ee4442af7937593c5b8fd70f818d7e15691862353a9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

feJUqNQ.exe

Path C:\Windows\System\feJUqNQ.exe
Size 5.9MB
SHA256 8c8e5a180e0dee0df53e203c25da8b213c0575ca228322be0dd7a12d07a4e4bd
MD5 1d28d8facae698f75def7225d594ddec
SHA1 d3cd2e1cb53b8842c6cd0206c1598b606c5f1d9a
SHA512 d5890892bf2e3abc255d721e37eb182ecf3468c8089244e17e8b9f488323a428fac08dcc83222e43946d7a1b777cf964cd5c383ebd522e1b1dc195f619fbda22
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

idfbwIH.exe

Path C:\Windows\System\idfbwIH.exe
Size 5.9MB
SHA256 68e9c12b5c1a11fd1487f76cea31938e1c90f3d2d86166bcdd8f06a61da23523
MD5 281334b0dc5f57eff14d8cd4b7073595
SHA1 0294b56e8c5ddb9cbe35f6187b71e965a26b0d24
SHA512 2c53fe1de22a9dfdde929a47cb5ab98db0e00b35b43e0f6427feade42d91e9fcbf78ffba06e0f3f53ecf3dcc020e97a5eb0a6730c549a96c757e6070c292a4be
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

nqZZLNh.exe

Path C:\Windows\System\nqZZLNh.exe
Size 5.9MB
SHA256 f4ec2dfb67edd9dfdfecd6362a8a63c0805bd41507a3a5b38e166cec2d837572
MD5 0b3561bd04868d0ef525be6bb8668c5c
SHA1 3d8ddbff19cd44caed3744cf2f56d4b4352b2e9a
SHA512 bf0c0d7db9cbf8024d5f199e3530285e4a838805aa4f1e22d3d324acf38ebdc3f4ec44ffda59e0e308762cbdd2ea722830bdde44e90410974bb014ad355d5323
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

oovXBFD.exe

Path C:\Windows\System\oovXBFD.exe
Size 5.9MB
SHA256 d8797bceee4e92c71c73cbf04d2962b9745a69178a366c7fbfa45f9e7ef8417d
MD5 ba12db56809ab9e806a8134a3b43bce1
SHA1 8f7651e6ebeb49f6231e9b1f4b034b7ecdee97af
SHA512 6002af19c2346b23a71955be1ed7e89816aabbf914a4198fc4dd07a352c9fe9771da18145675afaaced39eec21051d4a741a8a2cac3e55a33030be345b8e2471
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

tUxrZGf.exe

Path C:\Windows\System\tUxrZGf.exe
Size 5.9MB
SHA256 e9256087708d1481022d0d32eb7de696ca6066571f07a86fc9b45c5b75a1af06
MD5 24441e3bd46a44990f916f27ec145395
SHA1 8c875f5f6c173fac4b0ba110e804c8c3389945ab
SHA512 53de381d568329769d5ab450767aecfa4db210068142e89a2e43cdb6e8bd50d9697faf469f4890de99219e84114a3ed6161c67c6ccd87947b7787a8a5bc5f17a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbuASNh.exe

Path C:\Windows\System\wbuASNh.exe
Size 5.9MB
SHA256 9234ed04b1e086e5a03003657a5c29407f73090ce06e5abe4ab3533f7fea8f8c
MD5 221c810b00dbb8f99d88f48a8431227c
SHA1 0d96551ca92b5c3ca1dd9a032c304d7eed697048
SHA512 622b8d25e56361668de37989f7282fb9738956b00de2c7399bf79a7ec12e6d56b1f6088a92d1c74ad9b3d1912ef1ec049d42aaf0c52b0c7bc9e37d38eefee7cd
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

xKCWgMp.exe

Path C:\Windows\System\xKCWgMp.exe
Size 5.9MB
SHA256 d622257e85f828a34551d899cba05010fe6d0e758b43f8cd7f4f7a65b6b7fa04
MD5 019630c36a730400ad934ea541adc639
SHA1 75a10c59c01fa7c4c8933cd26c82e2e49aefa4a8
SHA512 b85169f9647345ada59106f66e2dc62ea9a906585125a42b3b2faf9227698aed623a5c3fb3403de7503e558b765d45712f64ecae1deb20503cc44e5d81438485
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

yzDJasR.exe

Path C:\Windows\System\yzDJasR.exe
Size 5.9MB
SHA256 b4e0c7def7776d104b1203209b2452a75fc035792378b3d343d13802f45e41f4
MD5 853ad0e6c7f8255bf501d4cee710bf51
SHA1 ce78c70c02550e2cd0ff39d3a653fccc11548530
SHA512 82d75348c904e85159b5ba39bfe02814ad19da742622d7ff36fc329bf7082cbbde0347dd4d79ce45d7b154ad099091f9e6c9bfbd14383ad6b14ce29f08e41256
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1020-148-0x00007FF7D83D0000-0x00007FF7D8724000-memory.dmp

Download

memory/1020-82-0x00007FF7D83D0000-0x00007FF7D8724000-memory.dmp

Download

memory/1276-125-0x00007FF639360000-0x00007FF6396B4000-memory.dmp

Download

memory/1276-153-0x00007FF639360000-0x00007FF6396B4000-memory.dmp

Download

memory/1528-150-0x00007FF7D3D30000-0x00007FF7D4084000-memory.dmp

Download

memory/1528-127-0x00007FF7D3D30000-0x00007FF7D4084000-memory.dmp

Download

memory/1540-158-0x00007FF6BB3A0000-0x00007FF6BB6F4000-memory.dmp

Download

memory/1540-138-0x00007FF6BB3A0000-0x00007FF6BB6F4000-memory.dmp

Download

memory/1540-75-0x00007FF6BB3A0000-0x00007FF6BB6F4000-memory.dmp

Download

memory/2156-159-0x00007FF630990000-0x00007FF630CE4000-memory.dmp

Download

memory/2156-89-0x00007FF630990000-0x00007FF630CE4000-memory.dmp

Download

memory/2272-156-0x00007FF635CB0000-0x00007FF636004000-memory.dmp

Download

memory/2272-124-0x00007FF635CB0000-0x00007FF636004000-memory.dmp

Download

memory/2400-141-0x00007FF644490000-0x00007FF6447E4000-memory.dmp

Download

memory/2400-130-0x00007FF644490000-0x00007FF6447E4000-memory.dmp

Download

memory/2400-18-0x00007FF644490000-0x00007FF6447E4000-memory.dmp

Download

memory/2668-57-0x00007FF6EA010000-0x00007FF6EA364000-memory.dmp

Download

memory/2668-149-0x00007FF6EA010000-0x00007FF6EA364000-memory.dmp

Download

memory/2668-135-0x00007FF6EA010000-0x00007FF6EA364000-memory.dmp

Download

memory/2744-0-0x00007FF6CD680000-0x00007FF6CD9D4000-memory.dmp

Download

memory/2744-1-0x000001DD37BA0000-0x000001DD37BB0000-memory.dmp

Download

memory/2744-128-0x00007FF6CD680000-0x00007FF6CD9D4000-memory.dmp

Download

memory/2924-99-0x00007FF79D900000-0x00007FF79DC54000-memory.dmp

Download

memory/2924-151-0x00007FF79D900000-0x00007FF79DC54000-memory.dmp

Download

memory/3048-157-0x00007FF683120000-0x00007FF683474000-memory.dmp

Download

memory/3048-91-0x00007FF683120000-0x00007FF683474000-memory.dmp

Download

memory/3048-139-0x00007FF683120000-0x00007FF683474000-memory.dmp

Download

memory/3528-154-0x00007FF6B2B50000-0x00007FF6B2EA4000-memory.dmp

Download

memory/3528-113-0x00007FF6B2B50000-0x00007FF6B2EA4000-memory.dmp

Download

memory/3592-27-0x00007FF60F680000-0x00007FF60F9D4000-memory.dmp

Download

memory/3592-144-0x00007FF60F680000-0x00007FF60F9D4000-memory.dmp

Download

memory/3592-133-0x00007FF60F680000-0x00007FF60F9D4000-memory.dmp

Download

memory/3644-53-0x00007FF6BBE30000-0x00007FF6BC184000-memory.dmp

Download

memory/3644-147-0x00007FF6BBE30000-0x00007FF6BC184000-memory.dmp

Download

memory/3644-134-0x00007FF6BBE30000-0x00007FF6BC184000-memory.dmp

Download

memory/3648-23-0x00007FF7233D0000-0x00007FF723724000-memory.dmp

Download

memory/3648-132-0x00007FF7233D0000-0x00007FF723724000-memory.dmp

Download

memory/3648-143-0x00007FF7233D0000-0x00007FF723724000-memory.dmp

Download

memory/3736-119-0x00007FF7CD590000-0x00007FF7CD8E4000-memory.dmp

Download

memory/3736-155-0x00007FF7CD590000-0x00007FF7CD8E4000-memory.dmp

Download

memory/3776-160-0x00007FF7EDC80000-0x00007FF7EDFD4000-memory.dmp

Download

memory/3776-126-0x00007FF7EDC80000-0x00007FF7EDFD4000-memory.dmp

Download

memory/3944-48-0x00007FF7D20E0000-0x00007FF7D2434000-memory.dmp

Download

memory/3944-145-0x00007FF7D20E0000-0x00007FF7D2434000-memory.dmp

Download

memory/3944-136-0x00007FF7D20E0000-0x00007FF7D2434000-memory.dmp

Download

memory/4176-152-0x00007FF6308F0000-0x00007FF630C44000-memory.dmp

Download

memory/4176-116-0x00007FF6308F0000-0x00007FF630C44000-memory.dmp

Download

memory/4644-129-0x00007FF7398D0000-0x00007FF739C24000-memory.dmp

Download

memory/4644-10-0x00007FF7398D0000-0x00007FF739C24000-memory.dmp

Download

memory/4644-140-0x00007FF7398D0000-0x00007FF739C24000-memory.dmp

Download

memory/4992-142-0x00007FF6D3DE0000-0x00007FF6D4134000-memory.dmp

Download

memory/4992-22-0x00007FF6D3DE0000-0x00007FF6D4134000-memory.dmp

Download

memory/4992-131-0x00007FF6D3DE0000-0x00007FF6D4134000-memory.dmp

Download

memory/5060-137-0x00007FF7CA490000-0x00007FF7CA7E4000-memory.dmp

Download

memory/5060-146-0x00007FF7CA490000-0x00007FF7CA7E4000-memory.dmp

Download

memory/5060-65-0x00007FF7CA490000-0x00007FF7CA7E4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads