cobaltstrike | 135e9249063156762d926a14e2966b308fa5e9b7a3f82d5be77a7f815ac3e795

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 00:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240528-ataedsff81
SHA256 135e9249063156762d926a14e2966b308fa5e9b7a3f82d5be77a7f815ac3e795
MD5 237e1a2bb744a42e323d3f2ad95ad731
SHA1 08e80a759b02b7c8a9004b08fe9fb5af04b47301
SHA512 3e9552e674139568c347353002e846acdcda1cffb952abfd5ed3d2894680c017dff2f520f9033943e0644a0f5b7568e82bb42c2d92316e28b6a453c2bfa3caa7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000900000002340c-5.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023414-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023413-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-36.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023419-46.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341a-51.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341c-65.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341b-62.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023418-44.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023416-32.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023415-24.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341d-71.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341e-77.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341f-79.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023420-89.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023421-99.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023422-101.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023424-111.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023425-121.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023426-124.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023423-118.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000900000002340c-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023414-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023413-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023419-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341a-51.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341c-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341b-62.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023418-44.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023416-32.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023415-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341d-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341e-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341f-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023420-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023421-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023422-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023424-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023425-121.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023426-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023423-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4504-0-0x00007FF78A540000-0x00007FF78A894000-memory.dmp	UPX
behavioral2/files/0x000900000002340c-5.dat	UPX
behavioral2/memory/4532-8-0x00007FF7221D0000-0x00007FF722524000-memory.dmp	UPX
behavioral2/files/0x0007000000023414-11.dat	UPX
behavioral2/files/0x0007000000023413-10.dat	UPX
behavioral2/memory/4076-23-0x00007FF7F6760000-0x00007FF7F6AB4000-memory.dmp	UPX
behavioral2/memory/4100-26-0x00007FF736E00000-0x00007FF737154000-memory.dmp	UPX
behavioral2/files/0x0007000000023417-36.dat	UPX
behavioral2/files/0x0007000000023419-46.dat	UPX
behavioral2/files/0x000700000002341a-51.dat	UPX
behavioral2/memory/1556-59-0x00007FF7A1280000-0x00007FF7A15D4000-memory.dmp	UPX
behavioral2/memory/3312-64-0x00007FF6EB7E0000-0x00007FF6EBB34000-memory.dmp	UPX
behavioral2/memory/5108-68-0x00007FF72F210000-0x00007FF72F564000-memory.dmp	UPX
behavioral2/memory/5044-67-0x00007FF773C80000-0x00007FF773FD4000-memory.dmp	UPX
behavioral2/files/0x000700000002341c-65.dat	UPX
behavioral2/files/0x000700000002341b-62.dat	UPX
behavioral2/memory/1468-58-0x00007FF66B630000-0x00007FF66B984000-memory.dmp	UPX
behavioral2/memory/3300-55-0x00007FF63BF00000-0x00007FF63C254000-memory.dmp	UPX
behavioral2/files/0x0007000000023418-44.dat	UPX
behavioral2/memory/2300-38-0x00007FF6A96C0000-0x00007FF6A9A14000-memory.dmp	UPX
behavioral2/files/0x0007000000023416-32.dat	UPX
behavioral2/files/0x0007000000023415-24.dat	UPX
behavioral2/memory/4344-15-0x00007FF642FB0000-0x00007FF643304000-memory.dmp	UPX
behavioral2/files/0x000700000002341d-71.dat	UPX
behavioral2/files/0x000700000002341e-77.dat	UPX
behavioral2/files/0x000700000002341f-79.dat	UPX
behavioral2/files/0x0007000000023420-89.dat	UPX
behavioral2/memory/1944-91-0x00007FF6F75A0000-0x00007FF6F78F4000-memory.dmp	UPX
behavioral2/files/0x0007000000023421-99.dat	UPX
behavioral2/files/0x0007000000023422-101.dat	UPX
behavioral2/files/0x0007000000023424-111.dat	UPX
behavioral2/memory/4596-116-0x00007FF66B3C0000-0x00007FF66B714000-memory.dmp	UPX
behavioral2/files/0x0007000000023425-121.dat	UPX
behavioral2/memory/2300-126-0x00007FF6A96C0000-0x00007FF6A9A14000-memory.dmp	UPX
behavioral2/memory/3544-128-0x00007FF664120000-0x00007FF664474000-memory.dmp	UPX
behavioral2/memory/4100-127-0x00007FF736E00000-0x00007FF737154000-memory.dmp	UPX
behavioral2/memory/4336-125-0x00007FF6C9910000-0x00007FF6C9C64000-memory.dmp	UPX
behavioral2/files/0x0007000000023426-124.dat	UPX
behavioral2/files/0x0007000000023423-118.dat	UPX
behavioral2/memory/1136-117-0x00007FF6F4460000-0x00007FF6F47B4000-memory.dmp	UPX
behavioral2/memory/4344-113-0x00007FF642FB0000-0x00007FF643304000-memory.dmp	UPX
behavioral2/memory/1076-112-0x00007FF670A60000-0x00007FF670DB4000-memory.dmp	UPX
behavioral2/memory/4076-108-0x00007FF7F6760000-0x00007FF7F6AB4000-memory.dmp	UPX
behavioral2/memory/876-104-0x00007FF669320000-0x00007FF669674000-memory.dmp	UPX
behavioral2/memory/4504-98-0x00007FF78A540000-0x00007FF78A894000-memory.dmp	UPX
behavioral2/memory/5104-88-0x00007FF739650000-0x00007FF7399A4000-memory.dmp	UPX
behavioral2/memory/3088-87-0x00007FF6BFE10000-0x00007FF6C0164000-memory.dmp	UPX
behavioral2/memory/4436-76-0x00007FF668950000-0x00007FF668CA4000-memory.dmp	UPX
behavioral2/memory/1556-133-0x00007FF7A1280000-0x00007FF7A15D4000-memory.dmp	UPX
behavioral2/memory/3312-134-0x00007FF6EB7E0000-0x00007FF6EBB34000-memory.dmp	UPX
behavioral2/memory/4436-135-0x00007FF668950000-0x00007FF668CA4000-memory.dmp	UPX
behavioral2/memory/1944-136-0x00007FF6F75A0000-0x00007FF6F78F4000-memory.dmp	UPX
behavioral2/memory/1076-137-0x00007FF670A60000-0x00007FF670DB4000-memory.dmp	UPX
behavioral2/memory/4596-138-0x00007FF66B3C0000-0x00007FF66B714000-memory.dmp	UPX
behavioral2/memory/1136-139-0x00007FF6F4460000-0x00007FF6F47B4000-memory.dmp	UPX
behavioral2/memory/3544-140-0x00007FF664120000-0x00007FF664474000-memory.dmp	UPX
behavioral2/memory/4532-141-0x00007FF7221D0000-0x00007FF722524000-memory.dmp	UPX
behavioral2/memory/4344-142-0x00007FF642FB0000-0x00007FF643304000-memory.dmp	UPX
behavioral2/memory/4076-143-0x00007FF7F6760000-0x00007FF7F6AB4000-memory.dmp	UPX
behavioral2/memory/4100-144-0x00007FF736E00000-0x00007FF737154000-memory.dmp	UPX
behavioral2/memory/3300-146-0x00007FF63BF00000-0x00007FF63C254000-memory.dmp	UPX
behavioral2/memory/1468-145-0x00007FF66B630000-0x00007FF66B984000-memory.dmp	UPX
behavioral2/memory/2300-148-0x00007FF6A96C0000-0x00007FF6A9A14000-memory.dmp	UPX
behavioral2/memory/5044-147-0x00007FF773C80000-0x00007FF773FD4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4504-0-0x00007FF78A540000-0x00007FF78A894000-memory.dmp	xmrig
behavioral2/files/0x000900000002340c-5.dat	xmrig
behavioral2/memory/4532-8-0x00007FF7221D0000-0x00007FF722524000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-11.dat	xmrig
behavioral2/files/0x0007000000023413-10.dat	xmrig
behavioral2/memory/4076-23-0x00007FF7F6760000-0x00007FF7F6AB4000-memory.dmp	xmrig
behavioral2/memory/4100-26-0x00007FF736E00000-0x00007FF737154000-memory.dmp	xmrig
behavioral2/files/0x0007000000023417-36.dat	xmrig
behavioral2/files/0x0007000000023419-46.dat	xmrig
behavioral2/files/0x000700000002341a-51.dat	xmrig
behavioral2/memory/1556-59-0x00007FF7A1280000-0x00007FF7A15D4000-memory.dmp	xmrig
behavioral2/memory/3312-64-0x00007FF6EB7E0000-0x00007FF6EBB34000-memory.dmp	xmrig
behavioral2/memory/5108-68-0x00007FF72F210000-0x00007FF72F564000-memory.dmp	xmrig
behavioral2/memory/5044-67-0x00007FF773C80000-0x00007FF773FD4000-memory.dmp	xmrig
behavioral2/files/0x000700000002341c-65.dat	xmrig
behavioral2/files/0x000700000002341b-62.dat	xmrig
behavioral2/memory/1468-58-0x00007FF66B630000-0x00007FF66B984000-memory.dmp	xmrig
behavioral2/memory/3300-55-0x00007FF63BF00000-0x00007FF63C254000-memory.dmp	xmrig
behavioral2/files/0x0007000000023418-44.dat	xmrig
behavioral2/memory/2300-38-0x00007FF6A96C0000-0x00007FF6A9A14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023416-32.dat	xmrig
behavioral2/files/0x0007000000023415-24.dat	xmrig
behavioral2/memory/4344-15-0x00007FF642FB0000-0x00007FF643304000-memory.dmp	xmrig
behavioral2/files/0x000700000002341d-71.dat	xmrig
behavioral2/files/0x000700000002341e-77.dat	xmrig
behavioral2/files/0x000700000002341f-79.dat	xmrig
behavioral2/files/0x0007000000023420-89.dat	xmrig
behavioral2/memory/1944-91-0x00007FF6F75A0000-0x00007FF6F78F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023421-99.dat	xmrig
behavioral2/files/0x0007000000023422-101.dat	xmrig
behavioral2/files/0x0007000000023424-111.dat	xmrig
behavioral2/memory/4596-116-0x00007FF66B3C0000-0x00007FF66B714000-memory.dmp	xmrig
behavioral2/files/0x0007000000023425-121.dat	xmrig
behavioral2/memory/2300-126-0x00007FF6A96C0000-0x00007FF6A9A14000-memory.dmp	xmrig
behavioral2/memory/3544-128-0x00007FF664120000-0x00007FF664474000-memory.dmp	xmrig
behavioral2/memory/4100-127-0x00007FF736E00000-0x00007FF737154000-memory.dmp	xmrig
behavioral2/memory/4336-125-0x00007FF6C9910000-0x00007FF6C9C64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023426-124.dat	xmrig
behavioral2/files/0x0007000000023423-118.dat	xmrig
behavioral2/memory/1136-117-0x00007FF6F4460000-0x00007FF6F47B4000-memory.dmp	xmrig
behavioral2/memory/4344-113-0x00007FF642FB0000-0x00007FF643304000-memory.dmp	xmrig
behavioral2/memory/1076-112-0x00007FF670A60000-0x00007FF670DB4000-memory.dmp	xmrig
behavioral2/memory/4076-108-0x00007FF7F6760000-0x00007FF7F6AB4000-memory.dmp	xmrig
behavioral2/memory/876-104-0x00007FF669320000-0x00007FF669674000-memory.dmp	xmrig
behavioral2/memory/4504-98-0x00007FF78A540000-0x00007FF78A894000-memory.dmp	xmrig
behavioral2/memory/5104-88-0x00007FF739650000-0x00007FF7399A4000-memory.dmp	xmrig
behavioral2/memory/3088-87-0x00007FF6BFE10000-0x00007FF6C0164000-memory.dmp	xmrig
behavioral2/memory/4436-76-0x00007FF668950000-0x00007FF668CA4000-memory.dmp	xmrig
behavioral2/memory/1556-133-0x00007FF7A1280000-0x00007FF7A15D4000-memory.dmp	xmrig
behavioral2/memory/3312-134-0x00007FF6EB7E0000-0x00007FF6EBB34000-memory.dmp	xmrig
behavioral2/memory/4436-135-0x00007FF668950000-0x00007FF668CA4000-memory.dmp	xmrig
behavioral2/memory/1944-136-0x00007FF6F75A0000-0x00007FF6F78F4000-memory.dmp	xmrig
behavioral2/memory/1076-137-0x00007FF670A60000-0x00007FF670DB4000-memory.dmp	xmrig
behavioral2/memory/4596-138-0x00007FF66B3C0000-0x00007FF66B714000-memory.dmp	xmrig
behavioral2/memory/1136-139-0x00007FF6F4460000-0x00007FF6F47B4000-memory.dmp	xmrig
behavioral2/memory/3544-140-0x00007FF664120000-0x00007FF664474000-memory.dmp	xmrig
behavioral2/memory/4532-141-0x00007FF7221D0000-0x00007FF722524000-memory.dmp	xmrig
behavioral2/memory/4344-142-0x00007FF642FB0000-0x00007FF643304000-memory.dmp	xmrig
behavioral2/memory/4076-143-0x00007FF7F6760000-0x00007FF7F6AB4000-memory.dmp	xmrig
behavioral2/memory/4100-144-0x00007FF736E00000-0x00007FF737154000-memory.dmp	xmrig
behavioral2/memory/3300-146-0x00007FF63BF00000-0x00007FF63C254000-memory.dmp	xmrig
behavioral2/memory/1468-145-0x00007FF66B630000-0x00007FF66B984000-memory.dmp	xmrig
behavioral2/memory/2300-148-0x00007FF6A96C0000-0x00007FF6A9A14000-memory.dmp	xmrig
behavioral2/memory/5044-147-0x00007FF773C80000-0x00007FF773FD4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4532	OWiuSUQ.exe
4344	YBaOXsg.exe
4076	zYVIDGu.exe
4100	PrTfizf.exe
2300	MMjHTAS.exe
5044	ZUemfZM.exe
3300	iZcYXmQ.exe
1468	HkFpiIw.exe
1556	CnCoslk.exe
5108	SQrUXoM.exe
3312	yGiqPGj.exe
4436	OImqiIe.exe
3088	QrJLUpk.exe
5104	odDKhve.exe
1944	fkFVkmB.exe
876	dnVCErT.exe
1076	tkTOnfT.exe
4596	RKcPUZh.exe
1136	yiFMbhR.exe
4336	SAuVqtP.exe
3544	oSEqirU.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4504-0-0x00007FF78A540000-0x00007FF78A894000-memory.dmp	upx
behavioral2/files/0x000900000002340c-5.dat	upx
behavioral2/memory/4532-8-0x00007FF7221D0000-0x00007FF722524000-memory.dmp	upx
behavioral2/files/0x0007000000023414-11.dat	upx
behavioral2/files/0x0007000000023413-10.dat	upx
behavioral2/memory/4076-23-0x00007FF7F6760000-0x00007FF7F6AB4000-memory.dmp	upx
behavioral2/memory/4100-26-0x00007FF736E00000-0x00007FF737154000-memory.dmp	upx
behavioral2/files/0x0007000000023417-36.dat	upx
behavioral2/files/0x0007000000023419-46.dat	upx
behavioral2/files/0x000700000002341a-51.dat	upx
behavioral2/memory/1556-59-0x00007FF7A1280000-0x00007FF7A15D4000-memory.dmp	upx
behavioral2/memory/3312-64-0x00007FF6EB7E0000-0x00007FF6EBB34000-memory.dmp	upx
behavioral2/memory/5108-68-0x00007FF72F210000-0x00007FF72F564000-memory.dmp	upx
behavioral2/memory/5044-67-0x00007FF773C80000-0x00007FF773FD4000-memory.dmp	upx
behavioral2/files/0x000700000002341c-65.dat	upx
behavioral2/files/0x000700000002341b-62.dat	upx
behavioral2/memory/1468-58-0x00007FF66B630000-0x00007FF66B984000-memory.dmp	upx
behavioral2/memory/3300-55-0x00007FF63BF00000-0x00007FF63C254000-memory.dmp	upx
behavioral2/files/0x0007000000023418-44.dat	upx
behavioral2/memory/2300-38-0x00007FF6A96C0000-0x00007FF6A9A14000-memory.dmp	upx
behavioral2/files/0x0007000000023416-32.dat	upx
behavioral2/files/0x0007000000023415-24.dat	upx
behavioral2/memory/4344-15-0x00007FF642FB0000-0x00007FF643304000-memory.dmp	upx
behavioral2/files/0x000700000002341d-71.dat	upx
behavioral2/files/0x000700000002341e-77.dat	upx
behavioral2/files/0x000700000002341f-79.dat	upx
behavioral2/files/0x0007000000023420-89.dat	upx
behavioral2/memory/1944-91-0x00007FF6F75A0000-0x00007FF6F78F4000-memory.dmp	upx
behavioral2/files/0x0007000000023421-99.dat	upx
behavioral2/files/0x0007000000023422-101.dat	upx
behavioral2/files/0x0007000000023424-111.dat	upx
behavioral2/memory/4596-116-0x00007FF66B3C0000-0x00007FF66B714000-memory.dmp	upx
behavioral2/files/0x0007000000023425-121.dat	upx
behavioral2/memory/2300-126-0x00007FF6A96C0000-0x00007FF6A9A14000-memory.dmp	upx
behavioral2/memory/3544-128-0x00007FF664120000-0x00007FF664474000-memory.dmp	upx
behavioral2/memory/4100-127-0x00007FF736E00000-0x00007FF737154000-memory.dmp	upx
behavioral2/memory/4336-125-0x00007FF6C9910000-0x00007FF6C9C64000-memory.dmp	upx
behavioral2/files/0x0007000000023426-124.dat	upx
behavioral2/files/0x0007000000023423-118.dat	upx
behavioral2/memory/1136-117-0x00007FF6F4460000-0x00007FF6F47B4000-memory.dmp	upx
behavioral2/memory/4344-113-0x00007FF642FB0000-0x00007FF643304000-memory.dmp	upx
behavioral2/memory/1076-112-0x00007FF670A60000-0x00007FF670DB4000-memory.dmp	upx
behavioral2/memory/4076-108-0x00007FF7F6760000-0x00007FF7F6AB4000-memory.dmp	upx
behavioral2/memory/876-104-0x00007FF669320000-0x00007FF669674000-memory.dmp	upx
behavioral2/memory/4504-98-0x00007FF78A540000-0x00007FF78A894000-memory.dmp	upx
behavioral2/memory/5104-88-0x00007FF739650000-0x00007FF7399A4000-memory.dmp	upx
behavioral2/memory/3088-87-0x00007FF6BFE10000-0x00007FF6C0164000-memory.dmp	upx
behavioral2/memory/4436-76-0x00007FF668950000-0x00007FF668CA4000-memory.dmp	upx
behavioral2/memory/1556-133-0x00007FF7A1280000-0x00007FF7A15D4000-memory.dmp	upx
behavioral2/memory/3312-134-0x00007FF6EB7E0000-0x00007FF6EBB34000-memory.dmp	upx
behavioral2/memory/4436-135-0x00007FF668950000-0x00007FF668CA4000-memory.dmp	upx
behavioral2/memory/1944-136-0x00007FF6F75A0000-0x00007FF6F78F4000-memory.dmp	upx
behavioral2/memory/1076-137-0x00007FF670A60000-0x00007FF670DB4000-memory.dmp	upx
behavioral2/memory/4596-138-0x00007FF66B3C0000-0x00007FF66B714000-memory.dmp	upx
behavioral2/memory/1136-139-0x00007FF6F4460000-0x00007FF6F47B4000-memory.dmp	upx
behavioral2/memory/3544-140-0x00007FF664120000-0x00007FF664474000-memory.dmp	upx
behavioral2/memory/4532-141-0x00007FF7221D0000-0x00007FF722524000-memory.dmp	upx
behavioral2/memory/4344-142-0x00007FF642FB0000-0x00007FF643304000-memory.dmp	upx
behavioral2/memory/4076-143-0x00007FF7F6760000-0x00007FF7F6AB4000-memory.dmp	upx
behavioral2/memory/4100-144-0x00007FF736E00000-0x00007FF737154000-memory.dmp	upx
behavioral2/memory/3300-146-0x00007FF63BF00000-0x00007FF63C254000-memory.dmp	upx
behavioral2/memory/1468-145-0x00007FF66B630000-0x00007FF66B984000-memory.dmp	upx
behavioral2/memory/2300-148-0x00007FF6A96C0000-0x00007FF6A9A14000-memory.dmp	upx
behavioral2/memory/5044-147-0x00007FF773C80000-0x00007FF773FD4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\tkTOnfT.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PrTfizf.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MMjHTAS.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iZcYXmQ.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CnCoslk.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fkFVkmB.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dnVCErT.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HkFpiIw.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RKcPUZh.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SAuVqtP.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zYVIDGu.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZUemfZM.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QrJLUpk.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\odDKhve.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oSEqirU.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OWiuSUQ.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YBaOXsg.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SQrUXoM.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yGiqPGj.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OImqiIe.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yiFMbhR.exe	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4532	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	83
PID 4504 wrote to memory of 4532	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	83
PID 4504 wrote to memory of 4344	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	84
PID 4504 wrote to memory of 4344	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	84
PID 4504 wrote to memory of 4076	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	85
PID 4504 wrote to memory of 4076	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	85
PID 4504 wrote to memory of 4100	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	86
PID 4504 wrote to memory of 4100	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	86
PID 4504 wrote to memory of 2300	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	87
PID 4504 wrote to memory of 2300	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	87
PID 4504 wrote to memory of 5044	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	88
PID 4504 wrote to memory of 5044	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	88
PID 4504 wrote to memory of 3300	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	89
PID 4504 wrote to memory of 3300	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	89
PID 4504 wrote to memory of 1468	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	90
PID 4504 wrote to memory of 1468	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	90
PID 4504 wrote to memory of 1556	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	91
PID 4504 wrote to memory of 1556	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	91
PID 4504 wrote to memory of 5108	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	92
PID 4504 wrote to memory of 5108	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	92
PID 4504 wrote to memory of 3312	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	93
PID 4504 wrote to memory of 3312	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	93
PID 4504 wrote to memory of 4436	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	94
PID 4504 wrote to memory of 4436	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	94
PID 4504 wrote to memory of 3088	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	95
PID 4504 wrote to memory of 3088	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	95
PID 4504 wrote to memory of 5104	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	96
PID 4504 wrote to memory of 5104	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	96
PID 4504 wrote to memory of 1944	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	97
PID 4504 wrote to memory of 1944	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	97
PID 4504 wrote to memory of 876	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	98
PID 4504 wrote to memory of 876	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	98
PID 4504 wrote to memory of 1076	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	100
PID 4504 wrote to memory of 1076	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	100
PID 4504 wrote to memory of 4596	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	101
PID 4504 wrote to memory of 4596	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	101
PID 4504 wrote to memory of 1136	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	102
PID 4504 wrote to memory of 1136	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	102
PID 4504 wrote to memory of 4336	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	103
PID 4504 wrote to memory of 4336	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	103
PID 4504 wrote to memory of 3544	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	104
PID 4504 wrote to memory of 3544	4504	2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe	104

C:\Users\Admin\AppData\Local\Temp\2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-28_237e1a2bb744a42e323d3f2ad95ad731_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\System\OWiuSUQ.exe
  C:\Windows\System\OWiuSUQ.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\YBaOXsg.exe
  C:\Windows\System\YBaOXsg.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\zYVIDGu.exe
  C:\Windows\System\zYVIDGu.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\PrTfizf.exe
  C:\Windows\System\PrTfizf.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\MMjHTAS.exe
  C:\Windows\System\MMjHTAS.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\ZUemfZM.exe
  C:\Windows\System\ZUemfZM.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\iZcYXmQ.exe
  C:\Windows\System\iZcYXmQ.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\HkFpiIw.exe
  C:\Windows\System\HkFpiIw.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\CnCoslk.exe
  C:\Windows\System\CnCoslk.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\SQrUXoM.exe
  C:\Windows\System\SQrUXoM.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\yGiqPGj.exe
  C:\Windows\System\yGiqPGj.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\OImqiIe.exe
  C:\Windows\System\OImqiIe.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\QrJLUpk.exe
  C:\Windows\System\QrJLUpk.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\odDKhve.exe
  C:\Windows\System\odDKhve.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\fkFVkmB.exe
  C:\Windows\System\fkFVkmB.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\dnVCErT.exe
  C:\Windows\System\dnVCErT.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\tkTOnfT.exe
  C:\Windows\System\tkTOnfT.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\RKcPUZh.exe
  C:\Windows\System\RKcPUZh.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\yiFMbhR.exe
  C:\Windows\System\yiFMbhR.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\SAuVqtP.exe
  C:\Windows\System\SAuVqtP.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\oSEqirU.exe
  C:\Windows\System\oSEqirU.exe
  2⤵
  - Executes dropped EXE
  PID:3544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CnCoslk.exe

Path C:\Windows\System\CnCoslk.exe
Size 5.9MB
SHA256 726db08e78edacba73dd16c68de60378b991dcd45bdf4dac58eeb9ef64ae1896
MD5 d04d403dc5aa8d0292f75090d134b4d8
SHA1 4f63968158d9bef009d71c9f214c55d7f6e5fd67
SHA512 9700dd85a49e13eff4ba40b14ec033815964ff7bcc7de1f111e760f0aa66bb0f8ce5d23f5c035b9ba6ab5bc6a2cd000d8d7ec101e57728cfd62bbbf2ad05fb02
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

HkFpiIw.exe

Path C:\Windows\System\HkFpiIw.exe
Size 5.9MB
SHA256 3196c580123ffabfcafc4c861ad87d43d64c1b19cd2797b93d5766033b22f5f7
MD5 86f7cb3c13b8248c1c4b3ec7e79ef469
SHA1 1fa6149cbdb5cf6a1a994e0c23613c107bafb09d
SHA512 0dd80ed321fb1a8a6c4016f4d068461324592f95ced5315e157eded379be5fa605f57bbd8531defd8b229f27192842a87ec2d59411529a298eae20732ef694ae
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

MMjHTAS.exe

Path C:\Windows\System\MMjHTAS.exe
Size 5.9MB
SHA256 a57ea13bd797b8bb34ffff6712edab841e995891d24eeae083346654106e74f7
MD5 f5998f7c1c84177b3a4ba407cabc520c
SHA1 c7373dc02936effcb2b89374e05e9927352f17b5
SHA512 2d8f6a7f9159a58b1b7773794f73e9635375d8cf308d24b756f4e884fdb088cd1a217b01bc91b3811f885f8532ffccd4adb7a381ed8067111ae5b1cc25454fdf
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

OImqiIe.exe

Path C:\Windows\System\OImqiIe.exe
Size 5.9MB
SHA256 9b2a17203c9d47e65266d830f2e1005857eb09baaa6b3c3a36b73c64ca63f616
MD5 1ad0b39e8121394eb524e3996f7a91cb
SHA1 92de1d563cfdad2f62fc5ca9f1c6efb30f7820b4
SHA512 ec8a4b411405d5e0e83bfeaaba806dde2e1fb331419f18c0d0236e9a67e5a44879eaf4a481aa94a96b876613f5bdc6b891e752e97a01b83fa80fd2c7bd59b704
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

OWiuSUQ.exe

Path C:\Windows\System\OWiuSUQ.exe
Size 5.9MB
SHA256 1c8a3383072cac2f327eaabdc02a02c2cf33d84b01e3f50d8093bb70ecb22f09
MD5 4a5e6d94e91a2c3924c5f9bac76f8f09
SHA1 cd88cf7b9859d694abfaebbff826aab5c7438fc5
SHA512 b267f47b88d0456bd05c11fb061f6719839041f341131aaa19161c343880fe11e6e06b1d757f5fec6ac578661678f2a17870bb7f53dc33c00db4ba4735d2cf45
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

PrTfizf.exe

Path C:\Windows\System\PrTfizf.exe
Size 5.9MB
SHA256 e4eda94e7de84e24d471dc6644cc77881a6cb8c7ef89c597380b97149da5768a
MD5 371d0f2012d6f86f465fc9b43a10458f
SHA1 f29b15174004bac6f2cfefe37617fcce4a2958b1
SHA512 6b9d53e88ab9e3586b1fa553198dc824aa2d43c92642bcc8ed916e9aa731ca6fd58e4890d9fd0340a1d8490cce507af3572d67847e2db40bd0221065b3ee7a99
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

QrJLUpk.exe

Path C:\Windows\System\QrJLUpk.exe
Size 5.9MB
SHA256 4d800fc4de25da4a048e79489938197199ac6b01c87427bcfee2ac559297bfa0
MD5 1ef88eebfe89c429146e6883ede20b4c
SHA1 8b871dd0affcb993a6afc2938a797dbd294be981
SHA512 db50224d2475adb7e92fe91a1b3b32c222aeb6e8b9428b44daaaa20f24bccf377fcd7b6ac68314ec9907b09c0ef1ddf4c787d9bfd62bb8ce6fceb006743cf4f0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

RKcPUZh.exe

Path C:\Windows\System\RKcPUZh.exe
Size 5.9MB
SHA256 d4a0f3472bc6f9fc9e842c1dd623ce59db52cf82adc24c49cbee6f649e9b931b
MD5 757c71ca49bee46250de0ad551280b29
SHA1 79206dc71d9446bc12f831ba379a1f182989c8fa
SHA512 90f84a2f570516b50c2084b0cd3c6db75f621efc596b7a15e6675b79af4cfcdc6594e0fdce0dc13eb579b02ac570e66038a9ead901c2544284ffe69b80838424
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

SAuVqtP.exe

Path C:\Windows\System\SAuVqtP.exe
Size 5.9MB
SHA256 fe9a9220c23cb58be821bc4c4c5a9532d1923d22b746fe9306474cae75dc2ad1
MD5 6fed1773cfb48dfe14af338a57ce577f
SHA1 e9492a59ac5bbd8c9c2be60e76a50fb599ef4b37
SHA512 9dfb105aac8096079ea276597fe8bbcf09ee510a232623e05d763c287fdaca147c8891d18bd5b3bee8fba428a68cf242d7b3f75260fc7887a2e5a9b3f364d33f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:Q+856utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

SQrUXoM.exe

Path C:\Windows\System\SQrUXoM.exe
Size 5.9MB
SHA256 658086ef3b923d739b68a9db9649cc127e4a275b08adbfc63e7a111ef7a0a7db
MD5 e9e2b594483f66f528e7e8fc1ad634a3
SHA1 c33bc036beb3ca6d79cd8daf66c91169a749a0bd
SHA512 a952d2cc83727d669cfdde308ef37852d84f7bf49f093159092ed459f15adb393f38316f609d9e860097dc6939433ba1d849dae2c2d3f48a3db1411d15feb3a1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

YBaOXsg.exe

Path C:\Windows\System\YBaOXsg.exe
Size 5.9MB
SHA256 4bce28c52972b4401611354d5e5315e7ef0bcd32a4f6673138892dc325ef20ca
MD5 150ad2bdfd5aebd665cb820da6ae869f
SHA1 ff6a019bc3808c8cefa5faa7ba59d86cc41908e1
SHA512 39846ae3ef301196ee02bc0d013c38fe93f7d03a18b83c29fdd27aeb7d58affa0090de20b8ac7c78de64145c589d0400997e2f780682fc2cab9941b41bbae1b5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZUemfZM.exe

Path C:\Windows\System\ZUemfZM.exe
Size 5.9MB
SHA256 de7879c44f00ea2a1af2cf14ed4b24468d6695211d8f798ca108850b762ecd14
MD5 f8ba1b052cf67b93e97a2b408ff5c2ca
SHA1 87cc5d474791311afa58623815901efdd09dea50
SHA512 8f2160b350772ab7c8912ee527696a412964f3352913c5d02d29b71e62eb89143687263d4e8b1f97faa07c7d22562480a653fa5a4f8063f94b131053fdb4d459
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnVCErT.exe

Path C:\Windows\System\dnVCErT.exe
Size 5.9MB
SHA256 b2309c95471324d12ed7ed011b183836601e757fc00be0e36418ed87437570b8
MD5 8083a06418fc38d36f43d89c395b081f
SHA1 0f948399ea717c95bdacc0e0cc94cc7d8bb0a5c3
SHA512 860378c5410fbb833663aa7b5689a53fa7a904c49f255e75b4b871296232428022508ea59c41d5181fe92848235fc08cc63a696cf1fca640cdb1566e241807e7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

fkFVkmB.exe

Path C:\Windows\System\fkFVkmB.exe
Size 5.9MB
SHA256 befa224d8c4ba9ae48f1b72173fda57ddfad2e4748c8e0b6d86b32e03e15d78e
MD5 bb444f5899a25b6a2a21900900b2556f
SHA1 69a09f15c9b68b44249831a2e9e86570aa344d85
SHA512 d3ba88a0e33a555818b3acffc11fc837fadd718ea083ab78bd01df888595813d5b36c61058cf616d46ad0f8f86610090f507ec1769617aeb3799d9d228796d68
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

iZcYXmQ.exe

Path C:\Windows\System\iZcYXmQ.exe
Size 5.9MB
SHA256 8b83b58701e7a1416c042a75eaa0e715962d7531e5f240013e581f67a32e9b8b
MD5 3edf3ca8b8242e9d425b0fa72458f506
SHA1 704a7ab2064a16db5827a383831f4878041c5436
SHA512 c356772e4f5f611a4f89afd127a183d8c0cbce38dda1c04c82b820de93d82c1a82532afa99978562690679679c4bd46439e973bcbb30ec82f21d8bb451639dbf
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

oSEqirU.exe

Path C:\Windows\System\oSEqirU.exe
Size 5.9MB
SHA256 f46454c9dbc59d9336c86204ef334c9358d5d688912a4407de3c8ba2f27836dd
MD5 e7089329a067dc0957167cf216e5c791
SHA1 c2fedf7e0295a2346a31cb85dd4e25b1cf4e09f1
SHA512 7f71211899bd8296eca88c967c1c677b679f0e4ec60a889ba97eca4b07ddef076fd1a5f00591c6ecacf6df6a176eb480e5f8c80074ddaafc86791f17af5f5bf5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

odDKhve.exe

Path C:\Windows\System\odDKhve.exe
Size 5.9MB
SHA256 03ef411b631a7e6f7288b4ac647b622556096fc1b8d361f70da110b8d052994f
MD5 1db5dd519a42dbfa4114b658a31d243f
SHA1 3e6e04d2cad41356269157b968da926c2bc9a1df
SHA512 2e624270d0b9c03bbafafa27eb1b18f9e7a366e70269cafa6be9a72a7a61855355c771eef16f8db1c641a305eee7ada2e692e5c245cf428af35cbd925d35b1cb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

tkTOnfT.exe

Path C:\Windows\System\tkTOnfT.exe
Size 5.9MB
SHA256 f8f7528ecce3595550b3feed2d298ed70709a051e14716e44abeabbbe3021fc8
MD5 4c7fc1ebc46405e163307852cd883fe1
SHA1 1600de67fdefec38c993b282160e04d3efaa75c4
SHA512 e4e5905a67a86a52664802974dcabddb0fbe97fc52f7691728279b87cbef6bcf0f30d4f8e9e1c65ae8c9dc8d1d197a7a69d0ca37c0baaafc96ab019ab43cdd9a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

yGiqPGj.exe

Path C:\Windows\System\yGiqPGj.exe
Size 5.9MB
SHA256 af84e13b91c7272a777025af483a98b3c6806e9e3812878edcebd2b8352696f3
MD5 835bb7e1fe41a8bb46498bba3f0facb6
SHA1 95ede892b2b6cdf433528ddfe293fe6d371407f3
SHA512 ee768c8a06bd47d7046037e89322226d43f08fd258f06df286d026354bcee5320fd187806e287e501c87ceae0f23b22ea4835293f445c4d6458c11afcfa4891d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

yiFMbhR.exe

Path C:\Windows\System\yiFMbhR.exe
Size 5.9MB
SHA256 322fe13e993c932b3e185562df8a0f0dd577e8eaedaf786f64554fee54ef19c4
MD5 8b09cc846f733d02b7acb33950ee09ed
SHA1 5b9453827f3e3f886cb8749c479c28c2eec0f7de
SHA512 09988422f641bdd79910da5ea5ed174d3fcef4baa5e770c6a3aec46c0e4619f574450516d5fa2ad36d3b15e36e08cd1e2e965a2bdaf3bef171a12aedeae7dffb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

zYVIDGu.exe

Path C:\Windows\System\zYVIDGu.exe
Size 5.9MB
SHA256 9527dc08e77ce8e3ded40ab9b11b3fed9a2d95584ad8b81540a380a791194ac6
MD5 aa53f308de520f2dc36015598568a018
SHA1 cdbb24d8676243846381ae61c3f75ba83f6e5510
SHA512 0b41f85fa115e772e8d1277e60ed908b94862e9de7808c5aab123554da8d98377bc195762017ceddeb98436d1f81353123323e6c349e618fe8735cd2a189ea47
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/876-104-0x00007FF669320000-0x00007FF669674000-memory.dmp

Download

memory/876-155-0x00007FF669320000-0x00007FF669674000-memory.dmp

Download

memory/1076-137-0x00007FF670A60000-0x00007FF670DB4000-memory.dmp

Download

memory/1076-112-0x00007FF670A60000-0x00007FF670DB4000-memory.dmp

Download

memory/1076-157-0x00007FF670A60000-0x00007FF670DB4000-memory.dmp

Download

memory/1136-139-0x00007FF6F4460000-0x00007FF6F47B4000-memory.dmp

Download

memory/1136-117-0x00007FF6F4460000-0x00007FF6F47B4000-memory.dmp

Download

memory/1136-160-0x00007FF6F4460000-0x00007FF6F47B4000-memory.dmp

Download

memory/1468-58-0x00007FF66B630000-0x00007FF66B984000-memory.dmp

Download

memory/1468-145-0x00007FF66B630000-0x00007FF66B984000-memory.dmp

Download

memory/1556-150-0x00007FF7A1280000-0x00007FF7A15D4000-memory.dmp

Download

memory/1556-133-0x00007FF7A1280000-0x00007FF7A15D4000-memory.dmp

Download

memory/1556-59-0x00007FF7A1280000-0x00007FF7A15D4000-memory.dmp

Download

memory/1944-136-0x00007FF6F75A0000-0x00007FF6F78F4000-memory.dmp

Download

memory/1944-91-0x00007FF6F75A0000-0x00007FF6F78F4000-memory.dmp

Download

memory/1944-156-0x00007FF6F75A0000-0x00007FF6F78F4000-memory.dmp

Download

memory/2300-38-0x00007FF6A96C0000-0x00007FF6A9A14000-memory.dmp

Download

memory/2300-148-0x00007FF6A96C0000-0x00007FF6A9A14000-memory.dmp

Download

memory/2300-126-0x00007FF6A96C0000-0x00007FF6A9A14000-memory.dmp

Download

memory/3088-87-0x00007FF6BFE10000-0x00007FF6C0164000-memory.dmp

Download

memory/3088-153-0x00007FF6BFE10000-0x00007FF6C0164000-memory.dmp

Download

memory/3300-146-0x00007FF63BF00000-0x00007FF63C254000-memory.dmp

Download

memory/3300-55-0x00007FF63BF00000-0x00007FF63C254000-memory.dmp

Download

memory/3312-134-0x00007FF6EB7E0000-0x00007FF6EBB34000-memory.dmp

Download

memory/3312-64-0x00007FF6EB7E0000-0x00007FF6EBB34000-memory.dmp

Download

memory/3312-151-0x00007FF6EB7E0000-0x00007FF6EBB34000-memory.dmp

Download

memory/3544-128-0x00007FF664120000-0x00007FF664474000-memory.dmp

Download

memory/3544-140-0x00007FF664120000-0x00007FF664474000-memory.dmp

Download

memory/3544-161-0x00007FF664120000-0x00007FF664474000-memory.dmp

Download

memory/4076-108-0x00007FF7F6760000-0x00007FF7F6AB4000-memory.dmp

Download

memory/4076-23-0x00007FF7F6760000-0x00007FF7F6AB4000-memory.dmp

Download

memory/4076-143-0x00007FF7F6760000-0x00007FF7F6AB4000-memory.dmp

Download

memory/4100-26-0x00007FF736E00000-0x00007FF737154000-memory.dmp

Download

memory/4100-127-0x00007FF736E00000-0x00007FF737154000-memory.dmp

Download

memory/4100-144-0x00007FF736E00000-0x00007FF737154000-memory.dmp

Download

memory/4336-125-0x00007FF6C9910000-0x00007FF6C9C64000-memory.dmp

Download

memory/4336-158-0x00007FF6C9910000-0x00007FF6C9C64000-memory.dmp

Download

memory/4344-15-0x00007FF642FB0000-0x00007FF643304000-memory.dmp

Download

memory/4344-113-0x00007FF642FB0000-0x00007FF643304000-memory.dmp

Download

memory/4344-142-0x00007FF642FB0000-0x00007FF643304000-memory.dmp

Download

memory/4436-76-0x00007FF668950000-0x00007FF668CA4000-memory.dmp

Download

memory/4436-152-0x00007FF668950000-0x00007FF668CA4000-memory.dmp

Download

memory/4436-135-0x00007FF668950000-0x00007FF668CA4000-memory.dmp

Download

memory/4504-1-0x0000020EEDA60000-0x0000020EEDA70000-memory.dmp

Download

memory/4504-0-0x00007FF78A540000-0x00007FF78A894000-memory.dmp

Download

memory/4504-98-0x00007FF78A540000-0x00007FF78A894000-memory.dmp

Download

memory/4532-8-0x00007FF7221D0000-0x00007FF722524000-memory.dmp

Download

memory/4532-141-0x00007FF7221D0000-0x00007FF722524000-memory.dmp

Download

memory/4596-116-0x00007FF66B3C0000-0x00007FF66B714000-memory.dmp

Download

memory/4596-159-0x00007FF66B3C0000-0x00007FF66B714000-memory.dmp

Download

memory/4596-138-0x00007FF66B3C0000-0x00007FF66B714000-memory.dmp

Download

memory/5044-67-0x00007FF773C80000-0x00007FF773FD4000-memory.dmp

Download

memory/5044-147-0x00007FF773C80000-0x00007FF773FD4000-memory.dmp

Download

memory/5104-88-0x00007FF739650000-0x00007FF7399A4000-memory.dmp

Download

memory/5104-154-0x00007FF739650000-0x00007FF7399A4000-memory.dmp

Download

memory/5108-68-0x00007FF72F210000-0x00007FF72F564000-memory.dmp

Download

memory/5108-149-0x00007FF72F210000-0x00007FF72F564000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads