cobaltstrike | 823c689f0983ad779288780d78e82768d169cab528133ac1b122717cd56b19bd

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240528-bajpdshf64
SHA256 823c689f0983ad779288780d78e82768d169cab528133ac1b122717cd56b19bd
MD5 576f61a7d6ff4e74f34f920dc840c756
SHA1 8a2d9c656f55d5956d9c69355e14fd69dec8765f
SHA512 6788fa6cc63aab5085316541aef58a077557a9c62842f26c83527478b5ad063fb2ee7f377f4a747b6f361038bb753111adda80038a6f691157a65591e6894d63
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00080000000233fe-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023402-9.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023403-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023404-23.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000233ff-28.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023407-41.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023408-46.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023409-51.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340a-55.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340c-65.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340d-70.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340e-79.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023411-91.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023412-99.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023415-110.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023414-108.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023413-104.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023410-87.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340f-84.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340b-61.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023406-36.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x00080000000233fe-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023402-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023403-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023404-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00080000000233ff-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023407-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023408-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023409-51.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340a-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340c-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340d-70.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340e-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023411-91.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023412-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023415-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023414-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023413-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023410-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340f-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340b-61.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023406-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4456-0-0x00007FF771410000-0x00007FF771764000-memory.dmp	UPX
behavioral2/files/0x00080000000233fe-4.dat	UPX
behavioral2/files/0x0007000000023402-9.dat	UPX
behavioral2/memory/2436-10-0x00007FF7D9CD0000-0x00007FF7DA024000-memory.dmp	UPX
behavioral2/files/0x0007000000023403-11.dat	UPX
behavioral2/memory/4920-14-0x00007FF6DEC80000-0x00007FF6DEFD4000-memory.dmp	UPX
behavioral2/memory/1868-20-0x00007FF7B1FF0000-0x00007FF7B2344000-memory.dmp	UPX
behavioral2/files/0x0007000000023404-23.dat	UPX
behavioral2/memory/3820-26-0x00007FF66E970000-0x00007FF66ECC4000-memory.dmp	UPX
behavioral2/files/0x00080000000233ff-28.dat	UPX
behavioral2/memory/2108-32-0x00007FF6FA2E0000-0x00007FF6FA634000-memory.dmp	UPX
behavioral2/files/0x0007000000023407-41.dat	UPX
behavioral2/files/0x0007000000023408-46.dat	UPX
behavioral2/files/0x0007000000023409-51.dat	UPX
behavioral2/files/0x000700000002340a-55.dat	UPX
behavioral2/files/0x000700000002340c-65.dat	UPX
behavioral2/files/0x000700000002340d-70.dat	UPX
behavioral2/files/0x000700000002340e-79.dat	UPX
behavioral2/files/0x0007000000023411-91.dat	UPX
behavioral2/files/0x0007000000023412-99.dat	UPX
behavioral2/files/0x0007000000023415-110.dat	UPX
behavioral2/files/0x0007000000023414-108.dat	UPX
behavioral2/files/0x0007000000023413-104.dat	UPX
behavioral2/files/0x0007000000023410-87.dat	UPX
behavioral2/files/0x000700000002340f-84.dat	UPX
behavioral2/files/0x000700000002340b-61.dat	UPX
behavioral2/files/0x0007000000023406-36.dat	UPX
behavioral2/memory/3568-112-0x00007FF6BD9F0000-0x00007FF6BDD44000-memory.dmp	UPX
behavioral2/memory/4732-113-0x00007FF70E350000-0x00007FF70E6A4000-memory.dmp	UPX
behavioral2/memory/2472-114-0x00007FF7426E0000-0x00007FF742A34000-memory.dmp	UPX
behavioral2/memory/3756-115-0x00007FF7D9370000-0x00007FF7D96C4000-memory.dmp	UPX
behavioral2/memory/948-116-0x00007FF7DEBD0000-0x00007FF7DEF24000-memory.dmp	UPX
behavioral2/memory/1340-117-0x00007FF655170000-0x00007FF6554C4000-memory.dmp	UPX
behavioral2/memory/3320-118-0x00007FF6F8F90000-0x00007FF6F92E4000-memory.dmp	UPX
behavioral2/memory/4836-119-0x00007FF6565F0000-0x00007FF656944000-memory.dmp	UPX
behavioral2/memory/4724-120-0x00007FF6E3070000-0x00007FF6E33C4000-memory.dmp	UPX
behavioral2/memory/4692-121-0x00007FF7D0A50000-0x00007FF7D0DA4000-memory.dmp	UPX
behavioral2/memory/1524-122-0x00007FF702660000-0x00007FF7029B4000-memory.dmp	UPX
behavioral2/memory/3864-123-0x00007FF7BF0A0000-0x00007FF7BF3F4000-memory.dmp	UPX
behavioral2/memory/3620-126-0x00007FF6EFEA0000-0x00007FF6F01F4000-memory.dmp	UPX
behavioral2/memory/4048-125-0x00007FF65EC90000-0x00007FF65EFE4000-memory.dmp	UPX
behavioral2/memory/1912-124-0x00007FF6D7BD0000-0x00007FF6D7F24000-memory.dmp	UPX
behavioral2/memory/1052-127-0x00007FF7510D0000-0x00007FF751424000-memory.dmp	UPX
behavioral2/memory/4456-128-0x00007FF771410000-0x00007FF771764000-memory.dmp	UPX
behavioral2/memory/2436-129-0x00007FF7D9CD0000-0x00007FF7DA024000-memory.dmp	UPX
behavioral2/memory/4920-130-0x00007FF6DEC80000-0x00007FF6DEFD4000-memory.dmp	UPX
behavioral2/memory/2436-131-0x00007FF7D9CD0000-0x00007FF7DA024000-memory.dmp	UPX
behavioral2/memory/4920-132-0x00007FF6DEC80000-0x00007FF6DEFD4000-memory.dmp	UPX
behavioral2/memory/1868-133-0x00007FF7B1FF0000-0x00007FF7B2344000-memory.dmp	UPX
behavioral2/memory/3820-134-0x00007FF66E970000-0x00007FF66ECC4000-memory.dmp	UPX
behavioral2/memory/2108-135-0x00007FF6FA2E0000-0x00007FF6FA634000-memory.dmp	UPX
behavioral2/memory/1052-136-0x00007FF7510D0000-0x00007FF751424000-memory.dmp	UPX
behavioral2/memory/2472-138-0x00007FF7426E0000-0x00007FF742A34000-memory.dmp	UPX
behavioral2/memory/3568-137-0x00007FF6BD9F0000-0x00007FF6BDD44000-memory.dmp	UPX
behavioral2/memory/3320-140-0x00007FF6F8F90000-0x00007FF6F92E4000-memory.dmp	UPX
behavioral2/memory/948-142-0x00007FF7DEBD0000-0x00007FF7DEF24000-memory.dmp	UPX
behavioral2/memory/4836-144-0x00007FF6565F0000-0x00007FF656944000-memory.dmp	UPX
behavioral2/memory/3756-143-0x00007FF7D9370000-0x00007FF7D96C4000-memory.dmp	UPX
behavioral2/memory/1340-141-0x00007FF655170000-0x00007FF6554C4000-memory.dmp	UPX
behavioral2/memory/4732-139-0x00007FF70E350000-0x00007FF70E6A4000-memory.dmp	UPX
behavioral2/memory/4692-146-0x00007FF7D0A50000-0x00007FF7D0DA4000-memory.dmp	UPX
behavioral2/memory/3620-145-0x00007FF6EFEA0000-0x00007FF6F01F4000-memory.dmp	UPX
behavioral2/memory/4724-149-0x00007FF6E3070000-0x00007FF6E33C4000-memory.dmp	UPX
behavioral2/memory/4048-151-0x00007FF65EC90000-0x00007FF65EFE4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4456-0-0x00007FF771410000-0x00007FF771764000-memory.dmp	xmrig
behavioral2/files/0x00080000000233fe-4.dat	xmrig
behavioral2/files/0x0007000000023402-9.dat	xmrig
behavioral2/memory/2436-10-0x00007FF7D9CD0000-0x00007FF7DA024000-memory.dmp	xmrig
behavioral2/files/0x0007000000023403-11.dat	xmrig
behavioral2/memory/4920-14-0x00007FF6DEC80000-0x00007FF6DEFD4000-memory.dmp	xmrig
behavioral2/memory/1868-20-0x00007FF7B1FF0000-0x00007FF7B2344000-memory.dmp	xmrig
behavioral2/files/0x0007000000023404-23.dat	xmrig
behavioral2/memory/3820-26-0x00007FF66E970000-0x00007FF66ECC4000-memory.dmp	xmrig
behavioral2/files/0x00080000000233ff-28.dat	xmrig
behavioral2/memory/2108-32-0x00007FF6FA2E0000-0x00007FF6FA634000-memory.dmp	xmrig
behavioral2/files/0x0007000000023407-41.dat	xmrig
behavioral2/files/0x0007000000023408-46.dat	xmrig
behavioral2/files/0x0007000000023409-51.dat	xmrig
behavioral2/files/0x000700000002340a-55.dat	xmrig
behavioral2/files/0x000700000002340c-65.dat	xmrig
behavioral2/files/0x000700000002340d-70.dat	xmrig
behavioral2/files/0x000700000002340e-79.dat	xmrig
behavioral2/files/0x0007000000023411-91.dat	xmrig
behavioral2/files/0x0007000000023412-99.dat	xmrig
behavioral2/files/0x0007000000023415-110.dat	xmrig
behavioral2/files/0x0007000000023414-108.dat	xmrig
behavioral2/files/0x0007000000023413-104.dat	xmrig
behavioral2/files/0x0007000000023410-87.dat	xmrig
behavioral2/files/0x000700000002340f-84.dat	xmrig
behavioral2/files/0x000700000002340b-61.dat	xmrig
behavioral2/files/0x0007000000023406-36.dat	xmrig
behavioral2/memory/3568-112-0x00007FF6BD9F0000-0x00007FF6BDD44000-memory.dmp	xmrig
behavioral2/memory/4732-113-0x00007FF70E350000-0x00007FF70E6A4000-memory.dmp	xmrig
behavioral2/memory/2472-114-0x00007FF7426E0000-0x00007FF742A34000-memory.dmp	xmrig
behavioral2/memory/3756-115-0x00007FF7D9370000-0x00007FF7D96C4000-memory.dmp	xmrig
behavioral2/memory/948-116-0x00007FF7DEBD0000-0x00007FF7DEF24000-memory.dmp	xmrig
behavioral2/memory/1340-117-0x00007FF655170000-0x00007FF6554C4000-memory.dmp	xmrig
behavioral2/memory/3320-118-0x00007FF6F8F90000-0x00007FF6F92E4000-memory.dmp	xmrig
behavioral2/memory/4836-119-0x00007FF6565F0000-0x00007FF656944000-memory.dmp	xmrig
behavioral2/memory/4724-120-0x00007FF6E3070000-0x00007FF6E33C4000-memory.dmp	xmrig
behavioral2/memory/4692-121-0x00007FF7D0A50000-0x00007FF7D0DA4000-memory.dmp	xmrig
behavioral2/memory/1524-122-0x00007FF702660000-0x00007FF7029B4000-memory.dmp	xmrig
behavioral2/memory/3864-123-0x00007FF7BF0A0000-0x00007FF7BF3F4000-memory.dmp	xmrig
behavioral2/memory/3620-126-0x00007FF6EFEA0000-0x00007FF6F01F4000-memory.dmp	xmrig
behavioral2/memory/4048-125-0x00007FF65EC90000-0x00007FF65EFE4000-memory.dmp	xmrig
behavioral2/memory/1912-124-0x00007FF6D7BD0000-0x00007FF6D7F24000-memory.dmp	xmrig
behavioral2/memory/1052-127-0x00007FF7510D0000-0x00007FF751424000-memory.dmp	xmrig
behavioral2/memory/4456-128-0x00007FF771410000-0x00007FF771764000-memory.dmp	xmrig
behavioral2/memory/2436-129-0x00007FF7D9CD0000-0x00007FF7DA024000-memory.dmp	xmrig
behavioral2/memory/4920-130-0x00007FF6DEC80000-0x00007FF6DEFD4000-memory.dmp	xmrig
behavioral2/memory/2436-131-0x00007FF7D9CD0000-0x00007FF7DA024000-memory.dmp	xmrig
behavioral2/memory/4920-132-0x00007FF6DEC80000-0x00007FF6DEFD4000-memory.dmp	xmrig
behavioral2/memory/1868-133-0x00007FF7B1FF0000-0x00007FF7B2344000-memory.dmp	xmrig
behavioral2/memory/3820-134-0x00007FF66E970000-0x00007FF66ECC4000-memory.dmp	xmrig
behavioral2/memory/2108-135-0x00007FF6FA2E0000-0x00007FF6FA634000-memory.dmp	xmrig
behavioral2/memory/1052-136-0x00007FF7510D0000-0x00007FF751424000-memory.dmp	xmrig
behavioral2/memory/2472-138-0x00007FF7426E0000-0x00007FF742A34000-memory.dmp	xmrig
behavioral2/memory/3568-137-0x00007FF6BD9F0000-0x00007FF6BDD44000-memory.dmp	xmrig
behavioral2/memory/3320-140-0x00007FF6F8F90000-0x00007FF6F92E4000-memory.dmp	xmrig
behavioral2/memory/948-142-0x00007FF7DEBD0000-0x00007FF7DEF24000-memory.dmp	xmrig
behavioral2/memory/4836-144-0x00007FF6565F0000-0x00007FF656944000-memory.dmp	xmrig
behavioral2/memory/3756-143-0x00007FF7D9370000-0x00007FF7D96C4000-memory.dmp	xmrig
behavioral2/memory/1340-141-0x00007FF655170000-0x00007FF6554C4000-memory.dmp	xmrig
behavioral2/memory/4732-139-0x00007FF70E350000-0x00007FF70E6A4000-memory.dmp	xmrig
behavioral2/memory/4692-146-0x00007FF7D0A50000-0x00007FF7D0DA4000-memory.dmp	xmrig
behavioral2/memory/3620-145-0x00007FF6EFEA0000-0x00007FF6F01F4000-memory.dmp	xmrig
behavioral2/memory/4724-149-0x00007FF6E3070000-0x00007FF6E33C4000-memory.dmp	xmrig
behavioral2/memory/4048-151-0x00007FF65EC90000-0x00007FF65EFE4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2436	QsWaEoK.exe
4920	zoEFIDW.exe
1868	eoJDYkO.exe
3820	VCrSYeN.exe
2108	LDQDFMV.exe
1052	LaXNniS.exe
3568	qpNHRjC.exe
4732	Lfjnytt.exe
2472	bSKrivd.exe
3756	ryDulIN.exe
948	HCZttgr.exe
1340	VeRLMqJ.exe
3320	RwVnATw.exe
4836	rykWzCt.exe
4724	SurEZVa.exe
4692	rvetUkF.exe
1524	jiaeAQZ.exe
3864	pRDodJP.exe
1912	eQOxkbJ.exe
4048	dAkVUDh.exe
3620	lqVkFiw.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4456-0-0x00007FF771410000-0x00007FF771764000-memory.dmp	upx
behavioral2/files/0x00080000000233fe-4.dat	upx
behavioral2/files/0x0007000000023402-9.dat	upx
behavioral2/memory/2436-10-0x00007FF7D9CD0000-0x00007FF7DA024000-memory.dmp	upx
behavioral2/files/0x0007000000023403-11.dat	upx
behavioral2/memory/4920-14-0x00007FF6DEC80000-0x00007FF6DEFD4000-memory.dmp	upx
behavioral2/memory/1868-20-0x00007FF7B1FF0000-0x00007FF7B2344000-memory.dmp	upx
behavioral2/files/0x0007000000023404-23.dat	upx
behavioral2/memory/3820-26-0x00007FF66E970000-0x00007FF66ECC4000-memory.dmp	upx
behavioral2/files/0x00080000000233ff-28.dat	upx
behavioral2/memory/2108-32-0x00007FF6FA2E0000-0x00007FF6FA634000-memory.dmp	upx
behavioral2/files/0x0007000000023407-41.dat	upx
behavioral2/files/0x0007000000023408-46.dat	upx
behavioral2/files/0x0007000000023409-51.dat	upx
behavioral2/files/0x000700000002340a-55.dat	upx
behavioral2/files/0x000700000002340c-65.dat	upx
behavioral2/files/0x000700000002340d-70.dat	upx
behavioral2/files/0x000700000002340e-79.dat	upx
behavioral2/files/0x0007000000023411-91.dat	upx
behavioral2/files/0x0007000000023412-99.dat	upx
behavioral2/files/0x0007000000023415-110.dat	upx
behavioral2/files/0x0007000000023414-108.dat	upx
behavioral2/files/0x0007000000023413-104.dat	upx
behavioral2/files/0x0007000000023410-87.dat	upx
behavioral2/files/0x000700000002340f-84.dat	upx
behavioral2/files/0x000700000002340b-61.dat	upx
behavioral2/files/0x0007000000023406-36.dat	upx
behavioral2/memory/3568-112-0x00007FF6BD9F0000-0x00007FF6BDD44000-memory.dmp	upx
behavioral2/memory/4732-113-0x00007FF70E350000-0x00007FF70E6A4000-memory.dmp	upx
behavioral2/memory/2472-114-0x00007FF7426E0000-0x00007FF742A34000-memory.dmp	upx
behavioral2/memory/3756-115-0x00007FF7D9370000-0x00007FF7D96C4000-memory.dmp	upx
behavioral2/memory/948-116-0x00007FF7DEBD0000-0x00007FF7DEF24000-memory.dmp	upx
behavioral2/memory/1340-117-0x00007FF655170000-0x00007FF6554C4000-memory.dmp	upx
behavioral2/memory/3320-118-0x00007FF6F8F90000-0x00007FF6F92E4000-memory.dmp	upx
behavioral2/memory/4836-119-0x00007FF6565F0000-0x00007FF656944000-memory.dmp	upx
behavioral2/memory/4724-120-0x00007FF6E3070000-0x00007FF6E33C4000-memory.dmp	upx
behavioral2/memory/4692-121-0x00007FF7D0A50000-0x00007FF7D0DA4000-memory.dmp	upx
behavioral2/memory/1524-122-0x00007FF702660000-0x00007FF7029B4000-memory.dmp	upx
behavioral2/memory/3864-123-0x00007FF7BF0A0000-0x00007FF7BF3F4000-memory.dmp	upx
behavioral2/memory/3620-126-0x00007FF6EFEA0000-0x00007FF6F01F4000-memory.dmp	upx
behavioral2/memory/4048-125-0x00007FF65EC90000-0x00007FF65EFE4000-memory.dmp	upx
behavioral2/memory/1912-124-0x00007FF6D7BD0000-0x00007FF6D7F24000-memory.dmp	upx
behavioral2/memory/1052-127-0x00007FF7510D0000-0x00007FF751424000-memory.dmp	upx
behavioral2/memory/4456-128-0x00007FF771410000-0x00007FF771764000-memory.dmp	upx
behavioral2/memory/2436-129-0x00007FF7D9CD0000-0x00007FF7DA024000-memory.dmp	upx
behavioral2/memory/4920-130-0x00007FF6DEC80000-0x00007FF6DEFD4000-memory.dmp	upx
behavioral2/memory/2436-131-0x00007FF7D9CD0000-0x00007FF7DA024000-memory.dmp	upx
behavioral2/memory/4920-132-0x00007FF6DEC80000-0x00007FF6DEFD4000-memory.dmp	upx
behavioral2/memory/1868-133-0x00007FF7B1FF0000-0x00007FF7B2344000-memory.dmp	upx
behavioral2/memory/3820-134-0x00007FF66E970000-0x00007FF66ECC4000-memory.dmp	upx
behavioral2/memory/2108-135-0x00007FF6FA2E0000-0x00007FF6FA634000-memory.dmp	upx
behavioral2/memory/1052-136-0x00007FF7510D0000-0x00007FF751424000-memory.dmp	upx
behavioral2/memory/2472-138-0x00007FF7426E0000-0x00007FF742A34000-memory.dmp	upx
behavioral2/memory/3568-137-0x00007FF6BD9F0000-0x00007FF6BDD44000-memory.dmp	upx
behavioral2/memory/3320-140-0x00007FF6F8F90000-0x00007FF6F92E4000-memory.dmp	upx
behavioral2/memory/948-142-0x00007FF7DEBD0000-0x00007FF7DEF24000-memory.dmp	upx
behavioral2/memory/4836-144-0x00007FF6565F0000-0x00007FF656944000-memory.dmp	upx
behavioral2/memory/3756-143-0x00007FF7D9370000-0x00007FF7D96C4000-memory.dmp	upx
behavioral2/memory/1340-141-0x00007FF655170000-0x00007FF6554C4000-memory.dmp	upx
behavioral2/memory/4732-139-0x00007FF70E350000-0x00007FF70E6A4000-memory.dmp	upx
behavioral2/memory/4692-146-0x00007FF7D0A50000-0x00007FF7D0DA4000-memory.dmp	upx
behavioral2/memory/3620-145-0x00007FF6EFEA0000-0x00007FF6F01F4000-memory.dmp	upx
behavioral2/memory/4724-149-0x00007FF6E3070000-0x00007FF6E33C4000-memory.dmp	upx
behavioral2/memory/4048-151-0x00007FF65EC90000-0x00007FF65EFE4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\eoJDYkO.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LDQDFMV.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qpNHRjC.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bSKrivd.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rykWzCt.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jiaeAQZ.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zoEFIDW.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VeRLMqJ.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RwVnATw.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eQOxkbJ.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dAkVUDh.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VCrSYeN.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ryDulIN.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HCZttgr.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SurEZVa.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rvetUkF.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pRDodJP.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lqVkFiw.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QsWaEoK.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LaXNniS.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\Lfjnytt.exe	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 2436	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	84
PID 4456 wrote to memory of 2436	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	84
PID 4456 wrote to memory of 4920	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	85
PID 4456 wrote to memory of 4920	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	85
PID 4456 wrote to memory of 1868	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	86
PID 4456 wrote to memory of 1868	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	86
PID 4456 wrote to memory of 3820	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	87
PID 4456 wrote to memory of 3820	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	87
PID 4456 wrote to memory of 2108	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	88
PID 4456 wrote to memory of 2108	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	88
PID 4456 wrote to memory of 1052	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	89
PID 4456 wrote to memory of 1052	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	89
PID 4456 wrote to memory of 3568	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	90
PID 4456 wrote to memory of 3568	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	90
PID 4456 wrote to memory of 4732	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	91
PID 4456 wrote to memory of 4732	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	91
PID 4456 wrote to memory of 2472	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	92
PID 4456 wrote to memory of 2472	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	92
PID 4456 wrote to memory of 3756	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	93
PID 4456 wrote to memory of 3756	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	93
PID 4456 wrote to memory of 948	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	94
PID 4456 wrote to memory of 948	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	94
PID 4456 wrote to memory of 1340	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	95
PID 4456 wrote to memory of 1340	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	95
PID 4456 wrote to memory of 3320	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	96
PID 4456 wrote to memory of 3320	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	96
PID 4456 wrote to memory of 4836	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	97
PID 4456 wrote to memory of 4836	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	97
PID 4456 wrote to memory of 4724	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	98
PID 4456 wrote to memory of 4724	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	98
PID 4456 wrote to memory of 4692	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	99
PID 4456 wrote to memory of 4692	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	99
PID 4456 wrote to memory of 1524	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	100
PID 4456 wrote to memory of 1524	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	100
PID 4456 wrote to memory of 3864	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	101
PID 4456 wrote to memory of 3864	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	101
PID 4456 wrote to memory of 1912	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	102
PID 4456 wrote to memory of 1912	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	102
PID 4456 wrote to memory of 4048	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	103
PID 4456 wrote to memory of 4048	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	103
PID 4456 wrote to memory of 3620	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	104
PID 4456 wrote to memory of 3620	4456	2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe	104

C:\Users\Admin\AppData\Local\Temp\2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-28_576f61a7d6ff4e74f34f920dc840c756_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\System\QsWaEoK.exe
  C:\Windows\System\QsWaEoK.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\zoEFIDW.exe
  C:\Windows\System\zoEFIDW.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\eoJDYkO.exe
  C:\Windows\System\eoJDYkO.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\VCrSYeN.exe
  C:\Windows\System\VCrSYeN.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\LDQDFMV.exe
  C:\Windows\System\LDQDFMV.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\LaXNniS.exe
  C:\Windows\System\LaXNniS.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\qpNHRjC.exe
  C:\Windows\System\qpNHRjC.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\Lfjnytt.exe
  C:\Windows\System\Lfjnytt.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\bSKrivd.exe
  C:\Windows\System\bSKrivd.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\ryDulIN.exe
  C:\Windows\System\ryDulIN.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\HCZttgr.exe
  C:\Windows\System\HCZttgr.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\VeRLMqJ.exe
  C:\Windows\System\VeRLMqJ.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\RwVnATw.exe
  C:\Windows\System\RwVnATw.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\rykWzCt.exe
  C:\Windows\System\rykWzCt.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\SurEZVa.exe
  C:\Windows\System\SurEZVa.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\rvetUkF.exe
  C:\Windows\System\rvetUkF.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\jiaeAQZ.exe
  C:\Windows\System\jiaeAQZ.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\pRDodJP.exe
  C:\Windows\System\pRDodJP.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\eQOxkbJ.exe
  C:\Windows\System\eQOxkbJ.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\dAkVUDh.exe
  C:\Windows\System\dAkVUDh.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\lqVkFiw.exe
  C:\Windows\System\lqVkFiw.exe
  2⤵
  - Executes dropped EXE
  PID:3620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

HCZttgr.exe

Path C:\Windows\System\HCZttgr.exe
Size 5.9MB
SHA256 9e8b46c2f42aeb3cc0349cfdd6174335c67e4e12f50e641ee733284f680192b7
MD5 8cbb0c9e2604b6b8f1defe5f4827471e
SHA1 958728a6a2333e62024ae51d427a7facbe7cffbe
SHA512 194a0aa0891ddaa491bbea877dc58b218e7cb352bd56a4e9da6badac9ce60f2344050a41e290d28c938ffde98f55d624a7d67cedfe85e0c4cd19de5345eed22e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:Q+856utgpPF8u/7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

LDQDFMV.exe

Path C:\Windows\System\LDQDFMV.exe
Size 5.9MB
SHA256 d20bb6a749c80650ae4a18ac7a9be6d18f14376c57e8ef0285a2cf21d6e7401b
MD5 7c742a5d4e1a80fcfc5da1be16e4f136
SHA1 07231cbab33f0d2968241e6a0fc4a40a768ef6ef
SHA512 601faf92bbf13669da731f93ff195c0df96cb7262802cfca6c2cb737ad74abeed27a6774e729213e629aabd30f39525bfb4bf6d796bd7cf0acb3cf42ab4a7c98
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

LaXNniS.exe

Path C:\Windows\System\LaXNniS.exe
Size 5.9MB
SHA256 7360ef1cbefff515ab69530cf26f3219daff65f102038d4fdd6e7783af3f5c60
MD5 a6345fb0f7a125c54cb243ff10ef3235
SHA1 bf5c592c8bb927ca84f2c536478f5f1b60eae102
SHA512 ef1a185952da5b1bbb063764d4010cb8d6e0ca7ee48d7119eaab5d4960d1fa47d69fa76c75da68b23192c9122d31d3a24e5dab34db1087b7b660271fc6db1e72
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lfjnytt.exe

Path C:\Windows\System\Lfjnytt.exe
Size 5.9MB
SHA256 f2dd6aeb60cbd88acbd2a53328908ef3c42c5dda0df8a2b39d3dd16838073c2a
MD5 b9009ba95039ac27432c0d04aa3fac2e
SHA1 dfe7972fccb4a508cf2a4d2fe2090f5bf69d3902
SHA512 bcb71d19f9591bc2367e726d773141246a2ac2c690f4188deb8b3a64173bad9bdafcf528bf91e2516a62e02733b40a6ce4c730432ec8786902322c0f8a3aabbe
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

QsWaEoK.exe

Path C:\Windows\System\QsWaEoK.exe
Size 5.9MB
SHA256 93350cf89f6d1390bd5907802c834fe646316d1cadc4d3999c4ccaa81b306add
MD5 f5b80f8fccae16ab55e4f04a2d11be94
SHA1 e23e364bd3e53029d1d83a0a2dca61de3dd74aef
SHA512 6cc680c08f5f46fe502db1b4758909b9a449e146f88cae3e15a2dcefb7be68a7e062e3ba345c6c1c50f857feea276717c3f17a4a66d17ad725aa066ba6e5a112
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

RwVnATw.exe

Path C:\Windows\System\RwVnATw.exe
Size 5.9MB
SHA256 7d6379a036ff4b73cdd75f8a03fff5064cd3f2c2ae402b88d565aca07db98c5d
MD5 be1d3a26bac30984895e8fe14f321cb8
SHA1 918c31ccc2e4f4ec1addfe129f3b68da8c3ec15e
SHA512 008e33c55036d8868ced3a424a9c835a2611553187e70b50ae5589720555ad227e55d20b988c5d33ed7d34d036b0ddd2998320003f63a889308897d29bb33784
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

SurEZVa.exe

Path C:\Windows\System\SurEZVa.exe
Size 5.9MB
SHA256 ea850fbdda59ea5b6df4804aa55f0630bbcd94d904d3e51150c1c536f91a3b58
MD5 f1e79cb1e0fa55917ac331df4e14a4f4
SHA1 c2e5a6f66a09d07ed0a90a4a1736cee0b7fbd1b4
SHA512 e6037200add19578bb2f4aa6220773ae7a4bdf7cb876217744ee3430af19a2bd8e2eef0e4e9690fa4ecae7c822e7e156b6c8895c0b6e0e53daf7127e38e02bd4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCrSYeN.exe

Path C:\Windows\System\VCrSYeN.exe
Size 5.9MB
SHA256 040d191decf06fb9be3d4013c3f676c3ef509ebeca638b0718ff48d1ff62949f
MD5 dbd9233b5005abcf412c621468a998a0
SHA1 db2e16cdb482603f6eb60a3e3318d097d88a6dab
SHA512 f80b7247cbd91945836b5172f3375ce8ea66ddc6d615e6a569c0e3cb4a5ca282f940df32c00394b3b1404f5dbd741fe1d75324f27ee468fb0bc3df5fb54e4704
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

VeRLMqJ.exe

Path C:\Windows\System\VeRLMqJ.exe
Size 5.9MB
SHA256 5ac6852a428c7a1884c24456c7893598b7cf2751477b7e4423a0712ff274d817
MD5 e81df3aaa3a2a7320f84835efbbc770d
SHA1 2472544d988854c69c0660cd961ae3ebde2f0de4
SHA512 f2d4ebc6fbb4b0b92ef8a62723c9944d7d5b4d4d83933942c7e802ad5d3ca71406bc3b143105cfbd9e6524a2463e275d74e086c58da576444310b22bd963e8f7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

bSKrivd.exe

Path C:\Windows\System\bSKrivd.exe
Size 5.9MB
SHA256 88c24687be45d2150df52462f5ca62701b67ae11577e66346456546c528d6c0f
MD5 c6acd30881c69d9339bc834416a45d47
SHA1 7d9aaa2f689fda6cd77c04111e63385422c653bb
SHA512 0a5ff8e1e018d4a46b95b5afb221d4512aee147fd552f77e19284d1b9d72671be70f0fd3b8cc72136f0243de63cd272e44ee806b9f2174a9cb3299504e7331d2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

dAkVUDh.exe

Path C:\Windows\System\dAkVUDh.exe
Size 5.9MB
SHA256 76b318a45e3e76bd4d6b7858917cf4bdb283ecaf49dc09b878337f1f57a1143b
MD5 6d5287ba6d820759a5e5d5bbead06525
SHA1 3ea0d3e6b16ca682bba68382aec339d0b86afad7
SHA512 7ef828693680b2c4c43d6da7d4869f4ea6ce1859e3b0f9420ad7deba925a5916a1181af2706a4b9e61fa2d1df1ece355d30945511801eb677f286ae79744dc20
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

eQOxkbJ.exe

Path C:\Windows\System\eQOxkbJ.exe
Size 5.9MB
SHA256 bfd8709b7d28acd6e99e4f97d51ef079d19445c3b9f3a5c4fe4360ee49f45a9f
MD5 217f5a6ea344ad0cc24ac067c4ea814a
SHA1 18fa6d68c4118dd7537c5a34f00c7865db338aec
SHA512 88ecf88831869889bfaf1c1dcad8e53a45012dfaa2451e0bf1f8ae1697d036fafa5d3317cd611d39583ff020badc3ed7083ddb7c0cfe33889e9187ed7c3c7511
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

eoJDYkO.exe

Path C:\Windows\System\eoJDYkO.exe
Size 5.9MB
SHA256 9d223634dba116c5b11c99d77c80e4a83c7316b9485792a70b7a7fc445596c09
MD5 e2144b5b6070890446393aecba9e4349
SHA1 f58a247198d472cd74e6c70ebc05727b22d5b0a8
SHA512 952047aad7ee2123beb80e3e9514528fea298d1480c7402989efd29f6bbe2520e708d4073d289793477e5b1616cb3647be619130ff16cb50d989d167a754602e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

jiaeAQZ.exe

Path C:\Windows\System\jiaeAQZ.exe
Size 5.9MB
SHA256 c2885eef291a33555efa03c73e791e278715b8465ec97aadbeedb6b94dad03b6
MD5 346a3e47f1a4b074240dca792f3971aa
SHA1 15bd59f2a6ef01c967b1b6d890e107896fae87b4
SHA512 be8e25f0478819867bcfbdd66098080f8f94aea0f406f00c08040e65a27a1095dde3eaa7f74bdea81b8563da5b40f5dcd758dd05669ae4bc083546c8971b1a81
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

lqVkFiw.exe

Path C:\Windows\System\lqVkFiw.exe
Size 5.9MB
SHA256 b88a34f3ef847211660ff4e39564861769cdb20904f9b5bee65e83c958f53f5c
MD5 5adb6076aed22883dca1dc6d997030e4
SHA1 d3bac1b8e7d658788bdacf0c6684d8a143a0fd55
SHA512 24d94bbeddea563242ff42072a3af7c0332539d795c11a3007745815b79e9f7309e1bd555982cfff2d0663b3571ee3eb9b4c65e82a35c232413bf76f897cec01
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:Q+856utgpPF8u/7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

pRDodJP.exe

Path C:\Windows\System\pRDodJP.exe
Size 5.9MB
SHA256 d7240bfc17fadd3b9eb99577784f222fe9376fd35fc823127b9d79ccc1270a61
MD5 8da89bed109fa32669bd5e114d660cca
SHA1 38e72182c0523e7a7354a0a20ef7c36380efe82c
SHA512 82d1dc7bc56f204fb2f1be45ebe22849774c6e2521aedfa6d2192b64205f63228598d42f52d0f25c2d3b618a8de40fac58369e76badcca93906118cda0167c34
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

qpNHRjC.exe

Path C:\Windows\System\qpNHRjC.exe
Size 5.9MB
SHA256 f9586f4cfe7447b375f18eb23a2cba5a06316190ae7d529d976157f0050f90f8
MD5 30e93e674eab47341b31179d82a9b478
SHA1 cf487eed752d2cfee0d8993ff12135d511bf80de
SHA512 ca3eabd9d3556d56ff9a02c5989b24238a2dadeb3f7149d6c4291c7bf79e44387e84be67726abf526e3fbe1079b2e0c5010d5f7b6b83e7252ab7e7623ca6f2b7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

rvetUkF.exe

Path C:\Windows\System\rvetUkF.exe
Size 5.9MB
SHA256 e6a3f88057abe86c70121c4eef7da9bde88f6b96657d87b119d148a40f860924
MD5 e23086807f06dfad354ec8e0839cc7b9
SHA1 3a45ec34224d91842c6eec9b50e209617e0caf86
SHA512 c0fdd756d2641f6a2ef28b3ed9786ca3f9adf128bc4c3cf5cf9b34f9f01b37731ea80ab69163c84ba05a964bdf859336372db14cb0c7dd58e2a4e254878df7ab
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

ryDulIN.exe

Path C:\Windows\System\ryDulIN.exe
Size 5.9MB
SHA256 322b512d964a7976059396e601cb60a1e153d8a7629586b89bf22476f5557baa
MD5 05933841a3b33ca2199704011ac577f0
SHA1 c5958f6bf11a0a82f751378af4cb8cdfd0ea79a3
SHA512 7bd62a80d01776e79cff6c432a923e307146f3a6fed5ebe3b8b2112e4c3d847986526072f5b8cfae8505c7ecbbf470e7d6b30b64082f341bf68b1c7e3bf77c39
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

rykWzCt.exe

Path C:\Windows\System\rykWzCt.exe
Size 5.9MB
SHA256 124c6db413a453a7ffc3e03f040b05422133fe18c8344862967dd6017a3adf43
MD5 de21eee3a4d6f6eeec52927b5e596519
SHA1 edc2cbcb0d08923ca36ecd89bee5fedcd9eab62d
SHA512 42dbdfc37df46fa6f4da1b7746eb09fa276ac0a5af9399f25a54c2834af4bc0918c8e4de3d17a4505a6bec6d5fc1178260382c73a59ee7950f87c0d82934713c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

zoEFIDW.exe

Path C:\Windows\System\zoEFIDW.exe
Size 5.9MB
SHA256 29d846aa178c6d53c0f38efa9c88fd6d03ca30e93d08153087218d11e9252e58
MD5 521ec018e35d02495b58b6129afa0b1f
SHA1 3283232ea4d2f471ab10a22df2f3e9159250e0d9
SHA512 6b67d633b708a0af009de9e86495a9d955efa25798140ebc42d2db43792b7644d899ec7e8160809eb50ea78e681cb49e51e46857b6548e7400b3f4c6456d8e0f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/948-142-0x00007FF7DEBD0000-0x00007FF7DEF24000-memory.dmp

Download

memory/948-116-0x00007FF7DEBD0000-0x00007FF7DEF24000-memory.dmp

Download

memory/1052-127-0x00007FF7510D0000-0x00007FF751424000-memory.dmp

Download

memory/1052-136-0x00007FF7510D0000-0x00007FF751424000-memory.dmp

Download

memory/1340-117-0x00007FF655170000-0x00007FF6554C4000-memory.dmp

Download

memory/1340-141-0x00007FF655170000-0x00007FF6554C4000-memory.dmp

Download

memory/1524-122-0x00007FF702660000-0x00007FF7029B4000-memory.dmp

Download

memory/1524-147-0x00007FF702660000-0x00007FF7029B4000-memory.dmp

Download

memory/1868-133-0x00007FF7B1FF0000-0x00007FF7B2344000-memory.dmp

Download

memory/1868-20-0x00007FF7B1FF0000-0x00007FF7B2344000-memory.dmp

Download

memory/1912-124-0x00007FF6D7BD0000-0x00007FF6D7F24000-memory.dmp

Download

memory/1912-148-0x00007FF6D7BD0000-0x00007FF6D7F24000-memory.dmp

Download

memory/2108-135-0x00007FF6FA2E0000-0x00007FF6FA634000-memory.dmp

Download

memory/2108-32-0x00007FF6FA2E0000-0x00007FF6FA634000-memory.dmp

Download

memory/2436-131-0x00007FF7D9CD0000-0x00007FF7DA024000-memory.dmp

Download

memory/2436-10-0x00007FF7D9CD0000-0x00007FF7DA024000-memory.dmp

Download

memory/2436-129-0x00007FF7D9CD0000-0x00007FF7DA024000-memory.dmp

Download

memory/2472-138-0x00007FF7426E0000-0x00007FF742A34000-memory.dmp

Download

memory/2472-114-0x00007FF7426E0000-0x00007FF742A34000-memory.dmp

Download

memory/3320-118-0x00007FF6F8F90000-0x00007FF6F92E4000-memory.dmp

Download

memory/3320-140-0x00007FF6F8F90000-0x00007FF6F92E4000-memory.dmp

Download

memory/3568-137-0x00007FF6BD9F0000-0x00007FF6BDD44000-memory.dmp

Download

memory/3568-112-0x00007FF6BD9F0000-0x00007FF6BDD44000-memory.dmp

Download

memory/3620-145-0x00007FF6EFEA0000-0x00007FF6F01F4000-memory.dmp

Download

memory/3620-126-0x00007FF6EFEA0000-0x00007FF6F01F4000-memory.dmp

Download

memory/3756-143-0x00007FF7D9370000-0x00007FF7D96C4000-memory.dmp

Download

memory/3756-115-0x00007FF7D9370000-0x00007FF7D96C4000-memory.dmp

Download

memory/3820-26-0x00007FF66E970000-0x00007FF66ECC4000-memory.dmp

Download

memory/3820-134-0x00007FF66E970000-0x00007FF66ECC4000-memory.dmp

Download

memory/3864-150-0x00007FF7BF0A0000-0x00007FF7BF3F4000-memory.dmp

Download

memory/3864-123-0x00007FF7BF0A0000-0x00007FF7BF3F4000-memory.dmp

Download

memory/4048-125-0x00007FF65EC90000-0x00007FF65EFE4000-memory.dmp

Download

memory/4048-151-0x00007FF65EC90000-0x00007FF65EFE4000-memory.dmp

Download

memory/4456-128-0x00007FF771410000-0x00007FF771764000-memory.dmp

Download

memory/4456-0-0x00007FF771410000-0x00007FF771764000-memory.dmp

Download

memory/4456-1-0x0000020783680000-0x0000020783690000-memory.dmp

Download

memory/4692-146-0x00007FF7D0A50000-0x00007FF7D0DA4000-memory.dmp

Download

memory/4692-121-0x00007FF7D0A50000-0x00007FF7D0DA4000-memory.dmp

Download

memory/4724-149-0x00007FF6E3070000-0x00007FF6E33C4000-memory.dmp

Download

memory/4724-120-0x00007FF6E3070000-0x00007FF6E33C4000-memory.dmp

Download

memory/4732-113-0x00007FF70E350000-0x00007FF70E6A4000-memory.dmp

Download

memory/4732-139-0x00007FF70E350000-0x00007FF70E6A4000-memory.dmp

Download

memory/4836-144-0x00007FF6565F0000-0x00007FF656944000-memory.dmp

Download

memory/4836-119-0x00007FF6565F0000-0x00007FF656944000-memory.dmp

Download

memory/4920-14-0x00007FF6DEC80000-0x00007FF6DEFD4000-memory.dmp

Download

memory/4920-130-0x00007FF6DEC80000-0x00007FF6DEFD4000-memory.dmp

Download

memory/4920-132-0x00007FF6DEC80000-0x00007FF6DEFD4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads