cobaltstrike | 1cc0fac907e421a703b28fa64d72daced69cfc6216cce75fdd0e908ba2769d30

Analysis

max time kernel
143s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240528-bd45hagg3w
SHA256 1cc0fac907e421a703b28fa64d72daced69cfc6216cce75fdd0e908ba2769d30
MD5 7124c8a9b3c707795c7c3547bd4f0024
SHA1 def2fd00614481efbd818a42efbe2c476e30fb01
SHA512 8c6ace9f76421f399c1aacb61012b773b08b53513b3a887b3c0f4a33136551fc2ee2a6716fb62c219607390323011447547cf6c67fcd182f0e33247cb6830284
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000900000002348b-6.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349a-10.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349b-11.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349c-22.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349e-35.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023493-40.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a0-49.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a1-58.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a2-60.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a3-66.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a4-70.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a5-73.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a6-86.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349d-30.dat	cobalt_reflective_dll
behavioral2/files/0x00030000000229de-105.dat	cobalt_reflective_dll
behavioral2/files/0x000400000001e3ce-98.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a7-96.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000022b23-117.dat	cobalt_reflective_dll
behavioral2/files/0x00030000000229e0-111.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a8-128.dat	cobalt_reflective_dll
behavioral2/files/0x000900000002340f-124.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000900000002348b-6.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349a-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349b-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349c-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349e-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0009000000023493-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000234a0-49.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000234a1-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000234a2-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000234a3-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000234a4-70.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000234a5-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000234a6-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349d-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00030000000229de-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000400000001e3ce-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000234a7-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000022b23-117.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00030000000229e0-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000234a8-128.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000900000002340f-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2400-0-0x00007FF7CD620000-0x00007FF7CD974000-memory.dmp	UPX
behavioral2/files/0x000900000002348b-6.dat	UPX
behavioral2/memory/4652-8-0x00007FF7B9750000-0x00007FF7B9AA4000-memory.dmp	UPX
behavioral2/files/0x000700000002349a-10.dat	UPX
behavioral2/files/0x000700000002349b-11.dat	UPX
behavioral2/memory/3848-14-0x00007FF6EFFE0000-0x00007FF6F0334000-memory.dmp	UPX
behavioral2/files/0x000700000002349c-22.dat	UPX
behavioral2/files/0x000700000002349e-35.dat	UPX
behavioral2/memory/552-32-0x00007FF6DBB80000-0x00007FF6DBED4000-memory.dmp	UPX
behavioral2/files/0x0009000000023493-40.dat	UPX
behavioral2/memory/1620-48-0x00007FF6E5F90000-0x00007FF6E62E4000-memory.dmp	UPX
behavioral2/files/0x00070000000234a0-49.dat	UPX
behavioral2/files/0x00070000000234a1-58.dat	UPX
behavioral2/files/0x00070000000234a2-60.dat	UPX
behavioral2/files/0x00070000000234a3-66.dat	UPX
behavioral2/files/0x00070000000234a4-70.dat	UPX
behavioral2/files/0x00070000000234a5-73.dat	UPX
behavioral2/memory/4104-81-0x00007FF609000000-0x00007FF609354000-memory.dmp	UPX
behavioral2/files/0x00070000000234a6-86.dat	UPX
behavioral2/memory/816-85-0x00007FF62E030000-0x00007FF62E384000-memory.dmp	UPX
behavioral2/memory/4772-84-0x00007FF642B20000-0x00007FF642E74000-memory.dmp	UPX
behavioral2/memory/4484-78-0x00007FF74BD40000-0x00007FF74C094000-memory.dmp	UPX
behavioral2/memory/2400-77-0x00007FF7CD620000-0x00007FF7CD974000-memory.dmp	UPX
behavioral2/memory/4984-57-0x00007FF730E20000-0x00007FF731174000-memory.dmp	UPX
behavioral2/memory/4796-55-0x00007FF7E3390000-0x00007FF7E36E4000-memory.dmp	UPX
behavioral2/memory/5108-46-0x00007FF71BB60000-0x00007FF71BEB4000-memory.dmp	UPX
behavioral2/memory/5084-43-0x00007FF6DC3E0000-0x00007FF6DC734000-memory.dmp	UPX
behavioral2/files/0x000700000002349d-30.dat	UPX
behavioral2/memory/2976-26-0x00007FF785CF0000-0x00007FF786044000-memory.dmp	UPX
behavioral2/memory/2600-20-0x00007FF660DE0000-0x00007FF661134000-memory.dmp	UPX
behavioral2/files/0x00030000000229de-105.dat	UPX
behavioral2/memory/4288-103-0x00007FF7C5800000-0x00007FF7C5B54000-memory.dmp	UPX
behavioral2/memory/3848-102-0x00007FF6EFFE0000-0x00007FF6F0334000-memory.dmp	UPX
behavioral2/files/0x000400000001e3ce-98.dat	UPX
behavioral2/files/0x00070000000234a7-96.dat	UPX
behavioral2/memory/3204-94-0x00007FF73D680000-0x00007FF73D9D4000-memory.dmp	UPX
behavioral2/memory/4652-91-0x00007FF7B9750000-0x00007FF7B9AA4000-memory.dmp	UPX
behavioral2/memory/3052-113-0x00007FF6F35F0000-0x00007FF6F3944000-memory.dmp	UPX
behavioral2/files/0x0007000000022b23-117.dat	UPX
behavioral2/memory/2108-118-0x00007FF782FE0000-0x00007FF783334000-memory.dmp	UPX
behavioral2/memory/1576-114-0x00007FF7D1C10000-0x00007FF7D1F64000-memory.dmp	UPX
behavioral2/files/0x00030000000229e0-111.dat	UPX
behavioral2/memory/2600-109-0x00007FF660DE0000-0x00007FF661134000-memory.dmp	UPX
behavioral2/files/0x00070000000234a8-128.dat	UPX
behavioral2/memory/4496-130-0x00007FF762B70000-0x00007FF762EC4000-memory.dmp	UPX
behavioral2/memory/632-131-0x00007FF6C5A80000-0x00007FF6C5DD4000-memory.dmp	UPX
behavioral2/files/0x000900000002340f-124.dat	UPX
behavioral2/memory/1620-132-0x00007FF6E5F90000-0x00007FF6E62E4000-memory.dmp	UPX
behavioral2/memory/4984-134-0x00007FF730E20000-0x00007FF731174000-memory.dmp	UPX
behavioral2/memory/4796-133-0x00007FF7E3390000-0x00007FF7E36E4000-memory.dmp	UPX
behavioral2/memory/816-136-0x00007FF62E030000-0x00007FF62E384000-memory.dmp	UPX
behavioral2/memory/4104-135-0x00007FF609000000-0x00007FF609354000-memory.dmp	UPX
behavioral2/memory/3204-137-0x00007FF73D680000-0x00007FF73D9D4000-memory.dmp	UPX
behavioral2/memory/2108-138-0x00007FF782FE0000-0x00007FF783334000-memory.dmp	UPX
behavioral2/memory/4652-139-0x00007FF7B9750000-0x00007FF7B9AA4000-memory.dmp	UPX
behavioral2/memory/3848-140-0x00007FF6EFFE0000-0x00007FF6F0334000-memory.dmp	UPX
behavioral2/memory/2600-141-0x00007FF660DE0000-0x00007FF661134000-memory.dmp	UPX
behavioral2/memory/2976-142-0x00007FF785CF0000-0x00007FF786044000-memory.dmp	UPX
behavioral2/memory/552-143-0x00007FF6DBB80000-0x00007FF6DBED4000-memory.dmp	UPX
behavioral2/memory/5084-144-0x00007FF6DC3E0000-0x00007FF6DC734000-memory.dmp	UPX
behavioral2/memory/5108-145-0x00007FF71BB60000-0x00007FF71BEB4000-memory.dmp	UPX
behavioral2/memory/1620-146-0x00007FF6E5F90000-0x00007FF6E62E4000-memory.dmp	UPX
behavioral2/memory/4984-148-0x00007FF730E20000-0x00007FF731174000-memory.dmp	UPX
behavioral2/memory/4796-147-0x00007FF7E3390000-0x00007FF7E36E4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2400-0-0x00007FF7CD620000-0x00007FF7CD974000-memory.dmp	xmrig
behavioral2/files/0x000900000002348b-6.dat	xmrig
behavioral2/memory/4652-8-0x00007FF7B9750000-0x00007FF7B9AA4000-memory.dmp	xmrig
behavioral2/files/0x000700000002349a-10.dat	xmrig
behavioral2/files/0x000700000002349b-11.dat	xmrig
behavioral2/memory/3848-14-0x00007FF6EFFE0000-0x00007FF6F0334000-memory.dmp	xmrig
behavioral2/files/0x000700000002349c-22.dat	xmrig
behavioral2/files/0x000700000002349e-35.dat	xmrig
behavioral2/memory/552-32-0x00007FF6DBB80000-0x00007FF6DBED4000-memory.dmp	xmrig
behavioral2/files/0x0009000000023493-40.dat	xmrig
behavioral2/memory/1620-48-0x00007FF6E5F90000-0x00007FF6E62E4000-memory.dmp	xmrig
behavioral2/files/0x00070000000234a0-49.dat	xmrig
behavioral2/files/0x00070000000234a1-58.dat	xmrig
behavioral2/files/0x00070000000234a2-60.dat	xmrig
behavioral2/files/0x00070000000234a3-66.dat	xmrig
behavioral2/files/0x00070000000234a4-70.dat	xmrig
behavioral2/files/0x00070000000234a5-73.dat	xmrig
behavioral2/memory/4104-81-0x00007FF609000000-0x00007FF609354000-memory.dmp	xmrig
behavioral2/files/0x00070000000234a6-86.dat	xmrig
behavioral2/memory/816-85-0x00007FF62E030000-0x00007FF62E384000-memory.dmp	xmrig
behavioral2/memory/4772-84-0x00007FF642B20000-0x00007FF642E74000-memory.dmp	xmrig
behavioral2/memory/4484-78-0x00007FF74BD40000-0x00007FF74C094000-memory.dmp	xmrig
behavioral2/memory/2400-77-0x00007FF7CD620000-0x00007FF7CD974000-memory.dmp	xmrig
behavioral2/memory/4984-57-0x00007FF730E20000-0x00007FF731174000-memory.dmp	xmrig
behavioral2/memory/4796-55-0x00007FF7E3390000-0x00007FF7E36E4000-memory.dmp	xmrig
behavioral2/memory/5108-46-0x00007FF71BB60000-0x00007FF71BEB4000-memory.dmp	xmrig
behavioral2/memory/5084-43-0x00007FF6DC3E0000-0x00007FF6DC734000-memory.dmp	xmrig
behavioral2/files/0x000700000002349d-30.dat	xmrig
behavioral2/memory/2976-26-0x00007FF785CF0000-0x00007FF786044000-memory.dmp	xmrig
behavioral2/memory/2600-20-0x00007FF660DE0000-0x00007FF661134000-memory.dmp	xmrig
behavioral2/files/0x00030000000229de-105.dat	xmrig
behavioral2/memory/4288-103-0x00007FF7C5800000-0x00007FF7C5B54000-memory.dmp	xmrig
behavioral2/memory/3848-102-0x00007FF6EFFE0000-0x00007FF6F0334000-memory.dmp	xmrig
behavioral2/files/0x000400000001e3ce-98.dat	xmrig
behavioral2/files/0x00070000000234a7-96.dat	xmrig
behavioral2/memory/3204-94-0x00007FF73D680000-0x00007FF73D9D4000-memory.dmp	xmrig
behavioral2/memory/4652-91-0x00007FF7B9750000-0x00007FF7B9AA4000-memory.dmp	xmrig
behavioral2/memory/3052-113-0x00007FF6F35F0000-0x00007FF6F3944000-memory.dmp	xmrig
behavioral2/files/0x0007000000022b23-117.dat	xmrig
behavioral2/memory/2108-118-0x00007FF782FE0000-0x00007FF783334000-memory.dmp	xmrig
behavioral2/memory/1576-114-0x00007FF7D1C10000-0x00007FF7D1F64000-memory.dmp	xmrig
behavioral2/files/0x00030000000229e0-111.dat	xmrig
behavioral2/memory/2600-109-0x00007FF660DE0000-0x00007FF661134000-memory.dmp	xmrig
behavioral2/files/0x00070000000234a8-128.dat	xmrig
behavioral2/memory/4496-130-0x00007FF762B70000-0x00007FF762EC4000-memory.dmp	xmrig
behavioral2/memory/632-131-0x00007FF6C5A80000-0x00007FF6C5DD4000-memory.dmp	xmrig
behavioral2/files/0x000900000002340f-124.dat	xmrig
behavioral2/memory/1620-132-0x00007FF6E5F90000-0x00007FF6E62E4000-memory.dmp	xmrig
behavioral2/memory/4984-134-0x00007FF730E20000-0x00007FF731174000-memory.dmp	xmrig
behavioral2/memory/4796-133-0x00007FF7E3390000-0x00007FF7E36E4000-memory.dmp	xmrig
behavioral2/memory/816-136-0x00007FF62E030000-0x00007FF62E384000-memory.dmp	xmrig
behavioral2/memory/4104-135-0x00007FF609000000-0x00007FF609354000-memory.dmp	xmrig
behavioral2/memory/3204-137-0x00007FF73D680000-0x00007FF73D9D4000-memory.dmp	xmrig
behavioral2/memory/2108-138-0x00007FF782FE0000-0x00007FF783334000-memory.dmp	xmrig
behavioral2/memory/4652-139-0x00007FF7B9750000-0x00007FF7B9AA4000-memory.dmp	xmrig
behavioral2/memory/3848-140-0x00007FF6EFFE0000-0x00007FF6F0334000-memory.dmp	xmrig
behavioral2/memory/2600-141-0x00007FF660DE0000-0x00007FF661134000-memory.dmp	xmrig
behavioral2/memory/2976-142-0x00007FF785CF0000-0x00007FF786044000-memory.dmp	xmrig
behavioral2/memory/552-143-0x00007FF6DBB80000-0x00007FF6DBED4000-memory.dmp	xmrig
behavioral2/memory/5084-144-0x00007FF6DC3E0000-0x00007FF6DC734000-memory.dmp	xmrig
behavioral2/memory/5108-145-0x00007FF71BB60000-0x00007FF71BEB4000-memory.dmp	xmrig
behavioral2/memory/1620-146-0x00007FF6E5F90000-0x00007FF6E62E4000-memory.dmp	xmrig
behavioral2/memory/4984-148-0x00007FF730E20000-0x00007FF731174000-memory.dmp	xmrig
behavioral2/memory/4796-147-0x00007FF7E3390000-0x00007FF7E36E4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4652	PgxrGPj.exe
3848	tNvdtFQ.exe
2600	oHFodYh.exe
2976	RoZlwnW.exe
552	bmdrvIr.exe
5084	ahrlGgQ.exe
5108	iCzFMyy.exe
1620	EcxYYxI.exe
4796	RhEJPKA.exe
4984	BRlcPBP.exe
4484	SdngpSC.exe
4104	OaxdPme.exe
4772	EcmRQrI.exe
816	fZsppsa.exe
3204	OdPdldG.exe
4288	OWrZxSp.exe
3052	ypbrbBN.exe
1576	zxDzRcO.exe
2108	qOVnMnY.exe
4496	ZVKdMct.exe
632	BWtDITs.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2400-0-0x00007FF7CD620000-0x00007FF7CD974000-memory.dmp	upx
behavioral2/files/0x000900000002348b-6.dat	upx
behavioral2/memory/4652-8-0x00007FF7B9750000-0x00007FF7B9AA4000-memory.dmp	upx
behavioral2/files/0x000700000002349a-10.dat	upx
behavioral2/files/0x000700000002349b-11.dat	upx
behavioral2/memory/3848-14-0x00007FF6EFFE0000-0x00007FF6F0334000-memory.dmp	upx
behavioral2/files/0x000700000002349c-22.dat	upx
behavioral2/files/0x000700000002349e-35.dat	upx
behavioral2/memory/552-32-0x00007FF6DBB80000-0x00007FF6DBED4000-memory.dmp	upx
behavioral2/files/0x0009000000023493-40.dat	upx
behavioral2/memory/1620-48-0x00007FF6E5F90000-0x00007FF6E62E4000-memory.dmp	upx
behavioral2/files/0x00070000000234a0-49.dat	upx
behavioral2/files/0x00070000000234a1-58.dat	upx
behavioral2/files/0x00070000000234a2-60.dat	upx
behavioral2/files/0x00070000000234a3-66.dat	upx
behavioral2/files/0x00070000000234a4-70.dat	upx
behavioral2/files/0x00070000000234a5-73.dat	upx
behavioral2/memory/4104-81-0x00007FF609000000-0x00007FF609354000-memory.dmp	upx
behavioral2/files/0x00070000000234a6-86.dat	upx
behavioral2/memory/816-85-0x00007FF62E030000-0x00007FF62E384000-memory.dmp	upx
behavioral2/memory/4772-84-0x00007FF642B20000-0x00007FF642E74000-memory.dmp	upx
behavioral2/memory/4484-78-0x00007FF74BD40000-0x00007FF74C094000-memory.dmp	upx
behavioral2/memory/2400-77-0x00007FF7CD620000-0x00007FF7CD974000-memory.dmp	upx
behavioral2/memory/4984-57-0x00007FF730E20000-0x00007FF731174000-memory.dmp	upx
behavioral2/memory/4796-55-0x00007FF7E3390000-0x00007FF7E36E4000-memory.dmp	upx
behavioral2/memory/5108-46-0x00007FF71BB60000-0x00007FF71BEB4000-memory.dmp	upx
behavioral2/memory/5084-43-0x00007FF6DC3E0000-0x00007FF6DC734000-memory.dmp	upx
behavioral2/files/0x000700000002349d-30.dat	upx
behavioral2/memory/2976-26-0x00007FF785CF0000-0x00007FF786044000-memory.dmp	upx
behavioral2/memory/2600-20-0x00007FF660DE0000-0x00007FF661134000-memory.dmp	upx
behavioral2/files/0x00030000000229de-105.dat	upx
behavioral2/memory/4288-103-0x00007FF7C5800000-0x00007FF7C5B54000-memory.dmp	upx
behavioral2/memory/3848-102-0x00007FF6EFFE0000-0x00007FF6F0334000-memory.dmp	upx
behavioral2/files/0x000400000001e3ce-98.dat	upx
behavioral2/files/0x00070000000234a7-96.dat	upx
behavioral2/memory/3204-94-0x00007FF73D680000-0x00007FF73D9D4000-memory.dmp	upx
behavioral2/memory/4652-91-0x00007FF7B9750000-0x00007FF7B9AA4000-memory.dmp	upx
behavioral2/memory/3052-113-0x00007FF6F35F0000-0x00007FF6F3944000-memory.dmp	upx
behavioral2/files/0x0007000000022b23-117.dat	upx
behavioral2/memory/2108-118-0x00007FF782FE0000-0x00007FF783334000-memory.dmp	upx
behavioral2/memory/1576-114-0x00007FF7D1C10000-0x00007FF7D1F64000-memory.dmp	upx
behavioral2/files/0x00030000000229e0-111.dat	upx
behavioral2/memory/2600-109-0x00007FF660DE0000-0x00007FF661134000-memory.dmp	upx
behavioral2/files/0x00070000000234a8-128.dat	upx
behavioral2/memory/4496-130-0x00007FF762B70000-0x00007FF762EC4000-memory.dmp	upx
behavioral2/memory/632-131-0x00007FF6C5A80000-0x00007FF6C5DD4000-memory.dmp	upx
behavioral2/files/0x000900000002340f-124.dat	upx
behavioral2/memory/1620-132-0x00007FF6E5F90000-0x00007FF6E62E4000-memory.dmp	upx
behavioral2/memory/4984-134-0x00007FF730E20000-0x00007FF731174000-memory.dmp	upx
behavioral2/memory/4796-133-0x00007FF7E3390000-0x00007FF7E36E4000-memory.dmp	upx
behavioral2/memory/816-136-0x00007FF62E030000-0x00007FF62E384000-memory.dmp	upx
behavioral2/memory/4104-135-0x00007FF609000000-0x00007FF609354000-memory.dmp	upx
behavioral2/memory/3204-137-0x00007FF73D680000-0x00007FF73D9D4000-memory.dmp	upx
behavioral2/memory/2108-138-0x00007FF782FE0000-0x00007FF783334000-memory.dmp	upx
behavioral2/memory/4652-139-0x00007FF7B9750000-0x00007FF7B9AA4000-memory.dmp	upx
behavioral2/memory/3848-140-0x00007FF6EFFE0000-0x00007FF6F0334000-memory.dmp	upx
behavioral2/memory/2600-141-0x00007FF660DE0000-0x00007FF661134000-memory.dmp	upx
behavioral2/memory/2976-142-0x00007FF785CF0000-0x00007FF786044000-memory.dmp	upx
behavioral2/memory/552-143-0x00007FF6DBB80000-0x00007FF6DBED4000-memory.dmp	upx
behavioral2/memory/5084-144-0x00007FF6DC3E0000-0x00007FF6DC734000-memory.dmp	upx
behavioral2/memory/5108-145-0x00007FF71BB60000-0x00007FF71BEB4000-memory.dmp	upx
behavioral2/memory/1620-146-0x00007FF6E5F90000-0x00007FF6E62E4000-memory.dmp	upx
behavioral2/memory/4984-148-0x00007FF730E20000-0x00007FF731174000-memory.dmp	upx
behavioral2/memory/4796-147-0x00007FF7E3390000-0x00007FF7E36E4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\ahrlGgQ.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iCzFMyy.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OaxdPme.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EcmRQrI.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fZsppsa.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OWrZxSp.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PgxrGPj.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RoZlwnW.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bmdrvIr.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SdngpSC.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OdPdldG.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ypbrbBN.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zxDzRcO.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BWtDITs.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tNvdtFQ.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RhEJPKA.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oHFodYh.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BRlcPBP.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qOVnMnY.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZVKdMct.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EcxYYxI.exe	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 4652	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	84
PID 2400 wrote to memory of 4652	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	84
PID 2400 wrote to memory of 3848	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	85
PID 2400 wrote to memory of 3848	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	85
PID 2400 wrote to memory of 2600	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	86
PID 2400 wrote to memory of 2600	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	86
PID 2400 wrote to memory of 2976	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	90
PID 2400 wrote to memory of 2976	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	90
PID 2400 wrote to memory of 552	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	91
PID 2400 wrote to memory of 552	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	91
PID 2400 wrote to memory of 5084	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	92
PID 2400 wrote to memory of 5084	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	92
PID 2400 wrote to memory of 5108	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	93
PID 2400 wrote to memory of 5108	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	93
PID 2400 wrote to memory of 1620	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	94
PID 2400 wrote to memory of 1620	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	94
PID 2400 wrote to memory of 4796	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	95
PID 2400 wrote to memory of 4796	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	95
PID 2400 wrote to memory of 4984	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	96
PID 2400 wrote to memory of 4984	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	96
PID 2400 wrote to memory of 4484	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	97
PID 2400 wrote to memory of 4484	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	97
PID 2400 wrote to memory of 4104	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	98
PID 2400 wrote to memory of 4104	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	98
PID 2400 wrote to memory of 4772	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	99
PID 2400 wrote to memory of 4772	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	99
PID 2400 wrote to memory of 816	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	100
PID 2400 wrote to memory of 816	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	100
PID 2400 wrote to memory of 3204	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	101
PID 2400 wrote to memory of 3204	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	101
PID 2400 wrote to memory of 4288	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	102
PID 2400 wrote to memory of 4288	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	102
PID 2400 wrote to memory of 3052	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	103
PID 2400 wrote to memory of 3052	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	103
PID 2400 wrote to memory of 1576	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	104
PID 2400 wrote to memory of 1576	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	104
PID 2400 wrote to memory of 2108	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	107
PID 2400 wrote to memory of 2108	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	107
PID 2400 wrote to memory of 4496	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	108
PID 2400 wrote to memory of 4496	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	108
PID 2400 wrote to memory of 632	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	110
PID 2400 wrote to memory of 632	2400	2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe	110

C:\Users\Admin\AppData\Local\Temp\2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-28_7124c8a9b3c707795c7c3547bd4f0024_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\System\PgxrGPj.exe
  C:\Windows\System\PgxrGPj.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\tNvdtFQ.exe
  C:\Windows\System\tNvdtFQ.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\oHFodYh.exe
  C:\Windows\System\oHFodYh.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\RoZlwnW.exe
  C:\Windows\System\RoZlwnW.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\bmdrvIr.exe
  C:\Windows\System\bmdrvIr.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\ahrlGgQ.exe
  C:\Windows\System\ahrlGgQ.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\iCzFMyy.exe
  C:\Windows\System\iCzFMyy.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\EcxYYxI.exe
  C:\Windows\System\EcxYYxI.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\RhEJPKA.exe
  C:\Windows\System\RhEJPKA.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\BRlcPBP.exe
  C:\Windows\System\BRlcPBP.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\SdngpSC.exe
  C:\Windows\System\SdngpSC.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\OaxdPme.exe
  C:\Windows\System\OaxdPme.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\EcmRQrI.exe
  C:\Windows\System\EcmRQrI.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\fZsppsa.exe
  C:\Windows\System\fZsppsa.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\OdPdldG.exe
  C:\Windows\System\OdPdldG.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\OWrZxSp.exe
  C:\Windows\System\OWrZxSp.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\ypbrbBN.exe
  C:\Windows\System\ypbrbBN.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\zxDzRcO.exe
  C:\Windows\System\zxDzRcO.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\qOVnMnY.exe
  C:\Windows\System\qOVnMnY.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\ZVKdMct.exe
  C:\Windows\System\ZVKdMct.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\BWtDITs.exe
  C:\Windows\System\BWtDITs.exe
  2⤵
  - Executes dropped EXE
  PID:632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BRlcPBP.exe

Path C:\Windows\System\BRlcPBP.exe
Size 5.9MB
SHA256 0f39fbb22b4f64c2c34ff1b3547f58d1519469ee69b56ea5e9faa469d92d1553
MD5 181a933c5cd591d0883103f1d50f8396
SHA1 c6befe05db124e9e3225b449dab77b9ededb5acd
SHA512 7b6444c3d1fdbcd3a808f4e7529f082824beed35e493a716aedaf9def2d7b3def2fd41d6ef8fe75c7790b64ff98132bf8d7eaff1934fd3ce8fbc9d6fe4f2dc7a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

BWtDITs.exe

Path C:\Windows\System\BWtDITs.exe
Size 5.9MB
SHA256 5878f19a25055a9a3f49265fb44781640904ac0b9290daf5dfaae78ab69e443c
MD5 e603c1b03f6589e6909b577d8679100a
SHA1 8208f5afafece3613a9d149f1e4711c0358a7292
SHA512 481c061f5115559d074557622468c356ef44dd29170c53e724d2a02d283aa8e3ea20782913d671a57437ee06a9971143d1b3ddf6c109b7933a41db88353d4788
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

EcmRQrI.exe

Path C:\Windows\System\EcmRQrI.exe
Size 5.9MB
SHA256 4db7620c8720079a221167f88db84fa2ab6807d80fc0b226a245a3f8422f377e
MD5 a4e836ad86efe2b384f80e493158a9ef
SHA1 97ccec320a2423aca2461aa7922a60499f1535cf
SHA512 f808294e00611a6ff8a9f3d84bd838a7ce7f882cf77aa3a60f71402ef3bd3cb6f715507488437867b6aac769108ab6c545a0eb559500b0d4d99a87fa5078ed4a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

EcxYYxI.exe

Path C:\Windows\System\EcxYYxI.exe
Size 5.9MB
SHA256 778e1a1f38f660b334b4bd839b18a04cbf149b0e2756cf06fdf6bc88479ab482
MD5 08d52bd8428f28586c5467e8244429ee
SHA1 e429cfa0d4ae6820eecbecb78167dd28d32ee490
SHA512 e3665efdbe00efaf543e6e42b2d9e243c0841da8866397180de45b85ea9ad63be398ab9d413564efd09530f1384f2a1afe41c813b2f23c15fdee0a4609cb6496
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

OWrZxSp.exe

Path C:\Windows\System\OWrZxSp.exe
Size 5.9MB
SHA256 1f2f2ee888276603ce32ca1ab1cb6ebe9f75b9cefc7e4c7445fae6a65cceebef
MD5 f6072d2219cc31eb12ea82e2fbe73198
SHA1 3022be6236686239e5d703cdd10db60634ee411f
SHA512 e3b5fcca9e30888bb56a10d5f4a79e89e502a576e45018fe0d256f061b0be1097dc7a1653a986b3f379763abe4559886092f2b52ac1d1fdd59f2ed6061665261
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:Q+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

OaxdPme.exe

Path C:\Windows\System\OaxdPme.exe
Size 5.9MB
SHA256 aa3a5a1b0f9c04913779eb2fc3a16848f8dc4c851d461cce133cbb4e7a56cf0f
MD5 4844a56f486049fc69ef2938dd5e1232
SHA1 3b075b3d76b95f6edc050130cfa1aeef67cf3bba
SHA512 7fb2c7b3c3124640254a668c9ba950919ff26c3829558c4a70b187abd3538c906631764373f453797f767b6d9fc72e4b17a64903a66e1cfaf8a95f8ec2384102
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

OdPdldG.exe

Path C:\Windows\System\OdPdldG.exe
Size 5.9MB
SHA256 5a66fc52d585103bd113659986048b6a48bdf756f4f4566f47b36d92ec846573
MD5 8eb14c291ce4606b510a8c58f40b473b
SHA1 691eced1bd3ad0b2fd1067862e724f30f05d5a94
SHA512 9a37acfad9af93be0bf08b5d628fab962a753fa366b3a5e07b06453f90462bc2b15b56cd87c4999118bdae7dc7edbf7890b5f586bcc12555d1c456acb7aabf97
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

PgxrGPj.exe

Path C:\Windows\System\PgxrGPj.exe
Size 5.9MB
SHA256 25bb6fa16d4f12660b54a5ed91dff7b7a3043bd1418636a883f1268a9e97e0f8
MD5 8f2f4ccd276a8e35f7f8b16c69f4bc39
SHA1 5ef74a031d2fe11b5d4d4eb79bff3f59c549ee77
SHA512 1bf0913ec8de12adda48cc12d7ad62a8f565f0ed52ebeb5fb1643a844eb8e4c7b974ba7580ca23fed51b126d45085626d752c0ca75d81231382bf1604c99b882
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

RhEJPKA.exe

Path C:\Windows\System\RhEJPKA.exe
Size 5.9MB
SHA256 aba6884bb8d3ac2a4cc97597753d77c8eef041bbd83d0b11384dd1fc832057f4
MD5 c16f686558cd5b2d6630fd17bd1dd298
SHA1 4602333f7523d7aeae250cded7625595343cbb1b
SHA512 16b12bd03dff05077dedd96e4f8dccadccc327ae650faab4c03d643c63a5a790800651e069d7d3d4b96dcb7d851ca8e6d06b0b057d5a6596887ca793da679f56
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

RoZlwnW.exe

Path C:\Windows\System\RoZlwnW.exe
Size 5.9MB
SHA256 47927ce7beaa2dd2d33faec98a3c6202be32c8a3acfa7cc21ebe38b0571f778d
MD5 a0677aa0bb62b3232832cb589de67919
SHA1 5fd307d137ba3e74e83414c2bc87f68e6b88c2d0
SHA512 ee5fb26130578c4abd7b8d9ed082d6d5c0e2e0562a9dd5e5586a4d917cbcddb7cf7c04eb4a11710d8817a99950dec8cdb78a6360b69792bd114a0c22e9d23512
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

SdngpSC.exe

Path C:\Windows\System\SdngpSC.exe
Size 5.9MB
SHA256 725f8148c7b5dc2db95f163db5a212a1952055ec4a1ecfbe6a9ef56d82744496
MD5 4c77ff5cd57ab701bd5ca4f061fa041c
SHA1 ed4b2299c84edc812c2aff1a48db250a3279fbbc
SHA512 d6328111d762ed135ce01a81989dd16b3dbe5ae21765afc770474d8c2a0b31b10a5cc712d95b2bb93eddf5c54e1b665efa4dccc65b7618231298648feff3bf5f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZVKdMct.exe

Path C:\Windows\System\ZVKdMct.exe
Size 5.9MB
SHA256 d63fe702ee51af2c168721897834aabd576ee9bbe9fe48c1edb26471af27a4d1
MD5 065eba395f4a9332b52417d269f93c68
SHA1 4fc99286b3935a2486b827f710e4615fd0c8e56c
SHA512 c89219be97e1347a5b9080711225cf22345d9b88cf8bb241fae379d4faa3c09a4f7a6ebe41ecd1f669ae6145cd6e61d9aa22357f26c98a72525050226f6c33ca
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

ahrlGgQ.exe

Path C:\Windows\System\ahrlGgQ.exe
Size 5.9MB
SHA256 24f21945d241840bd300088fb0f05ea97b7a61f76dd838e967935c37960233eb
MD5 6141bc4bd3448d4b9e777c9071341abc
SHA1 04a017af8c22085a44a19703b29d24c555089cea
SHA512 d61c0f6582871c2793c1c6fbb9531f1441598e1b47145fb57f942d2f09222390c4da6158c06927587b2eda1c67006b469f4ffdf76f71f69d7dd67e7718c518cf
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

bmdrvIr.exe

Path C:\Windows\System\bmdrvIr.exe
Size 5.9MB
SHA256 b9400fd6b4e970aa9f73df8f038e7b3c1deab2162d151ff608bac20d2b2cb788
MD5 c9f3ae2f8c087d7aaa1580d954e5e2d0
SHA1 c905346f906585d9083a068615ab6df4fbd4fd73
SHA512 607056c773b3de527760aff2ce994dc43079a91208b8f5578fa1603e14684d3181547502c1605b5b922ec429a243c6a00056a3a0068bd0395e5e5f67a5573471
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

fZsppsa.exe

Path C:\Windows\System\fZsppsa.exe
Size 5.9MB
SHA256 2221541d78c0d1e0636014f9a0ee8448ad547346a62347fc6f0b8a58a5f6ca6c
MD5 cdf4635f044911ef98ca389cff25c25a
SHA1 dde3b2187eca983c0c270864b4cf78d081b42382
SHA512 5529b2ce04323c907da8c15422a92d74c091d18dd8af076ad0fc3f3ee5b4a31a5106e2b5a77be2e3916a2a5887c2a20c6baccb7c00c73ae962f8ceefa7d2bc7a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

iCzFMyy.exe

Path C:\Windows\System\iCzFMyy.exe
Size 5.9MB
SHA256 f2069afc6994273fc20756ffadc595f3aa508fbfbbe991b4a4570d4418561b25
MD5 79bdbe6214784375aa4456f8d1d54f70
SHA1 ab59a558bf943040e1a9316fc3abade0c5b2120e
SHA512 2e9d6354ec40c89bbef9bfad82c5a39f789fb43ac933a8da28e2c54ef88a7e1173f63a6ebab823e8bd434d9456c8d7e9fac359a61085e4e4faeaef769ffcaeb2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

oHFodYh.exe

Path C:\Windows\System\oHFodYh.exe
Size 5.9MB
SHA256 479854b666d2cf870d1310342243e0107ad867e8ad73286220f716678d69fb83
MD5 034246c4929d8ca50cdfa470bd9811be
SHA1 0c6c9390dee284acf9178fc71c03bf1cff033dbe
SHA512 801af6f34c3e430fe8da138d62206bf516486cfcaad550081a1230139b38a399d7332b56d36479fdfb16a9d8d19c4d37e7fc67b592a3fb3cd097f39ab8a62638
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

qOVnMnY.exe

Path C:\Windows\System\qOVnMnY.exe
Size 5.9MB
SHA256 d45b9505f9bae74dfa4a04b8b345266505352b6d53c5b000880c9d38640d4d5a
MD5 ad5b47804ba94d7fcbbffd3057c3c27d
SHA1 1c85766fc55bc810dda8378d574dd217d754efdd
SHA512 ffe129a1fbbd2e7b1c0bbefae700c5fc78741a500f258ae3c33b3432c854db1a87dff40db2b8f973ad8740bb29ee42b4a29e5b81a66b7b2e5604e068fdd13e98
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

tNvdtFQ.exe

Path C:\Windows\System\tNvdtFQ.exe
Size 5.9MB
SHA256 bf43efce98130624cbae8c82e7e63a2ebd2c1348d3aa9fc2e7c23b427c582694
MD5 9372c1ef71c03cc10758839c2db5bb21
SHA1 d199de6701889068501ebc23baf7809f84bd490f
SHA512 e17dc3a7d3a0a7d819bc360d79ed8e1d386c8ea7b88a9826ba420e1fc28f35789666e7383813e882d782aebf212f4156613375a096f6491b94961587612d0a4e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

ypbrbBN.exe

Path C:\Windows\System\ypbrbBN.exe
Size 5.9MB
SHA256 dbcff29469b4d1918189d783a9662015da6dba17b1480190f868fee2c25ef7e3
MD5 0190c85e9ffc8bfe434a8bfe5cafdb2f
SHA1 1f0faed41d01431c87c4e51941e83be69b499e51
SHA512 4939511ffcd1b75badc42ba4d2dbcd48b8194622badae6ede156b4a59fc276624c1c9552e4563079c1ad0fc83ac11d998e034f2f5907a4f86fed2ce344076f33
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

zxDzRcO.exe

Path C:\Windows\System\zxDzRcO.exe
Size 5.9MB
SHA256 36124fd4cfb2a79d03843308068fd7531efe6455fd29ea91d15cde3586017328
MD5 be335c994c817aa182dfd3cd592c2a5f
SHA1 02e1c1dbd7d2bbdac1f5809b6f6e0b26ad15b6cb
SHA512 b9e0fcb04328cf022c572690ac59e8d97c8bdeb4a2cff8bd9f61b849a915ed8a157cee15a77292d27fe6641e14f85aad9f7ee49c846a292ff8f99695d2db3581
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/552-32-0x00007FF6DBB80000-0x00007FF6DBED4000-memory.dmp

Download

memory/552-143-0x00007FF6DBB80000-0x00007FF6DBED4000-memory.dmp

Download

memory/632-131-0x00007FF6C5A80000-0x00007FF6C5DD4000-memory.dmp

Download

memory/632-159-0x00007FF6C5A80000-0x00007FF6C5DD4000-memory.dmp

Download

memory/816-85-0x00007FF62E030000-0x00007FF62E384000-memory.dmp

Download

memory/816-136-0x00007FF62E030000-0x00007FF62E384000-memory.dmp

Download

memory/816-152-0x00007FF62E030000-0x00007FF62E384000-memory.dmp

Download

memory/1576-156-0x00007FF7D1C10000-0x00007FF7D1F64000-memory.dmp

Download

memory/1576-114-0x00007FF7D1C10000-0x00007FF7D1F64000-memory.dmp

Download

memory/1620-132-0x00007FF6E5F90000-0x00007FF6E62E4000-memory.dmp

Download

memory/1620-146-0x00007FF6E5F90000-0x00007FF6E62E4000-memory.dmp

Download

memory/1620-48-0x00007FF6E5F90000-0x00007FF6E62E4000-memory.dmp

Download

memory/2108-138-0x00007FF782FE0000-0x00007FF783334000-memory.dmp

Download

memory/2108-157-0x00007FF782FE0000-0x00007FF783334000-memory.dmp

Download

memory/2108-118-0x00007FF782FE0000-0x00007FF783334000-memory.dmp

Download

memory/2400-0-0x00007FF7CD620000-0x00007FF7CD974000-memory.dmp

Download

memory/2400-77-0x00007FF7CD620000-0x00007FF7CD974000-memory.dmp

Download

memory/2400-1-0x00000171CE160000-0x00000171CE170000-memory.dmp

Download

memory/2600-20-0x00007FF660DE0000-0x00007FF661134000-memory.dmp

Download

memory/2600-109-0x00007FF660DE0000-0x00007FF661134000-memory.dmp

Download

memory/2600-141-0x00007FF660DE0000-0x00007FF661134000-memory.dmp

Download

memory/2976-142-0x00007FF785CF0000-0x00007FF786044000-memory.dmp

Download

memory/2976-26-0x00007FF785CF0000-0x00007FF786044000-memory.dmp

Download

memory/3052-155-0x00007FF6F35F0000-0x00007FF6F3944000-memory.dmp

Download

memory/3052-113-0x00007FF6F35F0000-0x00007FF6F3944000-memory.dmp

Download

memory/3204-137-0x00007FF73D680000-0x00007FF73D9D4000-memory.dmp

Download

memory/3204-94-0x00007FF73D680000-0x00007FF73D9D4000-memory.dmp

Download

memory/3204-153-0x00007FF73D680000-0x00007FF73D9D4000-memory.dmp

Download

memory/3848-14-0x00007FF6EFFE0000-0x00007FF6F0334000-memory.dmp

Download

memory/3848-102-0x00007FF6EFFE0000-0x00007FF6F0334000-memory.dmp

Download

memory/3848-140-0x00007FF6EFFE0000-0x00007FF6F0334000-memory.dmp

Download

memory/4104-151-0x00007FF609000000-0x00007FF609354000-memory.dmp

Download

memory/4104-135-0x00007FF609000000-0x00007FF609354000-memory.dmp

Download

memory/4104-81-0x00007FF609000000-0x00007FF609354000-memory.dmp

Download

memory/4288-103-0x00007FF7C5800000-0x00007FF7C5B54000-memory.dmp

Download

memory/4288-154-0x00007FF7C5800000-0x00007FF7C5B54000-memory.dmp

Download

memory/4484-78-0x00007FF74BD40000-0x00007FF74C094000-memory.dmp

Download

memory/4484-149-0x00007FF74BD40000-0x00007FF74C094000-memory.dmp

Download

memory/4496-158-0x00007FF762B70000-0x00007FF762EC4000-memory.dmp

Download

memory/4496-130-0x00007FF762B70000-0x00007FF762EC4000-memory.dmp

Download

memory/4652-91-0x00007FF7B9750000-0x00007FF7B9AA4000-memory.dmp

Download

memory/4652-139-0x00007FF7B9750000-0x00007FF7B9AA4000-memory.dmp

Download

memory/4652-8-0x00007FF7B9750000-0x00007FF7B9AA4000-memory.dmp

Download

memory/4772-150-0x00007FF642B20000-0x00007FF642E74000-memory.dmp

Download

memory/4772-84-0x00007FF642B20000-0x00007FF642E74000-memory.dmp

Download

memory/4796-55-0x00007FF7E3390000-0x00007FF7E36E4000-memory.dmp

Download

memory/4796-147-0x00007FF7E3390000-0x00007FF7E36E4000-memory.dmp

Download

memory/4796-133-0x00007FF7E3390000-0x00007FF7E36E4000-memory.dmp

Download

memory/4984-134-0x00007FF730E20000-0x00007FF731174000-memory.dmp

Download

memory/4984-148-0x00007FF730E20000-0x00007FF731174000-memory.dmp

Download

memory/4984-57-0x00007FF730E20000-0x00007FF731174000-memory.dmp

Download

memory/5084-144-0x00007FF6DC3E0000-0x00007FF6DC734000-memory.dmp

Download

memory/5084-43-0x00007FF6DC3E0000-0x00007FF6DC734000-memory.dmp

Download

memory/5108-145-0x00007FF71BB60000-0x00007FF71BEB4000-memory.dmp

Download

memory/5108-46-0x00007FF71BB60000-0x00007FF71BEB4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads