cobaltstrike | fe822c0360132e44e5419e85b4063c7d3fd4e72eefee3154f0801664f4d2e468

Analysis

max time kernel
134s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 01:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240528-bhvfvsab32
SHA256 fe822c0360132e44e5419e85b4063c7d3fd4e72eefee3154f0801664f4d2e468
MD5 95ac2b862a501799118324d79d98ce3e
SHA1 826ca2b9fd62c2f3cd4cb40c478f735a4952933f
SHA512 616579d3bd0befdc7e8a11f4bdd43da0f6958f829b39a4ade3e5e8f945a7c22d24c5f9fd453ba05672817dbe3ec2ae53b2515cb2f1e7e62a52e678faf37287cf
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000a000000023400-5.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341b-10.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341c-11.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341d-23.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341f-31.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023420-37.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341e-39.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023421-50.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023418-53.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023423-60.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023424-67.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023426-78.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342d-118.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342c-116.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342b-110.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342a-106.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023429-102.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023428-94.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023427-88.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023425-76.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023422-61.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023400-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341b-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341c-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341d-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341f-31.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023420-37.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341e-39.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023421-50.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023418-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023423-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023424-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023426-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342d-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342c-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342b-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342a-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023429-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023428-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023427-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023425-76.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023422-61.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2020-0-0x00007FF78F7C0000-0x00007FF78FB14000-memory.dmp	UPX
behavioral2/files/0x000a000000023400-5.dat	UPX
behavioral2/files/0x000700000002341b-10.dat	UPX
behavioral2/files/0x000700000002341c-11.dat	UPX
behavioral2/memory/4264-18-0x00007FF786CF0000-0x00007FF787044000-memory.dmp	UPX
behavioral2/files/0x000700000002341d-23.dat	UPX
behavioral2/memory/5020-26-0x00007FF7599F0000-0x00007FF759D44000-memory.dmp	UPX
behavioral2/files/0x000700000002341f-31.dat	UPX
behavioral2/files/0x0007000000023420-37.dat	UPX
behavioral2/files/0x000700000002341e-39.dat	UPX
behavioral2/files/0x0007000000023421-50.dat	UPX
behavioral2/files/0x0008000000023418-53.dat	UPX
behavioral2/files/0x0007000000023423-60.dat	UPX
behavioral2/files/0x0007000000023424-67.dat	UPX
behavioral2/files/0x0007000000023426-78.dat	UPX
behavioral2/memory/4276-101-0x00007FF69F390000-0x00007FF69F6E4000-memory.dmp	UPX
behavioral2/memory/4524-114-0x00007FF6549B0000-0x00007FF654D04000-memory.dmp	UPX
behavioral2/memory/4864-123-0x00007FF690710000-0x00007FF690A64000-memory.dmp	UPX
behavioral2/memory/2400-127-0x00007FF64E650000-0x00007FF64E9A4000-memory.dmp	UPX
behavioral2/memory/4364-126-0x00007FF752330000-0x00007FF752684000-memory.dmp	UPX
behavioral2/memory/4540-125-0x00007FF64F500000-0x00007FF64F854000-memory.dmp	UPX
behavioral2/memory/1916-124-0x00007FF6A8280000-0x00007FF6A85D4000-memory.dmp	UPX
behavioral2/memory/4344-122-0x00007FF66DB70000-0x00007FF66DEC4000-memory.dmp	UPX
behavioral2/memory/3304-121-0x00007FF78A800000-0x00007FF78AB54000-memory.dmp	UPX
behavioral2/memory/4872-120-0x00007FF66D460000-0x00007FF66D7B4000-memory.dmp	UPX
behavioral2/files/0x000700000002342d-118.dat	UPX
behavioral2/files/0x000700000002342c-116.dat	UPX
behavioral2/memory/1704-115-0x00007FF7C5FC0000-0x00007FF7C6314000-memory.dmp	UPX
behavioral2/files/0x000700000002342b-110.dat	UPX
behavioral2/memory/2740-109-0x00007FF762710000-0x00007FF762A64000-memory.dmp	UPX
behavioral2/files/0x000700000002342a-106.dat	UPX
behavioral2/files/0x0007000000023429-102.dat	UPX
behavioral2/memory/3132-100-0x00007FF648770000-0x00007FF648AC4000-memory.dmp	UPX
behavioral2/memory/2544-97-0x00007FF6EF3E0000-0x00007FF6EF734000-memory.dmp	UPX
behavioral2/files/0x0007000000023428-94.dat	UPX
behavioral2/files/0x0007000000023427-88.dat	UPX
behavioral2/files/0x0007000000023425-76.dat	UPX
behavioral2/files/0x0007000000023422-61.dat	UPX
behavioral2/memory/1828-43-0x00007FF6F24F0000-0x00007FF6F2844000-memory.dmp	UPX
behavioral2/memory/1252-38-0x00007FF7C0AA0000-0x00007FF7C0DF4000-memory.dmp	UPX
behavioral2/memory/3576-35-0x00007FF6365C0000-0x00007FF636914000-memory.dmp	UPX
behavioral2/memory/1124-32-0x00007FF6C8910000-0x00007FF6C8C64000-memory.dmp	UPX
behavioral2/memory/620-9-0x00007FF7FCA60000-0x00007FF7FCDB4000-memory.dmp	UPX
behavioral2/memory/2020-128-0x00007FF78F7C0000-0x00007FF78FB14000-memory.dmp	UPX
behavioral2/memory/620-129-0x00007FF7FCA60000-0x00007FF7FCDB4000-memory.dmp	UPX
behavioral2/memory/3576-130-0x00007FF6365C0000-0x00007FF636914000-memory.dmp	UPX
behavioral2/memory/1252-131-0x00007FF7C0AA0000-0x00007FF7C0DF4000-memory.dmp	UPX
behavioral2/memory/1828-132-0x00007FF6F24F0000-0x00007FF6F2844000-memory.dmp	UPX
behavioral2/memory/620-133-0x00007FF7FCA60000-0x00007FF7FCDB4000-memory.dmp	UPX
behavioral2/memory/4264-134-0x00007FF786CF0000-0x00007FF787044000-memory.dmp	UPX
behavioral2/memory/5020-135-0x00007FF7599F0000-0x00007FF759D44000-memory.dmp	UPX
behavioral2/memory/1124-136-0x00007FF6C8910000-0x00007FF6C8C64000-memory.dmp	UPX
behavioral2/memory/1252-137-0x00007FF7C0AA0000-0x00007FF7C0DF4000-memory.dmp	UPX
behavioral2/memory/3576-138-0x00007FF6365C0000-0x00007FF636914000-memory.dmp	UPX
behavioral2/memory/3132-139-0x00007FF648770000-0x00007FF648AC4000-memory.dmp	UPX
behavioral2/memory/1828-141-0x00007FF6F24F0000-0x00007FF6F2844000-memory.dmp	UPX
behavioral2/memory/2544-140-0x00007FF6EF3E0000-0x00007FF6EF734000-memory.dmp	UPX
behavioral2/memory/4276-142-0x00007FF69F390000-0x00007FF69F6E4000-memory.dmp	UPX
behavioral2/memory/4524-145-0x00007FF6549B0000-0x00007FF654D04000-memory.dmp	UPX
behavioral2/memory/1704-144-0x00007FF7C5FC0000-0x00007FF7C6314000-memory.dmp	UPX
behavioral2/memory/2740-146-0x00007FF762710000-0x00007FF762A64000-memory.dmp	UPX
behavioral2/memory/4540-143-0x00007FF64F500000-0x00007FF64F854000-memory.dmp	UPX
behavioral2/memory/4344-147-0x00007FF66DB70000-0x00007FF66DEC4000-memory.dmp	UPX
behavioral2/memory/4872-149-0x00007FF66D460000-0x00007FF66D7B4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2020-0-0x00007FF78F7C0000-0x00007FF78FB14000-memory.dmp	xmrig
behavioral2/files/0x000a000000023400-5.dat	xmrig
behavioral2/files/0x000700000002341b-10.dat	xmrig
behavioral2/files/0x000700000002341c-11.dat	xmrig
behavioral2/memory/4264-18-0x00007FF786CF0000-0x00007FF787044000-memory.dmp	xmrig
behavioral2/files/0x000700000002341d-23.dat	xmrig
behavioral2/memory/5020-26-0x00007FF7599F0000-0x00007FF759D44000-memory.dmp	xmrig
behavioral2/files/0x000700000002341f-31.dat	xmrig
behavioral2/files/0x0007000000023420-37.dat	xmrig
behavioral2/files/0x000700000002341e-39.dat	xmrig
behavioral2/files/0x0007000000023421-50.dat	xmrig
behavioral2/files/0x0008000000023418-53.dat	xmrig
behavioral2/files/0x0007000000023423-60.dat	xmrig
behavioral2/files/0x0007000000023424-67.dat	xmrig
behavioral2/files/0x0007000000023426-78.dat	xmrig
behavioral2/memory/4276-101-0x00007FF69F390000-0x00007FF69F6E4000-memory.dmp	xmrig
behavioral2/memory/4524-114-0x00007FF6549B0000-0x00007FF654D04000-memory.dmp	xmrig
behavioral2/memory/4864-123-0x00007FF690710000-0x00007FF690A64000-memory.dmp	xmrig
behavioral2/memory/2400-127-0x00007FF64E650000-0x00007FF64E9A4000-memory.dmp	xmrig
behavioral2/memory/4364-126-0x00007FF752330000-0x00007FF752684000-memory.dmp	xmrig
behavioral2/memory/4540-125-0x00007FF64F500000-0x00007FF64F854000-memory.dmp	xmrig
behavioral2/memory/1916-124-0x00007FF6A8280000-0x00007FF6A85D4000-memory.dmp	xmrig
behavioral2/memory/4344-122-0x00007FF66DB70000-0x00007FF66DEC4000-memory.dmp	xmrig
behavioral2/memory/3304-121-0x00007FF78A800000-0x00007FF78AB54000-memory.dmp	xmrig
behavioral2/memory/4872-120-0x00007FF66D460000-0x00007FF66D7B4000-memory.dmp	xmrig
behavioral2/files/0x000700000002342d-118.dat	xmrig
behavioral2/files/0x000700000002342c-116.dat	xmrig
behavioral2/memory/1704-115-0x00007FF7C5FC0000-0x00007FF7C6314000-memory.dmp	xmrig
behavioral2/files/0x000700000002342b-110.dat	xmrig
behavioral2/memory/2740-109-0x00007FF762710000-0x00007FF762A64000-memory.dmp	xmrig
behavioral2/files/0x000700000002342a-106.dat	xmrig
behavioral2/files/0x0007000000023429-102.dat	xmrig
behavioral2/memory/3132-100-0x00007FF648770000-0x00007FF648AC4000-memory.dmp	xmrig
behavioral2/memory/2544-97-0x00007FF6EF3E0000-0x00007FF6EF734000-memory.dmp	xmrig
behavioral2/files/0x0007000000023428-94.dat	xmrig
behavioral2/files/0x0007000000023427-88.dat	xmrig
behavioral2/files/0x0007000000023425-76.dat	xmrig
behavioral2/files/0x0007000000023422-61.dat	xmrig
behavioral2/memory/1828-43-0x00007FF6F24F0000-0x00007FF6F2844000-memory.dmp	xmrig
behavioral2/memory/1252-38-0x00007FF7C0AA0000-0x00007FF7C0DF4000-memory.dmp	xmrig
behavioral2/memory/3576-35-0x00007FF6365C0000-0x00007FF636914000-memory.dmp	xmrig
behavioral2/memory/1124-32-0x00007FF6C8910000-0x00007FF6C8C64000-memory.dmp	xmrig
behavioral2/memory/620-9-0x00007FF7FCA60000-0x00007FF7FCDB4000-memory.dmp	xmrig
behavioral2/memory/2020-128-0x00007FF78F7C0000-0x00007FF78FB14000-memory.dmp	xmrig
behavioral2/memory/620-129-0x00007FF7FCA60000-0x00007FF7FCDB4000-memory.dmp	xmrig
behavioral2/memory/3576-130-0x00007FF6365C0000-0x00007FF636914000-memory.dmp	xmrig
behavioral2/memory/1252-131-0x00007FF7C0AA0000-0x00007FF7C0DF4000-memory.dmp	xmrig
behavioral2/memory/1828-132-0x00007FF6F24F0000-0x00007FF6F2844000-memory.dmp	xmrig
behavioral2/memory/620-133-0x00007FF7FCA60000-0x00007FF7FCDB4000-memory.dmp	xmrig
behavioral2/memory/4264-134-0x00007FF786CF0000-0x00007FF787044000-memory.dmp	xmrig
behavioral2/memory/5020-135-0x00007FF7599F0000-0x00007FF759D44000-memory.dmp	xmrig
behavioral2/memory/1124-136-0x00007FF6C8910000-0x00007FF6C8C64000-memory.dmp	xmrig
behavioral2/memory/1252-137-0x00007FF7C0AA0000-0x00007FF7C0DF4000-memory.dmp	xmrig
behavioral2/memory/3576-138-0x00007FF6365C0000-0x00007FF636914000-memory.dmp	xmrig
behavioral2/memory/3132-139-0x00007FF648770000-0x00007FF648AC4000-memory.dmp	xmrig
behavioral2/memory/1828-141-0x00007FF6F24F0000-0x00007FF6F2844000-memory.dmp	xmrig
behavioral2/memory/2544-140-0x00007FF6EF3E0000-0x00007FF6EF734000-memory.dmp	xmrig
behavioral2/memory/4276-142-0x00007FF69F390000-0x00007FF69F6E4000-memory.dmp	xmrig
behavioral2/memory/4524-145-0x00007FF6549B0000-0x00007FF654D04000-memory.dmp	xmrig
behavioral2/memory/1704-144-0x00007FF7C5FC0000-0x00007FF7C6314000-memory.dmp	xmrig
behavioral2/memory/2740-146-0x00007FF762710000-0x00007FF762A64000-memory.dmp	xmrig
behavioral2/memory/4540-143-0x00007FF64F500000-0x00007FF64F854000-memory.dmp	xmrig
behavioral2/memory/4344-147-0x00007FF66DB70000-0x00007FF66DEC4000-memory.dmp	xmrig
behavioral2/memory/4872-149-0x00007FF66D460000-0x00007FF66D7B4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
620	fQWycvQ.exe
4264	RkGjPTb.exe
5020	qJBlGgB.exe
1124	zGVOyWJ.exe
1252	SFfsXZQ.exe
3576	aOxjqmO.exe
1828	FrEHlgf.exe
2544	iepcViz.exe
3132	ToltheY.exe
4540	OLNrmsn.exe
4276	acHkAEa.exe
2740	BxLMOSN.exe
4524	PSFtgsL.exe
1704	VikIcnz.exe
4872	tLmwGVq.exe
3304	nOIGxnW.exe
4344	irpZIpK.exe
4864	WnOgrBH.exe
4364	tbnXTBg.exe
2400	NjwoCxZ.exe
1916	sgWgrqX.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2020-0-0x00007FF78F7C0000-0x00007FF78FB14000-memory.dmp	upx
behavioral2/files/0x000a000000023400-5.dat	upx
behavioral2/files/0x000700000002341b-10.dat	upx
behavioral2/files/0x000700000002341c-11.dat	upx
behavioral2/memory/4264-18-0x00007FF786CF0000-0x00007FF787044000-memory.dmp	upx
behavioral2/files/0x000700000002341d-23.dat	upx
behavioral2/memory/5020-26-0x00007FF7599F0000-0x00007FF759D44000-memory.dmp	upx
behavioral2/files/0x000700000002341f-31.dat	upx
behavioral2/files/0x0007000000023420-37.dat	upx
behavioral2/files/0x000700000002341e-39.dat	upx
behavioral2/files/0x0007000000023421-50.dat	upx
behavioral2/files/0x0008000000023418-53.dat	upx
behavioral2/files/0x0007000000023423-60.dat	upx
behavioral2/files/0x0007000000023424-67.dat	upx
behavioral2/files/0x0007000000023426-78.dat	upx
behavioral2/memory/4276-101-0x00007FF69F390000-0x00007FF69F6E4000-memory.dmp	upx
behavioral2/memory/4524-114-0x00007FF6549B0000-0x00007FF654D04000-memory.dmp	upx
behavioral2/memory/4864-123-0x00007FF690710000-0x00007FF690A64000-memory.dmp	upx
behavioral2/memory/2400-127-0x00007FF64E650000-0x00007FF64E9A4000-memory.dmp	upx
behavioral2/memory/4364-126-0x00007FF752330000-0x00007FF752684000-memory.dmp	upx
behavioral2/memory/4540-125-0x00007FF64F500000-0x00007FF64F854000-memory.dmp	upx
behavioral2/memory/1916-124-0x00007FF6A8280000-0x00007FF6A85D4000-memory.dmp	upx
behavioral2/memory/4344-122-0x00007FF66DB70000-0x00007FF66DEC4000-memory.dmp	upx
behavioral2/memory/3304-121-0x00007FF78A800000-0x00007FF78AB54000-memory.dmp	upx
behavioral2/memory/4872-120-0x00007FF66D460000-0x00007FF66D7B4000-memory.dmp	upx
behavioral2/files/0x000700000002342d-118.dat	upx
behavioral2/files/0x000700000002342c-116.dat	upx
behavioral2/memory/1704-115-0x00007FF7C5FC0000-0x00007FF7C6314000-memory.dmp	upx
behavioral2/files/0x000700000002342b-110.dat	upx
behavioral2/memory/2740-109-0x00007FF762710000-0x00007FF762A64000-memory.dmp	upx
behavioral2/files/0x000700000002342a-106.dat	upx
behavioral2/files/0x0007000000023429-102.dat	upx
behavioral2/memory/3132-100-0x00007FF648770000-0x00007FF648AC4000-memory.dmp	upx
behavioral2/memory/2544-97-0x00007FF6EF3E0000-0x00007FF6EF734000-memory.dmp	upx
behavioral2/files/0x0007000000023428-94.dat	upx
behavioral2/files/0x0007000000023427-88.dat	upx
behavioral2/files/0x0007000000023425-76.dat	upx
behavioral2/files/0x0007000000023422-61.dat	upx
behavioral2/memory/1828-43-0x00007FF6F24F0000-0x00007FF6F2844000-memory.dmp	upx
behavioral2/memory/1252-38-0x00007FF7C0AA0000-0x00007FF7C0DF4000-memory.dmp	upx
behavioral2/memory/3576-35-0x00007FF6365C0000-0x00007FF636914000-memory.dmp	upx
behavioral2/memory/1124-32-0x00007FF6C8910000-0x00007FF6C8C64000-memory.dmp	upx
behavioral2/memory/620-9-0x00007FF7FCA60000-0x00007FF7FCDB4000-memory.dmp	upx
behavioral2/memory/2020-128-0x00007FF78F7C0000-0x00007FF78FB14000-memory.dmp	upx
behavioral2/memory/620-129-0x00007FF7FCA60000-0x00007FF7FCDB4000-memory.dmp	upx
behavioral2/memory/3576-130-0x00007FF6365C0000-0x00007FF636914000-memory.dmp	upx
behavioral2/memory/1252-131-0x00007FF7C0AA0000-0x00007FF7C0DF4000-memory.dmp	upx
behavioral2/memory/1828-132-0x00007FF6F24F0000-0x00007FF6F2844000-memory.dmp	upx
behavioral2/memory/620-133-0x00007FF7FCA60000-0x00007FF7FCDB4000-memory.dmp	upx
behavioral2/memory/4264-134-0x00007FF786CF0000-0x00007FF787044000-memory.dmp	upx
behavioral2/memory/5020-135-0x00007FF7599F0000-0x00007FF759D44000-memory.dmp	upx
behavioral2/memory/1124-136-0x00007FF6C8910000-0x00007FF6C8C64000-memory.dmp	upx
behavioral2/memory/1252-137-0x00007FF7C0AA0000-0x00007FF7C0DF4000-memory.dmp	upx
behavioral2/memory/3576-138-0x00007FF6365C0000-0x00007FF636914000-memory.dmp	upx
behavioral2/memory/3132-139-0x00007FF648770000-0x00007FF648AC4000-memory.dmp	upx
behavioral2/memory/1828-141-0x00007FF6F24F0000-0x00007FF6F2844000-memory.dmp	upx
behavioral2/memory/2544-140-0x00007FF6EF3E0000-0x00007FF6EF734000-memory.dmp	upx
behavioral2/memory/4276-142-0x00007FF69F390000-0x00007FF69F6E4000-memory.dmp	upx
behavioral2/memory/4524-145-0x00007FF6549B0000-0x00007FF654D04000-memory.dmp	upx
behavioral2/memory/1704-144-0x00007FF7C5FC0000-0x00007FF7C6314000-memory.dmp	upx
behavioral2/memory/2740-146-0x00007FF762710000-0x00007FF762A64000-memory.dmp	upx
behavioral2/memory/4540-143-0x00007FF64F500000-0x00007FF64F854000-memory.dmp	upx
behavioral2/memory/4344-147-0x00007FF66DB70000-0x00007FF66DEC4000-memory.dmp	upx
behavioral2/memory/4872-149-0x00007FF66D460000-0x00007FF66D7B4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\fQWycvQ.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iepcViz.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tbnXTBg.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WnOgrBH.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zGVOyWJ.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SFfsXZQ.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FrEHlgf.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ToltheY.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BxLMOSN.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tLmwGVq.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nOIGxnW.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RkGjPTb.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qJBlGgB.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aOxjqmO.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OLNrmsn.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\acHkAEa.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PSFtgsL.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\irpZIpK.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VikIcnz.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NjwoCxZ.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\sgWgrqX.exe	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 620	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	85
PID 2020 wrote to memory of 620	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	85
PID 2020 wrote to memory of 4264	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	86
PID 2020 wrote to memory of 4264	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	86
PID 2020 wrote to memory of 5020	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	87
PID 2020 wrote to memory of 5020	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	87
PID 2020 wrote to memory of 1124	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	88
PID 2020 wrote to memory of 1124	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	88
PID 2020 wrote to memory of 1252	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	89
PID 2020 wrote to memory of 1252	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	89
PID 2020 wrote to memory of 3576	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	90
PID 2020 wrote to memory of 3576	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	90
PID 2020 wrote to memory of 1828	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	91
PID 2020 wrote to memory of 1828	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	91
PID 2020 wrote to memory of 2544	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	92
PID 2020 wrote to memory of 2544	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	92
PID 2020 wrote to memory of 3132	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	93
PID 2020 wrote to memory of 3132	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	93
PID 2020 wrote to memory of 4540	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	94
PID 2020 wrote to memory of 4540	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	94
PID 2020 wrote to memory of 4276	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	95
PID 2020 wrote to memory of 4276	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	95
PID 2020 wrote to memory of 2740	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	96
PID 2020 wrote to memory of 2740	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	96
PID 2020 wrote to memory of 4524	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	97
PID 2020 wrote to memory of 4524	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	97
PID 2020 wrote to memory of 1704	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	98
PID 2020 wrote to memory of 1704	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	98
PID 2020 wrote to memory of 4872	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	99
PID 2020 wrote to memory of 4872	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	99
PID 2020 wrote to memory of 3304	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	100
PID 2020 wrote to memory of 3304	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	100
PID 2020 wrote to memory of 4344	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	101
PID 2020 wrote to memory of 4344	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	101
PID 2020 wrote to memory of 4864	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	102
PID 2020 wrote to memory of 4864	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	102
PID 2020 wrote to memory of 4364	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	103
PID 2020 wrote to memory of 4364	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	103
PID 2020 wrote to memory of 2400	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	104
PID 2020 wrote to memory of 2400	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	104
PID 2020 wrote to memory of 1916	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	105
PID 2020 wrote to memory of 1916	2020	2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe	105

C:\Users\Admin\AppData\Local\Temp\2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-28_95ac2b862a501799118324d79d98ce3e_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\System\fQWycvQ.exe
  C:\Windows\System\fQWycvQ.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\RkGjPTb.exe
  C:\Windows\System\RkGjPTb.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\qJBlGgB.exe
  C:\Windows\System\qJBlGgB.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\zGVOyWJ.exe
  C:\Windows\System\zGVOyWJ.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\SFfsXZQ.exe
  C:\Windows\System\SFfsXZQ.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\aOxjqmO.exe
  C:\Windows\System\aOxjqmO.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\FrEHlgf.exe
  C:\Windows\System\FrEHlgf.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\iepcViz.exe
  C:\Windows\System\iepcViz.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\ToltheY.exe
  C:\Windows\System\ToltheY.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\OLNrmsn.exe
  C:\Windows\System\OLNrmsn.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\acHkAEa.exe
  C:\Windows\System\acHkAEa.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\BxLMOSN.exe
  C:\Windows\System\BxLMOSN.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\PSFtgsL.exe
  C:\Windows\System\PSFtgsL.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\VikIcnz.exe
  C:\Windows\System\VikIcnz.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\tLmwGVq.exe
  C:\Windows\System\tLmwGVq.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\nOIGxnW.exe
  C:\Windows\System\nOIGxnW.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\irpZIpK.exe
  C:\Windows\System\irpZIpK.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\WnOgrBH.exe
  C:\Windows\System\WnOgrBH.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\tbnXTBg.exe
  C:\Windows\System\tbnXTBg.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\NjwoCxZ.exe
  C:\Windows\System\NjwoCxZ.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\sgWgrqX.exe
  C:\Windows\System\sgWgrqX.exe
  2⤵
  - Executes dropped EXE
  PID:1916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BxLMOSN.exe

Path C:\Windows\System\BxLMOSN.exe
Size 5.9MB
SHA256 0061a311da493a70bb402f4d5a71a08363eecfdbede3d3290503a3a3ed752784
MD5 1e5a43a07b3e5c12e03a6b5690df84d3
SHA1 f31840b93a66aeea36095c372b30b31fba112283
SHA512 e7a378b04f4d0a4c2ee655de8a6be3ab1b76a1122cd55cc08d0cee50217109722f1c4f91090d5b345be63f3cd1896ad39e1ba31ded00743b70c3334eb35e9b02
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

FrEHlgf.exe

Path C:\Windows\System\FrEHlgf.exe
Size 5.9MB
SHA256 d5134dd731731766e4aa82b3bbb026705e4e13843b48e6504c72dd9f1914f97c
MD5 b23184214c8faed2485644d5de248052
SHA1 2f5674d944aa339a58cc9eeeffa0a863ee38066f
SHA512 0c7ceb98244003e492a844ba99b0d8eefd1d4b5582f632c6e291ccbbe83d9d718c42485f9b91edebec7c265a289d1a6dbab59f886cb555b96c3dc84f3c3bf62f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:Q+856utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

NjwoCxZ.exe

Path C:\Windows\System\NjwoCxZ.exe
Size 5.9MB
SHA256 3c8b4cf156604b38a08e4bde45904a072a6462a174275089d987cabcec005db1
MD5 fca935fae7a1030ef8fc3580d84ad970
SHA1 9271b393d7503bdf0523e4366b41893155468195
SHA512 20a673fba18da7b6cf266f41b5fff9cf11e2e2275d60b2db53d354acefe87e367b242f2788830a85a972b239a59e664230c2566ed3ed5bb07f7eb9a6e165ee32
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

OLNrmsn.exe

Path C:\Windows\System\OLNrmsn.exe
Size 5.9MB
SHA256 61663362c49b47e534a23f923cfe96ae23f19ffd1f386db08dec369c95c1cd70
MD5 e042a17f762821ffdd1f2aa11ce86916
SHA1 c78b3ee1d71726e5e63b8193f8b583c62805035c
SHA512 33567cb84b1811b58d9b43150ac2644d7c66dd91913bf5e2de3e7ca51da2a891da55b0af2c753daa35ae27c6d41cfd0fa4ea52f453cbaa68f288705d1a993281
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

PSFtgsL.exe

Path C:\Windows\System\PSFtgsL.exe
Size 5.9MB
SHA256 9fdbe94a88feb66f68fd5fa9a7d16ab179593c476ffe9396eddea2ecf24be903
MD5 0ae0c46c1229ccabb5f49145c53c7b25
SHA1 46c15e76ec97289fc217900f935b6918de251e61
SHA512 0b419327cf460ad71100dd5e6605c01b16b972f9120c7cca9c6c7d611513fc9f3fe75c6ccccc1a51420cfdacb70036f75795cfab20a4b5f101ecc3a66b64138f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:Q+856utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

RkGjPTb.exe

Path C:\Windows\System\RkGjPTb.exe
Size 5.9MB
SHA256 56cf52819c90139eee2405f94a534a44112a82349d5614bd4c4532afd980b196
MD5 981ef70b7b8d1ddd8d082d99e158b84d
SHA1 6c25680144e06a9a35fcee2f59d7e949cead061a
SHA512 fd10c0b8b260ace5f786bd1a6dc67b57bc9de70fb6482873342208b084a781625dffa00c72ba9ccb69da328ee5bd579b4e2ce3293e393278f7a9af060562a541
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

SFfsXZQ.exe

Path C:\Windows\System\SFfsXZQ.exe
Size 5.9MB
SHA256 af4e75be5e84a49af3c3a33ddcb5565e2395515f5ea4015745ab6dd8156cfefa
MD5 a46ba74145379c010e372eb05140f022
SHA1 458354178bf7ac3c5ce59531fa332a1d0f346be1
SHA512 7e929833ff41b7958effcf4e341473ba6d9e5ee105da9155a6219694f9de8a44ec0a5d8b2f00293c548cbd921fdb5239f5fd29594a396b2ec03e8bf32274383d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

ToltheY.exe

Path C:\Windows\System\ToltheY.exe
Size 5.9MB
SHA256 0580aec7af09f6557d233779a02db054bd809591ea4b856e3d0f771016286cf0
MD5 0b9fa8751e05e8d3581ae7a50504da39
SHA1 3536d4a0e76192d4cb6d25b900875a495da7027f
SHA512 f1be6cea3f88297bd9950f582921d6d5144037abb9f39176582bb68066300098d8dce98a68f193fa08b4d263ebd888141e7cf9badb1b28b4a0dd45610d20f803
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

VikIcnz.exe

Path C:\Windows\System\VikIcnz.exe
Size 5.9MB
SHA256 07608d1fa736fa4418325b58afbca8ca676dd73590443a2a958003b6aebbaa8f
MD5 afb71b6fe4c17a9d142a3ab52c675a66
SHA1 d4cdbbd3bf1ac8b480cc30919356b0942c5be66d
SHA512 f3e5fd3b54590a4f2b7815342b808f86f0e2587d06a0d5081131c1b2d433b33ae6055057c61bb64f16a4224e6769406438bf1f88e24d1abb1e54cd645fb574ca
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

WnOgrBH.exe

Path C:\Windows\System\WnOgrBH.exe
Size 5.9MB
SHA256 55167f197fa2d4e55a3f729125dea2787abe47055c30e4b8c87c1edae18c4e8d
MD5 dac5904287e258e2f398e9d8b398e3e0
SHA1 8b3623a12e4aef5af27c0a5410b6bc469ea7e782
SHA512 825659789e2e7ed79ee769ddf2a0377b5666aa298920d3c38ba610596294deace404a3f8eede580675cf4361019a23cb5cefac0abbe704a48a511a81af13adc8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

aOxjqmO.exe

Path C:\Windows\System\aOxjqmO.exe
Size 5.9MB
SHA256 36a0a8656ea8a6735eb806d224e3cb14726486284b1b8c4728f8950ac7c6be91
MD5 d199c0b2c2f684c6d1425290d6175b82
SHA1 f9ca80fb35f1944566f0fb7d22fc4acbda86398a
SHA512 a374f16c0041ce68f33908004100c5d28fa319cd54adf9311afe9afde9b614a0c1506ac1aef15550aeef260bfdf3faf2ba80e9d06af4dbccbfdf43eb6a403b83
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

acHkAEa.exe

Path C:\Windows\System\acHkAEa.exe
Size 5.9MB
SHA256 00e4e9db8333839eadb26832b77c29f97684fb2148d37ece7950c6d59f404801
MD5 1bdf544b7e3454821d1e6e678dbfa033
SHA1 fa45b01eac120a5cac4ec9899367f2d5155e996b
SHA512 00abb9d542b5677dbc1babba6a4bbff41260cea1f20779886504eb091b9738995ca4559bfa054c18517a859b76c86971ab8577c61dcca8f975111f34b12e7c6f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

fQWycvQ.exe

Path C:\Windows\System\fQWycvQ.exe
Size 5.9MB
SHA256 9af26cdca8ac298e4e5ad37c1a0d2117ec3e5e4a559e5f06532b6c90b21e8844
MD5 f5b2001aea4912438765e5892ca4ac2f
SHA1 11e4de8e48ec1acbc8192b30ccb61a69caf0b6a4
SHA512 9a0b4378e97e816286d1695143699eeaa4610c4aeb55797ac4b381d2c3911f0fd99e4677dd014fcb65a865c215e6387cd88d00fd7fd1a8520616cfd5da1abe15
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

iepcViz.exe

Path C:\Windows\System\iepcViz.exe
Size 5.9MB
SHA256 ea01aaf6f8f98beb76a32c5d778aef29c5590159a3fe4bec4cf0d2991391a918
MD5 ae86ca78a425f1dcc235703676a6bf9a
SHA1 fc5723479da0ef0c3f6e88f205bf910f9e8d435b
SHA512 f76ea09e44a08b1d1518ff959264d39e5b9354683f89de9bece04ab2a5765f233c0ed6e374fb2c4cf0e6e9dc8e32cfa1b6d7c9e0574eadb716718c16319d8ce7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:Q+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

irpZIpK.exe

Path C:\Windows\System\irpZIpK.exe
Size 5.9MB
SHA256 5e70daaf51a262197d21f42d28b024beb2c59e8f4b2a4b747b21cc5172b73525
MD5 0705692660944d9d9973bfd4b2f8955e
SHA1 02c1a640856601bb33ddd476f6c0c00c205b7f56
SHA512 2620db836e3ec7b13ddbb335f1bb85f8f2b668e71bda97061ce263f22d0a4d94932d62e91f8c4bfc1c9cb8e03f3f395a248f5bb9b6fa03087dd428089b5e33e6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:Q+856utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

nOIGxnW.exe

Path C:\Windows\System\nOIGxnW.exe
Size 5.9MB
SHA256 b39c67ac1b68bfad48178942542a35f36dfafbb0a4d5a3be89cb974714f0b533
MD5 a5d15357734617689d9fb32348262b69
SHA1 7eef2f2c0489f4de42a9c7e9ad9ee2c9b829f006
SHA512 d91a5c0183e0c80e6494473273c0c9ae5ee9e7f0fe606de702cdbd5c1f9c6570d819f012ff9d6ab4b206b1ab51ad7fff7494034288246d790527f3f9a90d8979
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

qJBlGgB.exe

Path C:\Windows\System\qJBlGgB.exe
Size 5.9MB
SHA256 c64754b8d5517ecae6b625d1e9601c7343cd49421407ccb936b55cece45e885d
MD5 0235a75cc976f3e5be1a885ee4eaee76
SHA1 ff9a231de4c3491580dc9ea8973c31622e07428c
SHA512 82e854b36170eb7f3d28eb6609037fd6ca8a3075a616944444231c2982ea7f518c2b68e9082c1852296650d29af8e34aba2282013f858947f53ef51e08ed8591
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

sgWgrqX.exe

Path C:\Windows\System\sgWgrqX.exe
Size 5.9MB
SHA256 a455d98422845fcd9a4a74edacadeeaf74a535c57edb7eb77ab90e973f3e529e
MD5 5c96489b44cf22a86c9164cff6b3c7ee
SHA1 d4f1f9086007d824de056441d9ae3249c9a533c1
SHA512 c064cc937fd53aac005ed736798626d1868b9c9356d702be8349588b471888321eb51287db8792c75f80f068ec69e476570560f947cf389fafdfaaa1fc2149ea
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

tLmwGVq.exe

Path C:\Windows\System\tLmwGVq.exe
Size 5.9MB
SHA256 bf583b547c0e133586fd28461b174836dfa0ccbc41958827fa2859ce5e2b10b4
MD5 4893270ebec6a34b3bc65184e0a02eb7
SHA1 293c4985c29b65c56e5e996a9e9dc30c44718e5b
SHA512 a164faf649c43c77b67c5045ef1a836bf5ff331d03c87aa4696346891671f9251a0d2703b2b088097cf17d7005bfff5a22515c323c8045cb7219377234c93348
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbnXTBg.exe

Path C:\Windows\System\tbnXTBg.exe
Size 5.9MB
SHA256 f81a3b356fee4a9a58c9376209938e7580fb0496584aa6890cbfb01bb3e58a0a
MD5 b45c472017d522203c62b8d385404de6
SHA1 8e5fd2f9c13b6a50775f2d43f3cae16404422904
SHA512 e6d48822f26bd10d9b0844ae3370a668d6824f246c3a58d442840cb01598da56c385eab97b457b7c11237a28217435946d0b3b9cdb05468b229b9cd020ab5f08
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

zGVOyWJ.exe

Path C:\Windows\System\zGVOyWJ.exe
Size 5.9MB
SHA256 6d0b604345b58b454b28aeebe95f83b93376732aa07761ea1b44284504c300e2
MD5 802e1fb247649d35a3ba7eeab2fbdbd1
SHA1 fbe3834ef867772c1519d10d777a575d7bca66eb
SHA512 4b5b58b65684bb60200d6eeccd5bec70df3d32dccaacf22a5691a86a8a0f918b4d8cae9b929b6378daeb2c3459c166b68b3e6dd346d01b0d0ce98e33f67c0571
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/620-133-0x00007FF7FCA60000-0x00007FF7FCDB4000-memory.dmp

Download

memory/620-129-0x00007FF7FCA60000-0x00007FF7FCDB4000-memory.dmp

Download

memory/620-9-0x00007FF7FCA60000-0x00007FF7FCDB4000-memory.dmp

Download

memory/1124-32-0x00007FF6C8910000-0x00007FF6C8C64000-memory.dmp

Download

memory/1124-136-0x00007FF6C8910000-0x00007FF6C8C64000-memory.dmp

Download

memory/1252-137-0x00007FF7C0AA0000-0x00007FF7C0DF4000-memory.dmp

Download

memory/1252-131-0x00007FF7C0AA0000-0x00007FF7C0DF4000-memory.dmp

Download

memory/1252-38-0x00007FF7C0AA0000-0x00007FF7C0DF4000-memory.dmp

Download

memory/1704-115-0x00007FF7C5FC0000-0x00007FF7C6314000-memory.dmp

Download

memory/1704-144-0x00007FF7C5FC0000-0x00007FF7C6314000-memory.dmp

Download

memory/1828-43-0x00007FF6F24F0000-0x00007FF6F2844000-memory.dmp

Download

memory/1828-132-0x00007FF6F24F0000-0x00007FF6F2844000-memory.dmp

Download

memory/1828-141-0x00007FF6F24F0000-0x00007FF6F2844000-memory.dmp

Download

memory/1916-153-0x00007FF6A8280000-0x00007FF6A85D4000-memory.dmp

Download

memory/1916-124-0x00007FF6A8280000-0x00007FF6A85D4000-memory.dmp

Download

memory/2020-128-0x00007FF78F7C0000-0x00007FF78FB14000-memory.dmp

Download

memory/2020-0-0x00007FF78F7C0000-0x00007FF78FB14000-memory.dmp

Download

memory/2020-1-0x000001BD7F140000-0x000001BD7F150000-memory.dmp

Download

memory/2400-127-0x00007FF64E650000-0x00007FF64E9A4000-memory.dmp

Download

memory/2400-151-0x00007FF64E650000-0x00007FF64E9A4000-memory.dmp

Download

memory/2544-97-0x00007FF6EF3E0000-0x00007FF6EF734000-memory.dmp

Download

memory/2544-140-0x00007FF6EF3E0000-0x00007FF6EF734000-memory.dmp

Download

memory/2740-109-0x00007FF762710000-0x00007FF762A64000-memory.dmp

Download

memory/2740-146-0x00007FF762710000-0x00007FF762A64000-memory.dmp

Download

memory/3132-139-0x00007FF648770000-0x00007FF648AC4000-memory.dmp

Download

memory/3132-100-0x00007FF648770000-0x00007FF648AC4000-memory.dmp

Download

memory/3304-148-0x00007FF78A800000-0x00007FF78AB54000-memory.dmp

Download

memory/3304-121-0x00007FF78A800000-0x00007FF78AB54000-memory.dmp

Download

memory/3576-35-0x00007FF6365C0000-0x00007FF636914000-memory.dmp

Download

memory/3576-130-0x00007FF6365C0000-0x00007FF636914000-memory.dmp

Download

memory/3576-138-0x00007FF6365C0000-0x00007FF636914000-memory.dmp

Download

memory/4264-134-0x00007FF786CF0000-0x00007FF787044000-memory.dmp

Download

memory/4264-18-0x00007FF786CF0000-0x00007FF787044000-memory.dmp

Download

memory/4276-142-0x00007FF69F390000-0x00007FF69F6E4000-memory.dmp

Download

memory/4276-101-0x00007FF69F390000-0x00007FF69F6E4000-memory.dmp

Download

memory/4344-147-0x00007FF66DB70000-0x00007FF66DEC4000-memory.dmp

Download

memory/4344-122-0x00007FF66DB70000-0x00007FF66DEC4000-memory.dmp

Download

memory/4364-152-0x00007FF752330000-0x00007FF752684000-memory.dmp

Download

memory/4364-126-0x00007FF752330000-0x00007FF752684000-memory.dmp

Download

memory/4524-114-0x00007FF6549B0000-0x00007FF654D04000-memory.dmp

Download

memory/4524-145-0x00007FF6549B0000-0x00007FF654D04000-memory.dmp

Download

memory/4540-143-0x00007FF64F500000-0x00007FF64F854000-memory.dmp

Download

memory/4540-125-0x00007FF64F500000-0x00007FF64F854000-memory.dmp

Download

memory/4864-123-0x00007FF690710000-0x00007FF690A64000-memory.dmp

Download

memory/4864-150-0x00007FF690710000-0x00007FF690A64000-memory.dmp

Download

memory/4872-149-0x00007FF66D460000-0x00007FF66D7B4000-memory.dmp

Download

memory/4872-120-0x00007FF66D460000-0x00007FF66D7B4000-memory.dmp

Download

memory/5020-135-0x00007FF7599F0000-0x00007FF759D44000-memory.dmp

Download

memory/5020-26-0x00007FF7599F0000-0x00007FF759D44000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads