Analysis
- max time kernel
133s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
28/05/2024, 01:24
Behavioral task
behavioral1
Sample
2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
General
- Target 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe
- Size 5.9MB
- Sample240528-bsdabsaf36
- SHA256 52a63696bb0e66024fbf0c2c586613d2d312b71fc0c7f5a7dfd10060ae787f8c
- MD5 e9d8b3b4983d72b659cd1763f7542d48
- SHA1 bf1a654ed589cbb0856d99ccbaca7d25fcbee0a0
- SHA512 df7cb5921203c676ee78a1ce9743ef2fa408c404458d17fa13c4fc73097c2894713bcbf4872545da5e03443af087ea75b910a94fbe5e9f188b245bb3e4aedb72
- SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- UPX dump on OEP (original entry point) 37 IoCs
resource yara_rule behavioral2/files/0x0007000000023433-10.dat UPX behavioral2/files/0x0007000000023435-23.dat UPX behavioral2/memory/2472-26-0x00007FF638800000-0x00007FF638B54000-memory.dmp UPX behavioral2/files/0x0007000000023443-114.dat UPX behavioral2/files/0x0007000000023444-119.dat UPX behavioral2/memory/4212-132-0x00007FF6F6080000-0x00007FF6F63D4000-memory.dmp UPX behavioral2/memory/2008-127-0x00007FF7DC5A0000-0x00007FF7DC8F4000-memory.dmp UPX behavioral2/memory/508-126-0x00007FF6E0120000-0x00007FF6E0474000-memory.dmp UPX behavioral2/files/0x0007000000023441-111.dat UPX behavioral2/files/0x0007000000023440-98.dat UPX behavioral2/files/0x0007000000023440-92.dat UPX behavioral2/memory/1460-90-0x00007FF6E5C70000-0x00007FF6E5FC4000-memory.dmp UPX behavioral2/files/0x000700000002343e-81.dat UPX behavioral2/files/0x000700000002343d-77.dat UPX behavioral2/memory/2820-50-0x00007FF69C6A0000-0x00007FF69C9F4000-memory.dmp UPX behavioral2/memory/4556-135-0x00007FF6DDD00000-0x00007FF6DE054000-memory.dmp UPX behavioral2/memory/1500-137-0x00007FF633BE0000-0x00007FF633F34000-memory.dmp UPX behavioral2/memory/2304-139-0x00007FF69C920000-0x00007FF69CC74000-memory.dmp UPX behavioral2/memory/444-140-0x00007FF6C53F0000-0x00007FF6C5744000-memory.dmp UPX behavioral2/memory/2576-141-0x00007FF62AF40000-0x00007FF62B294000-memory.dmp UPX behavioral2/memory/2472-142-0x00007FF638800000-0x00007FF638B54000-memory.dmp UPX behavioral2/memory/628-143-0x00007FF6349D0000-0x00007FF634D24000-memory.dmp UPX behavioral2/memory/1928-144-0x00007FF77CD70000-0x00007FF77D0C4000-memory.dmp UPX behavioral2/memory/4996-145-0x00007FF682E10000-0x00007FF683164000-memory.dmp UPX behavioral2/memory/2820-146-0x00007FF69C6A0000-0x00007FF69C9F4000-memory.dmp UPX behavioral2/memory/508-147-0x00007FF6E0120000-0x00007FF6E0474000-memory.dmp UPX behavioral2/memory/588-148-0x00007FF6E2FD0000-0x00007FF6E3324000-memory.dmp UPX behavioral2/memory/2676-149-0x00007FF73E750000-0x00007FF73EAA4000-memory.dmp UPX behavioral2/memory/2980-150-0x00007FF6446D0000-0x00007FF644A24000-memory.dmp UPX behavioral2/memory/5040-151-0x00007FF642780000-0x00007FF642AD4000-memory.dmp UPX behavioral2/memory/1888-155-0x00007FF7D6420000-0x00007FF7D6774000-memory.dmp UPX behavioral2/memory/4964-156-0x00007FF666710000-0x00007FF666A64000-memory.dmp UPX behavioral2/memory/2008-158-0x00007FF7DC5A0000-0x00007FF7DC8F4000-memory.dmp UPX behavioral2/memory/1500-157-0x00007FF633BE0000-0x00007FF633F34000-memory.dmp UPX behavioral2/memory/4580-154-0x00007FF608C60000-0x00007FF608FB4000-memory.dmp UPX behavioral2/memory/4556-153-0x00007FF6DDD00000-0x00007FF6DE054000-memory.dmp UPX behavioral2/memory/4212-159-0x00007FF6F6080000-0x00007FF6F63D4000-memory.dmp UPX - XMRig Miner payload 63 IoCs
resource yara_rule behavioral2/memory/1272-0-0x00007FF634870000-0x00007FF634BC4000-memory.dmp xmrig behavioral2/memory/2304-8-0x00007FF69C920000-0x00007FF69CC74000-memory.dmp xmrig behavioral2/files/0x0007000000023433-10.dat xmrig behavioral2/memory/444-14-0x00007FF6C53F0000-0x00007FF6C5744000-memory.dmp xmrig behavioral2/memory/2576-20-0x00007FF62AF40000-0x00007FF62B294000-memory.dmp xmrig behavioral2/files/0x0007000000023435-23.dat xmrig behavioral2/memory/2472-26-0x00007FF638800000-0x00007FF638B54000-memory.dmp xmrig behavioral2/memory/1928-38-0x00007FF77CD70000-0x00007FF77D0C4000-memory.dmp xmrig behavioral2/memory/4996-44-0x00007FF682E10000-0x00007FF683164000-memory.dmp xmrig behavioral2/memory/508-56-0x00007FF6E0120000-0x00007FF6E0474000-memory.dmp xmrig behavioral2/memory/588-63-0x00007FF6E2FD0000-0x00007FF6E3324000-memory.dmp xmrig behavioral2/memory/2980-74-0x00007FF6446D0000-0x00007FF644A24000-memory.dmp xmrig behavioral2/memory/4964-94-0x00007FF666710000-0x00007FF666A64000-memory.dmp xmrig behavioral2/memory/628-95-0x00007FF6349D0000-0x00007FF634D24000-memory.dmp xmrig behavioral2/memory/1888-109-0x00007FF7D6420000-0x00007FF7D6774000-memory.dmp xmrig behavioral2/files/0x0007000000023443-114.dat xmrig behavioral2/files/0x0007000000023444-119.dat xmrig behavioral2/memory/4212-132-0x00007FF6F6080000-0x00007FF6F63D4000-memory.dmp xmrig behavioral2/memory/2980-129-0x00007FF6446D0000-0x00007FF644A24000-memory.dmp xmrig behavioral2/memory/2008-127-0x00007FF7DC5A0000-0x00007FF7DC8F4000-memory.dmp xmrig behavioral2/memory/508-126-0x00007FF6E0120000-0x00007FF6E0474000-memory.dmp xmrig behavioral2/memory/1500-118-0x00007FF633BE0000-0x00007FF633F34000-memory.dmp xmrig behavioral2/memory/4580-115-0x00007FF608C60000-0x00007FF608FB4000-memory.dmp xmrig behavioral2/files/0x0007000000023441-111.dat xmrig behavioral2/memory/1928-101-0x00007FF77CD70000-0x00007FF77D0C4000-memory.dmp xmrig behavioral2/memory/4556-100-0x00007FF6DDD00000-0x00007FF6DE054000-memory.dmp xmrig behavioral2/files/0x0007000000023440-98.dat xmrig behavioral2/files/0x0007000000023440-92.dat xmrig behavioral2/memory/1460-90-0x00007FF6E5C70000-0x00007FF6E5FC4000-memory.dmp xmrig behavioral2/memory/5040-86-0x00007FF642780000-0x00007FF642AD4000-memory.dmp xmrig behavioral2/files/0x000700000002343e-81.dat xmrig behavioral2/files/0x000700000002343d-77.dat xmrig behavioral2/memory/2676-69-0x00007FF73E750000-0x00007FF73EAA4000-memory.dmp xmrig behavioral2/memory/1272-62-0x00007FF634870000-0x00007FF634BC4000-memory.dmp xmrig behavioral2/memory/2820-50-0x00007FF69C6A0000-0x00007FF69C9F4000-memory.dmp xmrig behavioral2/memory/628-32-0x00007FF6349D0000-0x00007FF634D24000-memory.dmp xmrig behavioral2/memory/5040-133-0x00007FF642780000-0x00007FF642AD4000-memory.dmp xmrig behavioral2/memory/4964-134-0x00007FF666710000-0x00007FF666A64000-memory.dmp xmrig behavioral2/memory/4556-135-0x00007FF6DDD00000-0x00007FF6DE054000-memory.dmp xmrig behavioral2/memory/1888-136-0x00007FF7D6420000-0x00007FF7D6774000-memory.dmp xmrig behavioral2/memory/1500-137-0x00007FF633BE0000-0x00007FF633F34000-memory.dmp xmrig behavioral2/memory/4212-138-0x00007FF6F6080000-0x00007FF6F63D4000-memory.dmp xmrig behavioral2/memory/2304-139-0x00007FF69C920000-0x00007FF69CC74000-memory.dmp xmrig behavioral2/memory/444-140-0x00007FF6C53F0000-0x00007FF6C5744000-memory.dmp xmrig behavioral2/memory/2576-141-0x00007FF62AF40000-0x00007FF62B294000-memory.dmp xmrig behavioral2/memory/2472-142-0x00007FF638800000-0x00007FF638B54000-memory.dmp xmrig behavioral2/memory/628-143-0x00007FF6349D0000-0x00007FF634D24000-memory.dmp xmrig behavioral2/memory/1928-144-0x00007FF77CD70000-0x00007FF77D0C4000-memory.dmp xmrig behavioral2/memory/4996-145-0x00007FF682E10000-0x00007FF683164000-memory.dmp xmrig behavioral2/memory/2820-146-0x00007FF69C6A0000-0x00007FF69C9F4000-memory.dmp xmrig behavioral2/memory/508-147-0x00007FF6E0120000-0x00007FF6E0474000-memory.dmp xmrig behavioral2/memory/588-148-0x00007FF6E2FD0000-0x00007FF6E3324000-memory.dmp xmrig behavioral2/memory/2676-149-0x00007FF73E750000-0x00007FF73EAA4000-memory.dmp xmrig behavioral2/memory/2980-150-0x00007FF6446D0000-0x00007FF644A24000-memory.dmp xmrig behavioral2/memory/1460-152-0x00007FF6E5C70000-0x00007FF6E5FC4000-memory.dmp xmrig behavioral2/memory/5040-151-0x00007FF642780000-0x00007FF642AD4000-memory.dmp xmrig behavioral2/memory/1888-155-0x00007FF7D6420000-0x00007FF7D6774000-memory.dmp xmrig behavioral2/memory/4964-156-0x00007FF666710000-0x00007FF666A64000-memory.dmp xmrig behavioral2/memory/2008-158-0x00007FF7DC5A0000-0x00007FF7DC8F4000-memory.dmp xmrig behavioral2/memory/1500-157-0x00007FF633BE0000-0x00007FF633F34000-memory.dmp xmrig behavioral2/memory/4580-154-0x00007FF608C60000-0x00007FF608FB4000-memory.dmp xmrig behavioral2/memory/4556-153-0x00007FF6DDD00000-0x00007FF6DE054000-memory.dmp xmrig behavioral2/memory/4212-159-0x00007FF6F6080000-0x00007FF6F63D4000-memory.dmp xmrig - Executes dropped EXE 21 IoCs
pid Process 2304 yfKYcBD.exe 444 mJEukEU.exe 2576 eYCbZVE.exe 2472 LHtsJcy.exe 628 ubKLXvN.exe 1928 QiCgYbN.exe 4996 tIjgtQG.exe 2820 Atzjgzd.exe 508 KlGXzEV.exe 588 XHaRfNV.exe 2676 UZdFQqk.exe 2980 VmIURgl.exe 5040 rYPlfls.exe 1460 BSoZVXV.exe 4964 ioJAfkO.exe 4556 bByWQpk.exe 1888 FDGHwWH.exe 4580 VBExlKo.exe 1500 XiJLYIU.exe 2008 oEPaSrv.exe 4212 lGfevUl.exe -
resource yara_rule behavioral2/memory/1272-0-0x00007FF634870000-0x00007FF634BC4000-memory.dmp upx behavioral2/memory/2304-8-0x00007FF69C920000-0x00007FF69CC74000-memory.dmp upx behavioral2/files/0x0007000000023433-10.dat upx behavioral2/memory/444-14-0x00007FF6C53F0000-0x00007FF6C5744000-memory.dmp upx behavioral2/memory/2576-20-0x00007FF62AF40000-0x00007FF62B294000-memory.dmp upx behavioral2/files/0x0007000000023435-23.dat upx behavioral2/memory/2472-26-0x00007FF638800000-0x00007FF638B54000-memory.dmp upx behavioral2/memory/1928-38-0x00007FF77CD70000-0x00007FF77D0C4000-memory.dmp upx behavioral2/memory/4996-44-0x00007FF682E10000-0x00007FF683164000-memory.dmp upx behavioral2/memory/508-56-0x00007FF6E0120000-0x00007FF6E0474000-memory.dmp upx behavioral2/memory/588-63-0x00007FF6E2FD0000-0x00007FF6E3324000-memory.dmp upx behavioral2/memory/2980-74-0x00007FF6446D0000-0x00007FF644A24000-memory.dmp upx behavioral2/memory/4964-94-0x00007FF666710000-0x00007FF666A64000-memory.dmp upx behavioral2/memory/628-95-0x00007FF6349D0000-0x00007FF634D24000-memory.dmp upx behavioral2/memory/1888-109-0x00007FF7D6420000-0x00007FF7D6774000-memory.dmp upx behavioral2/files/0x0007000000023443-114.dat upx behavioral2/files/0x0007000000023444-119.dat upx behavioral2/memory/4212-132-0x00007FF6F6080000-0x00007FF6F63D4000-memory.dmp upx behavioral2/memory/2980-129-0x00007FF6446D0000-0x00007FF644A24000-memory.dmp upx behavioral2/memory/2008-127-0x00007FF7DC5A0000-0x00007FF7DC8F4000-memory.dmp upx behavioral2/memory/508-126-0x00007FF6E0120000-0x00007FF6E0474000-memory.dmp upx behavioral2/memory/1500-118-0x00007FF633BE0000-0x00007FF633F34000-memory.dmp upx behavioral2/memory/4580-115-0x00007FF608C60000-0x00007FF608FB4000-memory.dmp upx behavioral2/files/0x0007000000023441-111.dat upx behavioral2/memory/1928-101-0x00007FF77CD70000-0x00007FF77D0C4000-memory.dmp upx behavioral2/memory/4556-100-0x00007FF6DDD00000-0x00007FF6DE054000-memory.dmp upx behavioral2/files/0x0007000000023440-98.dat upx behavioral2/files/0x0007000000023440-92.dat upx behavioral2/memory/1460-90-0x00007FF6E5C70000-0x00007FF6E5FC4000-memory.dmp upx behavioral2/memory/5040-86-0x00007FF642780000-0x00007FF642AD4000-memory.dmp upx behavioral2/files/0x000700000002343e-81.dat upx behavioral2/files/0x000700000002343d-77.dat upx behavioral2/memory/2676-69-0x00007FF73E750000-0x00007FF73EAA4000-memory.dmp upx behavioral2/memory/1272-62-0x00007FF634870000-0x00007FF634BC4000-memory.dmp upx behavioral2/memory/2820-50-0x00007FF69C6A0000-0x00007FF69C9F4000-memory.dmp upx behavioral2/memory/628-32-0x00007FF6349D0000-0x00007FF634D24000-memory.dmp upx behavioral2/memory/5040-133-0x00007FF642780000-0x00007FF642AD4000-memory.dmp upx behavioral2/memory/4964-134-0x00007FF666710000-0x00007FF666A64000-memory.dmp upx behavioral2/memory/4556-135-0x00007FF6DDD00000-0x00007FF6DE054000-memory.dmp upx behavioral2/memory/1888-136-0x00007FF7D6420000-0x00007FF7D6774000-memory.dmp upx behavioral2/memory/1500-137-0x00007FF633BE0000-0x00007FF633F34000-memory.dmp upx behavioral2/memory/4212-138-0x00007FF6F6080000-0x00007FF6F63D4000-memory.dmp upx behavioral2/memory/2304-139-0x00007FF69C920000-0x00007FF69CC74000-memory.dmp upx behavioral2/memory/444-140-0x00007FF6C53F0000-0x00007FF6C5744000-memory.dmp upx behavioral2/memory/2576-141-0x00007FF62AF40000-0x00007FF62B294000-memory.dmp upx behavioral2/memory/2472-142-0x00007FF638800000-0x00007FF638B54000-memory.dmp upx behavioral2/memory/628-143-0x00007FF6349D0000-0x00007FF634D24000-memory.dmp upx behavioral2/memory/1928-144-0x00007FF77CD70000-0x00007FF77D0C4000-memory.dmp upx behavioral2/memory/4996-145-0x00007FF682E10000-0x00007FF683164000-memory.dmp upx behavioral2/memory/2820-146-0x00007FF69C6A0000-0x00007FF69C9F4000-memory.dmp upx behavioral2/memory/508-147-0x00007FF6E0120000-0x00007FF6E0474000-memory.dmp upx behavioral2/memory/588-148-0x00007FF6E2FD0000-0x00007FF6E3324000-memory.dmp upx behavioral2/memory/2676-149-0x00007FF73E750000-0x00007FF73EAA4000-memory.dmp upx behavioral2/memory/2980-150-0x00007FF6446D0000-0x00007FF644A24000-memory.dmp upx behavioral2/memory/1460-152-0x00007FF6E5C70000-0x00007FF6E5FC4000-memory.dmp upx behavioral2/memory/5040-151-0x00007FF642780000-0x00007FF642AD4000-memory.dmp upx behavioral2/memory/1888-155-0x00007FF7D6420000-0x00007FF7D6774000-memory.dmp upx behavioral2/memory/4964-156-0x00007FF666710000-0x00007FF666A64000-memory.dmp upx behavioral2/memory/2008-158-0x00007FF7DC5A0000-0x00007FF7DC8F4000-memory.dmp upx behavioral2/memory/1500-157-0x00007FF633BE0000-0x00007FF633F34000-memory.dmp upx behavioral2/memory/4580-154-0x00007FF608C60000-0x00007FF608FB4000-memory.dmp upx behavioral2/memory/4556-153-0x00007FF6DDD00000-0x00007FF6DE054000-memory.dmp upx behavioral2/memory/4212-159-0x00007FF6F6080000-0x00007FF6F63D4000-memory.dmp upx - Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\System\yfKYcBD.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\LHtsJcy.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\QiCgYbN.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\XHaRfNV.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\UZdFQqk.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\bByWQpk.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\rYPlfls.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\oEPaSrv.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\lGfevUl.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\ubKLXvN.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\tIjgtQG.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\Atzjgzd.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\ioJAfkO.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\FDGHwWH.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\mJEukEU.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\eYCbZVE.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\KlGXzEV.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\VmIURgl.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\BSoZVXV.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\VBExlKo.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe File created C:\Windows\System\XiJLYIU.exe 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe Token: SeLockMemoryPrivilege 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1272 wrote to memory of 2304 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 82 PID 1272 wrote to memory of 2304 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 82 PID 1272 wrote to memory of 444 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 84 PID 1272 wrote to memory of 444 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 84 PID 1272 wrote to memory of 2576 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 85 PID 1272 wrote to memory of 2576 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 85 PID 1272 wrote to memory of 2472 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 86 PID 1272 wrote to memory of 2472 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 86 PID 1272 wrote to memory of 628 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 87 PID 1272 wrote to memory of 628 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 87 PID 1272 wrote to memory of 1928 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 89 PID 1272 wrote to memory of 1928 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 89 PID 1272 wrote to memory of 4996 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 90 PID 1272 wrote to memory of 4996 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 90 PID 1272 wrote to memory of 2820 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 91 PID 1272 wrote to memory of 2820 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 91 PID 1272 wrote to memory of 508 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 92 PID 1272 wrote to memory of 508 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 92 PID 1272 wrote to memory of 588 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 93 PID 1272 wrote to memory of 588 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 93 PID 1272 wrote to memory of 2676 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 94 PID 1272 wrote to memory of 2676 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 94 PID 1272 wrote to memory of 2980 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 96 PID 1272 wrote to memory of 2980 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 96 PID 1272 wrote to memory of 5040 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 98 PID 1272 wrote to memory of 5040 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 98 PID 1272 wrote to memory of 1460 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 99 PID 1272 wrote to memory of 1460 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 99 PID 1272 wrote to memory of 4964 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 100 PID 1272 wrote to memory of 4964 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 100 PID 1272 wrote to memory of 4556 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 101 PID 1272 wrote to memory of 4556 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 101 PID 1272 wrote to memory of 1888 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 102 PID 1272 wrote to memory of 1888 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 102 PID 1272 wrote to memory of 4580 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 103 PID 1272 wrote to memory of 4580 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 103 PID 1272 wrote to memory of 1500 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 104 PID 1272 wrote to memory of 1500 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 104 PID 1272 wrote to memory of 2008 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 105 PID 1272 wrote to memory of 2008 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 105 PID 1272 wrote to memory of 4212 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 106 PID 1272 wrote to memory of 4212 1272 2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_e9d8b3b4983d72b659cd1763f7542d48_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\System\yfKYcBD.exeC:\Windows\System\yfKYcBD.exe2⤵
- Executes dropped EXE
PID:2304
-
-
C:\Windows\System\mJEukEU.exeC:\Windows\System\mJEukEU.exe2⤵
- Executes dropped EXE
PID:444
-
-
C:\Windows\System\eYCbZVE.exeC:\Windows\System\eYCbZVE.exe2⤵
- Executes dropped EXE
PID:2576
-
-
C:\Windows\System\LHtsJcy.exeC:\Windows\System\LHtsJcy.exe2⤵
- Executes dropped EXE
PID:2472
-
-
C:\Windows\System\ubKLXvN.exeC:\Windows\System\ubKLXvN.exe2⤵
- Executes dropped EXE
PID:628
-
-
C:\Windows\System\QiCgYbN.exeC:\Windows\System\QiCgYbN.exe2⤵
- Executes dropped EXE
PID:1928
-
-
C:\Windows\System\tIjgtQG.exeC:\Windows\System\tIjgtQG.exe2⤵
- Executes dropped EXE
PID:4996
-
-
C:\Windows\System\Atzjgzd.exeC:\Windows\System\Atzjgzd.exe2⤵
- Executes dropped EXE
PID:2820
-
-
C:\Windows\System\KlGXzEV.exeC:\Windows\System\KlGXzEV.exe2⤵
- Executes dropped EXE
PID:508
-
-
C:\Windows\System\XHaRfNV.exeC:\Windows\System\XHaRfNV.exe2⤵
- Executes dropped EXE
PID:588
-
-
C:\Windows\System\UZdFQqk.exeC:\Windows\System\UZdFQqk.exe2⤵
- Executes dropped EXE
PID:2676
-
-
C:\Windows\System\VmIURgl.exeC:\Windows\System\VmIURgl.exe2⤵
- Executes dropped EXE
PID:2980
-
-
C:\Windows\System\rYPlfls.exeC:\Windows\System\rYPlfls.exe2⤵
- Executes dropped EXE
PID:5040
-
-
C:\Windows\System\BSoZVXV.exeC:\Windows\System\BSoZVXV.exe2⤵
- Executes dropped EXE
PID:1460
-
-
C:\Windows\System\ioJAfkO.exeC:\Windows\System\ioJAfkO.exe2⤵
- Executes dropped EXE
PID:4964
-
-
C:\Windows\System\bByWQpk.exeC:\Windows\System\bByWQpk.exe2⤵
- Executes dropped EXE
PID:4556
-
-
C:\Windows\System\FDGHwWH.exeC:\Windows\System\FDGHwWH.exe2⤵
- Executes dropped EXE
PID:1888
-
-
C:\Windows\System\VBExlKo.exeC:\Windows\System\VBExlKo.exe2⤵
- Executes dropped EXE
PID:4580
-
-
C:\Windows\System\XiJLYIU.exeC:\Windows\System\XiJLYIU.exe2⤵
- Executes dropped EXE
PID:1500
-
-
C:\Windows\System\oEPaSrv.exeC:\Windows\System\oEPaSrv.exe2⤵
- Executes dropped EXE
PID:2008
-
-
C:\Windows\System\lGfevUl.exeC:\Windows\System\lGfevUl.exe2⤵
- Executes dropped EXE
PID:4212
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\System\BSoZVXV.exe
- Size 1.9MB
- SHA256 60a5948084400707991c40b4413636168d0f0501efbc67fab461d4937de55fb6
- MD5 0b1dc771469fa6753e7aace834956918
- SHA1 ab392eb1cb5fc16a55a2c41b7c5a6d56cfdeced7
- SHA512 6ff29d03eaaae06a15e3efe1ea402940d3f7a6e2ebae2266481a1a80576dd91702b1cbddedd5f74c67cdfdf217582f180323fa66c29c2525747039f60c34ba60
- SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIt56uL3pgrCEdMKPj:BemTLkNdfE0pZrt56utgpPj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\FDGHwWH.exe
- Size 1.8MB
- SHA256 4ce197747d9fbeeec8496c26db012627d7ce7e6aa1a732a7c731d6ef8431204b
- MD5 c665d55523745ebd550a2c4296ad8ec9
- SHA1 43f72a8e93454ded742dbec7a7c84f59cb0d6520
- SHA512 57b316ce017c765c9f224c8ed85aafffadf3e3509d0b9d8b28c09b7a506bf84dd5216ab3d5048ad1f637628cef7585aca82701224766df2dd48aff33618c1454
- SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIt56uL3pgrCEdMu:BemTLkNdfE0pZrt56utg5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\LHtsJcy.exe
- Size 2.1MB
- SHA256 3ededef3bd2586830b0a8597cb8ce36b4909b0421f6d3ed699083dfd6f8c0a7d
- MD5 fbb6a602f644dbf57142122f30692c9a
- SHA1 8158aaa7168744874ea387599d6d2cead21e28a3
- SHA512 594ad340712d040831c50ecaffbc2dabd957ed3d1d45fbdcb2c0a001df0ecad88502ea7ae79d922d80e7ca9a296427129145281a618e70a75857e869e5c45bfe
- SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIt56uL3pgrCEdMKPFn:BemTLkNdfE0pZrt56utgpPFn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\VmIURgl.exe
- Size 5.4MB
- SHA256 caa068826195e26df36f4f536e4c6574635de1b7a9a02c85ee8ca5d8d8224bf8
- MD5 8003c8ca1c6255c4a9df50b61d369786
- SHA1 ef521c59d5519424152618453d9a1ec413a267cf
- SHA512 0384a1e885e5629a148689a8b4027e18c5b2d083fe94b00bac0956a112bba29ab292c390c9a09436cf2e74109a83853e787b70a1e1be9d9ef015a376f3eba795
- SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32I:Q+856utgpPF8u/h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\XiJLYIU.exe
- Size 1.1MB
- SHA256 2c35d06862247b330fc3f8d9e6af582fea555fda1909ac568685a45fc440b438
- MD5 d872631fef320bcfe95799f5b4c466cb
- SHA1 451a1400f207f69d35ba907e243aed76879dcd2c
- SHA512 2386867492e72b11ef633226d6bd8e4694f30ef287e4120da56c256823abf746800962069c455536682137d30dfdae1f3be9dfc70d5390788973809462de138d
- SSDEEP 24576:BezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbEwlKjpvzBF672K:BezaTF8FcNkNdfE0pZ9ozt4wIt+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\bByWQpk.exe
- Size 1.8MB
- SHA256 877be2224a2b649da5f78203ecb3453feb6fa6bbbc2d6c8d511c50eacb8915e1
- MD5 4ebd1901e669a14d40cee031fd206e82
- SHA1 48b4d9303ce77228a3ead5a9a71386291542a98f
- SHA512 c4c64ecded98a2388cd280fbf03b1c4943ae108cca32936b19ec1dc9b1e2275f8c7fb5cb86b3ef39ae05d629ddb91ee9822452b1bc6582399603f35642ecf087
- SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIt56uL3pgrCEdM7:BemTLkNdfE0pZrt56utgs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\bByWQpk.exe
- Size 5.3MB
- SHA256 cea51cc96156d8e8255e2ccada29ae7300a3315f995e7ba6d44446f87dc9a09d
- MD5 e8c4508a392ccf08590d3627a36cc3c3
- SHA1 3a57dd6c92ebc54582acaafd15cc9311eb0d15a2
- SHA512 f92387e78f5fe98543d9e60ae371868a188c86c9137b7d0a0d3bf28026dbd3fc59a4eb30687c1a9721f81959fcdee80d280162f492d355d2ec0e6a7c5d939410
- SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32S:Q+856utgpPF8u/X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\mJEukEU.exe
- Size 3.6MB
- SHA256 6f83751bb7dc13a49d7ca6c6a874635ca4829b15e2d7e8a8c8ddaf2890ac09c0
- MD5 0628374c349921c969043e8b725a574d
- SHA1 d4d4b61d7abb11c25e423140f9a833a035819e3d
- SHA512 2db578fa7a962b14aae5c857e6974664cd647108bf44f83523c1fc47be8f0f23756b21e5f42a2231cc51d1daf9889177945ad8eab23827274ef49200ad4dd7a1
- SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIt56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA0:BemTLkNdfE0pZrt56utgpPFotBER/W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System\oEPaSrv.exe
- Size 1.2MB
- SHA256 c07d701eb04ab4f8699484a3bd23da869373ffe5abb89855dad47bf019625666
- MD5 711965c0ed770375b388ea9b5ea57c70
- SHA1 21f7ffc0c96b29ee6bc8176dc97f6fd049d110a2
- SHA512 1805d8628649a043140bc3aafe1e7909e2e2c4d13967ba772fc49046b58f359c9204953c678c902e0a7afe7ca922f35fcfea6266309db91efb45c72ff619c428
- SSDEEP 24576:BezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbEwlKjpvzBF672l6iN:BezaTF8FcNkNdfE0pZ9ozt4wIt53
- MD5 SHA1 SHA512 SSDEEP