cobaltstrike | 90878ada595d6b5145f6ab71d50376c455cf9d52d7efcd08ca4648a853deb085

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240528-j2ethscb2v
SHA256 90878ada595d6b5145f6ab71d50376c455cf9d52d7efcd08ca4648a853deb085
MD5 4bf3ef7b76fa151bd79e72167b075d61
SHA1 387e96c2c85fa644d9dc5b534be5e144bd1a7060
SHA512 92e5f6d3e164dd185d86a2347ae340954fa35009cf2550f29a07f6294e3845ad1ce0796b92e6fde0ef91a095bbd4c277732ea45c1c37c30157540e00980d50d9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023462-5.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023466-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023467-9.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023463-22.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023468-28.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023469-36.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002346a-39.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002346c-46.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002346d-52.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002346e-59.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002346f-66.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023470-74.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023471-79.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000022b21-85.dat	cobalt_reflective_dll
behavioral2/files/0x000a0000000233dc-91.dat	cobalt_reflective_dll
behavioral2/files/0x00030000000229de-99.dat	cobalt_reflective_dll
behavioral2/files/0x00030000000229e0-103.dat	cobalt_reflective_dll
behavioral2/files/0x000a0000000233e0-111.dat	cobalt_reflective_dll
behavioral2/files/0x000a0000000233e1-118.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023472-124.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023473-128.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023462-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023466-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023467-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023463-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023468-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023469-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002346a-39.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002346c-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002346d-52.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002346e-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002346f-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023470-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023471-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000022b21-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a0000000233dc-91.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00030000000229de-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00030000000229e0-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a0000000233e0-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a0000000233e1-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023472-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023473-128.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/5076-0-0x00007FF6D0230000-0x00007FF6D0584000-memory.dmp	UPX
behavioral2/files/0x0008000000023462-5.dat	UPX
behavioral2/memory/3316-7-0x00007FF608F10000-0x00007FF609264000-memory.dmp	UPX
behavioral2/files/0x0007000000023466-10.dat	UPX
behavioral2/files/0x0007000000023467-9.dat	UPX
behavioral2/memory/2792-14-0x00007FF6255E0000-0x00007FF625934000-memory.dmp	UPX
behavioral2/files/0x0008000000023463-22.dat	UPX
behavioral2/memory/3940-20-0x00007FF669E20000-0x00007FF66A174000-memory.dmp	UPX
behavioral2/memory/4892-26-0x00007FF709650000-0x00007FF7099A4000-memory.dmp	UPX
behavioral2/files/0x0007000000023468-28.dat	UPX
behavioral2/memory/4704-32-0x00007FF6B21C0000-0x00007FF6B2514000-memory.dmp	UPX
behavioral2/files/0x0007000000023469-36.dat	UPX
behavioral2/memory/3148-38-0x00007FF74A900000-0x00007FF74AC54000-memory.dmp	UPX
behavioral2/files/0x000700000002346a-39.dat	UPX
behavioral2/memory/3356-42-0x00007FF6E1CB0000-0x00007FF6E2004000-memory.dmp	UPX
behavioral2/files/0x000700000002346c-46.dat	UPX
behavioral2/memory/1544-50-0x00007FF776540000-0x00007FF776894000-memory.dmp	UPX
behavioral2/files/0x000700000002346d-52.dat	UPX
behavioral2/memory/4984-56-0x00007FF7719A0000-0x00007FF771CF4000-memory.dmp	UPX
behavioral2/files/0x000700000002346e-59.dat	UPX
behavioral2/memory/5048-62-0x00007FF7DAEC0000-0x00007FF7DB214000-memory.dmp	UPX
behavioral2/files/0x000700000002346f-66.dat	UPX
behavioral2/memory/3316-69-0x00007FF608F10000-0x00007FF609264000-memory.dmp	UPX
behavioral2/files/0x0007000000023470-74.dat	UPX
behavioral2/memory/3952-73-0x00007FF6F31C0000-0x00007FF6F3514000-memory.dmp	UPX
behavioral2/memory/4808-70-0x00007FF7D6F50000-0x00007FF7D72A4000-memory.dmp	UPX
behavioral2/memory/5076-61-0x00007FF6D0230000-0x00007FF6D0584000-memory.dmp	UPX
behavioral2/files/0x0007000000023471-79.dat	UPX
behavioral2/files/0x0007000000022b21-85.dat	UPX
behavioral2/memory/4924-80-0x00007FF641540000-0x00007FF641894000-memory.dmp	UPX
behavioral2/memory/1012-89-0x00007FF6D0C50000-0x00007FF6D0FA4000-memory.dmp	UPX
behavioral2/memory/3940-88-0x00007FF669E20000-0x00007FF66A174000-memory.dmp	UPX
behavioral2/files/0x000a0000000233dc-91.dat	UPX
behavioral2/files/0x00030000000229de-99.dat	UPX
behavioral2/files/0x00030000000229e0-103.dat	UPX
behavioral2/memory/1456-100-0x00007FF7C75A0000-0x00007FF7C78F4000-memory.dmp	UPX
behavioral2/memory/2912-95-0x00007FF74E0B0000-0x00007FF74E404000-memory.dmp	UPX
behavioral2/memory/820-107-0x00007FF7760D0000-0x00007FF776424000-memory.dmp	UPX
behavioral2/files/0x000a0000000233e0-111.dat	UPX
behavioral2/memory/3356-113-0x00007FF6E1CB0000-0x00007FF6E2004000-memory.dmp	UPX
behavioral2/memory/5056-117-0x00007FF698A10000-0x00007FF698D64000-memory.dmp	UPX
behavioral2/files/0x000a0000000233e1-118.dat	UPX
behavioral2/memory/3212-120-0x00007FF6CD510000-0x00007FF6CD864000-memory.dmp	UPX
behavioral2/files/0x0007000000023472-124.dat	UPX
behavioral2/memory/1108-126-0x00007FF61A1F0000-0x00007FF61A544000-memory.dmp	UPX
behavioral2/files/0x0007000000023473-128.dat	UPX
behavioral2/memory/5048-131-0x00007FF7DAEC0000-0x00007FF7DB214000-memory.dmp	UPX
behavioral2/memory/1984-132-0x00007FF6DFFD0000-0x00007FF6E0324000-memory.dmp	UPX
behavioral2/memory/4808-133-0x00007FF7D6F50000-0x00007FF7D72A4000-memory.dmp	UPX
behavioral2/memory/3952-134-0x00007FF6F31C0000-0x00007FF6F3514000-memory.dmp	UPX
behavioral2/memory/4924-135-0x00007FF641540000-0x00007FF641894000-memory.dmp	UPX
behavioral2/memory/2912-136-0x00007FF74E0B0000-0x00007FF74E404000-memory.dmp	UPX
behavioral2/memory/1456-137-0x00007FF7C75A0000-0x00007FF7C78F4000-memory.dmp	UPX
behavioral2/memory/3316-138-0x00007FF608F10000-0x00007FF609264000-memory.dmp	UPX
behavioral2/memory/2792-139-0x00007FF6255E0000-0x00007FF625934000-memory.dmp	UPX
behavioral2/memory/3940-140-0x00007FF669E20000-0x00007FF66A174000-memory.dmp	UPX
behavioral2/memory/4892-141-0x00007FF709650000-0x00007FF7099A4000-memory.dmp	UPX
behavioral2/memory/4704-142-0x00007FF6B21C0000-0x00007FF6B2514000-memory.dmp	UPX
behavioral2/memory/3148-143-0x00007FF74A900000-0x00007FF74AC54000-memory.dmp	UPX
behavioral2/memory/3356-144-0x00007FF6E1CB0000-0x00007FF6E2004000-memory.dmp	UPX
behavioral2/memory/1544-145-0x00007FF776540000-0x00007FF776894000-memory.dmp	UPX
behavioral2/memory/4984-146-0x00007FF7719A0000-0x00007FF771CF4000-memory.dmp	UPX
behavioral2/memory/5048-147-0x00007FF7DAEC0000-0x00007FF7DB214000-memory.dmp	UPX
behavioral2/memory/3952-149-0x00007FF6F31C0000-0x00007FF6F3514000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/5076-0-0x00007FF6D0230000-0x00007FF6D0584000-memory.dmp	xmrig
behavioral2/files/0x0008000000023462-5.dat	xmrig
behavioral2/memory/3316-7-0x00007FF608F10000-0x00007FF609264000-memory.dmp	xmrig
behavioral2/files/0x0007000000023466-10.dat	xmrig
behavioral2/files/0x0007000000023467-9.dat	xmrig
behavioral2/memory/2792-14-0x00007FF6255E0000-0x00007FF625934000-memory.dmp	xmrig
behavioral2/files/0x0008000000023463-22.dat	xmrig
behavioral2/memory/3940-20-0x00007FF669E20000-0x00007FF66A174000-memory.dmp	xmrig
behavioral2/memory/4892-26-0x00007FF709650000-0x00007FF7099A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023468-28.dat	xmrig
behavioral2/memory/4704-32-0x00007FF6B21C0000-0x00007FF6B2514000-memory.dmp	xmrig
behavioral2/files/0x0007000000023469-36.dat	xmrig
behavioral2/memory/3148-38-0x00007FF74A900000-0x00007FF74AC54000-memory.dmp	xmrig
behavioral2/files/0x000700000002346a-39.dat	xmrig
behavioral2/memory/3356-42-0x00007FF6E1CB0000-0x00007FF6E2004000-memory.dmp	xmrig
behavioral2/files/0x000700000002346c-46.dat	xmrig
behavioral2/memory/1544-50-0x00007FF776540000-0x00007FF776894000-memory.dmp	xmrig
behavioral2/files/0x000700000002346d-52.dat	xmrig
behavioral2/memory/4984-56-0x00007FF7719A0000-0x00007FF771CF4000-memory.dmp	xmrig
behavioral2/files/0x000700000002346e-59.dat	xmrig
behavioral2/memory/5048-62-0x00007FF7DAEC0000-0x00007FF7DB214000-memory.dmp	xmrig
behavioral2/files/0x000700000002346f-66.dat	xmrig
behavioral2/memory/3316-69-0x00007FF608F10000-0x00007FF609264000-memory.dmp	xmrig
behavioral2/files/0x0007000000023470-74.dat	xmrig
behavioral2/memory/3952-73-0x00007FF6F31C0000-0x00007FF6F3514000-memory.dmp	xmrig
behavioral2/memory/4808-70-0x00007FF7D6F50000-0x00007FF7D72A4000-memory.dmp	xmrig
behavioral2/memory/5076-61-0x00007FF6D0230000-0x00007FF6D0584000-memory.dmp	xmrig
behavioral2/files/0x0007000000023471-79.dat	xmrig
behavioral2/files/0x0007000000022b21-85.dat	xmrig
behavioral2/memory/4924-80-0x00007FF641540000-0x00007FF641894000-memory.dmp	xmrig
behavioral2/memory/1012-89-0x00007FF6D0C50000-0x00007FF6D0FA4000-memory.dmp	xmrig
behavioral2/memory/3940-88-0x00007FF669E20000-0x00007FF66A174000-memory.dmp	xmrig
behavioral2/files/0x000a0000000233dc-91.dat	xmrig
behavioral2/files/0x00030000000229de-99.dat	xmrig
behavioral2/files/0x00030000000229e0-103.dat	xmrig
behavioral2/memory/1456-100-0x00007FF7C75A0000-0x00007FF7C78F4000-memory.dmp	xmrig
behavioral2/memory/2912-95-0x00007FF74E0B0000-0x00007FF74E404000-memory.dmp	xmrig
behavioral2/memory/820-107-0x00007FF7760D0000-0x00007FF776424000-memory.dmp	xmrig
behavioral2/files/0x000a0000000233e0-111.dat	xmrig
behavioral2/memory/3356-113-0x00007FF6E1CB0000-0x00007FF6E2004000-memory.dmp	xmrig
behavioral2/memory/5056-117-0x00007FF698A10000-0x00007FF698D64000-memory.dmp	xmrig
behavioral2/files/0x000a0000000233e1-118.dat	xmrig
behavioral2/memory/3212-120-0x00007FF6CD510000-0x00007FF6CD864000-memory.dmp	xmrig
behavioral2/files/0x0007000000023472-124.dat	xmrig
behavioral2/memory/1108-126-0x00007FF61A1F0000-0x00007FF61A544000-memory.dmp	xmrig
behavioral2/files/0x0007000000023473-128.dat	xmrig
behavioral2/memory/5048-131-0x00007FF7DAEC0000-0x00007FF7DB214000-memory.dmp	xmrig
behavioral2/memory/1984-132-0x00007FF6DFFD0000-0x00007FF6E0324000-memory.dmp	xmrig
behavioral2/memory/4808-133-0x00007FF7D6F50000-0x00007FF7D72A4000-memory.dmp	xmrig
behavioral2/memory/3952-134-0x00007FF6F31C0000-0x00007FF6F3514000-memory.dmp	xmrig
behavioral2/memory/4924-135-0x00007FF641540000-0x00007FF641894000-memory.dmp	xmrig
behavioral2/memory/2912-136-0x00007FF74E0B0000-0x00007FF74E404000-memory.dmp	xmrig
behavioral2/memory/1456-137-0x00007FF7C75A0000-0x00007FF7C78F4000-memory.dmp	xmrig
behavioral2/memory/3316-138-0x00007FF608F10000-0x00007FF609264000-memory.dmp	xmrig
behavioral2/memory/2792-139-0x00007FF6255E0000-0x00007FF625934000-memory.dmp	xmrig
behavioral2/memory/3940-140-0x00007FF669E20000-0x00007FF66A174000-memory.dmp	xmrig
behavioral2/memory/4892-141-0x00007FF709650000-0x00007FF7099A4000-memory.dmp	xmrig
behavioral2/memory/4704-142-0x00007FF6B21C0000-0x00007FF6B2514000-memory.dmp	xmrig
behavioral2/memory/3148-143-0x00007FF74A900000-0x00007FF74AC54000-memory.dmp	xmrig
behavioral2/memory/3356-144-0x00007FF6E1CB0000-0x00007FF6E2004000-memory.dmp	xmrig
behavioral2/memory/1544-145-0x00007FF776540000-0x00007FF776894000-memory.dmp	xmrig
behavioral2/memory/4984-146-0x00007FF7719A0000-0x00007FF771CF4000-memory.dmp	xmrig
behavioral2/memory/5048-147-0x00007FF7DAEC0000-0x00007FF7DB214000-memory.dmp	xmrig
behavioral2/memory/3952-149-0x00007FF6F31C0000-0x00007FF6F3514000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3316	dvdzvCY.exe
2792	BReWpYf.exe
3940	BQBRzqg.exe
4892	biNEMPi.exe
4704	xHzLvnP.exe
3148	sihSMEN.exe
3356	JLoGxDb.exe
1544	QianRlW.exe
4984	tgoaiCc.exe
5048	uctqsoG.exe
4808	JzXIDcU.exe
3952	iVJyWoP.exe
4924	ARaKpjw.exe
1012	yBSlUDe.exe
2912	yjsqjUy.exe
1456	UYWXhVu.exe
820	xTblJCv.exe
5056	OSHguLs.exe
3212	WlhzXue.exe
1108	ZoedVOV.exe
1984	pYDKZEa.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5076-0-0x00007FF6D0230000-0x00007FF6D0584000-memory.dmp	upx
behavioral2/files/0x0008000000023462-5.dat	upx
behavioral2/memory/3316-7-0x00007FF608F10000-0x00007FF609264000-memory.dmp	upx
behavioral2/files/0x0007000000023466-10.dat	upx
behavioral2/files/0x0007000000023467-9.dat	upx
behavioral2/memory/2792-14-0x00007FF6255E0000-0x00007FF625934000-memory.dmp	upx
behavioral2/files/0x0008000000023463-22.dat	upx
behavioral2/memory/3940-20-0x00007FF669E20000-0x00007FF66A174000-memory.dmp	upx
behavioral2/memory/4892-26-0x00007FF709650000-0x00007FF7099A4000-memory.dmp	upx
behavioral2/files/0x0007000000023468-28.dat	upx
behavioral2/memory/4704-32-0x00007FF6B21C0000-0x00007FF6B2514000-memory.dmp	upx
behavioral2/files/0x0007000000023469-36.dat	upx
behavioral2/memory/3148-38-0x00007FF74A900000-0x00007FF74AC54000-memory.dmp	upx
behavioral2/files/0x000700000002346a-39.dat	upx
behavioral2/memory/3356-42-0x00007FF6E1CB0000-0x00007FF6E2004000-memory.dmp	upx
behavioral2/files/0x000700000002346c-46.dat	upx
behavioral2/memory/1544-50-0x00007FF776540000-0x00007FF776894000-memory.dmp	upx
behavioral2/files/0x000700000002346d-52.dat	upx
behavioral2/memory/4984-56-0x00007FF7719A0000-0x00007FF771CF4000-memory.dmp	upx
behavioral2/files/0x000700000002346e-59.dat	upx
behavioral2/memory/5048-62-0x00007FF7DAEC0000-0x00007FF7DB214000-memory.dmp	upx
behavioral2/files/0x000700000002346f-66.dat	upx
behavioral2/memory/3316-69-0x00007FF608F10000-0x00007FF609264000-memory.dmp	upx
behavioral2/files/0x0007000000023470-74.dat	upx
behavioral2/memory/3952-73-0x00007FF6F31C0000-0x00007FF6F3514000-memory.dmp	upx
behavioral2/memory/4808-70-0x00007FF7D6F50000-0x00007FF7D72A4000-memory.dmp	upx
behavioral2/memory/5076-61-0x00007FF6D0230000-0x00007FF6D0584000-memory.dmp	upx
behavioral2/files/0x0007000000023471-79.dat	upx
behavioral2/files/0x0007000000022b21-85.dat	upx
behavioral2/memory/4924-80-0x00007FF641540000-0x00007FF641894000-memory.dmp	upx
behavioral2/memory/1012-89-0x00007FF6D0C50000-0x00007FF6D0FA4000-memory.dmp	upx
behavioral2/memory/3940-88-0x00007FF669E20000-0x00007FF66A174000-memory.dmp	upx
behavioral2/files/0x000a0000000233dc-91.dat	upx
behavioral2/files/0x00030000000229de-99.dat	upx
behavioral2/files/0x00030000000229e0-103.dat	upx
behavioral2/memory/1456-100-0x00007FF7C75A0000-0x00007FF7C78F4000-memory.dmp	upx
behavioral2/memory/2912-95-0x00007FF74E0B0000-0x00007FF74E404000-memory.dmp	upx
behavioral2/memory/820-107-0x00007FF7760D0000-0x00007FF776424000-memory.dmp	upx
behavioral2/files/0x000a0000000233e0-111.dat	upx
behavioral2/memory/3356-113-0x00007FF6E1CB0000-0x00007FF6E2004000-memory.dmp	upx
behavioral2/memory/5056-117-0x00007FF698A10000-0x00007FF698D64000-memory.dmp	upx
behavioral2/files/0x000a0000000233e1-118.dat	upx
behavioral2/memory/3212-120-0x00007FF6CD510000-0x00007FF6CD864000-memory.dmp	upx
behavioral2/files/0x0007000000023472-124.dat	upx
behavioral2/memory/1108-126-0x00007FF61A1F0000-0x00007FF61A544000-memory.dmp	upx
behavioral2/files/0x0007000000023473-128.dat	upx
behavioral2/memory/5048-131-0x00007FF7DAEC0000-0x00007FF7DB214000-memory.dmp	upx
behavioral2/memory/1984-132-0x00007FF6DFFD0000-0x00007FF6E0324000-memory.dmp	upx
behavioral2/memory/4808-133-0x00007FF7D6F50000-0x00007FF7D72A4000-memory.dmp	upx
behavioral2/memory/3952-134-0x00007FF6F31C0000-0x00007FF6F3514000-memory.dmp	upx
behavioral2/memory/4924-135-0x00007FF641540000-0x00007FF641894000-memory.dmp	upx
behavioral2/memory/2912-136-0x00007FF74E0B0000-0x00007FF74E404000-memory.dmp	upx
behavioral2/memory/1456-137-0x00007FF7C75A0000-0x00007FF7C78F4000-memory.dmp	upx
behavioral2/memory/3316-138-0x00007FF608F10000-0x00007FF609264000-memory.dmp	upx
behavioral2/memory/2792-139-0x00007FF6255E0000-0x00007FF625934000-memory.dmp	upx
behavioral2/memory/3940-140-0x00007FF669E20000-0x00007FF66A174000-memory.dmp	upx
behavioral2/memory/4892-141-0x00007FF709650000-0x00007FF7099A4000-memory.dmp	upx
behavioral2/memory/4704-142-0x00007FF6B21C0000-0x00007FF6B2514000-memory.dmp	upx
behavioral2/memory/3148-143-0x00007FF74A900000-0x00007FF74AC54000-memory.dmp	upx
behavioral2/memory/3356-144-0x00007FF6E1CB0000-0x00007FF6E2004000-memory.dmp	upx
behavioral2/memory/1544-145-0x00007FF776540000-0x00007FF776894000-memory.dmp	upx
behavioral2/memory/4984-146-0x00007FF7719A0000-0x00007FF771CF4000-memory.dmp	upx
behavioral2/memory/5048-147-0x00007FF7DAEC0000-0x00007FF7DB214000-memory.dmp	upx
behavioral2/memory/3952-149-0x00007FF6F31C0000-0x00007FF6F3514000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\sihSMEN.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JLoGxDb.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uctqsoG.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yBSlUDe.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dvdzvCY.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tgoaiCc.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WlhzXue.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZoedVOV.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pYDKZEa.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\biNEMPi.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xHzLvnP.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JzXIDcU.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yjsqjUy.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UYWXhVu.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BReWpYf.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QianRlW.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iVJyWoP.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ARaKpjw.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xTblJCv.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OSHguLs.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BQBRzqg.exe	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 3316	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	83
PID 5076 wrote to memory of 3316	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	83
PID 5076 wrote to memory of 2792	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	84
PID 5076 wrote to memory of 2792	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	84
PID 5076 wrote to memory of 3940	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	85
PID 5076 wrote to memory of 3940	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	85
PID 5076 wrote to memory of 4892	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	86
PID 5076 wrote to memory of 4892	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	86
PID 5076 wrote to memory of 4704	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	88
PID 5076 wrote to memory of 4704	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	88
PID 5076 wrote to memory of 3148	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	89
PID 5076 wrote to memory of 3148	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	89
PID 5076 wrote to memory of 3356	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	91
PID 5076 wrote to memory of 3356	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	91
PID 5076 wrote to memory of 1544	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	92
PID 5076 wrote to memory of 1544	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	92
PID 5076 wrote to memory of 4984	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	94
PID 5076 wrote to memory of 4984	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	94
PID 5076 wrote to memory of 5048	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	95
PID 5076 wrote to memory of 5048	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	95
PID 5076 wrote to memory of 4808	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	96
PID 5076 wrote to memory of 4808	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	96
PID 5076 wrote to memory of 3952	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	97
PID 5076 wrote to memory of 3952	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	97
PID 5076 wrote to memory of 4924	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	98
PID 5076 wrote to memory of 4924	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	98
PID 5076 wrote to memory of 1012	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	99
PID 5076 wrote to memory of 1012	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	99
PID 5076 wrote to memory of 2912	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	100
PID 5076 wrote to memory of 2912	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	100
PID 5076 wrote to memory of 1456	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	101
PID 5076 wrote to memory of 1456	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	101
PID 5076 wrote to memory of 820	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	102
PID 5076 wrote to memory of 820	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	102
PID 5076 wrote to memory of 5056	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	103
PID 5076 wrote to memory of 5056	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	103
PID 5076 wrote to memory of 3212	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	104
PID 5076 wrote to memory of 3212	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	104
PID 5076 wrote to memory of 1108	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	105
PID 5076 wrote to memory of 1108	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	105
PID 5076 wrote to memory of 1984	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	106
PID 5076 wrote to memory of 1984	5076	2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe	106

C:\Users\Admin\AppData\Local\Temp\2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-28_4bf3ef7b76fa151bd79e72167b075d61_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\System\dvdzvCY.exe
  C:\Windows\System\dvdzvCY.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\BReWpYf.exe
  C:\Windows\System\BReWpYf.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\BQBRzqg.exe
  C:\Windows\System\BQBRzqg.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\biNEMPi.exe
  C:\Windows\System\biNEMPi.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\xHzLvnP.exe
  C:\Windows\System\xHzLvnP.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\sihSMEN.exe
  C:\Windows\System\sihSMEN.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\JLoGxDb.exe
  C:\Windows\System\JLoGxDb.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\QianRlW.exe
  C:\Windows\System\QianRlW.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\tgoaiCc.exe
  C:\Windows\System\tgoaiCc.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\uctqsoG.exe
  C:\Windows\System\uctqsoG.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\JzXIDcU.exe
  C:\Windows\System\JzXIDcU.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\iVJyWoP.exe
  C:\Windows\System\iVJyWoP.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\ARaKpjw.exe
  C:\Windows\System\ARaKpjw.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\yBSlUDe.exe
  C:\Windows\System\yBSlUDe.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\yjsqjUy.exe
  C:\Windows\System\yjsqjUy.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\UYWXhVu.exe
  C:\Windows\System\UYWXhVu.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\xTblJCv.exe
  C:\Windows\System\xTblJCv.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\OSHguLs.exe
  C:\Windows\System\OSHguLs.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\WlhzXue.exe
  C:\Windows\System\WlhzXue.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\ZoedVOV.exe
  C:\Windows\System\ZoedVOV.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\pYDKZEa.exe
  C:\Windows\System\pYDKZEa.exe
  2⤵
  - Executes dropped EXE
  PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ARaKpjw.exe

Path C:\Windows\System\ARaKpjw.exe
Size 5.9MB
SHA256 f138cc35f7064257d14d64e85831b2ae25108e956b0d680b08c53e8d55c06c5f
MD5 32f1a76bdd1643858d62a63ee36af940
SHA1 c94de83e0a8ec1a8e9200bba87f5385c9fb02ab9
SHA512 375e34fa3bdcd26e0410ebf39f7d4d51840c533597e0af181f49d88ae87890182e6c041860f6870d2805f589d5f22170dd7ac8312a932cc6e02b52404ab8878b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

BQBRzqg.exe

Path C:\Windows\System\BQBRzqg.exe
Size 5.9MB
SHA256 be47e082ada646b539d36c5a836180cd07f040a6b960d6a3136e8f14723f2ced
MD5 473221d2c580282097a32984e494aa13
SHA1 1955f2b0ccc9b153fbabb1fe757567e4065560a0
SHA512 ef0680912173804eec1b132bc267a985ca04305144dc2b186a2c8d40331acdb43317d4b1fef1cb2174b62e594cc044072489e5c31575deb28f534017491f212e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

BReWpYf.exe

Path C:\Windows\System\BReWpYf.exe
Size 5.9MB
SHA256 6da0fc0ea389c7de7917f0a1177b5dd9198b2967872da69318e4c5c4ed1ec4ce
MD5 e3498a9d2153a754d8d4f38701119ccb
SHA1 b05ab2571860837511dc0aa7609febdc1e440261
SHA512 4ca14f349c11723d78913f23502242891aa3c892f38eb2c1f07071f02826e19416560d9aa4f753cc7aecaef7e7bf04007ebb225ccd17da775a62755d77bcce0a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

JLoGxDb.exe

Path C:\Windows\System\JLoGxDb.exe
Size 5.9MB
SHA256 ef00b8fda7053fb15de95908190b9c653fc291f5dabd8d830cbf8b7afde49997
MD5 c59313ee8f99886f432a3adace0c340c
SHA1 0a079045bd66d1972045c47b7983c010a0f4506f
SHA512 11fd093e7d9cf65bca57a000851831300f26c5ca573d5ca4ed146412eae754d93ccefd59d7d164481e1d23d1237f58e427f93443cca1aac2815f579360839430
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

JzXIDcU.exe

Path C:\Windows\System\JzXIDcU.exe
Size 5.9MB
SHA256 15168f33070a599b77f5698b4026eae02c5c511ad0ef822e46b78bb321f08088
MD5 068fa241fb279a79548d9536ea357020
SHA1 3cf48ef53dd0cee95e85942f62fc10a45225aa98
SHA512 3f4436f23dc104303b7b0934456167a4dc9b925fedb4f31c5fed834003f8a05e9d4fa33821dd3d0b1d887d5c19e18dd26b0a04b394e4c9439d6a6ee1c761d28d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSHguLs.exe

Path C:\Windows\System\OSHguLs.exe
Size 5.9MB
SHA256 f0a0d3f6ee50b82dcf0ed6c08a522857007895d487bd1dca362318873435becb
MD5 2efddd748cc90b2218982a98155acf00
SHA1 d97f9a4001def2435970328daeba0f28a5ba2e8f
SHA512 e556d26f99e52b8d9d92c8811e2b9566d98fba1c0235b22c60c8929989262afa55935fe01589fc700da96d9550923f0e600afc3f9308e808e3b2b1691275b2d8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

QianRlW.exe

Path C:\Windows\System\QianRlW.exe
Size 5.9MB
SHA256 3f814fbe77b8f7cffe1f7c118c93245b43c3c400dd01af78f688804849abae94
MD5 3fadc1625002868c716e257d8b0bd00c
SHA1 adc1adf2ea26366c51e9c8f9e2d012bd08ae5a20
SHA512 7c39c39e951568994b27befa42f516b56116457b8a84041756465218bc13899b0475ba0fac3bf108734c007dac19e0fc7fee4f2b4e49451a861d9534bd1e5c4f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

UYWXhVu.exe

Path C:\Windows\System\UYWXhVu.exe
Size 5.9MB
SHA256 240c62c3037953dfd81107492cfdbf9ccf9e28157096867206bdefcfac48b244
MD5 e404d78f775610e10cda11b88c25c563
SHA1 9a749c9c003bfe1c667ab466935edc297e52df71
SHA512 f1639cb97c2def0b93946adf655200a030911b51c019d63a0e3af8e3640c2808ee049055412f6df219a978468860913ea0d7bc4f5b59381288e7ff53d2b06cb0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:Q+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

WlhzXue.exe

Path C:\Windows\System\WlhzXue.exe
Size 5.9MB
SHA256 60f46aa3c310a0383335a0bb150d660b8b19093f59988cdbb0262c825efc8f4e
MD5 7430cc16b64b528ab52a2630f19a720b
SHA1 c2cb07731f149cd4ee4cc2e6a5507e8800e58c7e
SHA512 43c3b9009cc4abdc463c1dc059d6e4854a2a60250d74b55c729ccafd054622e4ebc35f5be2f57cd59f6b30b0e5a17a43461e92e59bccfc4d657c59ae6ecf19bd
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZoedVOV.exe

Path C:\Windows\System\ZoedVOV.exe
Size 5.9MB
SHA256 97bfe4a31d24492793b0172e726f778c0101b8d998a1d7a6c42c47ca4f6d2212
MD5 b480bc345cb19610c210d337e3a46547
SHA1 caa59512840e8c5d43bec35ff52ffa62e4f8dd0e
SHA512 d822b4866ceb55a34abba5520d9a8a0e1fa11ea0c6ef994b2a2422f1a05b9ea4034d726de8cb83b75474872c2f8713bed21490d6ef7c22d63d6ea9aff6cf6de0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

biNEMPi.exe

Path C:\Windows\System\biNEMPi.exe
Size 5.9MB
SHA256 7b9003c84f642a612780919c4017e5d8f41faa8adfb7fb405701247a390b7cb0
MD5 aa73f94b79d3a2eea3b2ed41d3347043
SHA1 2e9171f6bbaab5465fafb449b2e0ec3fd477ee32
SHA512 44857a7203fd6c0cac3580b0815d5ca71c42189c0d54d310de33896341c1ab5906edde8a4f2235dd787c045ae5718d706c82d291511e958508f2bf9d008bfeb4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

dvdzvCY.exe

Path C:\Windows\System\dvdzvCY.exe
Size 5.9MB
SHA256 68afbe8d9d491a8521bd74c532fc7eda3af6c684c2be66f7375d8756f82c54db
MD5 9fe11a8c62322dbe3b7487f3717b08a3
SHA1 3492647b5f98edda707d76aadf6652641959522a
SHA512 d8d629115b3b83dfdf5aca969887b101c6b056926eda49dfbf10efd64b6c66857326c74ef0cb82d4d532f87dffab2d8e033471de6bf7dc3cfcf248562d9cc38f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:Q+856utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

iVJyWoP.exe

Path C:\Windows\System\iVJyWoP.exe
Size 5.9MB
SHA256 b37d686fa064b5ced0d98081385348decc485100e538a6f2d94d32f4cf0c2ba8
MD5 77ab9eccbd7975ad4dfa9bdec628198e
SHA1 3a6610633813118f3c54c7323f214f67ec6ee1ee
SHA512 5c7cbaf3bc3bf059ee96d086e0703f5fa2c55018395184a01a67eeadcd5bfa2661971e45595b796051520486f0be1ac4874d611546668b8c052ab2ad133d9d1a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

pYDKZEa.exe

Path C:\Windows\System\pYDKZEa.exe
Size 5.9MB
SHA256 f6ff2396d04cf79696f70fbbb6af84d4e1dfdc63a8428aac7cf5f80d71256e87
MD5 dc96077455488faf70cc11a24ae1a934
SHA1 884e755b293a75ad61fbaaf3b8132801de31982e
SHA512 31acfc88e267a86952faea6ce73c0d7fb6fa48cfd21049d05886518754689d85947875822e00d9ac0abe7d0a391bbfb13eff58f357dd201860f53a7ca110d66c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

sihSMEN.exe

Path C:\Windows\System\sihSMEN.exe
Size 5.9MB
SHA256 b5e65edb605f1d592deed1c624b21bcd1e51db0993e1876a4bf7271eead79799
MD5 d7fdfa38ca292975706131ba1e2685bc
SHA1 ab6a97ab881ce2384b2c2dbffcd2ae6a1d10be6f
SHA512 f4080e414babf9d59ca7dda3219c3544d45ea756e15d410a95158986957f85e84d8e1d5384cbf568f1daa536fb897af4861f924a08b08b9d779dad7ca3fbbe11
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

tgoaiCc.exe

Path C:\Windows\System\tgoaiCc.exe
Size 5.9MB
SHA256 a0b54c49a84e56d8498ffe15cc667bd05258bc83f86749da6e582ac088d23d90
MD5 e99b761db8143911bb5c1436e9228447
SHA1 82396ba8df68167c95f39286c5877b8a03476c75
SHA512 c5daec9cb14515ac9bac591688efc0e2f58c78708bcaa2d2dc3617a04b3edb350705215fcce5b56caa86d3d402c01eb6ed088c234dff223b560f68af85706d09
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

uctqsoG.exe

Path C:\Windows\System\uctqsoG.exe
Size 5.9MB
SHA256 1525b1edb60210b63179d6ada4cb81646b73bb09778f2d15524764456eb7b2a4
MD5 ba58458b5e83d2a8907c2ad40e33e040
SHA1 48729087a15a15d842e6535a690fde1408245291
SHA512 12f8a434c9ce0d2921bd3e04746fce3afbd41dd32e4c53878a00db0751d045c83189d7416b082662d688f4a4028ecc364d82df4b16b23a5fb3aff5c5b0a3624d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

xHzLvnP.exe

Path C:\Windows\System\xHzLvnP.exe
Size 5.9MB
SHA256 103e831a349ecaa8d40b8d00de8bc9d970ecf0a1115a106c0e7fb66851dee460
MD5 a7ee6b8955e6f938c12ae109dee1db80
SHA1 6662a36d05ec2dc7f93f09d531ea89d07394f984
SHA512 966ca93e7023187b291f4bb4c0a4131a7c4c1cdfa5c9efda78b39463c1c97303be75842bbd82e4879b8a00dbc342482a785213936878515c3901d51fd74fcd89
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

xTblJCv.exe

Path C:\Windows\System\xTblJCv.exe
Size 5.9MB
SHA256 d7997e3bb4905ecdc6d5906abe551827aba9d911e24b1534e548297511909b58
MD5 88c418a261dc62e8b2f646b6052fdd14
SHA1 fab5807eea8288007a6dfadb437d6b3831117fa7
SHA512 6d5660cf27e489a4c78bf82d877b50993998bf2eadaa691c6e0a32c03b2a50f07c8e0b0b52d70e58a697bd819253c542ad02adb7936cc4ce7f83916d0da0a6de
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

yBSlUDe.exe

Path C:\Windows\System\yBSlUDe.exe
Size 5.9MB
SHA256 0ff442bcdc76f19cdf0fd8975cd1a6077831d8957338769a0b477a988ca1d611
MD5 bd4ba1bbc09af3e129dffe1f2bff3556
SHA1 d8c6dd19f7866c5c39938c934a0279ebcab375d8
SHA512 4337b5c79814153fe67d2dcc98acb24260309a5d64288505a760a28593abfb903892c57fc68049eb7e8819621be3d0ebe619d192f0303c1b77eae65af041904a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

yjsqjUy.exe

Path C:\Windows\System\yjsqjUy.exe
Size 5.9MB
SHA256 480d7d3edac763402ae269ee4ed6321feff5bc3f7ea04779f1956db0a45fcbbe
MD5 55d60c9b3872376a8eab97b6c699a9f5
SHA1 cc77975c5cb9a715dee00106c6e7f819b0f92fb5
SHA512 cc3cb6f4ee529dfdb5c460da410cc0ea27f4f1a9db58dbd5c11a1d6641d4842d05eb3e4912789a1e3b2b75572b7b07a57b6630c6797d08ad5508257b30b39dbc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/820-107-0x00007FF7760D0000-0x00007FF776424000-memory.dmp

Download

memory/820-153-0x00007FF7760D0000-0x00007FF776424000-memory.dmp

Download

memory/1012-89-0x00007FF6D0C50000-0x00007FF6D0FA4000-memory.dmp

Download

memory/1012-151-0x00007FF6D0C50000-0x00007FF6D0FA4000-memory.dmp

Download

memory/1108-157-0x00007FF61A1F0000-0x00007FF61A544000-memory.dmp

Download

memory/1108-126-0x00007FF61A1F0000-0x00007FF61A544000-memory.dmp

Download

memory/1456-154-0x00007FF7C75A0000-0x00007FF7C78F4000-memory.dmp

Download

memory/1456-100-0x00007FF7C75A0000-0x00007FF7C78F4000-memory.dmp

Download

memory/1456-137-0x00007FF7C75A0000-0x00007FF7C78F4000-memory.dmp

Download

memory/1544-50-0x00007FF776540000-0x00007FF776894000-memory.dmp

Download

memory/1544-145-0x00007FF776540000-0x00007FF776894000-memory.dmp

Download

memory/1984-158-0x00007FF6DFFD0000-0x00007FF6E0324000-memory.dmp

Download

memory/1984-132-0x00007FF6DFFD0000-0x00007FF6E0324000-memory.dmp

Download

memory/2792-14-0x00007FF6255E0000-0x00007FF625934000-memory.dmp

Download

memory/2792-139-0x00007FF6255E0000-0x00007FF625934000-memory.dmp

Download

memory/2912-136-0x00007FF74E0B0000-0x00007FF74E404000-memory.dmp

Download

memory/2912-95-0x00007FF74E0B0000-0x00007FF74E404000-memory.dmp

Download

memory/2912-152-0x00007FF74E0B0000-0x00007FF74E404000-memory.dmp

Download

memory/3148-38-0x00007FF74A900000-0x00007FF74AC54000-memory.dmp

Download

memory/3148-143-0x00007FF74A900000-0x00007FF74AC54000-memory.dmp

Download

memory/3212-156-0x00007FF6CD510000-0x00007FF6CD864000-memory.dmp

Download

memory/3212-120-0x00007FF6CD510000-0x00007FF6CD864000-memory.dmp

Download

memory/3316-138-0x00007FF608F10000-0x00007FF609264000-memory.dmp

Download

memory/3316-7-0x00007FF608F10000-0x00007FF609264000-memory.dmp

Download

memory/3316-69-0x00007FF608F10000-0x00007FF609264000-memory.dmp

Download

memory/3356-42-0x00007FF6E1CB0000-0x00007FF6E2004000-memory.dmp

Download

memory/3356-144-0x00007FF6E1CB0000-0x00007FF6E2004000-memory.dmp

Download

memory/3356-113-0x00007FF6E1CB0000-0x00007FF6E2004000-memory.dmp

Download

memory/3940-20-0x00007FF669E20000-0x00007FF66A174000-memory.dmp

Download

memory/3940-88-0x00007FF669E20000-0x00007FF66A174000-memory.dmp

Download

memory/3940-140-0x00007FF669E20000-0x00007FF66A174000-memory.dmp

Download

memory/3952-134-0x00007FF6F31C0000-0x00007FF6F3514000-memory.dmp

Download

memory/3952-149-0x00007FF6F31C0000-0x00007FF6F3514000-memory.dmp

Download

memory/3952-73-0x00007FF6F31C0000-0x00007FF6F3514000-memory.dmp

Download

memory/4704-142-0x00007FF6B21C0000-0x00007FF6B2514000-memory.dmp

Download

memory/4704-32-0x00007FF6B21C0000-0x00007FF6B2514000-memory.dmp

Download

memory/4808-70-0x00007FF7D6F50000-0x00007FF7D72A4000-memory.dmp

Download

memory/4808-148-0x00007FF7D6F50000-0x00007FF7D72A4000-memory.dmp

Download

memory/4808-133-0x00007FF7D6F50000-0x00007FF7D72A4000-memory.dmp

Download

memory/4892-26-0x00007FF709650000-0x00007FF7099A4000-memory.dmp

Download

memory/4892-141-0x00007FF709650000-0x00007FF7099A4000-memory.dmp

Download

memory/4924-135-0x00007FF641540000-0x00007FF641894000-memory.dmp

Download

memory/4924-150-0x00007FF641540000-0x00007FF641894000-memory.dmp

Download

memory/4924-80-0x00007FF641540000-0x00007FF641894000-memory.dmp

Download

memory/4984-56-0x00007FF7719A0000-0x00007FF771CF4000-memory.dmp

Download

memory/4984-146-0x00007FF7719A0000-0x00007FF771CF4000-memory.dmp

Download

memory/5048-147-0x00007FF7DAEC0000-0x00007FF7DB214000-memory.dmp

Download

memory/5048-131-0x00007FF7DAEC0000-0x00007FF7DB214000-memory.dmp

Download

memory/5048-62-0x00007FF7DAEC0000-0x00007FF7DB214000-memory.dmp

Download

memory/5056-117-0x00007FF698A10000-0x00007FF698D64000-memory.dmp

Download

memory/5056-155-0x00007FF698A10000-0x00007FF698D64000-memory.dmp

Download

memory/5076-0-0x00007FF6D0230000-0x00007FF6D0584000-memory.dmp

Download

memory/5076-1-0x0000026816210000-0x0000026816220000-memory.dmp

Download

memory/5076-61-0x00007FF6D0230000-0x00007FF6D0584000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads