cobaltstrike | 271bb6abf65e6cb24fb3f383d69a6e701278a6cf09ab50e05f37017bdb29b36c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
Size 5.2MB
Sample240530-lrerwadd7v
SHA256 271bb6abf65e6cb24fb3f383d69a6e701278a6cf09ab50e05f37017bdb29b36c
MD5 f2b0e68bf08f9fcfbd57e9f21aff5dc1
SHA1 516ea6d61ed26c6f214822776dfeceabd44fe44d
SHA512 ff27eea2af641707ad9b1e5d22bb0e01bfc16562806162a25a6f34ff42b538a7a47660640c82128c65a4fad73b4089a027c45b053667fefc19009f8a8c4cf57c
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ll:RWWBibC56utgpPFotBER/mQ32lUx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0007000000023298-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023425-8.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023427-26.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023426-34.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342c-64.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342b-72.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342e-80.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023430-88.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023422-95.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023431-93.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342f-86.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342d-65.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342a-56.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023429-46.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023428-43.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023421-17.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023432-103.dat	cobalt_reflective_dll
behavioral2/files/0x000900000002337b-112.dat	cobalt_reflective_dll
behavioral2/files/0x000b000000023380-123.dat	cobalt_reflective_dll
behavioral2/files/0x000a00000002337c-121.dat	cobalt_reflective_dll
behavioral2/files/0x000e000000023378-107.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023298-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023425-8.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023427-26.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023426-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342c-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342b-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342e-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023430-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023422-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023431-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342f-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342d-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342a-56.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023429-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023428-43.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023421-17.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023432-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000900000002337b-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b000000023380-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a00000002337c-121.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000e000000023378-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1848-0-0x00007FF62DE20000-0x00007FF62E171000-memory.dmp	UPX
behavioral2/files/0x0007000000023298-4.dat	UPX
behavioral2/files/0x0007000000023425-8.dat	UPX
behavioral2/files/0x0007000000023427-26.dat	UPX
behavioral2/files/0x0007000000023426-34.dat	UPX
behavioral2/memory/2732-45-0x00007FF7B8E70000-0x00007FF7B91C1000-memory.dmp	UPX
behavioral2/memory/3452-58-0x00007FF61C670000-0x00007FF61C9C1000-memory.dmp	UPX
behavioral2/files/0x000700000002342c-64.dat	UPX
behavioral2/files/0x000700000002342b-72.dat	UPX
behavioral2/files/0x000700000002342e-80.dat	UPX
behavioral2/memory/856-84-0x00007FF7B7200000-0x00007FF7B7551000-memory.dmp	UPX
behavioral2/files/0x0007000000023430-88.dat	UPX
behavioral2/files/0x0008000000023422-95.dat	UPX
behavioral2/files/0x0007000000023431-93.dat	UPX
behavioral2/memory/2336-90-0x00007FF6509D0000-0x00007FF650D21000-memory.dmp	UPX
behavioral2/files/0x000700000002342f-86.dat	UPX
behavioral2/memory/1428-85-0x00007FF6C07B0000-0x00007FF6C0B01000-memory.dmp	UPX
behavioral2/memory/804-83-0x00007FF6B9980000-0x00007FF6B9CD1000-memory.dmp	UPX
behavioral2/memory/4976-79-0x00007FF6EAF50000-0x00007FF6EB2A1000-memory.dmp	UPX
behavioral2/memory/3416-77-0x00007FF759CD0000-0x00007FF75A021000-memory.dmp	UPX
behavioral2/memory/3504-70-0x00007FF674C50000-0x00007FF674FA1000-memory.dmp	UPX
behavioral2/memory/2884-69-0x00007FF62F080000-0x00007FF62F3D1000-memory.dmp	UPX
behavioral2/files/0x000700000002342d-65.dat	UPX
behavioral2/files/0x000700000002342a-56.dat	UPX
behavioral2/files/0x0007000000023429-46.dat	UPX
behavioral2/files/0x0007000000023428-43.dat	UPX
behavioral2/memory/2548-41-0x00007FF6BCA80000-0x00007FF6BCDD1000-memory.dmp	UPX
behavioral2/memory/976-35-0x00007FF65DCF0000-0x00007FF65E041000-memory.dmp	UPX
behavioral2/memory/3028-23-0x00007FF6658E0000-0x00007FF665C31000-memory.dmp	UPX
behavioral2/files/0x0008000000023421-17.dat	UPX
behavioral2/memory/1396-15-0x00007FF6BD3B0000-0x00007FF6BD701000-memory.dmp	UPX
behavioral2/files/0x0007000000023432-103.dat	UPX
behavioral2/files/0x000900000002337b-112.dat	UPX
behavioral2/files/0x000b000000023380-123.dat	UPX
behavioral2/files/0x000a00000002337c-121.dat	UPX
behavioral2/memory/1848-116-0x00007FF62DE20000-0x00007FF62E171000-memory.dmp	UPX
behavioral2/memory/3160-104-0x00007FF7E61E0000-0x00007FF7E6531000-memory.dmp	UPX
behavioral2/files/0x000e000000023378-107.dat	UPX
behavioral2/memory/2620-98-0x00007FF6080C0000-0x00007FF608411000-memory.dmp	UPX
behavioral2/memory/1344-9-0x00007FF668590000-0x00007FF6688E1000-memory.dmp	UPX
behavioral2/memory/5060-126-0x00007FF78F6C0000-0x00007FF78FA11000-memory.dmp	UPX
behavioral2/memory/4508-127-0x00007FF60DC80000-0x00007FF60DFD1000-memory.dmp	UPX
behavioral2/memory/4056-128-0x00007FF612E90000-0x00007FF6131E1000-memory.dmp	UPX
behavioral2/memory/3740-125-0x00007FF70AF20000-0x00007FF70B271000-memory.dmp	UPX
behavioral2/memory/976-133-0x00007FF65DCF0000-0x00007FF65E041000-memory.dmp	UPX
behavioral2/memory/2732-137-0x00007FF7B8E70000-0x00007FF7B91C1000-memory.dmp	UPX
behavioral2/memory/3416-138-0x00007FF759CD0000-0x00007FF75A021000-memory.dmp	UPX
behavioral2/memory/2548-135-0x00007FF6BCA80000-0x00007FF6BCDD1000-memory.dmp	UPX
behavioral2/memory/3028-132-0x00007FF6658E0000-0x00007FF665C31000-memory.dmp	UPX
behavioral2/memory/1344-130-0x00007FF668590000-0x00007FF6688E1000-memory.dmp	UPX
behavioral2/memory/1396-131-0x00007FF6BD3B0000-0x00007FF6BD701000-memory.dmp	UPX
behavioral2/memory/1848-129-0x00007FF62DE20000-0x00007FF62E171000-memory.dmp	UPX
behavioral2/memory/2336-144-0x00007FF6509D0000-0x00007FF650D21000-memory.dmp	UPX
behavioral2/memory/1428-143-0x00007FF6C07B0000-0x00007FF6C0B01000-memory.dmp	UPX
behavioral2/memory/804-141-0x00007FF6B9980000-0x00007FF6B9CD1000-memory.dmp	UPX
behavioral2/memory/856-142-0x00007FF7B7200000-0x00007FF7B7551000-memory.dmp	UPX
behavioral2/memory/3452-140-0x00007FF61C670000-0x00007FF61C9C1000-memory.dmp	UPX
behavioral2/memory/3160-146-0x00007FF7E61E0000-0x00007FF7E6531000-memory.dmp	UPX
behavioral2/memory/1848-151-0x00007FF62DE20000-0x00007FF62E171000-memory.dmp	UPX
behavioral2/memory/1344-196-0x00007FF668590000-0x00007FF6688E1000-memory.dmp	UPX
behavioral2/memory/1396-198-0x00007FF6BD3B0000-0x00007FF6BD701000-memory.dmp	UPX
behavioral2/memory/3028-200-0x00007FF6658E0000-0x00007FF665C31000-memory.dmp	UPX
behavioral2/memory/2884-202-0x00007FF62F080000-0x00007FF62F3D1000-memory.dmp	UPX
behavioral2/memory/976-204-0x00007FF65DCF0000-0x00007FF65E041000-memory.dmp	UPX

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/804-83-0x00007FF6B9980000-0x00007FF6B9CD1000-memory.dmp	xmrig
behavioral2/memory/4976-79-0x00007FF6EAF50000-0x00007FF6EB2A1000-memory.dmp	xmrig
behavioral2/memory/3504-70-0x00007FF674C50000-0x00007FF674FA1000-memory.dmp	xmrig
behavioral2/memory/2884-69-0x00007FF62F080000-0x00007FF62F3D1000-memory.dmp	xmrig
behavioral2/memory/1848-116-0x00007FF62DE20000-0x00007FF62E171000-memory.dmp	xmrig
behavioral2/memory/2620-98-0x00007FF6080C0000-0x00007FF608411000-memory.dmp	xmrig
behavioral2/memory/5060-126-0x00007FF78F6C0000-0x00007FF78FA11000-memory.dmp	xmrig
behavioral2/memory/4508-127-0x00007FF60DC80000-0x00007FF60DFD1000-memory.dmp	xmrig
behavioral2/memory/4056-128-0x00007FF612E90000-0x00007FF6131E1000-memory.dmp	xmrig
behavioral2/memory/3740-125-0x00007FF70AF20000-0x00007FF70B271000-memory.dmp	xmrig
behavioral2/memory/976-133-0x00007FF65DCF0000-0x00007FF65E041000-memory.dmp	xmrig
behavioral2/memory/2732-137-0x00007FF7B8E70000-0x00007FF7B91C1000-memory.dmp	xmrig
behavioral2/memory/3416-138-0x00007FF759CD0000-0x00007FF75A021000-memory.dmp	xmrig
behavioral2/memory/2548-135-0x00007FF6BCA80000-0x00007FF6BCDD1000-memory.dmp	xmrig
behavioral2/memory/3028-132-0x00007FF6658E0000-0x00007FF665C31000-memory.dmp	xmrig
behavioral2/memory/1344-130-0x00007FF668590000-0x00007FF6688E1000-memory.dmp	xmrig
behavioral2/memory/1396-131-0x00007FF6BD3B0000-0x00007FF6BD701000-memory.dmp	xmrig
behavioral2/memory/1848-129-0x00007FF62DE20000-0x00007FF62E171000-memory.dmp	xmrig
behavioral2/memory/2336-144-0x00007FF6509D0000-0x00007FF650D21000-memory.dmp	xmrig
behavioral2/memory/1428-143-0x00007FF6C07B0000-0x00007FF6C0B01000-memory.dmp	xmrig
behavioral2/memory/804-141-0x00007FF6B9980000-0x00007FF6B9CD1000-memory.dmp	xmrig
behavioral2/memory/856-142-0x00007FF7B7200000-0x00007FF7B7551000-memory.dmp	xmrig
behavioral2/memory/3452-140-0x00007FF61C670000-0x00007FF61C9C1000-memory.dmp	xmrig
behavioral2/memory/3160-146-0x00007FF7E61E0000-0x00007FF7E6531000-memory.dmp	xmrig
behavioral2/memory/1848-151-0x00007FF62DE20000-0x00007FF62E171000-memory.dmp	xmrig
behavioral2/memory/1344-196-0x00007FF668590000-0x00007FF6688E1000-memory.dmp	xmrig
behavioral2/memory/1396-198-0x00007FF6BD3B0000-0x00007FF6BD701000-memory.dmp	xmrig
behavioral2/memory/3028-200-0x00007FF6658E0000-0x00007FF665C31000-memory.dmp	xmrig
behavioral2/memory/2884-202-0x00007FF62F080000-0x00007FF62F3D1000-memory.dmp	xmrig
behavioral2/memory/976-204-0x00007FF65DCF0000-0x00007FF65E041000-memory.dmp	xmrig
behavioral2/memory/3504-206-0x00007FF674C50000-0x00007FF674FA1000-memory.dmp	xmrig
behavioral2/memory/2548-208-0x00007FF6BCA80000-0x00007FF6BCDD1000-memory.dmp	xmrig
behavioral2/memory/4976-220-0x00007FF6EAF50000-0x00007FF6EB2A1000-memory.dmp	xmrig
behavioral2/memory/2732-222-0x00007FF7B8E70000-0x00007FF7B91C1000-memory.dmp	xmrig
behavioral2/memory/3452-224-0x00007FF61C670000-0x00007FF61C9C1000-memory.dmp	xmrig
behavioral2/memory/3416-226-0x00007FF759CD0000-0x00007FF75A021000-memory.dmp	xmrig
behavioral2/memory/804-228-0x00007FF6B9980000-0x00007FF6B9CD1000-memory.dmp	xmrig
behavioral2/memory/856-230-0x00007FF7B7200000-0x00007FF7B7551000-memory.dmp	xmrig
behavioral2/memory/1428-232-0x00007FF6C07B0000-0x00007FF6C0B01000-memory.dmp	xmrig
behavioral2/memory/2620-236-0x00007FF6080C0000-0x00007FF608411000-memory.dmp	xmrig
behavioral2/memory/2336-235-0x00007FF6509D0000-0x00007FF650D21000-memory.dmp	xmrig
behavioral2/memory/3160-243-0x00007FF7E61E0000-0x00007FF7E6531000-memory.dmp	xmrig
behavioral2/memory/3740-245-0x00007FF70AF20000-0x00007FF70B271000-memory.dmp	xmrig
behavioral2/memory/4508-247-0x00007FF60DC80000-0x00007FF60DFD1000-memory.dmp	xmrig
behavioral2/memory/5060-249-0x00007FF78F6C0000-0x00007FF78FA11000-memory.dmp	xmrig
behavioral2/memory/4056-251-0x00007FF612E90000-0x00007FF6131E1000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1344	pLXKwOr.exe
1396	QiTrchS.exe
3028	nEfiuFp.exe
976	qpvtobG.exe
2884	AFWnbKW.exe
2548	xYhjKQk.exe
3504	RbaxhDS.exe
2732	poKkSTW.exe
3416	IVCAErH.exe
4976	uaGfRWU.exe
3452	DIbPWhH.exe
804	JzFaEAJ.exe
856	AGLyaTZ.exe
1428	EuMeUON.exe
2336	rOrBFOG.exe
2620	eZlTiZe.exe
3160	IlHBnld.exe
3740	tAOJRHT.exe
4508	znSsqpA.exe
5060	vIwFuBX.exe
4056	ZpCYNcG.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1848-0-0x00007FF62DE20000-0x00007FF62E171000-memory.dmp	upx
behavioral2/files/0x0007000000023298-4.dat	upx
behavioral2/files/0x0007000000023425-8.dat	upx
behavioral2/files/0x0007000000023427-26.dat	upx
behavioral2/files/0x0007000000023426-34.dat	upx
behavioral2/memory/2732-45-0x00007FF7B8E70000-0x00007FF7B91C1000-memory.dmp	upx
behavioral2/memory/3452-58-0x00007FF61C670000-0x00007FF61C9C1000-memory.dmp	upx
behavioral2/files/0x000700000002342c-64.dat	upx
behavioral2/files/0x000700000002342b-72.dat	upx
behavioral2/files/0x000700000002342e-80.dat	upx
behavioral2/memory/856-84-0x00007FF7B7200000-0x00007FF7B7551000-memory.dmp	upx
behavioral2/files/0x0007000000023430-88.dat	upx
behavioral2/files/0x0008000000023422-95.dat	upx
behavioral2/files/0x0007000000023431-93.dat	upx
behavioral2/memory/2336-90-0x00007FF6509D0000-0x00007FF650D21000-memory.dmp	upx
behavioral2/files/0x000700000002342f-86.dat	upx
behavioral2/memory/1428-85-0x00007FF6C07B0000-0x00007FF6C0B01000-memory.dmp	upx
behavioral2/memory/804-83-0x00007FF6B9980000-0x00007FF6B9CD1000-memory.dmp	upx
behavioral2/memory/4976-79-0x00007FF6EAF50000-0x00007FF6EB2A1000-memory.dmp	upx
behavioral2/memory/3416-77-0x00007FF759CD0000-0x00007FF75A021000-memory.dmp	upx
behavioral2/memory/3504-70-0x00007FF674C50000-0x00007FF674FA1000-memory.dmp	upx
behavioral2/memory/2884-69-0x00007FF62F080000-0x00007FF62F3D1000-memory.dmp	upx
behavioral2/files/0x000700000002342d-65.dat	upx
behavioral2/files/0x000700000002342a-56.dat	upx
behavioral2/files/0x0007000000023429-46.dat	upx
behavioral2/files/0x0007000000023428-43.dat	upx
behavioral2/memory/2548-41-0x00007FF6BCA80000-0x00007FF6BCDD1000-memory.dmp	upx
behavioral2/memory/976-35-0x00007FF65DCF0000-0x00007FF65E041000-memory.dmp	upx
behavioral2/memory/3028-23-0x00007FF6658E0000-0x00007FF665C31000-memory.dmp	upx
behavioral2/files/0x0008000000023421-17.dat	upx
behavioral2/memory/1396-15-0x00007FF6BD3B0000-0x00007FF6BD701000-memory.dmp	upx
behavioral2/files/0x0007000000023432-103.dat	upx
behavioral2/files/0x000900000002337b-112.dat	upx
behavioral2/files/0x000b000000023380-123.dat	upx
behavioral2/files/0x000a00000002337c-121.dat	upx
behavioral2/memory/1848-116-0x00007FF62DE20000-0x00007FF62E171000-memory.dmp	upx
behavioral2/memory/3160-104-0x00007FF7E61E0000-0x00007FF7E6531000-memory.dmp	upx
behavioral2/files/0x000e000000023378-107.dat	upx
behavioral2/memory/2620-98-0x00007FF6080C0000-0x00007FF608411000-memory.dmp	upx
behavioral2/memory/1344-9-0x00007FF668590000-0x00007FF6688E1000-memory.dmp	upx
behavioral2/memory/5060-126-0x00007FF78F6C0000-0x00007FF78FA11000-memory.dmp	upx
behavioral2/memory/4508-127-0x00007FF60DC80000-0x00007FF60DFD1000-memory.dmp	upx
behavioral2/memory/4056-128-0x00007FF612E90000-0x00007FF6131E1000-memory.dmp	upx
behavioral2/memory/3740-125-0x00007FF70AF20000-0x00007FF70B271000-memory.dmp	upx
behavioral2/memory/976-133-0x00007FF65DCF0000-0x00007FF65E041000-memory.dmp	upx
behavioral2/memory/2732-137-0x00007FF7B8E70000-0x00007FF7B91C1000-memory.dmp	upx
behavioral2/memory/3416-138-0x00007FF759CD0000-0x00007FF75A021000-memory.dmp	upx
behavioral2/memory/2548-135-0x00007FF6BCA80000-0x00007FF6BCDD1000-memory.dmp	upx
behavioral2/memory/3028-132-0x00007FF6658E0000-0x00007FF665C31000-memory.dmp	upx
behavioral2/memory/1344-130-0x00007FF668590000-0x00007FF6688E1000-memory.dmp	upx
behavioral2/memory/1396-131-0x00007FF6BD3B0000-0x00007FF6BD701000-memory.dmp	upx
behavioral2/memory/1848-129-0x00007FF62DE20000-0x00007FF62E171000-memory.dmp	upx
behavioral2/memory/2336-144-0x00007FF6509D0000-0x00007FF650D21000-memory.dmp	upx
behavioral2/memory/1428-143-0x00007FF6C07B0000-0x00007FF6C0B01000-memory.dmp	upx
behavioral2/memory/804-141-0x00007FF6B9980000-0x00007FF6B9CD1000-memory.dmp	upx
behavioral2/memory/856-142-0x00007FF7B7200000-0x00007FF7B7551000-memory.dmp	upx
behavioral2/memory/3452-140-0x00007FF61C670000-0x00007FF61C9C1000-memory.dmp	upx
behavioral2/memory/3160-146-0x00007FF7E61E0000-0x00007FF7E6531000-memory.dmp	upx
behavioral2/memory/1848-151-0x00007FF62DE20000-0x00007FF62E171000-memory.dmp	upx
behavioral2/memory/1344-196-0x00007FF668590000-0x00007FF6688E1000-memory.dmp	upx
behavioral2/memory/1396-198-0x00007FF6BD3B0000-0x00007FF6BD701000-memory.dmp	upx
behavioral2/memory/3028-200-0x00007FF6658E0000-0x00007FF665C31000-memory.dmp	upx
behavioral2/memory/2884-202-0x00007FF62F080000-0x00007FF62F3D1000-memory.dmp	upx
behavioral2/memory/976-204-0x00007FF65DCF0000-0x00007FF65E041000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\qpvtobG.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\poKkSTW.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IVCAErH.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eZlTiZe.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IlHBnld.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tAOJRHT.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QiTrchS.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RbaxhDS.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uaGfRWU.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JzFaEAJ.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EuMeUON.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vIwFuBX.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZpCYNcG.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pLXKwOr.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xYhjKQk.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DIbPWhH.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nEfiuFp.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AFWnbKW.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AGLyaTZ.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rOrBFOG.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\znSsqpA.exe	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1344	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	83
PID 1848 wrote to memory of 1344	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	83
PID 1848 wrote to memory of 1396	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	84
PID 1848 wrote to memory of 1396	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	84
PID 1848 wrote to memory of 3028	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	85
PID 1848 wrote to memory of 3028	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	85
PID 1848 wrote to memory of 976	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	87
PID 1848 wrote to memory of 976	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	87
PID 1848 wrote to memory of 2884	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	88
PID 1848 wrote to memory of 2884	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	88
PID 1848 wrote to memory of 2548	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	89
PID 1848 wrote to memory of 2548	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	89
PID 1848 wrote to memory of 3504	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	90
PID 1848 wrote to memory of 3504	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	90
PID 1848 wrote to memory of 2732	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	91
PID 1848 wrote to memory of 2732	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	91
PID 1848 wrote to memory of 3416	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	92
PID 1848 wrote to memory of 3416	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	92
PID 1848 wrote to memory of 4976	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	93
PID 1848 wrote to memory of 4976	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	93
PID 1848 wrote to memory of 3452	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	94
PID 1848 wrote to memory of 3452	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	94
PID 1848 wrote to memory of 804	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	95
PID 1848 wrote to memory of 804	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	95
PID 1848 wrote to memory of 856	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	96
PID 1848 wrote to memory of 856	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	96
PID 1848 wrote to memory of 1428	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	97
PID 1848 wrote to memory of 1428	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	97
PID 1848 wrote to memory of 2336	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	98
PID 1848 wrote to memory of 2336	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	98
PID 1848 wrote to memory of 2620	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	99
PID 1848 wrote to memory of 2620	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	99
PID 1848 wrote to memory of 3160	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	103
PID 1848 wrote to memory of 3160	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	103
PID 1848 wrote to memory of 3740	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	104
PID 1848 wrote to memory of 3740	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	104
PID 1848 wrote to memory of 4508	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	105
PID 1848 wrote to memory of 4508	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	105
PID 1848 wrote to memory of 5060	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	106
PID 1848 wrote to memory of 5060	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	106
PID 1848 wrote to memory of 4056	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	107
PID 1848 wrote to memory of 4056	1848	2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe	107

C:\Users\Admin\AppData\Local\Temp\2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-30_f2b0e68bf08f9fcfbd57e9f21aff5dc1_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\System\pLXKwOr.exe
  C:\Windows\System\pLXKwOr.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\QiTrchS.exe
  C:\Windows\System\QiTrchS.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\nEfiuFp.exe
  C:\Windows\System\nEfiuFp.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\qpvtobG.exe
  C:\Windows\System\qpvtobG.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\AFWnbKW.exe
  C:\Windows\System\AFWnbKW.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\xYhjKQk.exe
  C:\Windows\System\xYhjKQk.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\RbaxhDS.exe
  C:\Windows\System\RbaxhDS.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\poKkSTW.exe
  C:\Windows\System\poKkSTW.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\IVCAErH.exe
  C:\Windows\System\IVCAErH.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\uaGfRWU.exe
  C:\Windows\System\uaGfRWU.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\DIbPWhH.exe
  C:\Windows\System\DIbPWhH.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\JzFaEAJ.exe
  C:\Windows\System\JzFaEAJ.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\AGLyaTZ.exe
  C:\Windows\System\AGLyaTZ.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\EuMeUON.exe
  C:\Windows\System\EuMeUON.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\rOrBFOG.exe
  C:\Windows\System\rOrBFOG.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\eZlTiZe.exe
  C:\Windows\System\eZlTiZe.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\IlHBnld.exe
  C:\Windows\System\IlHBnld.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\tAOJRHT.exe
  C:\Windows\System\tAOJRHT.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\znSsqpA.exe
  C:\Windows\System\znSsqpA.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\vIwFuBX.exe
  C:\Windows\System\vIwFuBX.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\ZpCYNcG.exe
  C:\Windows\System\ZpCYNcG.exe
  2⤵
  - Executes dropped EXE
  PID:4056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AFWnbKW.exe

Path C:\Windows\System\AFWnbKW.exe
Size 5.2MB
SHA256 9b88c5d66a8f713d70fd2687bf51d4d39e8dfdea07a1ff7521a676a6dedbcbc3
MD5 12442cc2c19a710853871c0034fe815b
SHA1 4a5dd05f7f893ce8eef7b6c2fab52e40567fbff2
SHA512 755c7be927eefeb42c4168d2f409126445dd030f136761ad235dc8f633a81b0aa609b053d50fe19ae720fde2e555479ffe3746c7ad2052a9423973aad04ebd90
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lI:RWWBibC56utgpPFotBER/mQ32lUU
MD5 SHA1 SHA512 SSDEEP

Submit Download

AGLyaTZ.exe

Path C:\Windows\System\AGLyaTZ.exe
Size 5.2MB
SHA256 049e2550514a3b53460470e55020bbd325b9b7456ed3d3342d8edb9c9a1f843a
MD5 de94681a2387564df84a993db767d5b4
SHA1 5a0482a33ba203f1f52f5d8936831b08dcc27bba
SHA512 9fbaaecdecc4e58e867283c6c015884bdffbfeafa9b3ab3c711603f9d7f4569803ab7bfe04f69f928ac80c54a1a4e31b5def6052a665b02f653a23902808ab9a
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lb:RWWBibC56utgpPFotBER/mQ32lUn
MD5 SHA1 SHA512 SSDEEP

Submit Download

DIbPWhH.exe

Path C:\Windows\System\DIbPWhH.exe
Size 5.2MB
SHA256 48c98d64464c69f4487a94169c1fbabfd5a526b138933136e6985e96fa6f11d5
MD5 4fa2ffccbce593c2ce1ed44a59ee3a4f
SHA1 414aa5f33f6a7c396577fe036f932d3cff763de1
SHA512 2c623e0bb774560620ea41ce3ee2d4a8456aa122ecf80194221f82130cf1dd622d37a1a8e6d11b4a160d6bb0bbab1eeb10dd9ac430328837682013db76a31f67
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6la:RWWBibC56utgpPFotBER/mQ32lUG
MD5 SHA1 SHA512 SSDEEP

Submit Download

EuMeUON.exe

Path C:\Windows\System\EuMeUON.exe
Size 5.2MB
SHA256 fc5b37aff48770e21ab816559447752f3e385dfbb9b6ae2c2b0a37be9b1eeced
MD5 747ae85a4e2ac90d497c4a3e01452ffd
SHA1 7494ecc440c9ba4e3a093f05ef034d2e5b5db24f
SHA512 979335c15e10bfe307049e3f08cadecf392e9ce474d7a3b98ec54832ff1be6f9b7a0cd39c4fb872ab5ba22b8b167713edb20e05b5f3cc130c2dc32c4d490d44c
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lC:RWWBibC56utgpPFotBER/mQ32lUe
MD5 SHA1 SHA512 SSDEEP

Submit Download

IVCAErH.exe

Path C:\Windows\System\IVCAErH.exe
Size 5.2MB
SHA256 f8ac6017f9bf860389c2da12b63c7864e6b8fb9245e49b3e29a4f74fc683a169
MD5 b8b3735efbce02f8690fd838c712272f
SHA1 3e7baf28905471e1ad0147cecb0eb33331dbfd9a
SHA512 dbc198f75ac1b61fc3ac89b3069f392883d19b21d8a9b3ed244f878c8716bd8c00a706c7e898c327f74fad6823eb4cea6b6776ce1503d56c4fdadf5a41e04df8
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lx:RWWBibC56utgpPFotBER/mQ32lUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

IlHBnld.exe

Path C:\Windows\System\IlHBnld.exe
Size 5.2MB
SHA256 9430b4deeaf653619162810bd2a9ea06d62e4fd30883e15bd700c5c052d8018c
MD5 99a13e0eeb8da58d8ff36e197843711b
SHA1 cc78efcd03522e14897718c924862d5f5dfd4529
SHA512 53b9deb7f8b9fcd2ccf1770d0bbe1af1113c856eea6f9e8582ec2b2b7002d63ac93b039ed39bfb9c36492e7524e03a61a2b806ed23e6e0eb99efc44fc9605b0b
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lt:RWWBibC56utgpPFotBER/mQ32lUZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

JzFaEAJ.exe

Path C:\Windows\System\JzFaEAJ.exe
Size 5.2MB
SHA256 f534118865e73ee975409ccd6b03aac98627677c65528da3f465cf53c4d0eeb5
MD5 fa7b21c2ab39aacfc18ac5c67a942c42
SHA1 b664190d4b979f26501a38a2f9b330da4028fa50
SHA512 f0340350652635adaa6f38b968d16b44b91ba23469a45086e5787364cf5dfed02c2ecc1d5e4c1bc0d7148d2c7bbfa636c9970822a8daae171e9721d772b24497
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lG:RWWBibC56utgpPFotBER/mQ32lUa
MD5 SHA1 SHA512 SSDEEP

Submit Download

QiTrchS.exe

Path C:\Windows\System\QiTrchS.exe
Size 5.2MB
SHA256 56a073404a105f17c3e441714d986ac6e414cbcdcdd468b7354547faf59d6c05
MD5 d4d45672afae8c62253e46e271cb48a6
SHA1 b85d4e0dc1ac2eee7f075a6ae3348fbf5b4ce10c
SHA512 db03a74ca6a0d93f96da86501879ac8ca6e67e878b8480c8b2e033090a72d75bf89909f15310227576d2d55fd655f4bfa1bc09d312237fe2d452c7678c3159ee
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lb:RWWBibC56utgpPFotBER/mQ32lUH
MD5 SHA1 SHA512 SSDEEP

Submit Download

RbaxhDS.exe

Path C:\Windows\System\RbaxhDS.exe
Size 5.2MB
SHA256 a145ad5fef5b2b2e185ae236567434e355e9194f939df8f224b8295d35a57e21
MD5 eba41ed13b5a9450bc1854663311f29e
SHA1 baa9952412db258c2750f0f1008ad8563d3e7f7f
SHA512 7261c8261c226c1e51a3b99b5844283639125b925da47ab21a77b63cc2c02d4a8f96e77618cfa777e3d10bf3225aaab7227307753e13e116eece5f7e8d4a97e8
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibC56utgpPFotBER/mQ32lUP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZpCYNcG.exe

Path C:\Windows\System\ZpCYNcG.exe
Size 5.2MB
SHA256 7db147811203dc28941af686dff1d1df22f2f624ffcef177ec56191253a40927
MD5 0cf74ba17f89618fff1c69386f5b7480
SHA1 32a387fb1fd20f33f31caedfef45b1e5a8129fa1
SHA512 36e6fce3f419ed2d9d4e292994e64e7dd44161f77cc48289a1d0c7cb75c0bb2231e4f6a94b13328476a86b8b0e1c0ab9096696adf4b668bb510d399da1b3c014
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lo:RWWBibC56utgpPFotBER/mQ32lUk
MD5 SHA1 SHA512 SSDEEP

Submit Download

eZlTiZe.exe

Path C:\Windows\System\eZlTiZe.exe
Size 5.2MB
SHA256 e0b811edb16fd1822173c2f76283bc1ed2ef338fbc9932ca62273a4f6f594999
MD5 c832790b24a4a5213f1a3b2d5169ece3
SHA1 04a12a91a72aa12ff9a80e8ad6886b80f2232c73
SHA512 d66f8d9adc0525c433fa2b63ed4c28d8bd620d0f9c225075c660ad8cbd3e7b2fc530217839c90da0854d71f969ffc64c5504efac5f1f59c7fc33fe32d5e802eb
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lT:RWWBibC56utgpPFotBER/mQ32lUP
MD5 SHA1 SHA512 SSDEEP

Submit Download

nEfiuFp.exe

Path C:\Windows\System\nEfiuFp.exe
Size 5.2MB
SHA256 6ac71afc9abf851d6e9c9742c5cf5b39d63ceba87c0642fc140a57034dc5a47b
MD5 d8d0681a0ba93c43cfdc35f2c0f658a7
SHA1 0e8d323863d1661d6e6501a4a2cae207159446ca
SHA512 977622ccf9f93273e6a089804e1e40df2fa5ef2be5cdcfdf380051958ddd2a6437dd5df421a88a187ca4d5acecb50e1aff00fc530ac0f06fceeb3c848d0bcf9a
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l3:RWWBibC56utgpPFotBER/mQ32lUz
MD5 SHA1 SHA512 SSDEEP

Submit Download

pLXKwOr.exe

Path C:\Windows\System\pLXKwOr.exe
Size 5.2MB
SHA256 a4d763a09cbee43dd114337d66df5cf7768d290ec678fa1d1f104d45a0b8c038
MD5 5ac7c5093daa3417a0d07c3a9dbc70c5
SHA1 b098ae707bdec473c668e9c8cdc09b69f2b0a185
SHA512 6191269070a14e61ab5a936a8a7d67274ed756bac6590f53806983df807caeba2df0547caaddae94aaa3590bb67b495cc5aa8ad06892d315ba88ce0b630d78e8
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibC56utgpPFotBER/mQ32lUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

poKkSTW.exe

Path C:\Windows\System\poKkSTW.exe
Size 5.2MB
SHA256 4d3326edcc01f5597e14577061a54c8584e1fb83bcac30e37d4f76c08252a47a
MD5 2433ba6519c3a7f3b4cbc8a8a6065765
SHA1 b61de995e4af745ee1ece296fbc5fbf9e1a1cc37
SHA512 c4c5a8af4e7b45e03a27ddeafe023bcfa9227aa90a4ac82d08bf27bc386287ce09a6cdf42b66deb620d38645556d7bf064f80002e3782f97c5615733aab9fb99
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ls:RWWBibC56utgpPFotBER/mQ32lUI
MD5 SHA1 SHA512 SSDEEP

Submit Download

qpvtobG.exe

Path C:\Windows\System\qpvtobG.exe
Size 5.2MB
SHA256 ce63474c3a45936725a27c443c307c9f210d0a4fd108afdf85ffadab559b949b
MD5 9251dc56bcf4e93c80c9358c3297a73d
SHA1 25a17d4306d661b7392c3f1163e3a1d3c55f8fc1
SHA512 5316d37f9260ebad5425e9ba48f94376cce302e565d1c61f70809ebbcf1792c31a4f66d1ef30770fa5953f4f6e0bb2dbdf64899d64aca4ef644d91b2a623fdb6
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibC56utgpPFotBER/mQ32lUO
MD5 SHA1 SHA512 SSDEEP

Submit Download

rOrBFOG.exe

Path C:\Windows\System\rOrBFOG.exe
Size 5.2MB
SHA256 5e6b58a99d858442344a1c2a9707ab5cc6cca50d9e707c901bc25f65e6d0ea5b
MD5 567433f8378e0e9953387035c080b976
SHA1 628ca425e6359824cb4d7b5d1ee7884bdf03a6cf
SHA512 78034a5d424d01b94e401d1aeaa2f203ee809c7fc94525569b520d36f2ef18b3b91108ad40d859b58dcd2c4a72e147386eeabb5581b3b48022e0c134cfa361b3
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lA:RWWBibC56utgpPFotBER/mQ32lUc
MD5 SHA1 SHA512 SSDEEP

Submit Download

tAOJRHT.exe

Path C:\Windows\System\tAOJRHT.exe
Size 5.2MB
SHA256 eb85883ee5bfea361ed252b0536536121401f233b29f09c2679ea3a4d50a3be0
MD5 ff98c2400da76d3a3d4cea9cc1735945
SHA1 6dfe0650a49ee2b9a9a89a1a900daf8d32c1ff55
SHA512 faef3f5a9f792c2e0e6c066203f51bdc2740c67b8786e16347d8ed5d759618705e73c637d1d70fc560e23b56b1a1ee456bb949facded0100ebce8fed430bc264
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lv:RWWBibC56utgpPFotBER/mQ32lU7
MD5 SHA1 SHA512 SSDEEP

Submit Download

uaGfRWU.exe

Path C:\Windows\System\uaGfRWU.exe
Size 5.2MB
SHA256 86e38bb8be0dc971727dceb9c33b91e5eb21ad2a7f5111e3cfb74e62761c0eaf
MD5 78d91efc4064e70cd8f7111921ce59bc
SHA1 ce34831cf29b0367294b859047bdbc3f195730bd
SHA512 d7432047147e6d4b14a2d11847cb0e148cbb5071ac1f965ba6689f422cca4349c9309db2ee3804722f7b7e2a355a0ea039574dcacbdfcbe3cbb1d66615ba8fca
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ly:RWWBibC56utgpPFotBER/mQ32lUG
MD5 SHA1 SHA512 SSDEEP

Submit Download

vIwFuBX.exe

Path C:\Windows\System\vIwFuBX.exe
Size 5.2MB
SHA256 5dd2b573354ef952c0f6953c67191f1d9ba8f66df37ac7e80c13bccbab7e39a5
MD5 4c391b7b13dc3268072b5fb2b72d663d
SHA1 85da8c090ead9a30410191a75cce21e192469e5a
SHA512 3a438e55251e99d65d418613b132e857d47801fc6127034185c9f4e20551d2e9759e10afe4c512f0039497e5ad199156c5b4e9effd12f6ad1bb3aa2126c4d6b5
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibC56utgpPFotBER/mQ32lUf
MD5 SHA1 SHA512 SSDEEP

Submit Download

xYhjKQk.exe

Path C:\Windows\System\xYhjKQk.exe
Size 5.2MB
SHA256 e7b7ed95e08d6f6a72cebda8612768b9060846efb6757607fb2c844cabc39f7c
MD5 d02a0472143ae76775d1a2af78a06030
SHA1 a99e8a7774a12080e83ba4753a982aed100af48d
SHA512 42c7801598287da6b283212b131377c4396cc1b55394e8bddf654ea05bff47221ba38f77a704768e6a42e39007a15a2204e048f82208dc7983b669311c5d00c9
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibC56utgpPFotBER/mQ32lU9
MD5 SHA1 SHA512 SSDEEP

Submit Download

znSsqpA.exe

Path C:\Windows\System\znSsqpA.exe
Size 5.2MB
SHA256 bd1449559a4047618f5f2c8d782eba21e047b5a566c6dbad961f13d10cc963ff
MD5 1d9a5c3b4634fe397b21e0479536d25e
SHA1 59b1b9e215568199f22f3aaf0b67557989ce25a8
SHA512 33bcccb5812531849f5fc2a18f12c751038a9e3ad3af5cf71e9e3e1c13b85982fc22b3677e0d1467f1405fbaf6303d5c2b30440f791d8de8e6b47e47c2a6765f
SSDEEP 49152:ROdWCCi7/rat56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lg:RWWBibC56utgpPFotBER/mQ32lU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/804-228-0x00007FF6B9980000-0x00007FF6B9CD1000-memory.dmp

Download

memory/804-141-0x00007FF6B9980000-0x00007FF6B9CD1000-memory.dmp

Download

memory/804-83-0x00007FF6B9980000-0x00007FF6B9CD1000-memory.dmp

Download

memory/856-84-0x00007FF7B7200000-0x00007FF7B7551000-memory.dmp

Download

memory/856-230-0x00007FF7B7200000-0x00007FF7B7551000-memory.dmp

Download

memory/856-142-0x00007FF7B7200000-0x00007FF7B7551000-memory.dmp

Download

memory/976-133-0x00007FF65DCF0000-0x00007FF65E041000-memory.dmp

Download

memory/976-35-0x00007FF65DCF0000-0x00007FF65E041000-memory.dmp

Download

memory/976-204-0x00007FF65DCF0000-0x00007FF65E041000-memory.dmp

Download

memory/1344-196-0x00007FF668590000-0x00007FF6688E1000-memory.dmp

Download

memory/1344-9-0x00007FF668590000-0x00007FF6688E1000-memory.dmp

Download

memory/1344-130-0x00007FF668590000-0x00007FF6688E1000-memory.dmp

Download

memory/1396-198-0x00007FF6BD3B0000-0x00007FF6BD701000-memory.dmp

Download

memory/1396-131-0x00007FF6BD3B0000-0x00007FF6BD701000-memory.dmp

Download

memory/1396-15-0x00007FF6BD3B0000-0x00007FF6BD701000-memory.dmp

Download

memory/1428-143-0x00007FF6C07B0000-0x00007FF6C0B01000-memory.dmp

Download

memory/1428-232-0x00007FF6C07B0000-0x00007FF6C0B01000-memory.dmp

Download

memory/1428-85-0x00007FF6C07B0000-0x00007FF6C0B01000-memory.dmp

Download

memory/1848-116-0x00007FF62DE20000-0x00007FF62E171000-memory.dmp

Download

memory/1848-0-0x00007FF62DE20000-0x00007FF62E171000-memory.dmp

Download

memory/1848-151-0x00007FF62DE20000-0x00007FF62E171000-memory.dmp

Download

memory/1848-129-0x00007FF62DE20000-0x00007FF62E171000-memory.dmp

Download

memory/1848-1-0x0000016CCF620000-0x0000016CCF630000-memory.dmp

Download

memory/2336-144-0x00007FF6509D0000-0x00007FF650D21000-memory.dmp

Download

memory/2336-235-0x00007FF6509D0000-0x00007FF650D21000-memory.dmp

Download

memory/2336-90-0x00007FF6509D0000-0x00007FF650D21000-memory.dmp

Download

memory/2548-208-0x00007FF6BCA80000-0x00007FF6BCDD1000-memory.dmp

Download

memory/2548-41-0x00007FF6BCA80000-0x00007FF6BCDD1000-memory.dmp

Download

memory/2548-135-0x00007FF6BCA80000-0x00007FF6BCDD1000-memory.dmp

Download

memory/2620-98-0x00007FF6080C0000-0x00007FF608411000-memory.dmp

Download

memory/2620-236-0x00007FF6080C0000-0x00007FF608411000-memory.dmp

Download

memory/2732-45-0x00007FF7B8E70000-0x00007FF7B91C1000-memory.dmp

Download

memory/2732-222-0x00007FF7B8E70000-0x00007FF7B91C1000-memory.dmp

Download

memory/2732-137-0x00007FF7B8E70000-0x00007FF7B91C1000-memory.dmp

Download

memory/2884-202-0x00007FF62F080000-0x00007FF62F3D1000-memory.dmp

Download

memory/2884-69-0x00007FF62F080000-0x00007FF62F3D1000-memory.dmp

Download

memory/3028-132-0x00007FF6658E0000-0x00007FF665C31000-memory.dmp

Download

memory/3028-23-0x00007FF6658E0000-0x00007FF665C31000-memory.dmp

Download

memory/3028-200-0x00007FF6658E0000-0x00007FF665C31000-memory.dmp

Download

memory/3160-146-0x00007FF7E61E0000-0x00007FF7E6531000-memory.dmp

Download

memory/3160-104-0x00007FF7E61E0000-0x00007FF7E6531000-memory.dmp

Download

memory/3160-243-0x00007FF7E61E0000-0x00007FF7E6531000-memory.dmp

Download

memory/3416-77-0x00007FF759CD0000-0x00007FF75A021000-memory.dmp

Download

memory/3416-226-0x00007FF759CD0000-0x00007FF75A021000-memory.dmp

Download

memory/3416-138-0x00007FF759CD0000-0x00007FF75A021000-memory.dmp

Download

memory/3452-58-0x00007FF61C670000-0x00007FF61C9C1000-memory.dmp

Download

memory/3452-224-0x00007FF61C670000-0x00007FF61C9C1000-memory.dmp

Download

memory/3452-140-0x00007FF61C670000-0x00007FF61C9C1000-memory.dmp

Download

memory/3504-206-0x00007FF674C50000-0x00007FF674FA1000-memory.dmp

Download

memory/3504-70-0x00007FF674C50000-0x00007FF674FA1000-memory.dmp

Download

memory/3740-125-0x00007FF70AF20000-0x00007FF70B271000-memory.dmp

Download

memory/3740-245-0x00007FF70AF20000-0x00007FF70B271000-memory.dmp

Download

memory/4056-128-0x00007FF612E90000-0x00007FF6131E1000-memory.dmp

Download

memory/4056-251-0x00007FF612E90000-0x00007FF6131E1000-memory.dmp

Download

memory/4508-127-0x00007FF60DC80000-0x00007FF60DFD1000-memory.dmp

Download

memory/4508-247-0x00007FF60DC80000-0x00007FF60DFD1000-memory.dmp

Download

memory/4976-220-0x00007FF6EAF50000-0x00007FF6EB2A1000-memory.dmp

Download

memory/4976-79-0x00007FF6EAF50000-0x00007FF6EB2A1000-memory.dmp

Download

memory/5060-126-0x00007FF78F6C0000-0x00007FF78FA11000-memory.dmp

Download

memory/5060-249-0x00007FF78F6C0000-0x00007FF78FA11000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads