cobaltstrike | 13628284652958a91ed59d2cff2abe3ebd1c787d07260de0817d39dcefba5e27

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 19:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240530-x3xydage5y
SHA256 13628284652958a91ed59d2cff2abe3ebd1c787d07260de0817d39dcefba5e27
MD5 bf00142c09967efe29fbd05538e36989
SHA1 7ec663fdef1159f4d299f57bb43b7eaf67511266
SHA512 c6ed1458c24bc660a527d229c9c490db9bdf097ad93c4c85327637e8c11b91fd436298a95bba03f5430f3c3fafd2353ef52d1d3ed5718756a381897a899ac827
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x001000000002324f-4.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002325e-12.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023261-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023262-22.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023263-28.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023264-34.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023265-41.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023266-47.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000001ea83-53.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023268-60.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023269-65.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326a-74.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326b-80.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326c-85.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326e-93.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326f-99.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023270-104.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023271-112.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023272-118.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023273-123.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023274-129.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x001000000002324f-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002325e-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023261-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023262-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023263-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023264-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023265-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023266-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000001ea83-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023268-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023269-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326a-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326b-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326c-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326e-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326f-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023270-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023271-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023272-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023273-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023274-129.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3372-0-0x00007FF6CF050000-0x00007FF6CF3A4000-memory.dmp	UPX
behavioral2/files/0x001000000002324f-4.dat	UPX
behavioral2/memory/4520-7-0x00007FF7B5A70000-0x00007FF7B5DC4000-memory.dmp	UPX
behavioral2/files/0x000800000002325e-12.dat	UPX
behavioral2/files/0x0007000000023261-11.dat	UPX
behavioral2/memory/2456-14-0x00007FF602650000-0x00007FF6029A4000-memory.dmp	UPX
behavioral2/memory/756-20-0x00007FF630AC0000-0x00007FF630E14000-memory.dmp	UPX
behavioral2/files/0x0007000000023262-22.dat	UPX
behavioral2/memory/2440-26-0x00007FF6EABA0000-0x00007FF6EAEF4000-memory.dmp	UPX
behavioral2/files/0x0007000000023263-28.dat	UPX
behavioral2/memory/4640-32-0x00007FF7B8630000-0x00007FF7B8984000-memory.dmp	UPX
behavioral2/files/0x0007000000023264-34.dat	UPX
behavioral2/memory/1460-36-0x00007FF6898E0000-0x00007FF689C34000-memory.dmp	UPX
behavioral2/files/0x0007000000023265-41.dat	UPX
behavioral2/memory/2068-44-0x00007FF7831B0000-0x00007FF783504000-memory.dmp	UPX
behavioral2/files/0x0007000000023266-47.dat	UPX
behavioral2/files/0x000b00000001ea83-53.dat	UPX
behavioral2/memory/1220-55-0x00007FF70C680000-0x00007FF70C9D4000-memory.dmp	UPX
behavioral2/memory/4760-56-0x00007FF6F9440000-0x00007FF6F9794000-memory.dmp	UPX
behavioral2/files/0x0008000000023268-60.dat	UPX
behavioral2/memory/3372-61-0x00007FF6CF050000-0x00007FF6CF3A4000-memory.dmp	UPX
behavioral2/memory/1344-63-0x00007FF6AA940000-0x00007FF6AAC94000-memory.dmp	UPX
behavioral2/files/0x0007000000023269-65.dat	UPX
behavioral2/memory/4520-68-0x00007FF7B5A70000-0x00007FF7B5DC4000-memory.dmp	UPX
behavioral2/memory/3336-70-0x00007FF798A00000-0x00007FF798D54000-memory.dmp	UPX
behavioral2/files/0x000700000002326a-74.dat	UPX
behavioral2/memory/2456-75-0x00007FF602650000-0x00007FF6029A4000-memory.dmp	UPX
behavioral2/memory/1872-77-0x00007FF7F6680000-0x00007FF7F69D4000-memory.dmp	UPX
behavioral2/files/0x000700000002326b-80.dat	UPX
behavioral2/memory/3080-81-0x00007FF7CBD50000-0x00007FF7CC0A4000-memory.dmp	UPX
behavioral2/files/0x000700000002326c-85.dat	UPX
behavioral2/memory/4176-89-0x00007FF6AE7D0000-0x00007FF6AEB24000-memory.dmp	UPX
behavioral2/files/0x000700000002326e-93.dat	UPX
behavioral2/memory/2608-95-0x00007FF7F9D70000-0x00007FF7FA0C4000-memory.dmp	UPX
behavioral2/files/0x000700000002326f-99.dat	UPX
behavioral2/files/0x0007000000023270-104.dat	UPX
behavioral2/memory/1460-106-0x00007FF6898E0000-0x00007FF689C34000-memory.dmp	UPX
behavioral2/memory/3536-108-0x00007FF677730000-0x00007FF677A84000-memory.dmp	UPX
behavioral2/files/0x0007000000023271-112.dat	UPX
behavioral2/memory/3340-111-0x00007FF761200000-0x00007FF761554000-memory.dmp	UPX
behavioral2/files/0x0007000000023272-118.dat	UPX
behavioral2/memory/3056-115-0x00007FF737E30000-0x00007FF738184000-memory.dmp	UPX
behavioral2/files/0x0007000000023273-123.dat	UPX
behavioral2/files/0x0007000000023274-129.dat	UPX
behavioral2/memory/5068-122-0x00007FF6623D0000-0x00007FF662724000-memory.dmp	UPX
behavioral2/memory/2068-107-0x00007FF7831B0000-0x00007FF783504000-memory.dmp	UPX
behavioral2/memory/1552-131-0x00007FF7EC000000-0x00007FF7EC354000-memory.dmp	UPX
behavioral2/memory/1480-132-0x00007FF79EC50000-0x00007FF79EFA4000-memory.dmp	UPX
behavioral2/memory/3336-133-0x00007FF798A00000-0x00007FF798D54000-memory.dmp	UPX
behavioral2/memory/3080-134-0x00007FF7CBD50000-0x00007FF7CC0A4000-memory.dmp	UPX
behavioral2/memory/4176-135-0x00007FF6AE7D0000-0x00007FF6AEB24000-memory.dmp	UPX
behavioral2/memory/3056-136-0x00007FF737E30000-0x00007FF738184000-memory.dmp	UPX
behavioral2/memory/4520-137-0x00007FF7B5A70000-0x00007FF7B5DC4000-memory.dmp	UPX
behavioral2/memory/2456-138-0x00007FF602650000-0x00007FF6029A4000-memory.dmp	UPX
behavioral2/memory/756-139-0x00007FF630AC0000-0x00007FF630E14000-memory.dmp	UPX
behavioral2/memory/2440-140-0x00007FF6EABA0000-0x00007FF6EAEF4000-memory.dmp	UPX
behavioral2/memory/4640-141-0x00007FF7B8630000-0x00007FF7B8984000-memory.dmp	UPX
behavioral2/memory/1460-142-0x00007FF6898E0000-0x00007FF689C34000-memory.dmp	UPX
behavioral2/memory/2068-143-0x00007FF7831B0000-0x00007FF783504000-memory.dmp	UPX
behavioral2/memory/1220-144-0x00007FF70C680000-0x00007FF70C9D4000-memory.dmp	UPX
behavioral2/memory/4760-145-0x00007FF6F9440000-0x00007FF6F9794000-memory.dmp	UPX
behavioral2/memory/1344-146-0x00007FF6AA940000-0x00007FF6AAC94000-memory.dmp	UPX
behavioral2/memory/3336-147-0x00007FF798A00000-0x00007FF798D54000-memory.dmp	UPX
behavioral2/memory/1872-148-0x00007FF7F6680000-0x00007FF7F69D4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3372-0-0x00007FF6CF050000-0x00007FF6CF3A4000-memory.dmp	xmrig
behavioral2/files/0x001000000002324f-4.dat	xmrig
behavioral2/memory/4520-7-0x00007FF7B5A70000-0x00007FF7B5DC4000-memory.dmp	xmrig
behavioral2/files/0x000800000002325e-12.dat	xmrig
behavioral2/files/0x0007000000023261-11.dat	xmrig
behavioral2/memory/2456-14-0x00007FF602650000-0x00007FF6029A4000-memory.dmp	xmrig
behavioral2/memory/756-20-0x00007FF630AC0000-0x00007FF630E14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023262-22.dat	xmrig
behavioral2/memory/2440-26-0x00007FF6EABA0000-0x00007FF6EAEF4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023263-28.dat	xmrig
behavioral2/memory/4640-32-0x00007FF7B8630000-0x00007FF7B8984000-memory.dmp	xmrig
behavioral2/files/0x0007000000023264-34.dat	xmrig
behavioral2/memory/1460-36-0x00007FF6898E0000-0x00007FF689C34000-memory.dmp	xmrig
behavioral2/files/0x0007000000023265-41.dat	xmrig
behavioral2/memory/2068-44-0x00007FF7831B0000-0x00007FF783504000-memory.dmp	xmrig
behavioral2/files/0x0007000000023266-47.dat	xmrig
behavioral2/files/0x000b00000001ea83-53.dat	xmrig
behavioral2/memory/1220-55-0x00007FF70C680000-0x00007FF70C9D4000-memory.dmp	xmrig
behavioral2/memory/4760-56-0x00007FF6F9440000-0x00007FF6F9794000-memory.dmp	xmrig
behavioral2/files/0x0008000000023268-60.dat	xmrig
behavioral2/memory/3372-61-0x00007FF6CF050000-0x00007FF6CF3A4000-memory.dmp	xmrig
behavioral2/memory/1344-63-0x00007FF6AA940000-0x00007FF6AAC94000-memory.dmp	xmrig
behavioral2/files/0x0007000000023269-65.dat	xmrig
behavioral2/memory/4520-68-0x00007FF7B5A70000-0x00007FF7B5DC4000-memory.dmp	xmrig
behavioral2/memory/3336-70-0x00007FF798A00000-0x00007FF798D54000-memory.dmp	xmrig
behavioral2/files/0x000700000002326a-74.dat	xmrig
behavioral2/memory/2456-75-0x00007FF602650000-0x00007FF6029A4000-memory.dmp	xmrig
behavioral2/memory/1872-77-0x00007FF7F6680000-0x00007FF7F69D4000-memory.dmp	xmrig
behavioral2/files/0x000700000002326b-80.dat	xmrig
behavioral2/memory/3080-81-0x00007FF7CBD50000-0x00007FF7CC0A4000-memory.dmp	xmrig
behavioral2/files/0x000700000002326c-85.dat	xmrig
behavioral2/memory/4176-89-0x00007FF6AE7D0000-0x00007FF6AEB24000-memory.dmp	xmrig
behavioral2/files/0x000700000002326e-93.dat	xmrig
behavioral2/memory/2608-95-0x00007FF7F9D70000-0x00007FF7FA0C4000-memory.dmp	xmrig
behavioral2/files/0x000700000002326f-99.dat	xmrig
behavioral2/files/0x0007000000023270-104.dat	xmrig
behavioral2/memory/1460-106-0x00007FF6898E0000-0x00007FF689C34000-memory.dmp	xmrig
behavioral2/memory/3536-108-0x00007FF677730000-0x00007FF677A84000-memory.dmp	xmrig
behavioral2/files/0x0007000000023271-112.dat	xmrig
behavioral2/memory/3340-111-0x00007FF761200000-0x00007FF761554000-memory.dmp	xmrig
behavioral2/files/0x0007000000023272-118.dat	xmrig
behavioral2/memory/3056-115-0x00007FF737E30000-0x00007FF738184000-memory.dmp	xmrig
behavioral2/files/0x0007000000023273-123.dat	xmrig
behavioral2/files/0x0007000000023274-129.dat	xmrig
behavioral2/memory/5068-122-0x00007FF6623D0000-0x00007FF662724000-memory.dmp	xmrig
behavioral2/memory/2068-107-0x00007FF7831B0000-0x00007FF783504000-memory.dmp	xmrig
behavioral2/memory/1552-131-0x00007FF7EC000000-0x00007FF7EC354000-memory.dmp	xmrig
behavioral2/memory/1480-132-0x00007FF79EC50000-0x00007FF79EFA4000-memory.dmp	xmrig
behavioral2/memory/3336-133-0x00007FF798A00000-0x00007FF798D54000-memory.dmp	xmrig
behavioral2/memory/3080-134-0x00007FF7CBD50000-0x00007FF7CC0A4000-memory.dmp	xmrig
behavioral2/memory/4176-135-0x00007FF6AE7D0000-0x00007FF6AEB24000-memory.dmp	xmrig
behavioral2/memory/3056-136-0x00007FF737E30000-0x00007FF738184000-memory.dmp	xmrig
behavioral2/memory/4520-137-0x00007FF7B5A70000-0x00007FF7B5DC4000-memory.dmp	xmrig
behavioral2/memory/2456-138-0x00007FF602650000-0x00007FF6029A4000-memory.dmp	xmrig
behavioral2/memory/756-139-0x00007FF630AC0000-0x00007FF630E14000-memory.dmp	xmrig
behavioral2/memory/2440-140-0x00007FF6EABA0000-0x00007FF6EAEF4000-memory.dmp	xmrig
behavioral2/memory/4640-141-0x00007FF7B8630000-0x00007FF7B8984000-memory.dmp	xmrig
behavioral2/memory/1460-142-0x00007FF6898E0000-0x00007FF689C34000-memory.dmp	xmrig
behavioral2/memory/2068-143-0x00007FF7831B0000-0x00007FF783504000-memory.dmp	xmrig
behavioral2/memory/1220-144-0x00007FF70C680000-0x00007FF70C9D4000-memory.dmp	xmrig
behavioral2/memory/4760-145-0x00007FF6F9440000-0x00007FF6F9794000-memory.dmp	xmrig
behavioral2/memory/1344-146-0x00007FF6AA940000-0x00007FF6AAC94000-memory.dmp	xmrig
behavioral2/memory/3336-147-0x00007FF798A00000-0x00007FF798D54000-memory.dmp	xmrig
behavioral2/memory/1872-148-0x00007FF7F6680000-0x00007FF7F69D4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4520	IRKWxME.exe
2456	IEHGZum.exe
756	bxCGtIO.exe
2440	idPQKMQ.exe
4640	AUiNCwI.exe
1460	sCGFsIn.exe
2068	PpaTZaj.exe
1220	SzcYTly.exe
4760	btAAjHN.exe
1344	waGPpfJ.exe
3336	IbxpYAu.exe
1872	tmKeOxt.exe
3080	uVjLhcO.exe
4176	mZUXnPe.exe
2608	qxBEXuO.exe
3536	aBOAJBq.exe
3340	GqAkScs.exe
3056	GOjTotx.exe
5068	BCrOeug.exe
1552	IuYjBTh.exe
1480	rNkYhyJ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3372-0-0x00007FF6CF050000-0x00007FF6CF3A4000-memory.dmp	upx
behavioral2/files/0x001000000002324f-4.dat	upx
behavioral2/memory/4520-7-0x00007FF7B5A70000-0x00007FF7B5DC4000-memory.dmp	upx
behavioral2/files/0x000800000002325e-12.dat	upx
behavioral2/files/0x0007000000023261-11.dat	upx
behavioral2/memory/2456-14-0x00007FF602650000-0x00007FF6029A4000-memory.dmp	upx
behavioral2/memory/756-20-0x00007FF630AC0000-0x00007FF630E14000-memory.dmp	upx
behavioral2/files/0x0007000000023262-22.dat	upx
behavioral2/memory/2440-26-0x00007FF6EABA0000-0x00007FF6EAEF4000-memory.dmp	upx
behavioral2/files/0x0007000000023263-28.dat	upx
behavioral2/memory/4640-32-0x00007FF7B8630000-0x00007FF7B8984000-memory.dmp	upx
behavioral2/files/0x0007000000023264-34.dat	upx
behavioral2/memory/1460-36-0x00007FF6898E0000-0x00007FF689C34000-memory.dmp	upx
behavioral2/files/0x0007000000023265-41.dat	upx
behavioral2/memory/2068-44-0x00007FF7831B0000-0x00007FF783504000-memory.dmp	upx
behavioral2/files/0x0007000000023266-47.dat	upx
behavioral2/files/0x000b00000001ea83-53.dat	upx
behavioral2/memory/1220-55-0x00007FF70C680000-0x00007FF70C9D4000-memory.dmp	upx
behavioral2/memory/4760-56-0x00007FF6F9440000-0x00007FF6F9794000-memory.dmp	upx
behavioral2/files/0x0008000000023268-60.dat	upx
behavioral2/memory/3372-61-0x00007FF6CF050000-0x00007FF6CF3A4000-memory.dmp	upx
behavioral2/memory/1344-63-0x00007FF6AA940000-0x00007FF6AAC94000-memory.dmp	upx
behavioral2/files/0x0007000000023269-65.dat	upx
behavioral2/memory/4520-68-0x00007FF7B5A70000-0x00007FF7B5DC4000-memory.dmp	upx
behavioral2/memory/3336-70-0x00007FF798A00000-0x00007FF798D54000-memory.dmp	upx
behavioral2/files/0x000700000002326a-74.dat	upx
behavioral2/memory/2456-75-0x00007FF602650000-0x00007FF6029A4000-memory.dmp	upx
behavioral2/memory/1872-77-0x00007FF7F6680000-0x00007FF7F69D4000-memory.dmp	upx
behavioral2/files/0x000700000002326b-80.dat	upx
behavioral2/memory/3080-81-0x00007FF7CBD50000-0x00007FF7CC0A4000-memory.dmp	upx
behavioral2/files/0x000700000002326c-85.dat	upx
behavioral2/memory/4176-89-0x00007FF6AE7D0000-0x00007FF6AEB24000-memory.dmp	upx
behavioral2/files/0x000700000002326e-93.dat	upx
behavioral2/memory/2608-95-0x00007FF7F9D70000-0x00007FF7FA0C4000-memory.dmp	upx
behavioral2/files/0x000700000002326f-99.dat	upx
behavioral2/files/0x0007000000023270-104.dat	upx
behavioral2/memory/1460-106-0x00007FF6898E0000-0x00007FF689C34000-memory.dmp	upx
behavioral2/memory/3536-108-0x00007FF677730000-0x00007FF677A84000-memory.dmp	upx
behavioral2/files/0x0007000000023271-112.dat	upx
behavioral2/memory/3340-111-0x00007FF761200000-0x00007FF761554000-memory.dmp	upx
behavioral2/files/0x0007000000023272-118.dat	upx
behavioral2/memory/3056-115-0x00007FF737E30000-0x00007FF738184000-memory.dmp	upx
behavioral2/files/0x0007000000023273-123.dat	upx
behavioral2/files/0x0007000000023274-129.dat	upx
behavioral2/memory/5068-122-0x00007FF6623D0000-0x00007FF662724000-memory.dmp	upx
behavioral2/memory/2068-107-0x00007FF7831B0000-0x00007FF783504000-memory.dmp	upx
behavioral2/memory/1552-131-0x00007FF7EC000000-0x00007FF7EC354000-memory.dmp	upx
behavioral2/memory/1480-132-0x00007FF79EC50000-0x00007FF79EFA4000-memory.dmp	upx
behavioral2/memory/3336-133-0x00007FF798A00000-0x00007FF798D54000-memory.dmp	upx
behavioral2/memory/3080-134-0x00007FF7CBD50000-0x00007FF7CC0A4000-memory.dmp	upx
behavioral2/memory/4176-135-0x00007FF6AE7D0000-0x00007FF6AEB24000-memory.dmp	upx
behavioral2/memory/3056-136-0x00007FF737E30000-0x00007FF738184000-memory.dmp	upx
behavioral2/memory/4520-137-0x00007FF7B5A70000-0x00007FF7B5DC4000-memory.dmp	upx
behavioral2/memory/2456-138-0x00007FF602650000-0x00007FF6029A4000-memory.dmp	upx
behavioral2/memory/756-139-0x00007FF630AC0000-0x00007FF630E14000-memory.dmp	upx
behavioral2/memory/2440-140-0x00007FF6EABA0000-0x00007FF6EAEF4000-memory.dmp	upx
behavioral2/memory/4640-141-0x00007FF7B8630000-0x00007FF7B8984000-memory.dmp	upx
behavioral2/memory/1460-142-0x00007FF6898E0000-0x00007FF689C34000-memory.dmp	upx
behavioral2/memory/2068-143-0x00007FF7831B0000-0x00007FF783504000-memory.dmp	upx
behavioral2/memory/1220-144-0x00007FF70C680000-0x00007FF70C9D4000-memory.dmp	upx
behavioral2/memory/4760-145-0x00007FF6F9440000-0x00007FF6F9794000-memory.dmp	upx
behavioral2/memory/1344-146-0x00007FF6AA940000-0x00007FF6AAC94000-memory.dmp	upx
behavioral2/memory/3336-147-0x00007FF798A00000-0x00007FF798D54000-memory.dmp	upx
behavioral2/memory/1872-148-0x00007FF7F6680000-0x00007FF7F69D4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\IRKWxME.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bxCGtIO.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\waGPpfJ.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uVjLhcO.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aBOAJBq.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GOjTotx.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IEHGZum.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\sCGFsIn.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IbxpYAu.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GqAkScs.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IuYjBTh.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\idPQKMQ.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PpaTZaj.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SzcYTly.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\btAAjHN.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tmKeOxt.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mZUXnPe.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BCrOeug.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rNkYhyJ.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AUiNCwI.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qxBEXuO.exe	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4520	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	92
PID 3372 wrote to memory of 4520	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	92
PID 3372 wrote to memory of 2456	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	93
PID 3372 wrote to memory of 2456	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	93
PID 3372 wrote to memory of 756	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	94
PID 3372 wrote to memory of 756	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	94
PID 3372 wrote to memory of 2440	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	95
PID 3372 wrote to memory of 2440	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	95
PID 3372 wrote to memory of 4640	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	96
PID 3372 wrote to memory of 4640	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	96
PID 3372 wrote to memory of 1460	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	97
PID 3372 wrote to memory of 1460	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	97
PID 3372 wrote to memory of 2068	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	98
PID 3372 wrote to memory of 2068	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	98
PID 3372 wrote to memory of 1220	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	99
PID 3372 wrote to memory of 1220	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	99
PID 3372 wrote to memory of 4760	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	100
PID 3372 wrote to memory of 4760	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	100
PID 3372 wrote to memory of 1344	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	101
PID 3372 wrote to memory of 1344	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	101
PID 3372 wrote to memory of 3336	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	102
PID 3372 wrote to memory of 3336	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	102
PID 3372 wrote to memory of 1872	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	103
PID 3372 wrote to memory of 1872	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	103
PID 3372 wrote to memory of 3080	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	104
PID 3372 wrote to memory of 3080	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	104
PID 3372 wrote to memory of 4176	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	105
PID 3372 wrote to memory of 4176	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	105
PID 3372 wrote to memory of 2608	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	106
PID 3372 wrote to memory of 2608	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	106
PID 3372 wrote to memory of 3536	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	107
PID 3372 wrote to memory of 3536	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	107
PID 3372 wrote to memory of 3340	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	108
PID 3372 wrote to memory of 3340	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	108
PID 3372 wrote to memory of 3056	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	109
PID 3372 wrote to memory of 3056	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	109
PID 3372 wrote to memory of 5068	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	110
PID 3372 wrote to memory of 5068	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	110
PID 3372 wrote to memory of 1552	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	111
PID 3372 wrote to memory of 1552	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	111
PID 3372 wrote to memory of 1480	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	112
PID 3372 wrote to memory of 1480	3372	2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe	112

C:\Users\Admin\AppData\Local\Temp\2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-30_bf00142c09967efe29fbd05538e36989_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\System\IRKWxME.exe
  C:\Windows\System\IRKWxME.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\IEHGZum.exe
  C:\Windows\System\IEHGZum.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\bxCGtIO.exe
  C:\Windows\System\bxCGtIO.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\idPQKMQ.exe
  C:\Windows\System\idPQKMQ.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\AUiNCwI.exe
  C:\Windows\System\AUiNCwI.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\sCGFsIn.exe
  C:\Windows\System\sCGFsIn.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\PpaTZaj.exe
  C:\Windows\System\PpaTZaj.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\SzcYTly.exe
  C:\Windows\System\SzcYTly.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\btAAjHN.exe
  C:\Windows\System\btAAjHN.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\waGPpfJ.exe
  C:\Windows\System\waGPpfJ.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\IbxpYAu.exe
  C:\Windows\System\IbxpYAu.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\tmKeOxt.exe
  C:\Windows\System\tmKeOxt.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\uVjLhcO.exe
  C:\Windows\System\uVjLhcO.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\mZUXnPe.exe
  C:\Windows\System\mZUXnPe.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\qxBEXuO.exe
  C:\Windows\System\qxBEXuO.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\aBOAJBq.exe
  C:\Windows\System\aBOAJBq.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\GqAkScs.exe
  C:\Windows\System\GqAkScs.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\GOjTotx.exe
  C:\Windows\System\GOjTotx.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\BCrOeug.exe
  C:\Windows\System\BCrOeug.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\IuYjBTh.exe
  C:\Windows\System\IuYjBTh.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\rNkYhyJ.exe
  C:\Windows\System\rNkYhyJ.exe
  2⤵
  - Executes dropped EXE
  PID:1480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:3504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AUiNCwI.exe

Path C:\Windows\System\AUiNCwI.exe
Size 5.9MB
SHA256 baec0deb5ec4ba3b568ffe44ae1c1d68fc8fc718e333f353f18f6c8a79057761
MD5 03fa027a42066c693f4fd7baffb053b3
SHA1 bbbabf9700e04d6498e8de4558e74f9f1b3ad2c0
SHA512 1d792e720ee39574c229cd711bd61e2733da92d3432368390c8a7032abeb7ce34b05399e29a305de8e75683ceea834ab004e85759b077b42b247dc54bdb3684f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

BCrOeug.exe

Path C:\Windows\System\BCrOeug.exe
Size 5.9MB
SHA256 942a38af3bb153cd93272e763bf96423a5575b3e582967696a637be1d06fa8ab
MD5 09a5c845688fb55922b91038bca65e43
SHA1 aadaae6ed5f8a9061c5cb6a37a58c572810ff960
SHA512 eb13e5d3a8d8c2205327d260ef4c8a8982c24790d36497241c6c8d36abb00ea7f0a0f16675a9916c754cef0fbf6328ac03fe03e72b0250b1495ff98cfe993a3c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

GOjTotx.exe

Path C:\Windows\System\GOjTotx.exe
Size 5.9MB
SHA256 5bf8ce7306c3393261ea7661481152e4a4e2628d083a1743568b17b5555582c4
MD5 20f2d863982fa3f9713bf93a34a6e2eb
SHA1 e37a68860b1ba410102be9a82324da0a180315d7
SHA512 f7cb7fa68f02cf0ebe67996daafd149aff0df8cb1ef8e2290890117663101bc474426d33af788837989975e1bc05d1a1d1487a9f755e80c9d067ce38237b1648
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

GqAkScs.exe

Path C:\Windows\System\GqAkScs.exe
Size 5.9MB
SHA256 3867ab2c146ed251b4562fb0e8db1afcd09db9bff3710a77d9edc93f51e69f53
MD5 45d8d8d6e9f160cfa2ea73c051c27eb1
SHA1 c42b367ba7b5c50d2497eee4ff71a3c84010896b
SHA512 69b893aea74213df315128add1d85390590e72ccd0597854d2988f177acd1dd6068332b6eaa4f3f8b1e4246df790d8e1ed1e04d5163adf0991c70a4ff6970c3f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

IEHGZum.exe

Path C:\Windows\System\IEHGZum.exe
Size 5.9MB
SHA256 ca267dafd7c28bead7b44aea56dbe382eff18263c5c6c6d5059e5766b87f2fae
MD5 fe73548d1af56608d50179cc0ccf4860
SHA1 c8e577a935d7ef81d5c749941034492583ea6ee6
SHA512 42e200939804740fa62002d856f0bfe08867e8904224933c328dd44d9704c1eba8a38e4747ca530376b1c235104ed346d08c4021200e2f657be077b88f9bc7a5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

IRKWxME.exe

Path C:\Windows\System\IRKWxME.exe
Size 5.9MB
SHA256 efa85099b007fba52c20e7e1ff8e2bfb7884284208554fb876df812a1522884f
MD5 18f6796527845199c9c9b4a1b408e1c4
SHA1 71f82a1fe1d10d35266594777ecd54172f24fe15
SHA512 f367f3227a61e33fc91eb524ab990b48c507a9ad8838a05d735efebe67ac1465a35d8e24d07b825fcf52da3310a0db36b7e548284907c16ad8aaaf5d20472d46
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

IbxpYAu.exe

Path C:\Windows\System\IbxpYAu.exe
Size 5.9MB
SHA256 f53154b8350d65cdc77c3c8637f2027165c5b529db7ffbfe4d9f32e03b1d8b21
MD5 591e3446c7df890a0690a508dda60329
SHA1 8d275805fb63308d97c98d3ce44dc174bd8c29f8
SHA512 692e6b5cd878f641a358bc57da94c69d34bf2951c0b2067d2da8ae5874bd8b37a3a9fbcc78b521b30d947a1b158f7fe5b83e4428b6470916195f0a05f907260a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

IuYjBTh.exe

Path C:\Windows\System\IuYjBTh.exe
Size 5.9MB
SHA256 7f2fb42118709865498c4b213d55250158fb17796aedb360cc4f08ce4592c40b
MD5 4eadaa6b20deabaac95fb1b8a6a33467
SHA1 bd56c6a29d2b6f742178f7390f4cf3557335f8e8
SHA512 a5cdc24d9d1c870d9cf5f6c9f92de702bf08dab0ee905f3b0bdebb7009b1dc3b0180acde83fcab8cfcd1817cc6beb0da09572ca3ed17bd81844ff95e83def826
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

PpaTZaj.exe

Path C:\Windows\System\PpaTZaj.exe
Size 5.9MB
SHA256 7d4f95492e25a8e1c37d796d6f4c57c1f6d7f326ce2e894ce602c9272e782afa
MD5 c36b2d960339972d1ce753b32c7422bf
SHA1 9b1b1d08fbf4f0511c6a8a8393b6d8d447a33978
SHA512 67402b929f2fa3876b6f34aa9ae5c6830ad86c3bfd7c157e95c4e8cb12a9ccb59efa2d74232380ace0059c5690cf59d0c82ae573086b448b3948bb7ce8342465
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

SzcYTly.exe

Path C:\Windows\System\SzcYTly.exe
Size 5.9MB
SHA256 ed2727af04773877f2e5971623bcd62351dd9c3d3c1e5a089c112fe5870f1c25
MD5 ea0e617084539b748a94d6f3a13db41c
SHA1 aa6c2174d0c4bd6f00729b93fb87b4947e04c0b2
SHA512 959873f5a5eb770f69caa0c1f204f690f3b77cd1753dbc22bfcb90b3942e58a08596bbe98b1bd5090a3b5673de53020185a24059392e50480e16b06e7f820e43
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

aBOAJBq.exe

Path C:\Windows\System\aBOAJBq.exe
Size 5.9MB
SHA256 7f61e55895ecb22962b94c8272a36b8fb39433ddf0b9614e4cc4f30f89f19874
MD5 21921e1581a16eb6327b81c2ee22b7e8
SHA1 1b718f7b310af9c788eb379a6c958167a9311597
SHA512 8aa47d98ad7f3d0646b1c8d83d1c4b8323b64a0891a814c05e92689da3e559708ed965c83d75dc94ad25eb46c0dee9ba19b38c56413409e063edb94a4d0ec5d8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

btAAjHN.exe

Path C:\Windows\System\btAAjHN.exe
Size 5.9MB
SHA256 a1b7b2f8a17720858bb281b332eda092936009fb9bb9aaaa9d06f6f9a71dfcb4
MD5 152b50ec4cccabe233a3373db389c8a5
SHA1 26d732552df1f5d5b172c315898d8c373090b912
SHA512 ed2902be031dabe89fab6a9284f6931f2496e3dbfba44012bd20fdcff4d5bd4ce079c5b2129ba3ac549f894066559eb9d05fc00125e766b94a40376898a4f920
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

bxCGtIO.exe

Path C:\Windows\System\bxCGtIO.exe
Size 5.9MB
SHA256 8d835983576b198d5e7ddd5684b1bd31649d69f949697e96a2b2d2581a529326
MD5 a2ac048866fec6d4e0091909ce421e2b
SHA1 10397d777d1ab51d89f5ac008653ced4a8c312b8
SHA512 97671873a169e2766f6e4b81a39fde01696b31bc561f280835dc286bb9b724761de11c518f45daeaf08d4599e8b5d2d1d591efc95240e30ec8b6593339bd5f90
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

idPQKMQ.exe

Path C:\Windows\System\idPQKMQ.exe
Size 5.9MB
SHA256 0422c7e02452f170ec6b97eea609255f1e6db5ba0e1d668d7438991c72e0acf4
MD5 660124308dd932b175e0566d38c8b7e7
SHA1 37e2616af60e4c9432731e241b5bb0783c442a0c
SHA512 2d5714466a4cbdc70ccb2df8e6f0e22c53059d03183806ae5d99ac2eabf67df7b073b7fc0b4f1fa0b49d3ee9363ad8286755c6b061039e49766404ff0aa3c62f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

mZUXnPe.exe

Path C:\Windows\System\mZUXnPe.exe
Size 5.9MB
SHA256 c0fb5f22d08f9397e5ab8d79355c42a7f11635fe4ed436331f8651c02de3cc12
MD5 a64beedb05e52502053f82b53498b097
SHA1 d178b229e8599978536f678c48fd7c4a3b3b05ea
SHA512 6127063a882f4e844f8a0cc6dd8a0286c940167e6c220c1d558ba08116be184ba198e5a06db854eaa9fb43a6d7170557c574a91b1fad0d4f6f7588d1f72b7cbf
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

qxBEXuO.exe

Path C:\Windows\System\qxBEXuO.exe
Size 5.9MB
SHA256 578dfad329b3faaa3387d733e91020dee64644918ee39207611904af96e8b22c
MD5 f19990359c65c9fabda06b35e14beced
SHA1 f85698df37fc99e946642e6b7d0140ca1d7ee350
SHA512 4c0122f5b5a0334e0f7b7389d6056eec81568bef17057d454f458419a790766093d07a2adecdcabf3fa22dcb781f6d3f1de679c2513cdb04a08e2914c04f802a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:Q+856utgpPF8u/7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

rNkYhyJ.exe

Path C:\Windows\System\rNkYhyJ.exe
Size 5.9MB
SHA256 d79ac44d57bf62cb7942ab3049c4e62d674728b4e8c45096f090d14dfc101dc1
MD5 1c55086d7c9bca78c82f4b69c3225ddb
SHA1 2f1d482eacb2aa27cd957704372138c8f4fb1e84
SHA512 aa30139c9def2b70666cd0aec34063de110f91e6c954eeef91e1cb1d549bceace16ed05abb57390c5337c9f8f10d6b4bf3dd1618552c33c2f02c7a7d8b0a730a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:Q+856utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

sCGFsIn.exe

Path C:\Windows\System\sCGFsIn.exe
Size 5.9MB
SHA256 cda3821b1dd1443276c57211c14f3118f18e1fa8668fd73318948d1e452b4490
MD5 d227164341a4a8ac1233c3c0ec1f0b8a
SHA1 63c3ef8ea0ff7fd9ef37d6b54bea9bcd05d945dd
SHA512 11099713b4ff8dd8f62a8d88efccc41590e2af57cbc456040d26cf1e95ef3215c6f08d49f2c0b5353ace4946e2612c7b2fe40c6874a5bf9e7ea167af06a72dfd
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmKeOxt.exe

Path C:\Windows\System\tmKeOxt.exe
Size 5.9MB
SHA256 b92a110b1dc41975ed51358adc07e5a2f638828453ddff4cffd2f215cdb8ef57
MD5 c7a2c3154d9959214cffdd10a52652a0
SHA1 bca9e2d06286a92e86f49acc96f98b92885acddd
SHA512 e6eba5e05415a7bfc4ca22cf23f7d7824cd9177ab979bc9243015f54c1603b7df8c6a3678b14d339dbb2be2dcded16d0cfecdf022dce39ca27ac2388a17981a4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

uVjLhcO.exe

Path C:\Windows\System\uVjLhcO.exe
Size 5.9MB
SHA256 96b417fadb4fd1be30f25ca33a5876960cc370e1e36a9ba036581c8bd8643592
MD5 2afb33452713ee0f1bc002fc4afd6cc3
SHA1 c7c6035439ec971848f757028573bc202d72f266
SHA512 33e88fa5452af32ce63fd51bb521645a65354d9852a5780bba125483dfed23c56857e30d763184fb82c3a1c4a4a31b68ed6a6564aeef158dd43fb03d7cda3e24
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

waGPpfJ.exe

Path C:\Windows\System\waGPpfJ.exe
Size 5.9MB
SHA256 58be308cac007fde811ca1cc867f9fbc830b21d1f36cd79a0ad19b347d0462b3
MD5 e61f157c1cdd985a9dc6db7e182617b1
SHA1 b0740b30b0881219762e82215d80d0168598e0c3
SHA512 d529bc7e797480d90467ac7fa1f129294fd968554b5970e3cb93a0d29521439d5ddd07ded8ebd218d0df516be918956f9de92fea336235d75c2cc6124b97e79a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/756-20-0x00007FF630AC0000-0x00007FF630E14000-memory.dmp

Download

memory/756-139-0x00007FF630AC0000-0x00007FF630E14000-memory.dmp

Download

memory/1220-55-0x00007FF70C680000-0x00007FF70C9D4000-memory.dmp

Download

memory/1220-144-0x00007FF70C680000-0x00007FF70C9D4000-memory.dmp

Download

memory/1344-63-0x00007FF6AA940000-0x00007FF6AAC94000-memory.dmp

Download

memory/1344-146-0x00007FF6AA940000-0x00007FF6AAC94000-memory.dmp

Download

memory/1460-36-0x00007FF6898E0000-0x00007FF689C34000-memory.dmp

Download

memory/1460-142-0x00007FF6898E0000-0x00007FF689C34000-memory.dmp

Download

memory/1460-106-0x00007FF6898E0000-0x00007FF689C34000-memory.dmp

Download

memory/1480-157-0x00007FF79EC50000-0x00007FF79EFA4000-memory.dmp

Download

memory/1480-132-0x00007FF79EC50000-0x00007FF79EFA4000-memory.dmp

Download

memory/1552-131-0x00007FF7EC000000-0x00007FF7EC354000-memory.dmp

Download

memory/1552-156-0x00007FF7EC000000-0x00007FF7EC354000-memory.dmp

Download

memory/1872-148-0x00007FF7F6680000-0x00007FF7F69D4000-memory.dmp

Download

memory/1872-77-0x00007FF7F6680000-0x00007FF7F69D4000-memory.dmp

Download

memory/2068-143-0x00007FF7831B0000-0x00007FF783504000-memory.dmp

Download

memory/2068-44-0x00007FF7831B0000-0x00007FF783504000-memory.dmp

Download

memory/2068-107-0x00007FF7831B0000-0x00007FF783504000-memory.dmp

Download

memory/2440-26-0x00007FF6EABA0000-0x00007FF6EAEF4000-memory.dmp

Download

memory/2440-140-0x00007FF6EABA0000-0x00007FF6EAEF4000-memory.dmp

Download

memory/2456-14-0x00007FF602650000-0x00007FF6029A4000-memory.dmp

Download

memory/2456-75-0x00007FF602650000-0x00007FF6029A4000-memory.dmp

Download

memory/2456-138-0x00007FF602650000-0x00007FF6029A4000-memory.dmp

Download

memory/2608-151-0x00007FF7F9D70000-0x00007FF7FA0C4000-memory.dmp

Download

memory/2608-95-0x00007FF7F9D70000-0x00007FF7FA0C4000-memory.dmp

Download

memory/3056-136-0x00007FF737E30000-0x00007FF738184000-memory.dmp

Download

memory/3056-115-0x00007FF737E30000-0x00007FF738184000-memory.dmp

Download

memory/3056-155-0x00007FF737E30000-0x00007FF738184000-memory.dmp

Download

memory/3080-149-0x00007FF7CBD50000-0x00007FF7CC0A4000-memory.dmp

Download

memory/3080-81-0x00007FF7CBD50000-0x00007FF7CC0A4000-memory.dmp

Download

memory/3080-134-0x00007FF7CBD50000-0x00007FF7CC0A4000-memory.dmp

Download

memory/3336-147-0x00007FF798A00000-0x00007FF798D54000-memory.dmp

Download

memory/3336-70-0x00007FF798A00000-0x00007FF798D54000-memory.dmp

Download

memory/3336-133-0x00007FF798A00000-0x00007FF798D54000-memory.dmp

Download

memory/3340-111-0x00007FF761200000-0x00007FF761554000-memory.dmp

Download

memory/3340-153-0x00007FF761200000-0x00007FF761554000-memory.dmp

Download

memory/3372-0-0x00007FF6CF050000-0x00007FF6CF3A4000-memory.dmp

Download

memory/3372-1-0x000001CC5BFB0000-0x000001CC5BFC0000-memory.dmp

Download

memory/3372-61-0x00007FF6CF050000-0x00007FF6CF3A4000-memory.dmp

Download

memory/3536-152-0x00007FF677730000-0x00007FF677A84000-memory.dmp

Download

memory/3536-108-0x00007FF677730000-0x00007FF677A84000-memory.dmp

Download

memory/4176-150-0x00007FF6AE7D0000-0x00007FF6AEB24000-memory.dmp

Download

memory/4176-135-0x00007FF6AE7D0000-0x00007FF6AEB24000-memory.dmp

Download

memory/4176-89-0x00007FF6AE7D0000-0x00007FF6AEB24000-memory.dmp

Download

memory/4520-7-0x00007FF7B5A70000-0x00007FF7B5DC4000-memory.dmp

Download

memory/4520-137-0x00007FF7B5A70000-0x00007FF7B5DC4000-memory.dmp

Download

memory/4520-68-0x00007FF7B5A70000-0x00007FF7B5DC4000-memory.dmp

Download

memory/4640-32-0x00007FF7B8630000-0x00007FF7B8984000-memory.dmp

Download

memory/4640-141-0x00007FF7B8630000-0x00007FF7B8984000-memory.dmp

Download

memory/4760-145-0x00007FF6F9440000-0x00007FF6F9794000-memory.dmp

Download

memory/4760-56-0x00007FF6F9440000-0x00007FF6F9794000-memory.dmp

Download

memory/5068-154-0x00007FF6623D0000-0x00007FF662724000-memory.dmp

Download

memory/5068-122-0x00007FF6623D0000-0x00007FF662724000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads