cobaltstrike | 2b0948c63c5e44d7329d51dcb39ccdbc63dcb52f81c344aeff81cb0608694f12

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 19:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240530-x83e2saa32
SHA256 2b0948c63c5e44d7329d51dcb39ccdbc63dcb52f81c344aeff81cb0608694f12
MD5 e461de92bc44d32731907d97ca946c5a
SHA1 4888be02c226f97bdc493c203ee24aae152510f2
SHA512 7853c007b39c793e71850b79749d31cefba767777cf2db7da41b2db616185c0109eb9d15c81e8536674460bf48ca641e492a2d5669ad897d95ef379c4079ea31
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:T+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0007000000023288-4.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023404-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023408-10.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340a-22.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340b-28.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340c-41.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340d-40.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340e-47.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340f-53.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023405-58.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023410-65.dat	cobalt_reflective_dll
behavioral2/files/0x000500000002296a-72.dat	cobalt_reflective_dll
behavioral2/files/0x000d000000023368-79.dat	cobalt_reflective_dll
behavioral2/files/0x000d000000023369-85.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023411-92.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023413-105.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023414-120.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023415-122.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023412-99.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023416-127.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-133.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023288-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023404-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023408-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340a-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340b-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340c-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340d-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340e-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340f-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023405-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023410-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000500000002296a-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d000000023368-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d000000023369-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023411-92.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023413-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023414-120.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023415-122.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023412-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023416-127.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-133.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2876-0-0x00007FF7190D0000-0x00007FF719424000-memory.dmp	UPX
behavioral2/files/0x0007000000023288-4.dat	UPX
behavioral2/memory/2324-8-0x00007FF6A56D0000-0x00007FF6A5A24000-memory.dmp	UPX
behavioral2/files/0x0008000000023404-11.dat	UPX
behavioral2/files/0x0007000000023408-10.dat	UPX
behavioral2/memory/3540-14-0x00007FF644E90000-0x00007FF6451E4000-memory.dmp	UPX
behavioral2/memory/1252-20-0x00007FF61F800000-0x00007FF61FB54000-memory.dmp	UPX
behavioral2/files/0x000700000002340a-22.dat	UPX
behavioral2/memory/740-24-0x00007FF7381B0000-0x00007FF738504000-memory.dmp	UPX
behavioral2/files/0x000700000002340b-28.dat	UPX
behavioral2/files/0x000700000002340c-41.dat	UPX
behavioral2/files/0x000700000002340d-40.dat	UPX
behavioral2/memory/3364-44-0x00007FF7C5700000-0x00007FF7C5A54000-memory.dmp	UPX
behavioral2/files/0x000700000002340e-47.dat	UPX
behavioral2/files/0x000700000002340f-53.dat	UPX
behavioral2/files/0x0008000000023405-58.dat	UPX
behavioral2/memory/2820-62-0x00007FF764000000-0x00007FF764354000-memory.dmp	UPX
behavioral2/memory/4392-61-0x00007FF6D5650000-0x00007FF6D59A4000-memory.dmp	UPX
behavioral2/memory/3664-50-0x00007FF7FF8F0000-0x00007FF7FFC44000-memory.dmp	UPX
behavioral2/memory/4888-38-0x00007FF74D970000-0x00007FF74DCC4000-memory.dmp	UPX
behavioral2/memory/2116-32-0x00007FF66A950000-0x00007FF66ACA4000-memory.dmp	UPX
behavioral2/files/0x0007000000023410-65.dat	UPX
behavioral2/memory/2824-71-0x00007FF6872A0000-0x00007FF6875F4000-memory.dmp	UPX
behavioral2/files/0x000500000002296a-72.dat	UPX
behavioral2/files/0x000d000000023368-79.dat	UPX
behavioral2/memory/2720-77-0x00007FF7CEC50000-0x00007FF7CEFA4000-memory.dmp	UPX
behavioral2/memory/2876-66-0x00007FF7190D0000-0x00007FF719424000-memory.dmp	UPX
behavioral2/memory/3540-81-0x00007FF644E90000-0x00007FF6451E4000-memory.dmp	UPX
behavioral2/files/0x000d000000023369-85.dat	UPX
behavioral2/memory/2864-84-0x00007FF7EDD20000-0x00007FF7EE074000-memory.dmp	UPX
behavioral2/memory/1252-86-0x00007FF61F800000-0x00007FF61FB54000-memory.dmp	UPX
behavioral2/files/0x0007000000023411-92.dat	UPX
behavioral2/memory/740-95-0x00007FF7381B0000-0x00007FF738504000-memory.dmp	UPX
behavioral2/memory/1420-91-0x00007FF71F130000-0x00007FF71F484000-memory.dmp	UPX
behavioral2/memory/1708-96-0x00007FF692100000-0x00007FF692454000-memory.dmp	UPX
behavioral2/memory/4888-102-0x00007FF74D970000-0x00007FF74DCC4000-memory.dmp	UPX
behavioral2/files/0x0007000000023413-105.dat	UPX
behavioral2/memory/3364-111-0x00007FF7C5700000-0x00007FF7C5A54000-memory.dmp	UPX
behavioral2/memory/2288-116-0x00007FF761030000-0x00007FF761384000-memory.dmp	UPX
behavioral2/files/0x0007000000023414-120.dat	UPX
behavioral2/files/0x0007000000023415-122.dat	UPX
behavioral2/memory/3052-119-0x00007FF721350000-0x00007FF7216A4000-memory.dmp	UPX
behavioral2/memory/3664-118-0x00007FF7FF8F0000-0x00007FF7FFC44000-memory.dmp	UPX
behavioral2/memory/1544-110-0x00007FF699850000-0x00007FF699BA4000-memory.dmp	UPX
behavioral2/memory/2284-108-0x00007FF730070000-0x00007FF7303C4000-memory.dmp	UPX
behavioral2/files/0x0007000000023412-99.dat	UPX
behavioral2/files/0x0007000000023416-127.dat	UPX
behavioral2/memory/4416-130-0x00007FF664810000-0x00007FF664B64000-memory.dmp	UPX
behavioral2/files/0x0007000000023417-133.dat	UPX
behavioral2/memory/2824-129-0x00007FF6872A0000-0x00007FF6875F4000-memory.dmp	UPX
behavioral2/memory/2260-135-0x00007FF61D070000-0x00007FF61D3C4000-memory.dmp	UPX
behavioral2/memory/1420-136-0x00007FF71F130000-0x00007FF71F484000-memory.dmp	UPX
behavioral2/memory/2284-137-0x00007FF730070000-0x00007FF7303C4000-memory.dmp	UPX
behavioral2/memory/1544-138-0x00007FF699850000-0x00007FF699BA4000-memory.dmp	UPX
behavioral2/memory/2288-139-0x00007FF761030000-0x00007FF761384000-memory.dmp	UPX
behavioral2/memory/3052-140-0x00007FF721350000-0x00007FF7216A4000-memory.dmp	UPX
behavioral2/memory/2324-141-0x00007FF6A56D0000-0x00007FF6A5A24000-memory.dmp	UPX
behavioral2/memory/3540-142-0x00007FF644E90000-0x00007FF6451E4000-memory.dmp	UPX
behavioral2/memory/1252-143-0x00007FF61F800000-0x00007FF61FB54000-memory.dmp	UPX
behavioral2/memory/740-144-0x00007FF7381B0000-0x00007FF738504000-memory.dmp	UPX
behavioral2/memory/2116-145-0x00007FF66A950000-0x00007FF66ACA4000-memory.dmp	UPX
behavioral2/memory/3364-146-0x00007FF7C5700000-0x00007FF7C5A54000-memory.dmp	UPX
behavioral2/memory/4888-147-0x00007FF74D970000-0x00007FF74DCC4000-memory.dmp	UPX
behavioral2/memory/3664-148-0x00007FF7FF8F0000-0x00007FF7FFC44000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2876-0-0x00007FF7190D0000-0x00007FF719424000-memory.dmp	xmrig
behavioral2/files/0x0007000000023288-4.dat	xmrig
behavioral2/memory/2324-8-0x00007FF6A56D0000-0x00007FF6A5A24000-memory.dmp	xmrig
behavioral2/files/0x0008000000023404-11.dat	xmrig
behavioral2/files/0x0007000000023408-10.dat	xmrig
behavioral2/memory/3540-14-0x00007FF644E90000-0x00007FF6451E4000-memory.dmp	xmrig
behavioral2/memory/1252-20-0x00007FF61F800000-0x00007FF61FB54000-memory.dmp	xmrig
behavioral2/files/0x000700000002340a-22.dat	xmrig
behavioral2/memory/740-24-0x00007FF7381B0000-0x00007FF738504000-memory.dmp	xmrig
behavioral2/files/0x000700000002340b-28.dat	xmrig
behavioral2/files/0x000700000002340c-41.dat	xmrig
behavioral2/files/0x000700000002340d-40.dat	xmrig
behavioral2/memory/3364-44-0x00007FF7C5700000-0x00007FF7C5A54000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-47.dat	xmrig
behavioral2/files/0x000700000002340f-53.dat	xmrig
behavioral2/files/0x0008000000023405-58.dat	xmrig
behavioral2/memory/2820-62-0x00007FF764000000-0x00007FF764354000-memory.dmp	xmrig
behavioral2/memory/4392-61-0x00007FF6D5650000-0x00007FF6D59A4000-memory.dmp	xmrig
behavioral2/memory/3664-50-0x00007FF7FF8F0000-0x00007FF7FFC44000-memory.dmp	xmrig
behavioral2/memory/4888-38-0x00007FF74D970000-0x00007FF74DCC4000-memory.dmp	xmrig
behavioral2/memory/2116-32-0x00007FF66A950000-0x00007FF66ACA4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023410-65.dat	xmrig
behavioral2/memory/2824-71-0x00007FF6872A0000-0x00007FF6875F4000-memory.dmp	xmrig
behavioral2/files/0x000500000002296a-72.dat	xmrig
behavioral2/files/0x000d000000023368-79.dat	xmrig
behavioral2/memory/2720-77-0x00007FF7CEC50000-0x00007FF7CEFA4000-memory.dmp	xmrig
behavioral2/memory/2876-66-0x00007FF7190D0000-0x00007FF719424000-memory.dmp	xmrig
behavioral2/memory/3540-81-0x00007FF644E90000-0x00007FF6451E4000-memory.dmp	xmrig
behavioral2/files/0x000d000000023369-85.dat	xmrig
behavioral2/memory/2864-84-0x00007FF7EDD20000-0x00007FF7EE074000-memory.dmp	xmrig
behavioral2/memory/1252-86-0x00007FF61F800000-0x00007FF61FB54000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-92.dat	xmrig
behavioral2/memory/740-95-0x00007FF7381B0000-0x00007FF738504000-memory.dmp	xmrig
behavioral2/memory/1420-91-0x00007FF71F130000-0x00007FF71F484000-memory.dmp	xmrig
behavioral2/memory/1708-96-0x00007FF692100000-0x00007FF692454000-memory.dmp	xmrig
behavioral2/memory/4888-102-0x00007FF74D970000-0x00007FF74DCC4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023413-105.dat	xmrig
behavioral2/memory/3364-111-0x00007FF7C5700000-0x00007FF7C5A54000-memory.dmp	xmrig
behavioral2/memory/2288-116-0x00007FF761030000-0x00007FF761384000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-120.dat	xmrig
behavioral2/files/0x0007000000023415-122.dat	xmrig
behavioral2/memory/3052-119-0x00007FF721350000-0x00007FF7216A4000-memory.dmp	xmrig
behavioral2/memory/3664-118-0x00007FF7FF8F0000-0x00007FF7FFC44000-memory.dmp	xmrig
behavioral2/memory/1544-110-0x00007FF699850000-0x00007FF699BA4000-memory.dmp	xmrig
behavioral2/memory/2284-108-0x00007FF730070000-0x00007FF7303C4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023412-99.dat	xmrig
behavioral2/files/0x0007000000023416-127.dat	xmrig
behavioral2/memory/4416-130-0x00007FF664810000-0x00007FF664B64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023417-133.dat	xmrig
behavioral2/memory/2824-129-0x00007FF6872A0000-0x00007FF6875F4000-memory.dmp	xmrig
behavioral2/memory/2260-135-0x00007FF61D070000-0x00007FF61D3C4000-memory.dmp	xmrig
behavioral2/memory/1420-136-0x00007FF71F130000-0x00007FF71F484000-memory.dmp	xmrig
behavioral2/memory/2284-137-0x00007FF730070000-0x00007FF7303C4000-memory.dmp	xmrig
behavioral2/memory/1544-138-0x00007FF699850000-0x00007FF699BA4000-memory.dmp	xmrig
behavioral2/memory/2288-139-0x00007FF761030000-0x00007FF761384000-memory.dmp	xmrig
behavioral2/memory/3052-140-0x00007FF721350000-0x00007FF7216A4000-memory.dmp	xmrig
behavioral2/memory/2324-141-0x00007FF6A56D0000-0x00007FF6A5A24000-memory.dmp	xmrig
behavioral2/memory/3540-142-0x00007FF644E90000-0x00007FF6451E4000-memory.dmp	xmrig
behavioral2/memory/1252-143-0x00007FF61F800000-0x00007FF61FB54000-memory.dmp	xmrig
behavioral2/memory/740-144-0x00007FF7381B0000-0x00007FF738504000-memory.dmp	xmrig
behavioral2/memory/2116-145-0x00007FF66A950000-0x00007FF66ACA4000-memory.dmp	xmrig
behavioral2/memory/3364-146-0x00007FF7C5700000-0x00007FF7C5A54000-memory.dmp	xmrig
behavioral2/memory/4888-147-0x00007FF74D970000-0x00007FF74DCC4000-memory.dmp	xmrig
behavioral2/memory/3664-148-0x00007FF7FF8F0000-0x00007FF7FFC44000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2324	aRNuwaQ.exe
3540	KqjYtuy.exe
1252	DjlqpGw.exe
740	WXspCcE.exe
2116	dqxVWBH.exe
4888	WcRbONI.exe
3364	TKTZfdx.exe
3664	pnEJxfU.exe
4392	ezuanop.exe
2820	paefCKr.exe
2824	tkOtEif.exe
2720	EjfUuMu.exe
2864	FjJVypw.exe
1420	RnzEYgu.exe
1708	FonndLJ.exe
2284	dyIKdqY.exe
1544	WbUXkNP.exe
2288	kKmDLei.exe
3052	OrkObpr.exe
4416	LdxlJBe.exe
2260	ErCKrOT.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2876-0-0x00007FF7190D0000-0x00007FF719424000-memory.dmp	upx
behavioral2/files/0x0007000000023288-4.dat	upx
behavioral2/memory/2324-8-0x00007FF6A56D0000-0x00007FF6A5A24000-memory.dmp	upx
behavioral2/files/0x0008000000023404-11.dat	upx
behavioral2/files/0x0007000000023408-10.dat	upx
behavioral2/memory/3540-14-0x00007FF644E90000-0x00007FF6451E4000-memory.dmp	upx
behavioral2/memory/1252-20-0x00007FF61F800000-0x00007FF61FB54000-memory.dmp	upx
behavioral2/files/0x000700000002340a-22.dat	upx
behavioral2/memory/740-24-0x00007FF7381B0000-0x00007FF738504000-memory.dmp	upx
behavioral2/files/0x000700000002340b-28.dat	upx
behavioral2/files/0x000700000002340c-41.dat	upx
behavioral2/files/0x000700000002340d-40.dat	upx
behavioral2/memory/3364-44-0x00007FF7C5700000-0x00007FF7C5A54000-memory.dmp	upx
behavioral2/files/0x000700000002340e-47.dat	upx
behavioral2/files/0x000700000002340f-53.dat	upx
behavioral2/files/0x0008000000023405-58.dat	upx
behavioral2/memory/2820-62-0x00007FF764000000-0x00007FF764354000-memory.dmp	upx
behavioral2/memory/4392-61-0x00007FF6D5650000-0x00007FF6D59A4000-memory.dmp	upx
behavioral2/memory/3664-50-0x00007FF7FF8F0000-0x00007FF7FFC44000-memory.dmp	upx
behavioral2/memory/4888-38-0x00007FF74D970000-0x00007FF74DCC4000-memory.dmp	upx
behavioral2/memory/2116-32-0x00007FF66A950000-0x00007FF66ACA4000-memory.dmp	upx
behavioral2/files/0x0007000000023410-65.dat	upx
behavioral2/memory/2824-71-0x00007FF6872A0000-0x00007FF6875F4000-memory.dmp	upx
behavioral2/files/0x000500000002296a-72.dat	upx
behavioral2/files/0x000d000000023368-79.dat	upx
behavioral2/memory/2720-77-0x00007FF7CEC50000-0x00007FF7CEFA4000-memory.dmp	upx
behavioral2/memory/2876-66-0x00007FF7190D0000-0x00007FF719424000-memory.dmp	upx
behavioral2/memory/3540-81-0x00007FF644E90000-0x00007FF6451E4000-memory.dmp	upx
behavioral2/files/0x000d000000023369-85.dat	upx
behavioral2/memory/2864-84-0x00007FF7EDD20000-0x00007FF7EE074000-memory.dmp	upx
behavioral2/memory/1252-86-0x00007FF61F800000-0x00007FF61FB54000-memory.dmp	upx
behavioral2/files/0x0007000000023411-92.dat	upx
behavioral2/memory/740-95-0x00007FF7381B0000-0x00007FF738504000-memory.dmp	upx
behavioral2/memory/1420-91-0x00007FF71F130000-0x00007FF71F484000-memory.dmp	upx
behavioral2/memory/1708-96-0x00007FF692100000-0x00007FF692454000-memory.dmp	upx
behavioral2/memory/4888-102-0x00007FF74D970000-0x00007FF74DCC4000-memory.dmp	upx
behavioral2/files/0x0007000000023413-105.dat	upx
behavioral2/memory/3364-111-0x00007FF7C5700000-0x00007FF7C5A54000-memory.dmp	upx
behavioral2/memory/2288-116-0x00007FF761030000-0x00007FF761384000-memory.dmp	upx
behavioral2/files/0x0007000000023414-120.dat	upx
behavioral2/files/0x0007000000023415-122.dat	upx
behavioral2/memory/3052-119-0x00007FF721350000-0x00007FF7216A4000-memory.dmp	upx
behavioral2/memory/3664-118-0x00007FF7FF8F0000-0x00007FF7FFC44000-memory.dmp	upx
behavioral2/memory/1544-110-0x00007FF699850000-0x00007FF699BA4000-memory.dmp	upx
behavioral2/memory/2284-108-0x00007FF730070000-0x00007FF7303C4000-memory.dmp	upx
behavioral2/files/0x0007000000023412-99.dat	upx
behavioral2/files/0x0007000000023416-127.dat	upx
behavioral2/memory/4416-130-0x00007FF664810000-0x00007FF664B64000-memory.dmp	upx
behavioral2/files/0x0007000000023417-133.dat	upx
behavioral2/memory/2824-129-0x00007FF6872A0000-0x00007FF6875F4000-memory.dmp	upx
behavioral2/memory/2260-135-0x00007FF61D070000-0x00007FF61D3C4000-memory.dmp	upx
behavioral2/memory/1420-136-0x00007FF71F130000-0x00007FF71F484000-memory.dmp	upx
behavioral2/memory/2284-137-0x00007FF730070000-0x00007FF7303C4000-memory.dmp	upx
behavioral2/memory/1544-138-0x00007FF699850000-0x00007FF699BA4000-memory.dmp	upx
behavioral2/memory/2288-139-0x00007FF761030000-0x00007FF761384000-memory.dmp	upx
behavioral2/memory/3052-140-0x00007FF721350000-0x00007FF7216A4000-memory.dmp	upx
behavioral2/memory/2324-141-0x00007FF6A56D0000-0x00007FF6A5A24000-memory.dmp	upx
behavioral2/memory/3540-142-0x00007FF644E90000-0x00007FF6451E4000-memory.dmp	upx
behavioral2/memory/1252-143-0x00007FF61F800000-0x00007FF61FB54000-memory.dmp	upx
behavioral2/memory/740-144-0x00007FF7381B0000-0x00007FF738504000-memory.dmp	upx
behavioral2/memory/2116-145-0x00007FF66A950000-0x00007FF66ACA4000-memory.dmp	upx
behavioral2/memory/3364-146-0x00007FF7C5700000-0x00007FF7C5A54000-memory.dmp	upx
behavioral2/memory/4888-147-0x00007FF74D970000-0x00007FF74DCC4000-memory.dmp	upx
behavioral2/memory/3664-148-0x00007FF7FF8F0000-0x00007FF7FFC44000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\paefCKr.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WbUXkNP.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OrkObpr.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ErCKrOT.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EjfUuMu.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LdxlJBe.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aRNuwaQ.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dqxVWBH.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WcRbONI.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TKTZfdx.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pnEJxfU.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ezuanop.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tkOtEif.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FjJVypw.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FonndLJ.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dyIKdqY.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KqjYtuy.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DjlqpGw.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WXspCcE.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RnzEYgu.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kKmDLei.exe	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2324	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	83
PID 2876 wrote to memory of 2324	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	83
PID 2876 wrote to memory of 3540	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	84
PID 2876 wrote to memory of 3540	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	84
PID 2876 wrote to memory of 1252	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	87
PID 2876 wrote to memory of 1252	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	87
PID 2876 wrote to memory of 740	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	89
PID 2876 wrote to memory of 740	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	89
PID 2876 wrote to memory of 2116	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	90
PID 2876 wrote to memory of 2116	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	90
PID 2876 wrote to memory of 4888	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	91
PID 2876 wrote to memory of 4888	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	91
PID 2876 wrote to memory of 3364	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	92
PID 2876 wrote to memory of 3364	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	92
PID 2876 wrote to memory of 3664	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	93
PID 2876 wrote to memory of 3664	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	93
PID 2876 wrote to memory of 4392	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	94
PID 2876 wrote to memory of 4392	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	94
PID 2876 wrote to memory of 2820	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	95
PID 2876 wrote to memory of 2820	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	95
PID 2876 wrote to memory of 2824	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	96
PID 2876 wrote to memory of 2824	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	96
PID 2876 wrote to memory of 2720	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	97
PID 2876 wrote to memory of 2720	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	97
PID 2876 wrote to memory of 2864	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	98
PID 2876 wrote to memory of 2864	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	98
PID 2876 wrote to memory of 1420	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	99
PID 2876 wrote to memory of 1420	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	99
PID 2876 wrote to memory of 1708	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	100
PID 2876 wrote to memory of 1708	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	100
PID 2876 wrote to memory of 2284	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	101
PID 2876 wrote to memory of 2284	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	101
PID 2876 wrote to memory of 1544	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	102
PID 2876 wrote to memory of 1544	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	102
PID 2876 wrote to memory of 2288	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	103
PID 2876 wrote to memory of 2288	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	103
PID 2876 wrote to memory of 3052	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	104
PID 2876 wrote to memory of 3052	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	104
PID 2876 wrote to memory of 4416	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	105
PID 2876 wrote to memory of 4416	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	105
PID 2876 wrote to memory of 2260	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	108
PID 2876 wrote to memory of 2260	2876	2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe	108

C:\Users\Admin\AppData\Local\Temp\2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-30_e461de92bc44d32731907d97ca946c5a_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\System\aRNuwaQ.exe
  C:\Windows\System\aRNuwaQ.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\KqjYtuy.exe
  C:\Windows\System\KqjYtuy.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\DjlqpGw.exe
  C:\Windows\System\DjlqpGw.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\WXspCcE.exe
  C:\Windows\System\WXspCcE.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\dqxVWBH.exe
  C:\Windows\System\dqxVWBH.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\WcRbONI.exe
  C:\Windows\System\WcRbONI.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\TKTZfdx.exe
  C:\Windows\System\TKTZfdx.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\pnEJxfU.exe
  C:\Windows\System\pnEJxfU.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\ezuanop.exe
  C:\Windows\System\ezuanop.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\paefCKr.exe
  C:\Windows\System\paefCKr.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\tkOtEif.exe
  C:\Windows\System\tkOtEif.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\EjfUuMu.exe
  C:\Windows\System\EjfUuMu.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\FjJVypw.exe
  C:\Windows\System\FjJVypw.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\RnzEYgu.exe
  C:\Windows\System\RnzEYgu.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\FonndLJ.exe
  C:\Windows\System\FonndLJ.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\dyIKdqY.exe
  C:\Windows\System\dyIKdqY.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\WbUXkNP.exe
  C:\Windows\System\WbUXkNP.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\kKmDLei.exe
  C:\Windows\System\kKmDLei.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\OrkObpr.exe
  C:\Windows\System\OrkObpr.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\LdxlJBe.exe
  C:\Windows\System\LdxlJBe.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\ErCKrOT.exe
  C:\Windows\System\ErCKrOT.exe
  2⤵
  - Executes dropped EXE
  PID:2260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DjlqpGw.exe

Path C:\Windows\System\DjlqpGw.exe
Size 5.9MB
SHA256 02ea93975bfa458a1ea2df18b305b05cf6cfefd02c273e942e5d5209e718e005
MD5 53b3288bae5442216bcb6221809025cb
SHA1 80f0e758d1249ec5f1509958a78883e6ec4f870c
SHA512 8d7b810f2380b0c53880f8daf1442c42420f219c767d3acd0ef403edf15e69fee9e32737fb60a8cd088d44dcc7548f727f56c891a150e01987a74399f190c63a
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:T+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

EjfUuMu.exe

Path C:\Windows\System\EjfUuMu.exe
Size 5.9MB
SHA256 8848ac8753c8abd5255c8f8484842cfc396065d07050103a20cd2dcabbadce1c
MD5 829f79c17bd64ec9123d38b6b2ba81e3
SHA1 91cf1a390c74d023b59d45dc850acec19a46c738
SHA512 3234173a710ea761c44403db2bc4cbf2d2a4f84aa0a8816022121c79fc4e4f575165cccf0c0bb5e83e1cecf076b0e70aa35153becbdcd967cdf13bb2a5d128a4
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:T+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

ErCKrOT.exe

Path C:\Windows\System\ErCKrOT.exe
Size 5.9MB
SHA256 476956f6157b21e69482c804b97033c74274ae230163048022f930019072d201
MD5 cee67059a7ca6c1775c749e9a8710842
SHA1 5d29f17fa302f7171a03854bcfd3840a7906636b
SHA512 870f25ac32ad3c89bedd504ef321c4be875ebe0c6bc0d144b6eb4aeb480ef04270345c2751b036b7cb401c1d3d2fddda933fdfce2c708c15d61548a077a979d8
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:T+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

FjJVypw.exe

Path C:\Windows\System\FjJVypw.exe
Size 5.9MB
SHA256 737db0be91cace811814f9d313b859be6b2580a582b2805629cf35448a41fbb1
MD5 a731f181574cba70c09b730d3abd8050
SHA1 c95de02b996e7e461c5c3416c6a35cdf6ca53700
SHA512 3e82978ffbdd0c741e5e700435a9bb07e05ed37692060bc22ca6fc127d9e234dfd273935aa5ec6d42e75128337850bb933bdb6f7e621f6e4a9202533783c2998
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:T+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

FonndLJ.exe

Path C:\Windows\System\FonndLJ.exe
Size 5.9MB
SHA256 4d3ec8c80db634966b0530dfbe4df683491db7015515fa0c59154e2c9bb99b32
MD5 be3a7d0adaa67ced636558354391c91b
SHA1 c2a9fccbf14e9760ccb1ebd1aa36708725207d41
SHA512 fe01be61fdedbd94680d81557189fbbdfebdb72989aa47c96e6efc84175bd29d3991490f0776c36e922352ca2ce1d8293d0d5a7365152a77445425de575566e0
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:T+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

KqjYtuy.exe

Path C:\Windows\System\KqjYtuy.exe
Size 5.9MB
SHA256 9508ebc123bccd72ccdfa81eeb4896d0bb1dcc6d45215ae1657b6c1c4b5d8324
MD5 f3607dcf48dda32d5c5dbdc4a0cc33c0
SHA1 4ec0a2413b1d69a725ebce3aab1c6f2e0c22aac9
SHA512 1894efee5d07768815aa62971be81904b35ddee85af8ae19378d5f409b0aece15339f84a01b44de5b5028560a2b711e02b4a8afb1448824f85c026537894dac4
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:T+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

LdxlJBe.exe

Path C:\Windows\System\LdxlJBe.exe
Size 5.9MB
SHA256 ae778db90391d8ff3ae1f9cc795b1db8c31dc309dda97c481143636f5324f89e
MD5 e009995c71db3924f41df3454eb22f08
SHA1 cec95947f2859b016fddcef2786cb9c60ff424c7
SHA512 2305098e9bb8e9ec9cc750354632f217550761200d75749fad0fe9aff05d3220c42037e9a1a82f2591ee33be1d3f8d49a8e87080d9728e89435ed5c4834773cc
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:T+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

OrkObpr.exe

Path C:\Windows\System\OrkObpr.exe
Size 5.9MB
SHA256 3822b59195e0ea94df5bbfa128ff35c20f188634182d3bcea58f0069bacb3de5
MD5 9ad2d71d9c721c7682a7a088d6274417
SHA1 cbf661af941bb6e11ee54d3c8e39a18b5c43771a
SHA512 f794bacb444c958018460963ad8fedaeedfc49e742a499cd326ee5d652fcf3795800f698509b65c3aa003f678eeb3ce90fd3c011412eb3eb06c9e724cd550a31
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:T+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

RnzEYgu.exe

Path C:\Windows\System\RnzEYgu.exe
Size 5.9MB
SHA256 a84dfb44e167d11dec64fea13cb5b43c88ea801bc6544ddf712d6d891a1946a7
MD5 2f0e02b1a123440176dc1b6620d26d30
SHA1 5f90a208dc2daddfa8e7b6615a6dffa924803a6d
SHA512 175f8e65afde34d8e66d5c27a14a7aca1b7e88f1b47ef1c49e790c50e5905a3b874374b9a56fb2fd527e15c81d1ba09720d1c0ef5214f63ada309791d913b5e4
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:T+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

TKTZfdx.exe

Path C:\Windows\System\TKTZfdx.exe
Size 5.9MB
SHA256 97a94b85093c67beaa4ab69747a87113a570a7ff559852c338086f2fe6c3f50a
MD5 de6a2018cb1f8188b4563a06cfe31578
SHA1 27d941405030239fa9e1c99facf0e5595f4767ca
SHA512 586247e2153d1a77161d96a39f0d44b3c2b0f53c5bb0b719f1b40be025e1c5bcebbd3c66fd1f1627949d37c11cf96faa4fc29591f7bdce36caf458cf1da7e492
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:T+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

WXspCcE.exe

Path C:\Windows\System\WXspCcE.exe
Size 5.9MB
SHA256 48bdca9d0047da000cc7012b21fe6fd86362e1983dd63fb067c231d977dcdd94
MD5 9b05220a9bc60c949378a396ceca508f
SHA1 34fe11812ca58bb01433a4522b39bd2b3b6479e3
SHA512 55620e76eca29ca6782473fa25e64e11063a9f86cee7108a5697673553a1632425de9862b03614b6cb03d8bf06d5c1b38ee9d7c7fe90c1b04f780c6f9a8082ca
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:T+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

WbUXkNP.exe

Path C:\Windows\System\WbUXkNP.exe
Size 5.9MB
SHA256 9e72a4024dc20cb77fa45ead67e1f237a88f4b9833142caa28abe9bdd029cc98
MD5 d67a31264c6e619f59f7ec6cd487d835
SHA1 d99cd6db5ff5703a8e6940339cbe42b1aecb85a4
SHA512 a87ec5bb15f89fa7981f68b123c5d174d8c1c796f1622834417fdb63ca639ae5861628279d59effa22bb2c876921bac103a3109b61c0ffee66a26a92b36912b1
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:T+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

WcRbONI.exe

Path C:\Windows\System\WcRbONI.exe
Size 5.9MB
SHA256 4ea9dab51b9bcab1e2593e023ed8cac7817228c668f6be896e58cf979267bd90
MD5 8de1a19a8669ad553dba4d9e529cfea8
SHA1 8a80a0869a836cf8be1579a55a5a9a76854e536e
SHA512 eb657cc59d733440d68a093627e1dace5af80113c0491f07592e61eb017cce165dbadb51a420bbedeaba334db87e89c2ddc6808a5b61401ac5140e78a7badff7
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:T+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

aRNuwaQ.exe

Path C:\Windows\System\aRNuwaQ.exe
Size 5.9MB
SHA256 2b11364b3e583e01ff2339826966d4df47c78ada122e7114bcd360e93d787ed8
MD5 73bd91c5b16a41a459cea2b2eb4519f8
SHA1 e4de5acdfe10cc26d60f8b963330c016b76565d0
SHA512 1844f132264b4c9ec291f943bd447442c8da0fd3ee4ecd4552c98a827c85afe19097a2bb8835a7791c15ae36eb69fa82b4f98152129fda0c36db0eb38e78c37b
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:T+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

dqxVWBH.exe

Path C:\Windows\System\dqxVWBH.exe
Size 5.9MB
SHA256 ce8c97d9a3fa524f1ce8325c9d772eec2ccf778820cc37a9411fbaeb8bb4f2d1
MD5 6e02b102fc22c07d4cf349610628eaa0
SHA1 16ac60f52a6aa721f54e1cdd21a09b294a7aff5d
SHA512 cf7d265e6cd5a92f356161b4516b53808d850792cec25e8a83d2eb268e11e4d01b092111592a677590a1e3cada89a3bf9384a62c0cb97c55795ec297edb2bd9c
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:T+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

dyIKdqY.exe

Path C:\Windows\System\dyIKdqY.exe
Size 5.9MB
SHA256 c118b1e4666f83a0ab613e5b2290c13cfe75708db6423104153f1f41495d0d33
MD5 2f4de081bb9b50e9f3f8e496e350bacf
SHA1 30fcc3c6e7bef74c1cbc235ca9726bdfe1a2c123
SHA512 1590f9c6a8431dc5fe05598b9debd64076a386a3aa47c3dd0c4fa06cb89aa4f225b7d08f1f427577cf3a4e9f7d9d723a7f757cb722f92c63937a77900457c91d
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:T+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

ezuanop.exe

Path C:\Windows\System\ezuanop.exe
Size 5.9MB
SHA256 ae448f975a148afcd7ecb25e4239b3edcd117678e16db9994d684d96210a7c83
MD5 4a69b145eda4c915b3409afb83bd0495
SHA1 b82ebb16fdcdfbe806bdce1264823d60fe81cc1a
SHA512 785a42d718dfcbb840797be5875d9f509e840f271970f69443109e9753d1cee7433f625d78db04a7f6d1a0883c54f81f516dbc560394b04b2f479123cf1d911a
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:T+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

kKmDLei.exe

Path C:\Windows\System\kKmDLei.exe
Size 5.9MB
SHA256 c879d79d31129895ac9764b1e2227ae75092cd83229542df4070a00858c2c8ea
MD5 0139a1301670a1655da053f934938baa
SHA1 3dacb469c68af823e6cb719134eecc8cde16dcec
SHA512 fe26f9d0b6ba9179b527e13537ac0edf421bc98baecfc831d75fe8fc9cd1d7671c9fd4aac0ef018ce329da2698a6e11a83aebd7773f463cd46eb92aaefc2c336
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:T+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

paefCKr.exe

Path C:\Windows\System\paefCKr.exe
Size 5.9MB
SHA256 547fb181f295fb6d2bca0b85e440ab2a16662df0c94ed0f4f002fd58c21b99d6
MD5 476d48fbe4819f918a1ddaac09c93145
SHA1 3ea3d87724bbf785f78fec390be6a3df77d531f2
SHA512 b279af3b5981f284e0dfabe042534a7cfd4de3e776f0e6850ffad4a5f0e87698b1e8704536ad4d50426afc496c217d663427171726076bbe023e9b1b1e0a6014
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:T+856utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

pnEJxfU.exe

Path C:\Windows\System\pnEJxfU.exe
Size 5.9MB
SHA256 108d29cfad18aff837037f93b07ef99d8ffb0595a60917aa624477c860f2489c
MD5 b55d4b42425a3fd9e8472562f4222ae5
SHA1 c8f04076ce1d45caf1e09f01952047e5078b8cbc
SHA512 ff3e96a6c0120ee2b21ea94f1a4673e67a8a7ce8ec5ac3fd30e8eb215bf27cfc6fb1cb6b0f3b94d6fcc22488400c1f8e302b8a456f60d18e6e1828573cd1c5f4
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:T+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

tkOtEif.exe

Path C:\Windows\System\tkOtEif.exe
Size 5.9MB
SHA256 0596774f3924dcc5654c4dd763370b0b2c2534de57c179a42e1d9e34074f25c9
MD5 3ee9febd0ef697f730180cb11192f71c
SHA1 274a88119e795c52ffc01c997fccdb8648a584bf
SHA512 501d14f614becb93f6b5287d134a016d056fede1caa6027f47b28ff3a10fd87eb9f6c78739df27371d5688428eca081edc330e934ca9aff69478f62c155ad0c8
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:T+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/740-95-0x00007FF7381B0000-0x00007FF738504000-memory.dmp

Download

memory/740-24-0x00007FF7381B0000-0x00007FF738504000-memory.dmp

Download

memory/740-144-0x00007FF7381B0000-0x00007FF738504000-memory.dmp

Download

memory/1252-86-0x00007FF61F800000-0x00007FF61FB54000-memory.dmp

Download

memory/1252-20-0x00007FF61F800000-0x00007FF61FB54000-memory.dmp

Download

memory/1252-143-0x00007FF61F800000-0x00007FF61FB54000-memory.dmp

Download

memory/1420-154-0x00007FF71F130000-0x00007FF71F484000-memory.dmp

Download

memory/1420-91-0x00007FF71F130000-0x00007FF71F484000-memory.dmp

Download

memory/1420-136-0x00007FF71F130000-0x00007FF71F484000-memory.dmp

Download

memory/1544-157-0x00007FF699850000-0x00007FF699BA4000-memory.dmp

Download

memory/1544-138-0x00007FF699850000-0x00007FF699BA4000-memory.dmp

Download

memory/1544-110-0x00007FF699850000-0x00007FF699BA4000-memory.dmp

Download

memory/1708-155-0x00007FF692100000-0x00007FF692454000-memory.dmp

Download

memory/1708-96-0x00007FF692100000-0x00007FF692454000-memory.dmp

Download

memory/2116-145-0x00007FF66A950000-0x00007FF66ACA4000-memory.dmp

Download

memory/2116-32-0x00007FF66A950000-0x00007FF66ACA4000-memory.dmp

Download

memory/2260-161-0x00007FF61D070000-0x00007FF61D3C4000-memory.dmp

Download

memory/2260-135-0x00007FF61D070000-0x00007FF61D3C4000-memory.dmp

Download

memory/2284-156-0x00007FF730070000-0x00007FF7303C4000-memory.dmp

Download

memory/2284-108-0x00007FF730070000-0x00007FF7303C4000-memory.dmp

Download

memory/2284-137-0x00007FF730070000-0x00007FF7303C4000-memory.dmp

Download

memory/2288-116-0x00007FF761030000-0x00007FF761384000-memory.dmp

Download

memory/2288-158-0x00007FF761030000-0x00007FF761384000-memory.dmp

Download

memory/2288-139-0x00007FF761030000-0x00007FF761384000-memory.dmp

Download

memory/2324-8-0x00007FF6A56D0000-0x00007FF6A5A24000-memory.dmp

Download

memory/2324-141-0x00007FF6A56D0000-0x00007FF6A5A24000-memory.dmp

Download

memory/2720-77-0x00007FF7CEC50000-0x00007FF7CEFA4000-memory.dmp

Download

memory/2720-151-0x00007FF7CEC50000-0x00007FF7CEFA4000-memory.dmp

Download

memory/2820-62-0x00007FF764000000-0x00007FF764354000-memory.dmp

Download

memory/2820-150-0x00007FF764000000-0x00007FF764354000-memory.dmp

Download

memory/2824-129-0x00007FF6872A0000-0x00007FF6875F4000-memory.dmp

Download

memory/2824-152-0x00007FF6872A0000-0x00007FF6875F4000-memory.dmp

Download

memory/2824-71-0x00007FF6872A0000-0x00007FF6875F4000-memory.dmp

Download

memory/2864-153-0x00007FF7EDD20000-0x00007FF7EE074000-memory.dmp

Download

memory/2864-84-0x00007FF7EDD20000-0x00007FF7EE074000-memory.dmp

Download

memory/2876-0-0x00007FF7190D0000-0x00007FF719424000-memory.dmp

Download

memory/2876-66-0x00007FF7190D0000-0x00007FF719424000-memory.dmp

Download

memory/2876-1-0x000001ECB78B0000-0x000001ECB78C0000-memory.dmp

Download

memory/3052-140-0x00007FF721350000-0x00007FF7216A4000-memory.dmp

Download

memory/3052-159-0x00007FF721350000-0x00007FF7216A4000-memory.dmp

Download

memory/3052-119-0x00007FF721350000-0x00007FF7216A4000-memory.dmp

Download

memory/3364-111-0x00007FF7C5700000-0x00007FF7C5A54000-memory.dmp

Download

memory/3364-146-0x00007FF7C5700000-0x00007FF7C5A54000-memory.dmp

Download

memory/3364-44-0x00007FF7C5700000-0x00007FF7C5A54000-memory.dmp

Download

memory/3540-14-0x00007FF644E90000-0x00007FF6451E4000-memory.dmp

Download

memory/3540-142-0x00007FF644E90000-0x00007FF6451E4000-memory.dmp

Download

memory/3540-81-0x00007FF644E90000-0x00007FF6451E4000-memory.dmp

Download

memory/3664-148-0x00007FF7FF8F0000-0x00007FF7FFC44000-memory.dmp

Download

memory/3664-118-0x00007FF7FF8F0000-0x00007FF7FFC44000-memory.dmp

Download

memory/3664-50-0x00007FF7FF8F0000-0x00007FF7FFC44000-memory.dmp

Download

memory/4392-61-0x00007FF6D5650000-0x00007FF6D59A4000-memory.dmp

Download

memory/4392-149-0x00007FF6D5650000-0x00007FF6D59A4000-memory.dmp

Download

memory/4416-160-0x00007FF664810000-0x00007FF664B64000-memory.dmp

Download

memory/4416-130-0x00007FF664810000-0x00007FF664B64000-memory.dmp

Download

memory/4888-102-0x00007FF74D970000-0x00007FF74DCC4000-memory.dmp

Download

memory/4888-38-0x00007FF74D970000-0x00007FF74DCC4000-memory.dmp

Download

memory/4888-147-0x00007FF74D970000-0x00007FF74DCC4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads