cobaltstrike | d02bfbe765facb7a30f2f1c0df67bbe126d11de8d8ba2d3bc4b1d61b7bf98052

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240530-xe3tqagb2s
SHA256 d02bfbe765facb7a30f2f1c0df67bbe126d11de8d8ba2d3bc4b1d61b7bf98052
MD5 075ee725de6568559dcee3baa404ae15
SHA1 6fd3b3c262f86b22831b0b0344928929b6c8b4a9
SHA512 ef620da6196dff189933c58db32eaac0167893d8101a28e38a7aa5e61e407ae8386125e1739b26cb016683057531e5c73421dd1f3670659e2124850662c80449
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:T+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0007000000023276-5.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341a-9.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341b-8.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341c-22.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341d-24.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341e-31.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023420-44.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023423-60.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023427-86.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023417-88.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023429-99.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342a-108.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342b-110.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023428-103.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023424-80.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023426-76.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023425-73.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023422-56.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023421-52.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341f-39.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342c-124.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023276-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341a-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341b-8.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341c-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341d-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341e-31.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023420-44.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023423-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023427-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023417-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023429-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342a-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342b-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023428-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023424-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023426-76.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023425-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023422-56.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023421-52.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341f-39.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342c-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/5000-0-0x00007FF6952B0000-0x00007FF695604000-memory.dmp	UPX
behavioral2/files/0x0007000000023276-5.dat	UPX
behavioral2/files/0x000700000002341a-9.dat	UPX
behavioral2/files/0x000700000002341b-8.dat	UPX
behavioral2/files/0x000700000002341c-22.dat	UPX
behavioral2/files/0x000700000002341d-24.dat	UPX
behavioral2/files/0x000700000002341e-31.dat	UPX
behavioral2/files/0x0007000000023420-44.dat	UPX
behavioral2/files/0x0007000000023423-60.dat	UPX
behavioral2/files/0x0007000000023427-86.dat	UPX
behavioral2/files/0x0008000000023417-88.dat	UPX
behavioral2/files/0x0007000000023429-99.dat	UPX
behavioral2/files/0x000700000002342a-108.dat	UPX
behavioral2/memory/2944-113-0x00007FF65C820000-0x00007FF65CB74000-memory.dmp	UPX
behavioral2/memory/964-117-0x00007FF73D530000-0x00007FF73D884000-memory.dmp	UPX
behavioral2/memory/2376-120-0x00007FF7FC350000-0x00007FF7FC6A4000-memory.dmp	UPX
behavioral2/memory/208-121-0x00007FF6BC4B0000-0x00007FF6BC804000-memory.dmp	UPX
behavioral2/memory/1568-119-0x00007FF7288A0000-0x00007FF728BF4000-memory.dmp	UPX
behavioral2/memory/1084-118-0x00007FF623A70000-0x00007FF623DC4000-memory.dmp	UPX
behavioral2/memory/980-116-0x00007FF718380000-0x00007FF7186D4000-memory.dmp	UPX
behavioral2/memory/1516-115-0x00007FF7846E0000-0x00007FF784A34000-memory.dmp	UPX
behavioral2/memory/2204-114-0x00007FF614C10000-0x00007FF614F64000-memory.dmp	UPX
behavioral2/memory/4308-112-0x00007FF7D3550000-0x00007FF7D38A4000-memory.dmp	UPX
behavioral2/files/0x000700000002342b-110.dat	UPX
behavioral2/memory/4744-105-0x00007FF7D7EF0000-0x00007FF7D8244000-memory.dmp	UPX
behavioral2/files/0x0007000000023428-103.dat	UPX
behavioral2/memory/2760-102-0x00007FF75C200000-0x00007FF75C554000-memory.dmp	UPX
behavioral2/memory/2428-98-0x00007FF7D5260000-0x00007FF7D55B4000-memory.dmp	UPX
behavioral2/files/0x0007000000023424-80.dat	UPX
behavioral2/memory/4948-77-0x00007FF7797D0000-0x00007FF779B24000-memory.dmp	UPX
behavioral2/files/0x0007000000023426-76.dat	UPX
behavioral2/files/0x0007000000023425-73.dat	UPX
behavioral2/memory/2304-68-0x00007FF711390000-0x00007FF7116E4000-memory.dmp	UPX
behavioral2/memory/3928-66-0x00007FF7AD1D0000-0x00007FF7AD524000-memory.dmp	UPX
behavioral2/memory/4752-62-0x00007FF66E6F0000-0x00007FF66EA44000-memory.dmp	UPX
behavioral2/files/0x0007000000023422-56.dat	UPX
behavioral2/files/0x0007000000023421-52.dat	UPX
behavioral2/files/0x000700000002341f-39.dat	UPX
behavioral2/memory/4884-32-0x00007FF683110000-0x00007FF683464000-memory.dmp	UPX
behavioral2/memory/1664-28-0x00007FF698D80000-0x00007FF6990D4000-memory.dmp	UPX
behavioral2/memory/4704-12-0x00007FF7157E0000-0x00007FF715B34000-memory.dmp	UPX
behavioral2/files/0x000700000002342c-124.dat	UPX
behavioral2/memory/2472-127-0x00007FF7D5020000-0x00007FF7D5374000-memory.dmp	UPX
behavioral2/memory/5000-128-0x00007FF6952B0000-0x00007FF695604000-memory.dmp	UPX
behavioral2/memory/4704-129-0x00007FF7157E0000-0x00007FF715B34000-memory.dmp	UPX
behavioral2/memory/4752-130-0x00007FF66E6F0000-0x00007FF66EA44000-memory.dmp	UPX
behavioral2/memory/1664-131-0x00007FF698D80000-0x00007FF6990D4000-memory.dmp	UPX
behavioral2/memory/4704-132-0x00007FF7157E0000-0x00007FF715B34000-memory.dmp	UPX
behavioral2/memory/2204-133-0x00007FF614C10000-0x00007FF614F64000-memory.dmp	UPX
behavioral2/memory/4884-134-0x00007FF683110000-0x00007FF683464000-memory.dmp	UPX
behavioral2/memory/4752-135-0x00007FF66E6F0000-0x00007FF66EA44000-memory.dmp	UPX
behavioral2/memory/980-137-0x00007FF718380000-0x00007FF7186D4000-memory.dmp	UPX
behavioral2/memory/1516-136-0x00007FF7846E0000-0x00007FF784A34000-memory.dmp	UPX
behavioral2/memory/3928-139-0x00007FF7AD1D0000-0x00007FF7AD524000-memory.dmp	UPX
behavioral2/memory/2304-138-0x00007FF711390000-0x00007FF7116E4000-memory.dmp	UPX
behavioral2/memory/4948-140-0x00007FF7797D0000-0x00007FF779B24000-memory.dmp	UPX
behavioral2/memory/964-144-0x00007FF73D530000-0x00007FF73D884000-memory.dmp	UPX
behavioral2/memory/2428-143-0x00007FF7D5260000-0x00007FF7D55B4000-memory.dmp	UPX
behavioral2/memory/1568-145-0x00007FF7288A0000-0x00007FF728BF4000-memory.dmp	UPX
behavioral2/memory/2760-142-0x00007FF75C200000-0x00007FF75C554000-memory.dmp	UPX
behavioral2/memory/1084-141-0x00007FF623A70000-0x00007FF623DC4000-memory.dmp	UPX
behavioral2/memory/4308-146-0x00007FF7D3550000-0x00007FF7D38A4000-memory.dmp	UPX
behavioral2/memory/2376-148-0x00007FF7FC350000-0x00007FF7FC6A4000-memory.dmp	UPX
behavioral2/memory/2944-150-0x00007FF65C820000-0x00007FF65CB74000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/5000-0-0x00007FF6952B0000-0x00007FF695604000-memory.dmp	xmrig
behavioral2/files/0x0007000000023276-5.dat	xmrig
behavioral2/files/0x000700000002341a-9.dat	xmrig
behavioral2/files/0x000700000002341b-8.dat	xmrig
behavioral2/files/0x000700000002341c-22.dat	xmrig
behavioral2/files/0x000700000002341d-24.dat	xmrig
behavioral2/files/0x000700000002341e-31.dat	xmrig
behavioral2/files/0x0007000000023420-44.dat	xmrig
behavioral2/files/0x0007000000023423-60.dat	xmrig
behavioral2/files/0x0007000000023427-86.dat	xmrig
behavioral2/files/0x0008000000023417-88.dat	xmrig
behavioral2/files/0x0007000000023429-99.dat	xmrig
behavioral2/files/0x000700000002342a-108.dat	xmrig
behavioral2/memory/2944-113-0x00007FF65C820000-0x00007FF65CB74000-memory.dmp	xmrig
behavioral2/memory/964-117-0x00007FF73D530000-0x00007FF73D884000-memory.dmp	xmrig
behavioral2/memory/2376-120-0x00007FF7FC350000-0x00007FF7FC6A4000-memory.dmp	xmrig
behavioral2/memory/208-121-0x00007FF6BC4B0000-0x00007FF6BC804000-memory.dmp	xmrig
behavioral2/memory/1568-119-0x00007FF7288A0000-0x00007FF728BF4000-memory.dmp	xmrig
behavioral2/memory/1084-118-0x00007FF623A70000-0x00007FF623DC4000-memory.dmp	xmrig
behavioral2/memory/980-116-0x00007FF718380000-0x00007FF7186D4000-memory.dmp	xmrig
behavioral2/memory/1516-115-0x00007FF7846E0000-0x00007FF784A34000-memory.dmp	xmrig
behavioral2/memory/2204-114-0x00007FF614C10000-0x00007FF614F64000-memory.dmp	xmrig
behavioral2/memory/4308-112-0x00007FF7D3550000-0x00007FF7D38A4000-memory.dmp	xmrig
behavioral2/files/0x000700000002342b-110.dat	xmrig
behavioral2/memory/4744-105-0x00007FF7D7EF0000-0x00007FF7D8244000-memory.dmp	xmrig
behavioral2/files/0x0007000000023428-103.dat	xmrig
behavioral2/memory/2760-102-0x00007FF75C200000-0x00007FF75C554000-memory.dmp	xmrig
behavioral2/memory/2428-98-0x00007FF7D5260000-0x00007FF7D55B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023424-80.dat	xmrig
behavioral2/memory/4948-77-0x00007FF7797D0000-0x00007FF779B24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023426-76.dat	xmrig
behavioral2/files/0x0007000000023425-73.dat	xmrig
behavioral2/memory/2304-68-0x00007FF711390000-0x00007FF7116E4000-memory.dmp	xmrig
behavioral2/memory/3928-66-0x00007FF7AD1D0000-0x00007FF7AD524000-memory.dmp	xmrig
behavioral2/memory/4752-62-0x00007FF66E6F0000-0x00007FF66EA44000-memory.dmp	xmrig
behavioral2/files/0x0007000000023422-56.dat	xmrig
behavioral2/files/0x0007000000023421-52.dat	xmrig
behavioral2/files/0x000700000002341f-39.dat	xmrig
behavioral2/memory/4884-32-0x00007FF683110000-0x00007FF683464000-memory.dmp	xmrig
behavioral2/memory/1664-28-0x00007FF698D80000-0x00007FF6990D4000-memory.dmp	xmrig
behavioral2/memory/4704-12-0x00007FF7157E0000-0x00007FF715B34000-memory.dmp	xmrig
behavioral2/files/0x000700000002342c-124.dat	xmrig
behavioral2/memory/2472-127-0x00007FF7D5020000-0x00007FF7D5374000-memory.dmp	xmrig
behavioral2/memory/5000-128-0x00007FF6952B0000-0x00007FF695604000-memory.dmp	xmrig
behavioral2/memory/4704-129-0x00007FF7157E0000-0x00007FF715B34000-memory.dmp	xmrig
behavioral2/memory/4752-130-0x00007FF66E6F0000-0x00007FF66EA44000-memory.dmp	xmrig
behavioral2/memory/1664-131-0x00007FF698D80000-0x00007FF6990D4000-memory.dmp	xmrig
behavioral2/memory/4704-132-0x00007FF7157E0000-0x00007FF715B34000-memory.dmp	xmrig
behavioral2/memory/2204-133-0x00007FF614C10000-0x00007FF614F64000-memory.dmp	xmrig
behavioral2/memory/4884-134-0x00007FF683110000-0x00007FF683464000-memory.dmp	xmrig
behavioral2/memory/4752-135-0x00007FF66E6F0000-0x00007FF66EA44000-memory.dmp	xmrig
behavioral2/memory/980-137-0x00007FF718380000-0x00007FF7186D4000-memory.dmp	xmrig
behavioral2/memory/1516-136-0x00007FF7846E0000-0x00007FF784A34000-memory.dmp	xmrig
behavioral2/memory/3928-139-0x00007FF7AD1D0000-0x00007FF7AD524000-memory.dmp	xmrig
behavioral2/memory/2304-138-0x00007FF711390000-0x00007FF7116E4000-memory.dmp	xmrig
behavioral2/memory/4948-140-0x00007FF7797D0000-0x00007FF779B24000-memory.dmp	xmrig
behavioral2/memory/964-144-0x00007FF73D530000-0x00007FF73D884000-memory.dmp	xmrig
behavioral2/memory/2428-143-0x00007FF7D5260000-0x00007FF7D55B4000-memory.dmp	xmrig
behavioral2/memory/1568-145-0x00007FF7288A0000-0x00007FF728BF4000-memory.dmp	xmrig
behavioral2/memory/2760-142-0x00007FF75C200000-0x00007FF75C554000-memory.dmp	xmrig
behavioral2/memory/1084-141-0x00007FF623A70000-0x00007FF623DC4000-memory.dmp	xmrig
behavioral2/memory/4308-146-0x00007FF7D3550000-0x00007FF7D38A4000-memory.dmp	xmrig
behavioral2/memory/2376-148-0x00007FF7FC350000-0x00007FF7FC6A4000-memory.dmp	xmrig
behavioral2/memory/2944-150-0x00007FF65C820000-0x00007FF65CB74000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4704	QRKwKUu.exe
1664	hLATDuk.exe
2204	LWrNpyk.exe
4884	wHESTqN.exe
4752	BtWIpzz.exe
1516	UQAtRUt.exe
980	KIzfbfr.exe
3928	JaZEPJl.exe
2304	bRTEGvg.exe
4948	IMtOttN.exe
2428	Qxollzj.exe
2760	zVBVSCM.exe
964	GGVNHhL.exe
1084	NDVVIGD.exe
1568	bKDUeAW.exe
4744	wJoPgqq.exe
2376	zFBJHKz.exe
208	LFuEHaw.exe
4308	mVJZEOy.exe
2944	HrFTHcc.exe
2472	RthnSwA.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5000-0-0x00007FF6952B0000-0x00007FF695604000-memory.dmp	upx
behavioral2/files/0x0007000000023276-5.dat	upx
behavioral2/files/0x000700000002341a-9.dat	upx
behavioral2/files/0x000700000002341b-8.dat	upx
behavioral2/files/0x000700000002341c-22.dat	upx
behavioral2/files/0x000700000002341d-24.dat	upx
behavioral2/files/0x000700000002341e-31.dat	upx
behavioral2/files/0x0007000000023420-44.dat	upx
behavioral2/files/0x0007000000023423-60.dat	upx
behavioral2/files/0x0007000000023427-86.dat	upx
behavioral2/files/0x0008000000023417-88.dat	upx
behavioral2/files/0x0007000000023429-99.dat	upx
behavioral2/files/0x000700000002342a-108.dat	upx
behavioral2/memory/2944-113-0x00007FF65C820000-0x00007FF65CB74000-memory.dmp	upx
behavioral2/memory/964-117-0x00007FF73D530000-0x00007FF73D884000-memory.dmp	upx
behavioral2/memory/2376-120-0x00007FF7FC350000-0x00007FF7FC6A4000-memory.dmp	upx
behavioral2/memory/208-121-0x00007FF6BC4B0000-0x00007FF6BC804000-memory.dmp	upx
behavioral2/memory/1568-119-0x00007FF7288A0000-0x00007FF728BF4000-memory.dmp	upx
behavioral2/memory/1084-118-0x00007FF623A70000-0x00007FF623DC4000-memory.dmp	upx
behavioral2/memory/980-116-0x00007FF718380000-0x00007FF7186D4000-memory.dmp	upx
behavioral2/memory/1516-115-0x00007FF7846E0000-0x00007FF784A34000-memory.dmp	upx
behavioral2/memory/2204-114-0x00007FF614C10000-0x00007FF614F64000-memory.dmp	upx
behavioral2/memory/4308-112-0x00007FF7D3550000-0x00007FF7D38A4000-memory.dmp	upx
behavioral2/files/0x000700000002342b-110.dat	upx
behavioral2/memory/4744-105-0x00007FF7D7EF0000-0x00007FF7D8244000-memory.dmp	upx
behavioral2/files/0x0007000000023428-103.dat	upx
behavioral2/memory/2760-102-0x00007FF75C200000-0x00007FF75C554000-memory.dmp	upx
behavioral2/memory/2428-98-0x00007FF7D5260000-0x00007FF7D55B4000-memory.dmp	upx
behavioral2/files/0x0007000000023424-80.dat	upx
behavioral2/memory/4948-77-0x00007FF7797D0000-0x00007FF779B24000-memory.dmp	upx
behavioral2/files/0x0007000000023426-76.dat	upx
behavioral2/files/0x0007000000023425-73.dat	upx
behavioral2/memory/2304-68-0x00007FF711390000-0x00007FF7116E4000-memory.dmp	upx
behavioral2/memory/3928-66-0x00007FF7AD1D0000-0x00007FF7AD524000-memory.dmp	upx
behavioral2/memory/4752-62-0x00007FF66E6F0000-0x00007FF66EA44000-memory.dmp	upx
behavioral2/files/0x0007000000023422-56.dat	upx
behavioral2/files/0x0007000000023421-52.dat	upx
behavioral2/files/0x000700000002341f-39.dat	upx
behavioral2/memory/4884-32-0x00007FF683110000-0x00007FF683464000-memory.dmp	upx
behavioral2/memory/1664-28-0x00007FF698D80000-0x00007FF6990D4000-memory.dmp	upx
behavioral2/memory/4704-12-0x00007FF7157E0000-0x00007FF715B34000-memory.dmp	upx
behavioral2/files/0x000700000002342c-124.dat	upx
behavioral2/memory/2472-127-0x00007FF7D5020000-0x00007FF7D5374000-memory.dmp	upx
behavioral2/memory/5000-128-0x00007FF6952B0000-0x00007FF695604000-memory.dmp	upx
behavioral2/memory/4704-129-0x00007FF7157E0000-0x00007FF715B34000-memory.dmp	upx
behavioral2/memory/4752-130-0x00007FF66E6F0000-0x00007FF66EA44000-memory.dmp	upx
behavioral2/memory/1664-131-0x00007FF698D80000-0x00007FF6990D4000-memory.dmp	upx
behavioral2/memory/4704-132-0x00007FF7157E0000-0x00007FF715B34000-memory.dmp	upx
behavioral2/memory/2204-133-0x00007FF614C10000-0x00007FF614F64000-memory.dmp	upx
behavioral2/memory/4884-134-0x00007FF683110000-0x00007FF683464000-memory.dmp	upx
behavioral2/memory/4752-135-0x00007FF66E6F0000-0x00007FF66EA44000-memory.dmp	upx
behavioral2/memory/980-137-0x00007FF718380000-0x00007FF7186D4000-memory.dmp	upx
behavioral2/memory/1516-136-0x00007FF7846E0000-0x00007FF784A34000-memory.dmp	upx
behavioral2/memory/3928-139-0x00007FF7AD1D0000-0x00007FF7AD524000-memory.dmp	upx
behavioral2/memory/2304-138-0x00007FF711390000-0x00007FF7116E4000-memory.dmp	upx
behavioral2/memory/4948-140-0x00007FF7797D0000-0x00007FF779B24000-memory.dmp	upx
behavioral2/memory/964-144-0x00007FF73D530000-0x00007FF73D884000-memory.dmp	upx
behavioral2/memory/2428-143-0x00007FF7D5260000-0x00007FF7D55B4000-memory.dmp	upx
behavioral2/memory/1568-145-0x00007FF7288A0000-0x00007FF728BF4000-memory.dmp	upx
behavioral2/memory/2760-142-0x00007FF75C200000-0x00007FF75C554000-memory.dmp	upx
behavioral2/memory/1084-141-0x00007FF623A70000-0x00007FF623DC4000-memory.dmp	upx
behavioral2/memory/4308-146-0x00007FF7D3550000-0x00007FF7D38A4000-memory.dmp	upx
behavioral2/memory/2376-148-0x00007FF7FC350000-0x00007FF7FC6A4000-memory.dmp	upx
behavioral2/memory/2944-150-0x00007FF65C820000-0x00007FF65CB74000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\IMtOttN.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zFBJHKz.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LFuEHaw.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QRKwKUu.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GGVNHhL.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bKDUeAW.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RthnSwA.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bRTEGvg.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KIzfbfr.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JaZEPJl.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\Qxollzj.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zVBVSCM.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NDVVIGD.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LWrNpyk.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wHESTqN.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BtWIpzz.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UQAtRUt.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wJoPgqq.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mVJZEOy.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HrFTHcc.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hLATDuk.exe	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 4704	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	83
PID 5000 wrote to memory of 4704	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	83
PID 5000 wrote to memory of 1664	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	84
PID 5000 wrote to memory of 1664	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	84
PID 5000 wrote to memory of 2204	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	85
PID 5000 wrote to memory of 2204	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	85
PID 5000 wrote to memory of 4884	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	86
PID 5000 wrote to memory of 4884	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	86
PID 5000 wrote to memory of 4752	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	87
PID 5000 wrote to memory of 4752	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	87
PID 5000 wrote to memory of 1516	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	88
PID 5000 wrote to memory of 1516	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	88
PID 5000 wrote to memory of 980	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	89
PID 5000 wrote to memory of 980	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	89
PID 5000 wrote to memory of 3928	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	90
PID 5000 wrote to memory of 3928	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	90
PID 5000 wrote to memory of 2304	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	91
PID 5000 wrote to memory of 2304	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	91
PID 5000 wrote to memory of 4948	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	92
PID 5000 wrote to memory of 4948	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	92
PID 5000 wrote to memory of 2428	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	93
PID 5000 wrote to memory of 2428	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	93
PID 5000 wrote to memory of 2760	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	94
PID 5000 wrote to memory of 2760	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	94
PID 5000 wrote to memory of 964	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	95
PID 5000 wrote to memory of 964	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	95
PID 5000 wrote to memory of 1084	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	96
PID 5000 wrote to memory of 1084	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	96
PID 5000 wrote to memory of 4744	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	97
PID 5000 wrote to memory of 4744	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	97
PID 5000 wrote to memory of 1568	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	98
PID 5000 wrote to memory of 1568	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	98
PID 5000 wrote to memory of 2376	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	99
PID 5000 wrote to memory of 2376	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	99
PID 5000 wrote to memory of 208	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	100
PID 5000 wrote to memory of 208	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	100
PID 5000 wrote to memory of 4308	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	101
PID 5000 wrote to memory of 4308	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	101
PID 5000 wrote to memory of 2944	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	102
PID 5000 wrote to memory of 2944	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	102
PID 5000 wrote to memory of 2472	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	103
PID 5000 wrote to memory of 2472	5000	2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe	103

C:\Users\Admin\AppData\Local\Temp\2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-30_075ee725de6568559dcee3baa404ae15_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\System\QRKwKUu.exe
  C:\Windows\System\QRKwKUu.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\hLATDuk.exe
  C:\Windows\System\hLATDuk.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\LWrNpyk.exe
  C:\Windows\System\LWrNpyk.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\wHESTqN.exe
  C:\Windows\System\wHESTqN.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\BtWIpzz.exe
  C:\Windows\System\BtWIpzz.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\UQAtRUt.exe
  C:\Windows\System\UQAtRUt.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\KIzfbfr.exe
  C:\Windows\System\KIzfbfr.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\JaZEPJl.exe
  C:\Windows\System\JaZEPJl.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\bRTEGvg.exe
  C:\Windows\System\bRTEGvg.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\IMtOttN.exe
  C:\Windows\System\IMtOttN.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\Qxollzj.exe
  C:\Windows\System\Qxollzj.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\zVBVSCM.exe
  C:\Windows\System\zVBVSCM.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\GGVNHhL.exe
  C:\Windows\System\GGVNHhL.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\NDVVIGD.exe
  C:\Windows\System\NDVVIGD.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\wJoPgqq.exe
  C:\Windows\System\wJoPgqq.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\bKDUeAW.exe
  C:\Windows\System\bKDUeAW.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\zFBJHKz.exe
  C:\Windows\System\zFBJHKz.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\LFuEHaw.exe
  C:\Windows\System\LFuEHaw.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\mVJZEOy.exe
  C:\Windows\System\mVJZEOy.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\HrFTHcc.exe
  C:\Windows\System\HrFTHcc.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\RthnSwA.exe
  C:\Windows\System\RthnSwA.exe
  2⤵
  - Executes dropped EXE
  PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BtWIpzz.exe

Path C:\Windows\System\BtWIpzz.exe
Size 5.9MB
SHA256 ff083a442a9ec481f5ae2e2aa29c39d0ea7d671c3dca858b22876a82a46f43d1
MD5 a75f3ff7f4ba837cb08faffa9e06fe74
SHA1 aff43e075f068e3379f40d7adc1f68a95c86357b
SHA512 7f879c8d5f80657ca9b4a1e90fe675dfef9c6095f18f669688761913a27d3c42e6721699532094680f57e9b9a14855c1eafee225b085c56cddde65b79cac89d8
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:T+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

GGVNHhL.exe

Path C:\Windows\System\GGVNHhL.exe
Size 5.9MB
SHA256 6ffd7e696d0f8d466f2eb23b9e8d3e3683aad70e212ee2775cd2477a5d625000
MD5 03c24736bb257c0c436e564a3419e04c
SHA1 889f2f1463f8fbef93d22350920850c50c2e641a
SHA512 40b751af312738e8a34ea2cc7186940d7fd9959a909c00f25afb33e50e22f97796b94d0ecb94eea3d6a82caf925e858c841f15727ba0fd1e5d3c85ea118a5448
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:T+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

HrFTHcc.exe

Path C:\Windows\System\HrFTHcc.exe
Size 5.9MB
SHA256 ee8ad509cfb5be6a8bdeae9a2f84011d5db2c101386295c74d0a9f0d9649a6a9
MD5 9533d238eb7252aa30dcb78a03cf6a15
SHA1 2d3f3322075c81a00354e679f4542b141a0a832d
SHA512 b2a161d93eff54b2b087bd5097a9309fa872e07b4f1460037e6474978d04c03d31643edfe34b405c64671754ad36619c36f7c261067baf9e05f4ae636f2ba63f
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:T+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

IMtOttN.exe

Path C:\Windows\System\IMtOttN.exe
Size 5.9MB
SHA256 ca7c4823cf2dfd8469b3f709eebb11dfadf5b78a068ff5c4ec75f56e79be45a0
MD5 7c7d7577ec07bc1f27f776aa59e7efab
SHA1 8a5f49bb144d3a154ee05bc30373a6e79a166aeb
SHA512 75eb21264c74a71d2862475101a08b1d231e17a4e6178cbe713db4e2392f6746ba99aaf4bf8b27091bfeabf72a4f1d434a9dbe488aadc0f5cea1b5d814d5d3a7
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:T+856utgpPF8u/7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

JaZEPJl.exe

Path C:\Windows\System\JaZEPJl.exe
Size 5.9MB
SHA256 6970e8b66575d41c7082c6a7db11f9805d371088f297724aea2c96024f933855
MD5 765e6f7a18e92eb1c82cb1b85df4ac73
SHA1 c3e82b129dd39f480afa2d330b3fc1d21a604d5b
SHA512 09af18b99a43a68e08ca9d8b1f9b6c03824f9552eddc13f6838713a02eeaf719ebc12e2010ba3fd52ffc910cf36e882787ae824a39f035333763477c2e4ffebd
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:T+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

KIzfbfr.exe

Path C:\Windows\System\KIzfbfr.exe
Size 5.9MB
SHA256 358667015ba19b63623407b7032afc695ac5bbd8db19a49fb472d80b38ae4e74
MD5 3006e68301c3db1312f6344079186d46
SHA1 a177bd4fd62f0005f0d0f999a6f0a9f778dd61d6
SHA512 31496d986da282e074570946fcaa033e6f55f2cdc0052efc907e7c5567fade74e346184290f1ced979c579b81d686581c930aec2a7ae5de3c99531cc7110c0d8
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:T+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

LFuEHaw.exe

Path C:\Windows\System\LFuEHaw.exe
Size 5.9MB
SHA256 bb93ed3a1030930f19e3116e02a9cd046a437af66c06ec35b48ab27519f8ecd7
MD5 1758376eeb68d222bed24441ab7fd841
SHA1 4b7c968a0cd22483c66ef0142b3f352c8a216c36
SHA512 3d5727528732a797f811b27743002080f995195e9ad39cce2960ccb535a2f90ff6f80d5b57970b463d563d66d182dbb23a97b0c837875e5d4f8992f9d40d5f7a
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:T+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

LWrNpyk.exe

Path C:\Windows\System\LWrNpyk.exe
Size 5.9MB
SHA256 bc983713686dfc3eb550553c36d70567fe51e492f91ba52ade9191b02429e6f4
MD5 bf66b51b4d06a9c87ce4b72a4f2f02e3
SHA1 7ec33aa2d3b92657b7cc2a6f0cd1e578197fafb1
SHA512 b0e092a9043a5d9ee75abb947152b36f399ebe90e6a918aa70af2869634fd630cfa870224d790a5c9f2caf817176b69eca7f8b92a0b22da01720c274f5762462
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:T+856utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

NDVVIGD.exe

Path C:\Windows\System\NDVVIGD.exe
Size 5.9MB
SHA256 a72575f22590d2f1ed92c2bebcbc1f1184ce640897f51231082d1ad4ce6ddb44
MD5 f0e0708e8d4dd17d30fec0dc10d68516
SHA1 17cb3f7191cc0cae4934d8e955c0497e83b9f543
SHA512 ed7dc7e651167b0349c528fc7b18c2a4388416f2517a9a76b316193df6f300a249e18f41947ec292ba4821f8587c2881b0f5533521af7e24a146f3c4d70fe58f
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:T+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

QRKwKUu.exe

Path C:\Windows\System\QRKwKUu.exe
Size 5.9MB
SHA256 8bf3807e1a11c4713513a2a5e84f69c63bebf0922dce808fa54890d50a4d6df8
MD5 7a5988e7f085d70f0a36c028ae834008
SHA1 76e7fb8f9c362f3d798ed75ef78c69ce128ff737
SHA512 60d325a229e06e9ce59f9b075937c81cc9590f4b8c710db9081a184f4db72489bf5fc458aae732c375c13bbfc45ba74ff10c723941cd1bd410d00fcc5844befc
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:T+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qxollzj.exe

Path C:\Windows\System\Qxollzj.exe
Size 5.9MB
SHA256 a1c38a4d6d8b559a8e7c7327cc3ffb8f5e19ba95b20d5ee34efd5ebbd60889fc
MD5 324b9829b12b1bf1f3f7f1633fb5922e
SHA1 80cf41a805666c38c83e4ef9c5b0324b8705d620
SHA512 3f5bb3a6e947ec8c290c0a89694a91d9f4c50344be996550485513b3f4cb0b0fd40ee6d1eaf5d18caaf6cbe3aac482da4036220f70cbb1b3ed5468e342282451
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:T+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

RthnSwA.exe

Path C:\Windows\System\RthnSwA.exe
Size 5.9MB
SHA256 12f9d9cbac3077dd08108b32c9d15c4d4413e41f3f1730db5454b7db26dd27c6
MD5 8f58a8170a2e43c1038a2bac97e7ae4f
SHA1 6e26ef25008a0aa71845e7303e97b6ebd4e8bb02
SHA512 481bac57352d5cfbc6d1ee570fdf8ce6a9ee67061ea4581485298bd8914173f6f264c399eafd12c643d4eeaf53ae3e408eb2e5f515e913039fd4f1cc23d6c2f6
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:T+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

UQAtRUt.exe

Path C:\Windows\System\UQAtRUt.exe
Size 5.9MB
SHA256 3480e291c97135280d4a8214cb578a4195a6caec3eaf949a9fcb65766823cabc
MD5 e900e48b74f658322522ac7e76e61e38
SHA1 38d565c3bc592f169d0331eef8a2a6a379769f37
SHA512 78d1825e082879ea925820329504d440e72adba6636540d78a79b637058bed6a63bbaea407675386fc22fb5fa0434cd36dbb29302ccb2f936da98699edef3c39
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:T+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

bKDUeAW.exe

Path C:\Windows\System\bKDUeAW.exe
Size 5.9MB
SHA256 de0c83c4a75af1e6b8d2717367aedd0a78ce21dbb88a5febb329398abc19ac26
MD5 7204e389925c38dbca347613af129d2d
SHA1 d50e786f1744243d2e54d007ff9a42be80da1a93
SHA512 aac3e18c6c12fe041696c7f41e7e599972eb7ab9dcde9e261336e7e3f495808c8872859dbc710a5a6cd09573bf38db966ab1b4933f9ed72488cc5f12b94e84c5
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:T+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

bRTEGvg.exe

Path C:\Windows\System\bRTEGvg.exe
Size 5.9MB
SHA256 ba5da534e574221a68470c09e377f047cc9e6e6d8b00eabe7d73ffc6a7ec9c82
MD5 8cd4c9d2b591ad9a8dcb62419d513493
SHA1 05904cb9026ee82ff4dae7fe158cbf183d918387
SHA512 8abf7bf9030dd4bbe20e823082cbb6a865a9cccb3ac471e4806265bd56542687532cfccdd50512c2a78e5a51d3f1518c0bf1746ff4cd9f55820342641f27cc84
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:T+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

hLATDuk.exe

Path C:\Windows\System\hLATDuk.exe
Size 5.9MB
SHA256 e709c50977c976aaae01f1587ebdb0fa0f16fe51cd3ee0bf9526cb660e30eb53
MD5 c33327a9ec85e4a942fa610b027163db
SHA1 5cfaf16f76cbd3ae1b359c863326da0b125fcab1
SHA512 393b4dd4e105620d86004b9daad716a0d708e07d59a7e59c03bfe94c591d24e8126976b605e52874d70e60657d4e937f6697628fe4ab0d052cff9593bb5d5c3f
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:T+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

mVJZEOy.exe

Path C:\Windows\System\mVJZEOy.exe
Size 5.9MB
SHA256 67ec697aeebb7465eec39b6a53ef27c59ee66188614f3554830eccf10b09f29d
MD5 e3ba0d8dc55978fc8a57d3b43d72d4a9
SHA1 276e01e04d5b9e81024fed6d9dc690313793d361
SHA512 c37f838a2998b49642d3428465d48e887492449994841d0078fcda9f8fd50886406a335fee42d86e93c6a59092bb1fe71f690d7701f2abbe6b8184408332ad13
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:T+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

wHESTqN.exe

Path C:\Windows\System\wHESTqN.exe
Size 5.9MB
SHA256 71db1933895262efc6c9a40f77f30077d69acb0c7e2996c18b239a8e51dfe4fb
MD5 aa368a949d7c8cf8aaddb2abeebefaf3
SHA1 1fd8b6f178d2bb21c975130c57fe2cddede7417b
SHA512 dbd68b6777f0f4c977fc61ca4e6237cfa83df4787d5d1aa832a29044e9911499c7ee036005096b7a7a2504bf0d176e2f50f2e1aca351da0e4d98717164ba126f
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:T+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

wJoPgqq.exe

Path C:\Windows\System\wJoPgqq.exe
Size 5.9MB
SHA256 0a4674ff8ca2d43c100dcefa5100f04340143c8233d06ae3a48f401c9bbaa64e
MD5 ca5f477c0b3142863384cc25ce673d09
SHA1 6a7addbc8eca7c20939bde86dbab464684e2f2f1
SHA512 963fb9c9e33c956a1b0b8e8d9b7be04a8b5de169f09dff0a9cd18b4b86835e12a02e64e081ecbf3194c1333f7fe13ce4f55df09daa88e3bc89e68a03b47f9fd8
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:T+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

zFBJHKz.exe

Path C:\Windows\System\zFBJHKz.exe
Size 5.9MB
SHA256 73fdf9b721e55ee60fca3779b067a22ee5eab19b35032487de2821c547b1603c
MD5 4d666884030fdc411c36c7114ee693a1
SHA1 0045a9e00251434de7d91476b8ab005552ee5deb
SHA512 af4baedf7af2fa16d0d14de1ade671eec952f12acbfd4b982e3803598f9d0f051449dbb7c6cb7988d2ce1a4f514216726d3a400d6c3ac70e42f1d8eef4af4fb6
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:T+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

zVBVSCM.exe

Path C:\Windows\System\zVBVSCM.exe
Size 5.9MB
SHA256 92224186bf6ed6a899371baf7ace65b22cc5bdc46286ad75321c9de528cc9604
MD5 0e5d567baacd12a63bd9bfc5018d54e7
SHA1 2ec8dc999f3e2d80a74f65302d84b1eec506b7f9
SHA512 aceedfea779409c0dbe215d8b0f163bbd750cff716fba3162c1be8f4e3744fc5753265ca5ea7cea8022100379aa1f3e28fcecc4b601ece006a05d3e169ce7554
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:T+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-121-0x00007FF6BC4B0000-0x00007FF6BC804000-memory.dmp

Download

memory/208-147-0x00007FF6BC4B0000-0x00007FF6BC804000-memory.dmp

Download

memory/964-117-0x00007FF73D530000-0x00007FF73D884000-memory.dmp

Download

memory/964-144-0x00007FF73D530000-0x00007FF73D884000-memory.dmp

Download

memory/980-137-0x00007FF718380000-0x00007FF7186D4000-memory.dmp

Download

memory/980-116-0x00007FF718380000-0x00007FF7186D4000-memory.dmp

Download

memory/1084-118-0x00007FF623A70000-0x00007FF623DC4000-memory.dmp

Download

memory/1084-141-0x00007FF623A70000-0x00007FF623DC4000-memory.dmp

Download

memory/1516-115-0x00007FF7846E0000-0x00007FF784A34000-memory.dmp

Download

memory/1516-136-0x00007FF7846E0000-0x00007FF784A34000-memory.dmp

Download

memory/1568-119-0x00007FF7288A0000-0x00007FF728BF4000-memory.dmp

Download

memory/1568-145-0x00007FF7288A0000-0x00007FF728BF4000-memory.dmp

Download

memory/1664-131-0x00007FF698D80000-0x00007FF6990D4000-memory.dmp

Download

memory/1664-28-0x00007FF698D80000-0x00007FF6990D4000-memory.dmp

Download

memory/2204-114-0x00007FF614C10000-0x00007FF614F64000-memory.dmp

Download

memory/2204-133-0x00007FF614C10000-0x00007FF614F64000-memory.dmp

Download

memory/2304-138-0x00007FF711390000-0x00007FF7116E4000-memory.dmp

Download

memory/2304-68-0x00007FF711390000-0x00007FF7116E4000-memory.dmp

Download

memory/2376-148-0x00007FF7FC350000-0x00007FF7FC6A4000-memory.dmp

Download

memory/2376-120-0x00007FF7FC350000-0x00007FF7FC6A4000-memory.dmp

Download

memory/2428-98-0x00007FF7D5260000-0x00007FF7D55B4000-memory.dmp

Download

memory/2428-143-0x00007FF7D5260000-0x00007FF7D55B4000-memory.dmp

Download

memory/2472-127-0x00007FF7D5020000-0x00007FF7D5374000-memory.dmp

Download

memory/2472-151-0x00007FF7D5020000-0x00007FF7D5374000-memory.dmp

Download

memory/2760-102-0x00007FF75C200000-0x00007FF75C554000-memory.dmp

Download

memory/2760-142-0x00007FF75C200000-0x00007FF75C554000-memory.dmp

Download

memory/2944-150-0x00007FF65C820000-0x00007FF65CB74000-memory.dmp

Download

memory/2944-113-0x00007FF65C820000-0x00007FF65CB74000-memory.dmp

Download

memory/3928-66-0x00007FF7AD1D0000-0x00007FF7AD524000-memory.dmp

Download

memory/3928-139-0x00007FF7AD1D0000-0x00007FF7AD524000-memory.dmp

Download

memory/4308-146-0x00007FF7D3550000-0x00007FF7D38A4000-memory.dmp

Download

memory/4308-112-0x00007FF7D3550000-0x00007FF7D38A4000-memory.dmp

Download

memory/4704-12-0x00007FF7157E0000-0x00007FF715B34000-memory.dmp

Download

memory/4704-129-0x00007FF7157E0000-0x00007FF715B34000-memory.dmp

Download

memory/4704-132-0x00007FF7157E0000-0x00007FF715B34000-memory.dmp

Download

memory/4744-149-0x00007FF7D7EF0000-0x00007FF7D8244000-memory.dmp

Download

memory/4744-105-0x00007FF7D7EF0000-0x00007FF7D8244000-memory.dmp

Download

memory/4752-62-0x00007FF66E6F0000-0x00007FF66EA44000-memory.dmp

Download

memory/4752-135-0x00007FF66E6F0000-0x00007FF66EA44000-memory.dmp

Download

memory/4752-130-0x00007FF66E6F0000-0x00007FF66EA44000-memory.dmp

Download

memory/4884-32-0x00007FF683110000-0x00007FF683464000-memory.dmp

Download

memory/4884-134-0x00007FF683110000-0x00007FF683464000-memory.dmp

Download

memory/4948-77-0x00007FF7797D0000-0x00007FF779B24000-memory.dmp

Download

memory/4948-140-0x00007FF7797D0000-0x00007FF779B24000-memory.dmp

Download

memory/5000-128-0x00007FF6952B0000-0x00007FF695604000-memory.dmp

Download

memory/5000-0-0x00007FF6952B0000-0x00007FF695604000-memory.dmp

Download

memory/5000-1-0x0000027A97420000-0x0000027A97430000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads