cobaltstrike | 0b71962af4b1f193758eac95f58c482e2de4452674ea3fd3d1c1787306c152f3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
Size 5.2MB
Sample240531-2mty1aha34
SHA256 0b71962af4b1f193758eac95f58c482e2de4452674ea3fd3d1c1787306c152f3
MD5 8c1a13b64da8367dc8fa1778151a9099
SHA1 a03c8a18f52a89f4c165dfd7c132e6ed886739df
SHA512 0eed2b103e992b40121ef0b5cd1e5c1c3b0a7ba5b111f32dfa1fae5bb3f3176c94c16da117bf84beebb57e61f2c93b1ddd181031db30227446d55bd6583021ec
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l2:RWWBibf56utgpPFotBER/mQ32lUK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00090000000233f4-4.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340d-21.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340f-34.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023412-38.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023415-61.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-72.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023418-89.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023409-82.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023416-78.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023414-65.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023413-58.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023411-44.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023410-41.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340e-23.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340c-14.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341b-99.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341c-112.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341d-111.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341e-116.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341f-118.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023419-102.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233f4-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340d-21.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340f-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023412-38.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023415-61.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023418-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023409-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023416-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023414-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023413-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023411-44.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023410-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340e-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340c-14.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341b-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341c-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341d-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341e-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341f-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023419-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/940-0-0x00007FF6C7A00000-0x00007FF6C7D51000-memory.dmp	UPX
behavioral2/files/0x00090000000233f4-4.dat	UPX
behavioral2/files/0x000700000002340d-21.dat	UPX
behavioral2/files/0x000700000002340f-34.dat	UPX
behavioral2/files/0x0007000000023412-38.dat	UPX
behavioral2/memory/4016-51-0x00007FF603880000-0x00007FF603BD1000-memory.dmp	UPX
behavioral2/files/0x0007000000023415-61.dat	UPX
behavioral2/files/0x0007000000023417-72.dat	UPX
behavioral2/memory/2044-84-0x00007FF7032D0000-0x00007FF703621000-memory.dmp	UPX
behavioral2/files/0x0007000000023418-89.dat	UPX
behavioral2/memory/452-87-0x00007FF64F930000-0x00007FF64FC81000-memory.dmp	UPX
behavioral2/files/0x0008000000023409-82.dat	UPX
behavioral2/files/0x0007000000023416-78.dat	UPX
behavioral2/memory/3076-77-0x00007FF69EEE0000-0x00007FF69F231000-memory.dmp	UPX
behavioral2/memory/3132-74-0x00007FF6F7270000-0x00007FF6F75C1000-memory.dmp	UPX
behavioral2/memory/1612-70-0x00007FF7A9A40000-0x00007FF7A9D91000-memory.dmp	UPX
behavioral2/memory/4572-67-0x00007FF7F5970000-0x00007FF7F5CC1000-memory.dmp	UPX
behavioral2/files/0x0007000000023414-65.dat	UPX
behavioral2/memory/1944-60-0x00007FF732B90000-0x00007FF732EE1000-memory.dmp	UPX
behavioral2/files/0x0007000000023413-58.dat	UPX
behavioral2/memory/2988-40-0x00007FF7D7C60000-0x00007FF7D7FB1000-memory.dmp	UPX
behavioral2/memory/4824-39-0x00007FF6B1C10000-0x00007FF6B1F61000-memory.dmp	UPX
behavioral2/files/0x0007000000023411-44.dat	UPX
behavioral2/files/0x0007000000023410-41.dat	UPX
behavioral2/memory/2104-35-0x00007FF7BCEB0000-0x00007FF7BD201000-memory.dmp	UPX
behavioral2/memory/4988-28-0x00007FF779E10000-0x00007FF77A161000-memory.dmp	UPX
behavioral2/files/0x000700000002340e-23.dat	UPX
behavioral2/memory/4044-16-0x00007FF6BA010000-0x00007FF6BA361000-memory.dmp	UPX
behavioral2/files/0x000700000002340c-14.dat	UPX
behavioral2/memory/4460-6-0x00007FF69B590000-0x00007FF69B8E1000-memory.dmp	UPX
behavioral2/memory/1456-91-0x00007FF6FFF70000-0x00007FF7002C1000-memory.dmp	UPX
behavioral2/memory/3268-98-0x00007FF7F8BF0000-0x00007FF7F8F41000-memory.dmp	UPX
behavioral2/files/0x000700000002341b-99.dat	UPX
behavioral2/files/0x000700000002341c-112.dat	UPX
behavioral2/files/0x000700000002341d-111.dat	UPX
behavioral2/files/0x000700000002341e-116.dat	UPX
behavioral2/files/0x000700000002341f-118.dat	UPX
behavioral2/memory/2888-115-0x00007FF71F5F0000-0x00007FF71F941000-memory.dmp	UPX
behavioral2/memory/1616-113-0x00007FF75EDB0000-0x00007FF75F101000-memory.dmp	UPX
behavioral2/files/0x0007000000023419-102.dat	UPX
behavioral2/memory/1156-126-0x00007FF777D60000-0x00007FF7780B1000-memory.dmp	UPX
behavioral2/memory/4532-128-0x00007FF6E6860000-0x00007FF6E6BB1000-memory.dmp	UPX
behavioral2/memory/4460-129-0x00007FF69B590000-0x00007FF69B8E1000-memory.dmp	UPX
behavioral2/memory/940-127-0x00007FF6C7A00000-0x00007FF6C7D51000-memory.dmp	UPX
behavioral2/memory/4248-125-0x00007FF671A60000-0x00007FF671DB1000-memory.dmp	UPX
behavioral2/memory/4988-133-0x00007FF779E10000-0x00007FF77A161000-memory.dmp	UPX
behavioral2/memory/2104-134-0x00007FF7BCEB0000-0x00007FF7BD201000-memory.dmp	UPX
behavioral2/memory/4572-140-0x00007FF7F5970000-0x00007FF7F5CC1000-memory.dmp	UPX
behavioral2/memory/1612-142-0x00007FF7A9A40000-0x00007FF7A9D91000-memory.dmp	UPX
behavioral2/memory/3132-144-0x00007FF6F7270000-0x00007FF6F75C1000-memory.dmp	UPX
behavioral2/memory/1944-138-0x00007FF732B90000-0x00007FF732EE1000-memory.dmp	UPX
behavioral2/memory/4824-137-0x00007FF6B1C10000-0x00007FF6B1F61000-memory.dmp	UPX
behavioral2/memory/2988-135-0x00007FF7D7C60000-0x00007FF7D7FB1000-memory.dmp	UPX
behavioral2/memory/4044-132-0x00007FF6BA010000-0x00007FF6BA361000-memory.dmp	UPX
behavioral2/memory/940-130-0x00007FF6C7A00000-0x00007FF6C7D51000-memory.dmp	UPX
behavioral2/memory/3268-150-0x00007FF7F8BF0000-0x00007FF7F8F41000-memory.dmp	UPX
behavioral2/memory/2888-153-0x00007FF71F5F0000-0x00007FF71F941000-memory.dmp	UPX
behavioral2/memory/1616-151-0x00007FF75EDB0000-0x00007FF75F101000-memory.dmp	UPX
behavioral2/memory/940-146-0x00007FF6C7A00000-0x00007FF6C7D51000-memory.dmp	UPX
behavioral2/memory/940-168-0x00007FF6C7A00000-0x00007FF6C7D51000-memory.dmp	UPX
behavioral2/memory/4460-197-0x00007FF69B590000-0x00007FF69B8E1000-memory.dmp	UPX
behavioral2/memory/4044-199-0x00007FF6BA010000-0x00007FF6BA361000-memory.dmp	UPX
behavioral2/memory/4988-201-0x00007FF779E10000-0x00007FF77A161000-memory.dmp	UPX
behavioral2/memory/2104-203-0x00007FF7BCEB0000-0x00007FF7BD201000-memory.dmp	UPX

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/4016-51-0x00007FF603880000-0x00007FF603BD1000-memory.dmp	xmrig
behavioral2/memory/2044-84-0x00007FF7032D0000-0x00007FF703621000-memory.dmp	xmrig
behavioral2/memory/452-87-0x00007FF64F930000-0x00007FF64FC81000-memory.dmp	xmrig
behavioral2/memory/3076-77-0x00007FF69EEE0000-0x00007FF69F231000-memory.dmp	xmrig
behavioral2/memory/1944-60-0x00007FF732B90000-0x00007FF732EE1000-memory.dmp	xmrig
behavioral2/memory/2104-35-0x00007FF7BCEB0000-0x00007FF7BD201000-memory.dmp	xmrig
behavioral2/memory/1456-91-0x00007FF6FFF70000-0x00007FF7002C1000-memory.dmp	xmrig
behavioral2/memory/1156-126-0x00007FF777D60000-0x00007FF7780B1000-memory.dmp	xmrig
behavioral2/memory/4532-128-0x00007FF6E6860000-0x00007FF6E6BB1000-memory.dmp	xmrig
behavioral2/memory/4460-129-0x00007FF69B590000-0x00007FF69B8E1000-memory.dmp	xmrig
behavioral2/memory/940-127-0x00007FF6C7A00000-0x00007FF6C7D51000-memory.dmp	xmrig
behavioral2/memory/4248-125-0x00007FF671A60000-0x00007FF671DB1000-memory.dmp	xmrig
behavioral2/memory/4988-133-0x00007FF779E10000-0x00007FF77A161000-memory.dmp	xmrig
behavioral2/memory/2104-134-0x00007FF7BCEB0000-0x00007FF7BD201000-memory.dmp	xmrig
behavioral2/memory/4572-140-0x00007FF7F5970000-0x00007FF7F5CC1000-memory.dmp	xmrig
behavioral2/memory/1612-142-0x00007FF7A9A40000-0x00007FF7A9D91000-memory.dmp	xmrig
behavioral2/memory/3132-144-0x00007FF6F7270000-0x00007FF6F75C1000-memory.dmp	xmrig
behavioral2/memory/1944-138-0x00007FF732B90000-0x00007FF732EE1000-memory.dmp	xmrig
behavioral2/memory/4824-137-0x00007FF6B1C10000-0x00007FF6B1F61000-memory.dmp	xmrig
behavioral2/memory/2988-135-0x00007FF7D7C60000-0x00007FF7D7FB1000-memory.dmp	xmrig
behavioral2/memory/4044-132-0x00007FF6BA010000-0x00007FF6BA361000-memory.dmp	xmrig
behavioral2/memory/940-130-0x00007FF6C7A00000-0x00007FF6C7D51000-memory.dmp	xmrig
behavioral2/memory/3268-150-0x00007FF7F8BF0000-0x00007FF7F8F41000-memory.dmp	xmrig
behavioral2/memory/2888-153-0x00007FF71F5F0000-0x00007FF71F941000-memory.dmp	xmrig
behavioral2/memory/1616-151-0x00007FF75EDB0000-0x00007FF75F101000-memory.dmp	xmrig
behavioral2/memory/940-146-0x00007FF6C7A00000-0x00007FF6C7D51000-memory.dmp	xmrig
behavioral2/memory/940-168-0x00007FF6C7A00000-0x00007FF6C7D51000-memory.dmp	xmrig
behavioral2/memory/4460-197-0x00007FF69B590000-0x00007FF69B8E1000-memory.dmp	xmrig
behavioral2/memory/4044-199-0x00007FF6BA010000-0x00007FF6BA361000-memory.dmp	xmrig
behavioral2/memory/4988-201-0x00007FF779E10000-0x00007FF77A161000-memory.dmp	xmrig
behavioral2/memory/2104-203-0x00007FF7BCEB0000-0x00007FF7BD201000-memory.dmp	xmrig
behavioral2/memory/4016-205-0x00007FF603880000-0x00007FF603BD1000-memory.dmp	xmrig
behavioral2/memory/2988-207-0x00007FF7D7C60000-0x00007FF7D7FB1000-memory.dmp	xmrig
behavioral2/memory/4824-210-0x00007FF6B1C10000-0x00007FF6B1F61000-memory.dmp	xmrig
behavioral2/memory/3076-211-0x00007FF69EEE0000-0x00007FF69F231000-memory.dmp	xmrig
behavioral2/memory/4572-215-0x00007FF7F5970000-0x00007FF7F5CC1000-memory.dmp	xmrig
behavioral2/memory/1944-214-0x00007FF732B90000-0x00007FF732EE1000-memory.dmp	xmrig
behavioral2/memory/1456-218-0x00007FF6FFF70000-0x00007FF7002C1000-memory.dmp	xmrig
behavioral2/memory/2044-225-0x00007FF7032D0000-0x00007FF703621000-memory.dmp	xmrig
behavioral2/memory/1612-224-0x00007FF7A9A40000-0x00007FF7A9D91000-memory.dmp	xmrig
behavioral2/memory/452-221-0x00007FF64F930000-0x00007FF64FC81000-memory.dmp	xmrig
behavioral2/memory/3132-220-0x00007FF6F7270000-0x00007FF6F75C1000-memory.dmp	xmrig
behavioral2/memory/1616-228-0x00007FF75EDB0000-0x00007FF75F101000-memory.dmp	xmrig
behavioral2/memory/3268-230-0x00007FF7F8BF0000-0x00007FF7F8F41000-memory.dmp	xmrig
behavioral2/memory/4248-235-0x00007FF671A60000-0x00007FF671DB1000-memory.dmp	xmrig
behavioral2/memory/2888-236-0x00007FF71F5F0000-0x00007FF71F941000-memory.dmp	xmrig
behavioral2/memory/4532-234-0x00007FF6E6860000-0x00007FF6E6BB1000-memory.dmp	xmrig
behavioral2/memory/1156-238-0x00007FF777D60000-0x00007FF7780B1000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4460	EIvCfdW.exe
4044	uOvcwVv.exe
4988	yprRdQl.exe
2104	NyjjDQg.exe
4016	UvtSagI.exe
4824	lYJeRkk.exe
2988	nNOcNWR.exe
1944	aGjUAJD.exe
3076	wRozyUw.exe
4572	dakVCIX.exe
2044	fLImivm.exe
1612	SMEKVjf.exe
452	ODjdwTr.exe
3132	gTPdPzo.exe
1456	BCQueMs.exe
3268	jBYWEOm.exe
1616	qiECaSQ.exe
4248	HyewybI.exe
2888	rEhckgK.exe
4532	LXKfJyg.exe
1156	ABFkfnP.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/940-0-0x00007FF6C7A00000-0x00007FF6C7D51000-memory.dmp	upx
behavioral2/files/0x00090000000233f4-4.dat	upx
behavioral2/files/0x000700000002340d-21.dat	upx
behavioral2/files/0x000700000002340f-34.dat	upx
behavioral2/files/0x0007000000023412-38.dat	upx
behavioral2/memory/4016-51-0x00007FF603880000-0x00007FF603BD1000-memory.dmp	upx
behavioral2/files/0x0007000000023415-61.dat	upx
behavioral2/files/0x0007000000023417-72.dat	upx
behavioral2/memory/2044-84-0x00007FF7032D0000-0x00007FF703621000-memory.dmp	upx
behavioral2/files/0x0007000000023418-89.dat	upx
behavioral2/memory/452-87-0x00007FF64F930000-0x00007FF64FC81000-memory.dmp	upx
behavioral2/files/0x0008000000023409-82.dat	upx
behavioral2/files/0x0007000000023416-78.dat	upx
behavioral2/memory/3076-77-0x00007FF69EEE0000-0x00007FF69F231000-memory.dmp	upx
behavioral2/memory/3132-74-0x00007FF6F7270000-0x00007FF6F75C1000-memory.dmp	upx
behavioral2/memory/1612-70-0x00007FF7A9A40000-0x00007FF7A9D91000-memory.dmp	upx
behavioral2/memory/4572-67-0x00007FF7F5970000-0x00007FF7F5CC1000-memory.dmp	upx
behavioral2/files/0x0007000000023414-65.dat	upx
behavioral2/memory/1944-60-0x00007FF732B90000-0x00007FF732EE1000-memory.dmp	upx
behavioral2/files/0x0007000000023413-58.dat	upx
behavioral2/memory/2988-40-0x00007FF7D7C60000-0x00007FF7D7FB1000-memory.dmp	upx
behavioral2/memory/4824-39-0x00007FF6B1C10000-0x00007FF6B1F61000-memory.dmp	upx
behavioral2/files/0x0007000000023411-44.dat	upx
behavioral2/files/0x0007000000023410-41.dat	upx
behavioral2/memory/2104-35-0x00007FF7BCEB0000-0x00007FF7BD201000-memory.dmp	upx
behavioral2/memory/4988-28-0x00007FF779E10000-0x00007FF77A161000-memory.dmp	upx
behavioral2/files/0x000700000002340e-23.dat	upx
behavioral2/memory/4044-16-0x00007FF6BA010000-0x00007FF6BA361000-memory.dmp	upx
behavioral2/files/0x000700000002340c-14.dat	upx
behavioral2/memory/4460-6-0x00007FF69B590000-0x00007FF69B8E1000-memory.dmp	upx
behavioral2/memory/1456-91-0x00007FF6FFF70000-0x00007FF7002C1000-memory.dmp	upx
behavioral2/memory/3268-98-0x00007FF7F8BF0000-0x00007FF7F8F41000-memory.dmp	upx
behavioral2/files/0x000700000002341b-99.dat	upx
behavioral2/files/0x000700000002341c-112.dat	upx
behavioral2/files/0x000700000002341d-111.dat	upx
behavioral2/files/0x000700000002341e-116.dat	upx
behavioral2/files/0x000700000002341f-118.dat	upx
behavioral2/memory/2888-115-0x00007FF71F5F0000-0x00007FF71F941000-memory.dmp	upx
behavioral2/memory/1616-113-0x00007FF75EDB0000-0x00007FF75F101000-memory.dmp	upx
behavioral2/files/0x0007000000023419-102.dat	upx
behavioral2/memory/1156-126-0x00007FF777D60000-0x00007FF7780B1000-memory.dmp	upx
behavioral2/memory/4532-128-0x00007FF6E6860000-0x00007FF6E6BB1000-memory.dmp	upx
behavioral2/memory/4460-129-0x00007FF69B590000-0x00007FF69B8E1000-memory.dmp	upx
behavioral2/memory/940-127-0x00007FF6C7A00000-0x00007FF6C7D51000-memory.dmp	upx
behavioral2/memory/4248-125-0x00007FF671A60000-0x00007FF671DB1000-memory.dmp	upx
behavioral2/memory/4988-133-0x00007FF779E10000-0x00007FF77A161000-memory.dmp	upx
behavioral2/memory/2104-134-0x00007FF7BCEB0000-0x00007FF7BD201000-memory.dmp	upx
behavioral2/memory/4572-140-0x00007FF7F5970000-0x00007FF7F5CC1000-memory.dmp	upx
behavioral2/memory/1612-142-0x00007FF7A9A40000-0x00007FF7A9D91000-memory.dmp	upx
behavioral2/memory/3132-144-0x00007FF6F7270000-0x00007FF6F75C1000-memory.dmp	upx
behavioral2/memory/1944-138-0x00007FF732B90000-0x00007FF732EE1000-memory.dmp	upx
behavioral2/memory/4824-137-0x00007FF6B1C10000-0x00007FF6B1F61000-memory.dmp	upx
behavioral2/memory/2988-135-0x00007FF7D7C60000-0x00007FF7D7FB1000-memory.dmp	upx
behavioral2/memory/4044-132-0x00007FF6BA010000-0x00007FF6BA361000-memory.dmp	upx
behavioral2/memory/940-130-0x00007FF6C7A00000-0x00007FF6C7D51000-memory.dmp	upx
behavioral2/memory/3268-150-0x00007FF7F8BF0000-0x00007FF7F8F41000-memory.dmp	upx
behavioral2/memory/2888-153-0x00007FF71F5F0000-0x00007FF71F941000-memory.dmp	upx
behavioral2/memory/1616-151-0x00007FF75EDB0000-0x00007FF75F101000-memory.dmp	upx
behavioral2/memory/940-146-0x00007FF6C7A00000-0x00007FF6C7D51000-memory.dmp	upx
behavioral2/memory/940-168-0x00007FF6C7A00000-0x00007FF6C7D51000-memory.dmp	upx
behavioral2/memory/4460-197-0x00007FF69B590000-0x00007FF69B8E1000-memory.dmp	upx
behavioral2/memory/4044-199-0x00007FF6BA010000-0x00007FF6BA361000-memory.dmp	upx
behavioral2/memory/4988-201-0x00007FF779E10000-0x00007FF77A161000-memory.dmp	upx
behavioral2/memory/2104-203-0x00007FF7BCEB0000-0x00007FF7BD201000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\aGjUAJD.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wRozyUw.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BCQueMs.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LXKfJyg.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ABFkfnP.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yprRdQl.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fLImivm.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gTPdPzo.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EIvCfdW.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nNOcNWR.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HyewybI.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uOvcwVv.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UvtSagI.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lYJeRkk.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dakVCIX.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SMEKVjf.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ODjdwTr.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jBYWEOm.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qiECaSQ.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NyjjDQg.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rEhckgK.exe	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 4460	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	84
PID 940 wrote to memory of 4460	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	84
PID 940 wrote to memory of 4044	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	85
PID 940 wrote to memory of 4044	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	85
PID 940 wrote to memory of 4988	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	86
PID 940 wrote to memory of 4988	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	86
PID 940 wrote to memory of 2104	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	87
PID 940 wrote to memory of 2104	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	87
PID 940 wrote to memory of 2988	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	88
PID 940 wrote to memory of 2988	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	88
PID 940 wrote to memory of 4016	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	89
PID 940 wrote to memory of 4016	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	89
PID 940 wrote to memory of 4824	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	90
PID 940 wrote to memory of 4824	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	90
PID 940 wrote to memory of 1944	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	91
PID 940 wrote to memory of 1944	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	91
PID 940 wrote to memory of 3076	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	92
PID 940 wrote to memory of 3076	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	92
PID 940 wrote to memory of 4572	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	93
PID 940 wrote to memory of 4572	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	93
PID 940 wrote to memory of 2044	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	94
PID 940 wrote to memory of 2044	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	94
PID 940 wrote to memory of 1612	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	95
PID 940 wrote to memory of 1612	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	95
PID 940 wrote to memory of 452	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	96
PID 940 wrote to memory of 452	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	96
PID 940 wrote to memory of 3132	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	97
PID 940 wrote to memory of 3132	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	97
PID 940 wrote to memory of 1456	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	98
PID 940 wrote to memory of 1456	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	98
PID 940 wrote to memory of 3268	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	99
PID 940 wrote to memory of 3268	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	99
PID 940 wrote to memory of 1616	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	101
PID 940 wrote to memory of 1616	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	101
PID 940 wrote to memory of 4248	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	102
PID 940 wrote to memory of 4248	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	102
PID 940 wrote to memory of 2888	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	103
PID 940 wrote to memory of 2888	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	103
PID 940 wrote to memory of 4532	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	104
PID 940 wrote to memory of 4532	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	104
PID 940 wrote to memory of 1156	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	105
PID 940 wrote to memory of 1156	940	2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe	105

C:\Users\Admin\AppData\Local\Temp\2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_8c1a13b64da8367dc8fa1778151a9099_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\System\EIvCfdW.exe
  C:\Windows\System\EIvCfdW.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\uOvcwVv.exe
  C:\Windows\System\uOvcwVv.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\yprRdQl.exe
  C:\Windows\System\yprRdQl.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\NyjjDQg.exe
  C:\Windows\System\NyjjDQg.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\nNOcNWR.exe
  C:\Windows\System\nNOcNWR.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\UvtSagI.exe
  C:\Windows\System\UvtSagI.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\lYJeRkk.exe
  C:\Windows\System\lYJeRkk.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\aGjUAJD.exe
  C:\Windows\System\aGjUAJD.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\wRozyUw.exe
  C:\Windows\System\wRozyUw.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\dakVCIX.exe
  C:\Windows\System\dakVCIX.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\fLImivm.exe
  C:\Windows\System\fLImivm.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\SMEKVjf.exe
  C:\Windows\System\SMEKVjf.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\ODjdwTr.exe
  C:\Windows\System\ODjdwTr.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\gTPdPzo.exe
  C:\Windows\System\gTPdPzo.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\BCQueMs.exe
  C:\Windows\System\BCQueMs.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\jBYWEOm.exe
  C:\Windows\System\jBYWEOm.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\qiECaSQ.exe
  C:\Windows\System\qiECaSQ.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\HyewybI.exe
  C:\Windows\System\HyewybI.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\rEhckgK.exe
  C:\Windows\System\rEhckgK.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\LXKfJyg.exe
  C:\Windows\System\LXKfJyg.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\ABFkfnP.exe
  C:\Windows\System\ABFkfnP.exe
  2⤵
  - Executes dropped EXE
  PID:1156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ABFkfnP.exe

Path C:\Windows\System\ABFkfnP.exe
Size 5.2MB
SHA256 2d8486dd2664f0a728dc03bf5f5e3cf7fb1d18e766a444650c9d1dd7d6d96ea4
MD5 1ca2a8c3e2c10e384261314aea1a78e2
SHA1 3780159e05316ed5ab1cdf607f5dcf2801df248e
SHA512 c059d87c5769f55ba14e80f9a84f82ead441b13f90fad77602ddcbef73d1632887b5e31d671206e99922ffb8424318cd1fc35730b00af0e7d6e1ce0fc3b67a5e
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lE:RWWBibf56utgpPFotBER/mQ32lUQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

BCQueMs.exe

Path C:\Windows\System\BCQueMs.exe
Size 5.2MB
SHA256 f5258901c226f1c3b375aabc182b272082b3002a46f53e75233339dad64a660f
MD5 d903d0517249375dcc8c22a256980947
SHA1 6a36fb160e0fec83a72e6af68fb6e25219be89c9
SHA512 27a801436f1c7613a8d19f9f87e412f95b1f0b476045726346ed6f3c6d96e22ac48a8e5b984e364936ae3f4e0d5dc2d4a5c997258c66c367b4582ec69c62457f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lP:RWWBibf56utgpPFotBER/mQ32lUT
MD5 SHA1 SHA512 SSDEEP

Submit Download

EIvCfdW.exe

Path C:\Windows\System\EIvCfdW.exe
Size 5.2MB
SHA256 d1afea9cbd3794056ff1cc27f591d5aa4a532837b1629f82eb5cd0cd3544ecbd
MD5 4b1f0f4f42d6527d6ffc5ce16b33df72
SHA1 06fd0bfc051b29e767a7c170700b31b29a302739
SHA512 b8267eb7fc8beee6d8e407423f604adcdaf5da44b1c70353904dca143c5a2b82dbebc6fd748e4219c8cb24c4ff62cc9fd8e13a7daaca38c7e1701877de91620c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lg:RWWBibf56utgpPFotBER/mQ32lUk
MD5 SHA1 SHA512 SSDEEP

Submit Download

HyewybI.exe

Path C:\Windows\System\HyewybI.exe
Size 5.2MB
SHA256 f3cd40512d44d29dc18858ace7c85b4adf80121cd12d3b5b6703055e3ca93842
MD5 95d461ba8bbbf43a4e4542010e3e5253
SHA1 cd533321a314cf60612d3c8ebc902d830a71d1de
SHA512 2634b60784770aaabfbc4134567646464879aa4be62e4981680ce7f95583a64568da1f4415478c1ae2a428f5dfce13a781b0e4b314f93663a63cb8c75fcfe258
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ls:RWWBibf56utgpPFotBER/mQ32lUY
MD5 SHA1 SHA512 SSDEEP

Submit Download

LXKfJyg.exe

Path C:\Windows\System\LXKfJyg.exe
Size 5.2MB
SHA256 7c1022be369123de4df21159e06be02ffff96944c672be3d16caeb1c36f45356
MD5 da5b6309428c4643d0611a713dd0e918
SHA1 b02a0d0010f3811dfb3cc0d0311b9f797d3d9b6e
SHA512 da9afb328133534a928a8beb2c558a06f78865ea823ad05969cd9d2593ac0fea725050079a84e51bfca22c118aea0025d66986b4fde56801e23141ba6e03cf53
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lv:RWWBibf56utgpPFotBER/mQ32lUr
MD5 SHA1 SHA512 SSDEEP

Submit Download

NyjjDQg.exe

Path C:\Windows\System\NyjjDQg.exe
Size 5.2MB
SHA256 3628813fb3ce5492a1219920ed11e688c42aa3ea24c7ef1d9317707e72907593
MD5 e9f70df960806c71c4c71be01b5f2532
SHA1 10bb0187b07c3bbc24fd3ecac65a391319e9bba5
SHA512 832c0821360fc3d6fb0b24021c9b7d14687f2fae20cc169daf89b79c878f410f76f0fbd483326cc56c7f14dd2c59553a7c76bcf353271a814d57eb27fc822ceb
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lM:RWWBibf56utgpPFotBER/mQ32lUI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ODjdwTr.exe

Path C:\Windows\System\ODjdwTr.exe
Size 5.2MB
SHA256 a5dff3cb66271f170f4898e1bd9bf43627575736d7d3e48d829829c5a9ab4824
MD5 f8aceda63fa114e372536e0258cd6a57
SHA1 4430120f3b17c2408e1efdabaaff0e7227d1674d
SHA512 1e240eb82b9144627a9c9722609967de3ad271f177c0f796c4a6449be49cc953d4de6c4364939186034b904eadd0a678f5582830213a5f17e8702569b3f2f47c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l4:RWWBibf56utgpPFotBER/mQ32lUc
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMEKVjf.exe

Path C:\Windows\System\SMEKVjf.exe
Size 5.2MB
SHA256 f118f3854b63ee01263ff5c7d481f4bbf34c98761f97a53fd6886bf78086ade2
MD5 ccdef7f90c4becaefcd64f05b88d8704
SHA1 e87f3abd750d0b943e384d03102220713f334370
SHA512 2e96e37c0042bcfde45a40d172c8ba9c42c735fa6c1b260dc626977764126c4296c89c78a1ddf5267d5a6c945c3d9cfe7bb120708c624973e21354f664f1e85f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lQ:RWWBibf56utgpPFotBER/mQ32lUk
MD5 SHA1 SHA512 SSDEEP

Submit Download

UvtSagI.exe

Path C:\Windows\System\UvtSagI.exe
Size 5.2MB
SHA256 3c68dddcb55d9d98eeab7e5c2d217dbdf4d032b6d334254f9bc2da85f591353b
MD5 d0766713dffdb0006142d82d1525e3d3
SHA1 e8619f512e472ff75e6e9ca63c7b81868245fd99
SHA512 b5ac5deebce855987761c2ca38000a7097950d2dacc0a33d89462f1257a4b42f9de172f45b65d519dab23413e9ec92389877a3775cf50a5444fa5c71f0e20a21
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lO:RWWBibf56utgpPFotBER/mQ32lUq
MD5 SHA1 SHA512 SSDEEP

Submit Download

aGjUAJD.exe

Path C:\Windows\System\aGjUAJD.exe
Size 5.2MB
SHA256 4290207b6bd9f34ecc1c824efcf957739d53be36890b83cb4df0610af7be28e0
MD5 4b653538123f0752df777e68e465cd54
SHA1 1bc8676eb85ad95b5de03b8d9d5c3cf0ac458ae7
SHA512 ff8d4a6c852203d7ad3cd168a2fd1a32524e43fe3fb2b9b5a3436349db07d89858f27dc3c5c9e493ffc7c9dce50c965e4a879ffba1b8db0e9ae9f66bcac05170
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lG:RWWBibf56utgpPFotBER/mQ32lUC
MD5 SHA1 SHA512 SSDEEP

Submit Download

dakVCIX.exe

Path C:\Windows\System\dakVCIX.exe
Size 5.2MB
SHA256 9e1663ace721a3beac72fa1089875064a9f49dc93c9cc7afaf54cec5d4d48a1c
MD5 a538de8fcf8825ffadc3f16aa522c4f3
SHA1 30acdd1ca00c83acf9ff8042b6f51152c98d87b8
SHA512 ca9f28bfd76f0fcfae85f3ef238120ccddde47f22299d14107c4c1c5573442e0f81530412bc7656efd41cc1e764b8f15d19528b285c2861602077c14d158e486
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUA
MD5 SHA1 SHA512 SSDEEP

Submit Download

fLImivm.exe

Path C:\Windows\System\fLImivm.exe
Size 5.2MB
SHA256 e4bf33d3425bbdf70698ffa5e4e6253a277fc000f410e1cf608e75a224cb0193
MD5 dae8d9c3543f4e4f5b1858beab7543ee
SHA1 b452e3fcbd8f6ff90848c0229b80faafd6395eec
SHA512 777be1fb3478d2392ab090762c52e152b33f1ea5a7ffc6c126300f0d175a40899f7d04299ff5d31214b1bda5cf4a4555d5bcdc385f3091e0a0649485a9dc6e1a
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUr
MD5 SHA1 SHA512 SSDEEP

Submit Download

gTPdPzo.exe

Path C:\Windows\System\gTPdPzo.exe
Size 5.2MB
SHA256 3bd9629333a1bdc052dc4ba7740ce778c2ffd41675f4b054929a51a1ae4de4e7
MD5 ade1ff03618a189c403f638d955fe231
SHA1 cfba20820c975c1cbf8b904de9cd7db0c2ed5a24
SHA512 15d87338dac98034fbe72f82c56d35119843a05bb1b70e597f3ed320fd4c856f6579e420a5cdf019e0ded923c626452418a4085b7f769b27b0563fdd1e93f939
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lK:RWWBibf56utgpPFotBER/mQ32lUW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jBYWEOm.exe

Path C:\Windows\System\jBYWEOm.exe
Size 5.2MB
SHA256 cf33424cd3c23e397d20c40319432b29b1122738c4efec7217b0a3df1708daec
MD5 59e7969fa8310564daf5192fd5e06172
SHA1 fccdaf86a5a9250006f5da359c251eb03ff0ae4d
SHA512 6f1654837f9fa151fa70eca2d5003e0f1f70c2565acd6155907cd6212e79694a17c7ecc761759f3a37140bd32386fa4d913a2ab6215a8094b52b75c0ef14a064
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lf:RWWBibf56utgpPFotBER/mQ32lUT
MD5 SHA1 SHA512 SSDEEP

Submit Download

lYJeRkk.exe

Path C:\Windows\System\lYJeRkk.exe
Size 5.2MB
SHA256 a6fce487197dd0a67b9881437835b07c4295e1eba332a72817e6b49a3b2b3041
MD5 ecc1085dd189dc7fdc9c12c74d467130
SHA1 98ca857e1e5c79a63d68c52a75989b23e73b9d4e
SHA512 1ce144716b75fd6753ae4a15471b76e4c88cdb15a5587f7abda1c3ce73c9bd60683a39724cd675e8b218a3845a2cd0186dbf5b79d77afa96bc258fa1d5d2ac9a
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lUf
MD5 SHA1 SHA512 SSDEEP

Submit Download

nNOcNWR.exe

Path C:\Windows\System\nNOcNWR.exe
Size 5.2MB
SHA256 6a9a4fe7379971ef07cb01b1dcf005a7b4b6a90e15209a2c8c70e202a3881c49
MD5 f5d97b098955984d91b6311178f87070
SHA1 a68b1826f3b6724bd8485eaaf03ef93b093a94b3
SHA512 c4725828b9b18449fbba1eb853c09c136dfd81091c049c899391c2b3fab94890931ccf499255f7189ede7f6410bf3d557c8f4d893b9e167ad8e4c3679169b42f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lT:RWWBibf56utgpPFotBER/mQ32lUv
MD5 SHA1 SHA512 SSDEEP

Submit Download

qiECaSQ.exe

Path C:\Windows\System\qiECaSQ.exe
Size 5.2MB
SHA256 e1304407bece75a8a012df8410532c89a8806179ef4d26aee1850ae8228f240b
MD5 17275e69fc29b1fc4ccd7eff3983f832
SHA1 087ce5560aa289c5b05b16cd38521701321065e8
SHA512 8b6dfca020bc8e248da6d6c844a5c01c1a0365f13b9b099547f262e79c4c67e540c015713931e2f52639aad38a00b961989f8541b58ef516596769236120cca9
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBibf56utgpPFotBER/mQ32lUl
MD5 SHA1 SHA512 SSDEEP

Submit Download

rEhckgK.exe

Path C:\Windows\System\rEhckgK.exe
Size 5.2MB
SHA256 0e33914a708c29e8f3d84a403a30ea24405c7b4b26e648d661ffa420eb02c5c2
MD5 c4478972e6a0faa3e0e4dbf5ad737396
SHA1 cdbad1b731b70220c25adf8d075c80fa11c87262
SHA512 db6d9bf957a8e98380d698d8b9116e99cd60b0415449a097888b67d1d8396769f93f0ff1107d3418f8fae5a415b6ae848f0fc399e78a8994ca41f13a56fafecd
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lf:RWWBibf56utgpPFotBER/mQ32lUT
MD5 SHA1 SHA512 SSDEEP

Submit Download

uOvcwVv.exe

Path C:\Windows\System\uOvcwVv.exe
Size 5.2MB
SHA256 e89d0dae4b06f0b664f477dec402e1244df78fbf2908bc97a9645e06c4ffb815
MD5 fa90a830663f33047254a947b0908117
SHA1 96dda7fbd39b26df7856509a6c17a9210a89f605
SHA512 7f4ec1fffb6b39f03f406130959ec4c149ad95a13378527c8e411e31e815c63678855023ad53e9e068fe1255c63f9e41209ff901c727835bab22bb0f3217d6c3
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lx:RWWBibf56utgpPFotBER/mQ32lUN
MD5 SHA1 SHA512 SSDEEP

Submit Download

wRozyUw.exe

Path C:\Windows\System\wRozyUw.exe
Size 5.2MB
SHA256 e2b69916206da41e996fb45fff817908da97fd08db19cb6e9816f1f4b4f3104f
MD5 c574d4a2a809a5afc4fe986083aa0e08
SHA1 232f3b69deb858786916843a32cb3290c2442fe5
SHA512 077524af07f1b9f9746a22e245499dbb266b5a48a252745feea5efc3f95bb72e66f77ce1e9f5b94614b4dff42515c595467fff4637ef8c948c245bc1d957d7c7
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l5:RWWBibf56utgpPFotBER/mQ32lUt
MD5 SHA1 SHA512 SSDEEP

Submit Download

yprRdQl.exe

Path C:\Windows\System\yprRdQl.exe
Size 5.2MB
SHA256 3959dfd929449b48b66941728463fc1c6444e4f339725146ca77845675cbee4f
MD5 896fd11b0bd3fbe47faebc72dff4e132
SHA1 3aa5acbe40570ce7b9dac0282a16543b7345b0f4
SHA512 929fb515c5c05194cbca167cf4c5d3c9bfeefaf95c2eae65c3271c410b590a9646929ca0eeb24c253a213808dc39639a87d36c587a9ea6d0326a7d772f8b9a54
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6li:RWWBibf56utgpPFotBER/mQ32lU2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/452-221-0x00007FF64F930000-0x00007FF64FC81000-memory.dmp

Download

memory/452-87-0x00007FF64F930000-0x00007FF64FC81000-memory.dmp

Download

memory/940-168-0x00007FF6C7A00000-0x00007FF6C7D51000-memory.dmp

Download

memory/940-0-0x00007FF6C7A00000-0x00007FF6C7D51000-memory.dmp

Download

memory/940-127-0x00007FF6C7A00000-0x00007FF6C7D51000-memory.dmp

Download

memory/940-130-0x00007FF6C7A00000-0x00007FF6C7D51000-memory.dmp

Download

memory/940-146-0x00007FF6C7A00000-0x00007FF6C7D51000-memory.dmp

Download

memory/940-1-0x000001A8CBE20000-0x000001A8CBE30000-memory.dmp

Download

memory/1156-126-0x00007FF777D60000-0x00007FF7780B1000-memory.dmp

Download

memory/1156-238-0x00007FF777D60000-0x00007FF7780B1000-memory.dmp

Download

memory/1456-218-0x00007FF6FFF70000-0x00007FF7002C1000-memory.dmp

Download

memory/1456-91-0x00007FF6FFF70000-0x00007FF7002C1000-memory.dmp

Download

memory/1612-224-0x00007FF7A9A40000-0x00007FF7A9D91000-memory.dmp

Download

memory/1612-142-0x00007FF7A9A40000-0x00007FF7A9D91000-memory.dmp

Download

memory/1612-70-0x00007FF7A9A40000-0x00007FF7A9D91000-memory.dmp

Download

memory/1616-228-0x00007FF75EDB0000-0x00007FF75F101000-memory.dmp

Download

memory/1616-151-0x00007FF75EDB0000-0x00007FF75F101000-memory.dmp

Download

memory/1616-113-0x00007FF75EDB0000-0x00007FF75F101000-memory.dmp

Download

memory/1944-138-0x00007FF732B90000-0x00007FF732EE1000-memory.dmp

Download

memory/1944-60-0x00007FF732B90000-0x00007FF732EE1000-memory.dmp

Download

memory/1944-214-0x00007FF732B90000-0x00007FF732EE1000-memory.dmp

Download

memory/2044-225-0x00007FF7032D0000-0x00007FF703621000-memory.dmp

Download

memory/2044-84-0x00007FF7032D0000-0x00007FF703621000-memory.dmp

Download

memory/2104-35-0x00007FF7BCEB0000-0x00007FF7BD201000-memory.dmp

Download

memory/2104-134-0x00007FF7BCEB0000-0x00007FF7BD201000-memory.dmp

Download

memory/2104-203-0x00007FF7BCEB0000-0x00007FF7BD201000-memory.dmp

Download

memory/2888-153-0x00007FF71F5F0000-0x00007FF71F941000-memory.dmp

Download

memory/2888-236-0x00007FF71F5F0000-0x00007FF71F941000-memory.dmp

Download

memory/2888-115-0x00007FF71F5F0000-0x00007FF71F941000-memory.dmp

Download

memory/2988-207-0x00007FF7D7C60000-0x00007FF7D7FB1000-memory.dmp

Download

memory/2988-135-0x00007FF7D7C60000-0x00007FF7D7FB1000-memory.dmp

Download

memory/2988-40-0x00007FF7D7C60000-0x00007FF7D7FB1000-memory.dmp

Download

memory/3076-211-0x00007FF69EEE0000-0x00007FF69F231000-memory.dmp

Download

memory/3076-77-0x00007FF69EEE0000-0x00007FF69F231000-memory.dmp

Download

memory/3132-74-0x00007FF6F7270000-0x00007FF6F75C1000-memory.dmp

Download

memory/3132-220-0x00007FF6F7270000-0x00007FF6F75C1000-memory.dmp

Download

memory/3132-144-0x00007FF6F7270000-0x00007FF6F75C1000-memory.dmp

Download

memory/3268-98-0x00007FF7F8BF0000-0x00007FF7F8F41000-memory.dmp

Download

memory/3268-230-0x00007FF7F8BF0000-0x00007FF7F8F41000-memory.dmp

Download

memory/3268-150-0x00007FF7F8BF0000-0x00007FF7F8F41000-memory.dmp

Download

memory/4016-205-0x00007FF603880000-0x00007FF603BD1000-memory.dmp

Download

memory/4016-51-0x00007FF603880000-0x00007FF603BD1000-memory.dmp

Download

memory/4044-199-0x00007FF6BA010000-0x00007FF6BA361000-memory.dmp

Download

memory/4044-16-0x00007FF6BA010000-0x00007FF6BA361000-memory.dmp

Download

memory/4044-132-0x00007FF6BA010000-0x00007FF6BA361000-memory.dmp

Download

memory/4248-125-0x00007FF671A60000-0x00007FF671DB1000-memory.dmp

Download

memory/4248-235-0x00007FF671A60000-0x00007FF671DB1000-memory.dmp

Download

memory/4460-197-0x00007FF69B590000-0x00007FF69B8E1000-memory.dmp

Download

memory/4460-6-0x00007FF69B590000-0x00007FF69B8E1000-memory.dmp

Download

memory/4460-129-0x00007FF69B590000-0x00007FF69B8E1000-memory.dmp

Download

memory/4532-234-0x00007FF6E6860000-0x00007FF6E6BB1000-memory.dmp

Download

memory/4532-128-0x00007FF6E6860000-0x00007FF6E6BB1000-memory.dmp

Download

memory/4572-67-0x00007FF7F5970000-0x00007FF7F5CC1000-memory.dmp

Download

memory/4572-140-0x00007FF7F5970000-0x00007FF7F5CC1000-memory.dmp

Download

memory/4572-215-0x00007FF7F5970000-0x00007FF7F5CC1000-memory.dmp

Download

memory/4824-39-0x00007FF6B1C10000-0x00007FF6B1F61000-memory.dmp

Download

memory/4824-137-0x00007FF6B1C10000-0x00007FF6B1F61000-memory.dmp

Download

memory/4824-210-0x00007FF6B1C10000-0x00007FF6B1F61000-memory.dmp

Download

memory/4988-28-0x00007FF779E10000-0x00007FF77A161000-memory.dmp

Download

memory/4988-133-0x00007FF779E10000-0x00007FF77A161000-memory.dmp

Download

memory/4988-201-0x00007FF779E10000-0x00007FF77A161000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads