cobaltstrike | 517bdbf155a63b02f11654281e68f8914796e5553d732c2806d139c16534ca4e

Analysis

max time kernel
137s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 23:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
Size 6.0MB
Sample240531-3z2eaaba59
SHA256 517bdbf155a63b02f11654281e68f8914796e5553d732c2806d139c16534ca4e
MD5 ae874c2369a506659cab949431265e67
SHA1 0881cc5a071dd75646ecf8d0faaf3c06a2eb7279
SHA512 580533571e8783a834c6fbe77846a1c04349eeaac1349a3fa8391ccf957d4e7044f0462eb84de07777580ef915f2e9716651a82d47d1223a843897f394301bfe
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:T+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000800000002340b-5.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340d-11.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340c-12.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340e-24.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340f-28.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023410-34.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023412-48.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023413-53.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023414-63.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023416-74.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023415-71.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023411-41.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000022a94-84.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000002335e-99.dat	cobalt_reflective_dll
behavioral2/files/0x000c00000002335f-105.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-112.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341b-121.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341a-124.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023419-122.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000002335d-95.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023409-90.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000800000002340b-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340d-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340c-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340e-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340f-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023410-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023412-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023413-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023414-63.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023416-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023415-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023411-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a000000022a94-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000002335e-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000c00000002335f-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341b-121.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341a-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023419-122.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000002335d-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023409-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2392-0-0x00007FF6B0CC0000-0x00007FF6B1014000-memory.dmp	UPX
behavioral2/files/0x000800000002340b-5.dat	UPX
behavioral2/memory/432-14-0x00007FF63A010000-0x00007FF63A364000-memory.dmp	UPX
behavioral2/files/0x000700000002340d-11.dat	UPX
behavioral2/files/0x000700000002340c-12.dat	UPX
behavioral2/memory/1604-8-0x00007FF7F00D0000-0x00007FF7F0424000-memory.dmp	UPX
behavioral2/files/0x000700000002340e-24.dat	UPX
behavioral2/files/0x000700000002340f-28.dat	UPX
behavioral2/files/0x0007000000023410-34.dat	UPX
behavioral2/memory/3932-37-0x00007FF780D30000-0x00007FF781084000-memory.dmp	UPX
behavioral2/files/0x0007000000023412-48.dat	UPX
behavioral2/files/0x0007000000023413-53.dat	UPX
behavioral2/files/0x0007000000023414-63.dat	UPX
behavioral2/memory/4960-68-0x00007FF739260000-0x00007FF7395B4000-memory.dmp	UPX
behavioral2/memory/1604-69-0x00007FF7F00D0000-0x00007FF7F0424000-memory.dmp	UPX
behavioral2/memory/4956-77-0x00007FF7F7600000-0x00007FF7F7954000-memory.dmp	UPX
behavioral2/memory/432-76-0x00007FF63A010000-0x00007FF63A364000-memory.dmp	UPX
behavioral2/files/0x0007000000023416-74.dat	UPX
behavioral2/files/0x0007000000023415-71.dat	UPX
behavioral2/memory/1584-70-0x00007FF62FE30000-0x00007FF630184000-memory.dmp	UPX
behavioral2/memory/2392-60-0x00007FF6B0CC0000-0x00007FF6B1014000-memory.dmp	UPX
behavioral2/memory/5116-59-0x00007FF7262D0000-0x00007FF726624000-memory.dmp	UPX
behavioral2/memory/4252-57-0x00007FF6C2EB0000-0x00007FF6C3204000-memory.dmp	UPX
behavioral2/memory/2016-45-0x00007FF6948C0000-0x00007FF694C14000-memory.dmp	UPX
behavioral2/files/0x0007000000023411-41.dat	UPX
behavioral2/memory/4548-32-0x00007FF70EC30000-0x00007FF70EF84000-memory.dmp	UPX
behavioral2/memory/1952-27-0x00007FF7DEE40000-0x00007FF7DF194000-memory.dmp	UPX
behavioral2/memory/1856-20-0x00007FF716A70000-0x00007FF716DC4000-memory.dmp	UPX
behavioral2/files/0x000a000000022a94-84.dat	UPX
behavioral2/files/0x000b00000002335e-99.dat	UPX
behavioral2/memory/4356-104-0x00007FF629600000-0x00007FF629954000-memory.dmp	UPX
behavioral2/files/0x000c00000002335f-105.dat	UPX
behavioral2/files/0x0007000000023417-112.dat	UPX
behavioral2/files/0x000700000002341b-121.dat	UPX
behavioral2/files/0x000700000002341a-124.dat	UPX
behavioral2/files/0x0007000000023419-122.dat	UPX
behavioral2/memory/216-115-0x00007FF653D70000-0x00007FF6540C4000-memory.dmp	UPX
behavioral2/memory/3932-101-0x00007FF780D30000-0x00007FF781084000-memory.dmp	UPX
behavioral2/memory/2516-96-0x00007FF7CBA60000-0x00007FF7CBDB4000-memory.dmp	UPX
behavioral2/files/0x000b00000002335d-95.dat	UPX
behavioral2/files/0x0008000000023409-90.dat	UPX
behavioral2/memory/2564-89-0x00007FF7E79C0000-0x00007FF7E7D14000-memory.dmp	UPX
behavioral2/memory/3312-83-0x00007FF6E61D0000-0x00007FF6E6524000-memory.dmp	UPX
behavioral2/memory/4400-128-0x00007FF613E40000-0x00007FF614194000-memory.dmp	UPX
behavioral2/memory/4184-130-0x00007FF644180000-0x00007FF6444D4000-memory.dmp	UPX
behavioral2/memory/1376-129-0x00007FF7AE640000-0x00007FF7AE994000-memory.dmp	UPX
behavioral2/memory/3532-131-0x00007FF60C260000-0x00007FF60C5B4000-memory.dmp	UPX
behavioral2/memory/4960-132-0x00007FF739260000-0x00007FF7395B4000-memory.dmp	UPX
behavioral2/memory/1584-133-0x00007FF62FE30000-0x00007FF630184000-memory.dmp	UPX
behavioral2/memory/3312-134-0x00007FF6E61D0000-0x00007FF6E6524000-memory.dmp	UPX
behavioral2/memory/2564-135-0x00007FF7E79C0000-0x00007FF7E7D14000-memory.dmp	UPX
behavioral2/memory/2516-136-0x00007FF7CBA60000-0x00007FF7CBDB4000-memory.dmp	UPX
behavioral2/memory/4400-137-0x00007FF613E40000-0x00007FF614194000-memory.dmp	UPX
behavioral2/memory/1604-138-0x00007FF7F00D0000-0x00007FF7F0424000-memory.dmp	UPX
behavioral2/memory/432-139-0x00007FF63A010000-0x00007FF63A364000-memory.dmp	UPX
behavioral2/memory/1856-140-0x00007FF716A70000-0x00007FF716DC4000-memory.dmp	UPX
behavioral2/memory/1952-141-0x00007FF7DEE40000-0x00007FF7DF194000-memory.dmp	UPX
behavioral2/memory/4548-142-0x00007FF70EC30000-0x00007FF70EF84000-memory.dmp	UPX
behavioral2/memory/3932-143-0x00007FF780D30000-0x00007FF781084000-memory.dmp	UPX
behavioral2/memory/2016-144-0x00007FF6948C0000-0x00007FF694C14000-memory.dmp	UPX
behavioral2/memory/4252-145-0x00007FF6C2EB0000-0x00007FF6C3204000-memory.dmp	UPX
behavioral2/memory/5116-146-0x00007FF7262D0000-0x00007FF726624000-memory.dmp	UPX
behavioral2/memory/4960-147-0x00007FF739260000-0x00007FF7395B4000-memory.dmp	UPX
behavioral2/memory/1584-149-0x00007FF62FE30000-0x00007FF630184000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2392-0-0x00007FF6B0CC0000-0x00007FF6B1014000-memory.dmp	xmrig
behavioral2/files/0x000800000002340b-5.dat	xmrig
behavioral2/memory/432-14-0x00007FF63A010000-0x00007FF63A364000-memory.dmp	xmrig
behavioral2/files/0x000700000002340d-11.dat	xmrig
behavioral2/files/0x000700000002340c-12.dat	xmrig
behavioral2/memory/1604-8-0x00007FF7F00D0000-0x00007FF7F0424000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-24.dat	xmrig
behavioral2/files/0x000700000002340f-28.dat	xmrig
behavioral2/files/0x0007000000023410-34.dat	xmrig
behavioral2/memory/3932-37-0x00007FF780D30000-0x00007FF781084000-memory.dmp	xmrig
behavioral2/files/0x0007000000023412-48.dat	xmrig
behavioral2/files/0x0007000000023413-53.dat	xmrig
behavioral2/files/0x0007000000023414-63.dat	xmrig
behavioral2/memory/4960-68-0x00007FF739260000-0x00007FF7395B4000-memory.dmp	xmrig
behavioral2/memory/1604-69-0x00007FF7F00D0000-0x00007FF7F0424000-memory.dmp	xmrig
behavioral2/memory/4956-77-0x00007FF7F7600000-0x00007FF7F7954000-memory.dmp	xmrig
behavioral2/memory/432-76-0x00007FF63A010000-0x00007FF63A364000-memory.dmp	xmrig
behavioral2/files/0x0007000000023416-74.dat	xmrig
behavioral2/files/0x0007000000023415-71.dat	xmrig
behavioral2/memory/1584-70-0x00007FF62FE30000-0x00007FF630184000-memory.dmp	xmrig
behavioral2/memory/2392-60-0x00007FF6B0CC0000-0x00007FF6B1014000-memory.dmp	xmrig
behavioral2/memory/5116-59-0x00007FF7262D0000-0x00007FF726624000-memory.dmp	xmrig
behavioral2/memory/4252-57-0x00007FF6C2EB0000-0x00007FF6C3204000-memory.dmp	xmrig
behavioral2/memory/2016-45-0x00007FF6948C0000-0x00007FF694C14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-41.dat	xmrig
behavioral2/memory/4548-32-0x00007FF70EC30000-0x00007FF70EF84000-memory.dmp	xmrig
behavioral2/memory/1952-27-0x00007FF7DEE40000-0x00007FF7DF194000-memory.dmp	xmrig
behavioral2/memory/1856-20-0x00007FF716A70000-0x00007FF716DC4000-memory.dmp	xmrig
behavioral2/files/0x000a000000022a94-84.dat	xmrig
behavioral2/files/0x000b00000002335e-99.dat	xmrig
behavioral2/memory/4356-104-0x00007FF629600000-0x00007FF629954000-memory.dmp	xmrig
behavioral2/files/0x000c00000002335f-105.dat	xmrig
behavioral2/files/0x0007000000023417-112.dat	xmrig
behavioral2/files/0x000700000002341b-121.dat	xmrig
behavioral2/files/0x000700000002341a-124.dat	xmrig
behavioral2/files/0x0007000000023419-122.dat	xmrig
behavioral2/memory/216-115-0x00007FF653D70000-0x00007FF6540C4000-memory.dmp	xmrig
behavioral2/memory/3932-101-0x00007FF780D30000-0x00007FF781084000-memory.dmp	xmrig
behavioral2/memory/2516-96-0x00007FF7CBA60000-0x00007FF7CBDB4000-memory.dmp	xmrig
behavioral2/files/0x000b00000002335d-95.dat	xmrig
behavioral2/files/0x0008000000023409-90.dat	xmrig
behavioral2/memory/2564-89-0x00007FF7E79C0000-0x00007FF7E7D14000-memory.dmp	xmrig
behavioral2/memory/3312-83-0x00007FF6E61D0000-0x00007FF6E6524000-memory.dmp	xmrig
behavioral2/memory/4400-128-0x00007FF613E40000-0x00007FF614194000-memory.dmp	xmrig
behavioral2/memory/4184-130-0x00007FF644180000-0x00007FF6444D4000-memory.dmp	xmrig
behavioral2/memory/1376-129-0x00007FF7AE640000-0x00007FF7AE994000-memory.dmp	xmrig
behavioral2/memory/3532-131-0x00007FF60C260000-0x00007FF60C5B4000-memory.dmp	xmrig
behavioral2/memory/4960-132-0x00007FF739260000-0x00007FF7395B4000-memory.dmp	xmrig
behavioral2/memory/1584-133-0x00007FF62FE30000-0x00007FF630184000-memory.dmp	xmrig
behavioral2/memory/3312-134-0x00007FF6E61D0000-0x00007FF6E6524000-memory.dmp	xmrig
behavioral2/memory/2564-135-0x00007FF7E79C0000-0x00007FF7E7D14000-memory.dmp	xmrig
behavioral2/memory/2516-136-0x00007FF7CBA60000-0x00007FF7CBDB4000-memory.dmp	xmrig
behavioral2/memory/4400-137-0x00007FF613E40000-0x00007FF614194000-memory.dmp	xmrig
behavioral2/memory/1604-138-0x00007FF7F00D0000-0x00007FF7F0424000-memory.dmp	xmrig
behavioral2/memory/432-139-0x00007FF63A010000-0x00007FF63A364000-memory.dmp	xmrig
behavioral2/memory/1856-140-0x00007FF716A70000-0x00007FF716DC4000-memory.dmp	xmrig
behavioral2/memory/1952-141-0x00007FF7DEE40000-0x00007FF7DF194000-memory.dmp	xmrig
behavioral2/memory/4548-142-0x00007FF70EC30000-0x00007FF70EF84000-memory.dmp	xmrig
behavioral2/memory/3932-143-0x00007FF780D30000-0x00007FF781084000-memory.dmp	xmrig
behavioral2/memory/2016-144-0x00007FF6948C0000-0x00007FF694C14000-memory.dmp	xmrig
behavioral2/memory/4252-145-0x00007FF6C2EB0000-0x00007FF6C3204000-memory.dmp	xmrig
behavioral2/memory/5116-146-0x00007FF7262D0000-0x00007FF726624000-memory.dmp	xmrig
behavioral2/memory/4960-147-0x00007FF739260000-0x00007FF7395B4000-memory.dmp	xmrig
behavioral2/memory/1584-149-0x00007FF62FE30000-0x00007FF630184000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1604	kRBTuhS.exe
432	MQolYzD.exe
1856	uzVIwhJ.exe
1952	gxTAIOZ.exe
4548	CVspCSa.exe
3932	qAVHaCq.exe
2016	DMEJXCk.exe
4252	CTrIXGs.exe
5116	tNsRpkJ.exe
4960	qzQdzaO.exe
1584	QkLYbfD.exe
4956	OxGZffy.exe
3312	DBHWFDT.exe
2564	aLpRTUe.exe
2516	mJkZlKX.exe
4356	pvlpTnI.exe
216	COYcIJW.exe
4184	owkIcVK.exe
4400	LlDrurp.exe
3532	ITpCnUH.exe
1376	CgGdAST.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2392-0-0x00007FF6B0CC0000-0x00007FF6B1014000-memory.dmp	upx
behavioral2/files/0x000800000002340b-5.dat	upx
behavioral2/memory/432-14-0x00007FF63A010000-0x00007FF63A364000-memory.dmp	upx
behavioral2/files/0x000700000002340d-11.dat	upx
behavioral2/files/0x000700000002340c-12.dat	upx
behavioral2/memory/1604-8-0x00007FF7F00D0000-0x00007FF7F0424000-memory.dmp	upx
behavioral2/files/0x000700000002340e-24.dat	upx
behavioral2/files/0x000700000002340f-28.dat	upx
behavioral2/files/0x0007000000023410-34.dat	upx
behavioral2/memory/3932-37-0x00007FF780D30000-0x00007FF781084000-memory.dmp	upx
behavioral2/files/0x0007000000023412-48.dat	upx
behavioral2/files/0x0007000000023413-53.dat	upx
behavioral2/files/0x0007000000023414-63.dat	upx
behavioral2/memory/4960-68-0x00007FF739260000-0x00007FF7395B4000-memory.dmp	upx
behavioral2/memory/1604-69-0x00007FF7F00D0000-0x00007FF7F0424000-memory.dmp	upx
behavioral2/memory/4956-77-0x00007FF7F7600000-0x00007FF7F7954000-memory.dmp	upx
behavioral2/memory/432-76-0x00007FF63A010000-0x00007FF63A364000-memory.dmp	upx
behavioral2/files/0x0007000000023416-74.dat	upx
behavioral2/files/0x0007000000023415-71.dat	upx
behavioral2/memory/1584-70-0x00007FF62FE30000-0x00007FF630184000-memory.dmp	upx
behavioral2/memory/2392-60-0x00007FF6B0CC0000-0x00007FF6B1014000-memory.dmp	upx
behavioral2/memory/5116-59-0x00007FF7262D0000-0x00007FF726624000-memory.dmp	upx
behavioral2/memory/4252-57-0x00007FF6C2EB0000-0x00007FF6C3204000-memory.dmp	upx
behavioral2/memory/2016-45-0x00007FF6948C0000-0x00007FF694C14000-memory.dmp	upx
behavioral2/files/0x0007000000023411-41.dat	upx
behavioral2/memory/4548-32-0x00007FF70EC30000-0x00007FF70EF84000-memory.dmp	upx
behavioral2/memory/1952-27-0x00007FF7DEE40000-0x00007FF7DF194000-memory.dmp	upx
behavioral2/memory/1856-20-0x00007FF716A70000-0x00007FF716DC4000-memory.dmp	upx
behavioral2/files/0x000a000000022a94-84.dat	upx
behavioral2/files/0x000b00000002335e-99.dat	upx
behavioral2/memory/4356-104-0x00007FF629600000-0x00007FF629954000-memory.dmp	upx
behavioral2/files/0x000c00000002335f-105.dat	upx
behavioral2/files/0x0007000000023417-112.dat	upx
behavioral2/files/0x000700000002341b-121.dat	upx
behavioral2/files/0x000700000002341a-124.dat	upx
behavioral2/files/0x0007000000023419-122.dat	upx
behavioral2/memory/216-115-0x00007FF653D70000-0x00007FF6540C4000-memory.dmp	upx
behavioral2/memory/3932-101-0x00007FF780D30000-0x00007FF781084000-memory.dmp	upx
behavioral2/memory/2516-96-0x00007FF7CBA60000-0x00007FF7CBDB4000-memory.dmp	upx
behavioral2/files/0x000b00000002335d-95.dat	upx
behavioral2/files/0x0008000000023409-90.dat	upx
behavioral2/memory/2564-89-0x00007FF7E79C0000-0x00007FF7E7D14000-memory.dmp	upx
behavioral2/memory/3312-83-0x00007FF6E61D0000-0x00007FF6E6524000-memory.dmp	upx
behavioral2/memory/4400-128-0x00007FF613E40000-0x00007FF614194000-memory.dmp	upx
behavioral2/memory/4184-130-0x00007FF644180000-0x00007FF6444D4000-memory.dmp	upx
behavioral2/memory/1376-129-0x00007FF7AE640000-0x00007FF7AE994000-memory.dmp	upx
behavioral2/memory/3532-131-0x00007FF60C260000-0x00007FF60C5B4000-memory.dmp	upx
behavioral2/memory/4960-132-0x00007FF739260000-0x00007FF7395B4000-memory.dmp	upx
behavioral2/memory/1584-133-0x00007FF62FE30000-0x00007FF630184000-memory.dmp	upx
behavioral2/memory/3312-134-0x00007FF6E61D0000-0x00007FF6E6524000-memory.dmp	upx
behavioral2/memory/2564-135-0x00007FF7E79C0000-0x00007FF7E7D14000-memory.dmp	upx
behavioral2/memory/2516-136-0x00007FF7CBA60000-0x00007FF7CBDB4000-memory.dmp	upx
behavioral2/memory/4400-137-0x00007FF613E40000-0x00007FF614194000-memory.dmp	upx
behavioral2/memory/1604-138-0x00007FF7F00D0000-0x00007FF7F0424000-memory.dmp	upx
behavioral2/memory/432-139-0x00007FF63A010000-0x00007FF63A364000-memory.dmp	upx
behavioral2/memory/1856-140-0x00007FF716A70000-0x00007FF716DC4000-memory.dmp	upx
behavioral2/memory/1952-141-0x00007FF7DEE40000-0x00007FF7DF194000-memory.dmp	upx
behavioral2/memory/4548-142-0x00007FF70EC30000-0x00007FF70EF84000-memory.dmp	upx
behavioral2/memory/3932-143-0x00007FF780D30000-0x00007FF781084000-memory.dmp	upx
behavioral2/memory/2016-144-0x00007FF6948C0000-0x00007FF694C14000-memory.dmp	upx
behavioral2/memory/4252-145-0x00007FF6C2EB0000-0x00007FF6C3204000-memory.dmp	upx
behavioral2/memory/5116-146-0x00007FF7262D0000-0x00007FF726624000-memory.dmp	upx
behavioral2/memory/4960-147-0x00007FF739260000-0x00007FF7395B4000-memory.dmp	upx
behavioral2/memory/1584-149-0x00007FF62FE30000-0x00007FF630184000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\tNsRpkJ.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DBHWFDT.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\COYcIJW.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\owkIcVK.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LlDrurp.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MQolYzD.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gxTAIOZ.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aLpRTUe.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mJkZlKX.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ITpCnUH.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qAVHaCq.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CTrIXGs.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CVspCSa.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DMEJXCk.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pvlpTnI.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CgGdAST.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kRBTuhS.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uzVIwhJ.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OxGZffy.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qzQdzaO.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QkLYbfD.exe	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1604	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	85
PID 2392 wrote to memory of 1604	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	85
PID 2392 wrote to memory of 432	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	86
PID 2392 wrote to memory of 432	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	86
PID 2392 wrote to memory of 1856	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	88
PID 2392 wrote to memory of 1856	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	88
PID 2392 wrote to memory of 1952	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	91
PID 2392 wrote to memory of 1952	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	91
PID 2392 wrote to memory of 4548	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	92
PID 2392 wrote to memory of 4548	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	92
PID 2392 wrote to memory of 3932	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	93
PID 2392 wrote to memory of 3932	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	93
PID 2392 wrote to memory of 2016	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	94
PID 2392 wrote to memory of 2016	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	94
PID 2392 wrote to memory of 4252	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	95
PID 2392 wrote to memory of 4252	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	95
PID 2392 wrote to memory of 5116	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	96
PID 2392 wrote to memory of 5116	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	96
PID 2392 wrote to memory of 4960	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	97
PID 2392 wrote to memory of 4960	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	97
PID 2392 wrote to memory of 1584	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	98
PID 2392 wrote to memory of 1584	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	98
PID 2392 wrote to memory of 4956	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	99
PID 2392 wrote to memory of 4956	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	99
PID 2392 wrote to memory of 3312	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	100
PID 2392 wrote to memory of 3312	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	100
PID 2392 wrote to memory of 2564	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	101
PID 2392 wrote to memory of 2564	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	101
PID 2392 wrote to memory of 2516	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	102
PID 2392 wrote to memory of 2516	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	102
PID 2392 wrote to memory of 4356	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	103
PID 2392 wrote to memory of 4356	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	103
PID 2392 wrote to memory of 216	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	104
PID 2392 wrote to memory of 216	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	104
PID 2392 wrote to memory of 4184	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	105
PID 2392 wrote to memory of 4184	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	105
PID 2392 wrote to memory of 4400	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	106
PID 2392 wrote to memory of 4400	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	106
PID 2392 wrote to memory of 3532	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	107
PID 2392 wrote to memory of 3532	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	107
PID 2392 wrote to memory of 1376	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	108
PID 2392 wrote to memory of 1376	2392	2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe	108

C:\Users\Admin\AppData\Local\Temp\2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_ae874c2369a506659cab949431265e67_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\System\kRBTuhS.exe
  C:\Windows\System\kRBTuhS.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\MQolYzD.exe
  C:\Windows\System\MQolYzD.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\uzVIwhJ.exe
  C:\Windows\System\uzVIwhJ.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\gxTAIOZ.exe
  C:\Windows\System\gxTAIOZ.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\CVspCSa.exe
  C:\Windows\System\CVspCSa.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\qAVHaCq.exe
  C:\Windows\System\qAVHaCq.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\DMEJXCk.exe
  C:\Windows\System\DMEJXCk.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\CTrIXGs.exe
  C:\Windows\System\CTrIXGs.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\tNsRpkJ.exe
  C:\Windows\System\tNsRpkJ.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\qzQdzaO.exe
  C:\Windows\System\qzQdzaO.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\QkLYbfD.exe
  C:\Windows\System\QkLYbfD.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\OxGZffy.exe
  C:\Windows\System\OxGZffy.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\DBHWFDT.exe
  C:\Windows\System\DBHWFDT.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\aLpRTUe.exe
  C:\Windows\System\aLpRTUe.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\mJkZlKX.exe
  C:\Windows\System\mJkZlKX.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\pvlpTnI.exe
  C:\Windows\System\pvlpTnI.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\COYcIJW.exe
  C:\Windows\System\COYcIJW.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\owkIcVK.exe
  C:\Windows\System\owkIcVK.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\LlDrurp.exe
  C:\Windows\System\LlDrurp.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\ITpCnUH.exe
  C:\Windows\System\ITpCnUH.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\CgGdAST.exe
  C:\Windows\System\CgGdAST.exe
  2⤵
  - Executes dropped EXE
  PID:1376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

COYcIJW.exe

Path C:\Windows\System\COYcIJW.exe
Size 6.0MB
SHA256 72582fd0db17a9f2f4898cef44600e82d0217c31d3d524e49b8ee234f44d580d
MD5 125d80844990b85ff07571edb040ab7e
SHA1 343eccf680a37ce3a264e08f424bdf3023f629bb
SHA512 58d989986074b23485988e312c2c7c5e49128487036f28370a56a691130112492c01aa33b86b4112895a6fa8729e11a1364ed3e7c25a60d62e9c3130ca1c2b19
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:T+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

CTrIXGs.exe

Path C:\Windows\System\CTrIXGs.exe
Size 6.0MB
SHA256 5681896cadca79c9edbdafc6e65eabd8ae7eaeba8664bc39bde758c5b2bcc5ad
MD5 08cfae20ae245113ba6cfee0b245d490
SHA1 765bf556a352460855650884866732fa03797765
SHA512 84467e054897fd4c6f5b8dbbd2d658c21e5befcf36259eed263417c728ed6f3e18e2956fa27d1d33cb2a5826a2f61af792ef031b89e2f7d8ce7fb964936e9e15
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:T+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

CVspCSa.exe

Path C:\Windows\System\CVspCSa.exe
Size 6.0MB
SHA256 4322b5aed0f85879907fac596ec7dba36a77240fd3a520950afa79947a6f5dc8
MD5 adab3d03dc9c83e3b7d8aa36f1be510f
SHA1 752397389db0723d4ddf54c7b8b244b8a35e5636
SHA512 acfc5156acfa93080fd6455c019a32011aa33ace0c3a0af6b51b265c2c1413ec3677b412a0949e8bd34790e9d8c5dcf2e6151d456abe9cf54c90a625636f109e
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:T+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

CgGdAST.exe

Path C:\Windows\System\CgGdAST.exe
Size 6.0MB
SHA256 2beae0a318b665ba247f4b18e09cf0769164113c945e525a96e6af6702d293d6
MD5 5591d252ef25b2db1441283ba5c334d9
SHA1 6d4fcfbd50cd8e7f619bb3613135247ef7e4131f
SHA512 3607a69be54d6d810569b9599740c62e1572ac2074e0a36a4f6f4a12dd78909bbb8fd4e53248f2ccec68d513db35def0b4620b7a04019aec7e28a4c13009d4ce
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:T+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

DBHWFDT.exe

Path C:\Windows\System\DBHWFDT.exe
Size 6.0MB
SHA256 9ae0af1c29569dc5a11d61687579789c302d8af4653d82185a8672115fa9737b
MD5 4d782c4e84c6ee28221391c53b931566
SHA1 afd5b1db43dc2d0bcee14f4bfaafa636fa2077e0
SHA512 271c6b38785023055e8fdabae3cc4c97069be1cdaf7387aeea3cd1c9fa0c456691d4c0c4653270435a19d42657b23017f6a1f28086c778ede8240fc6ab3d9bb0
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:T+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

DMEJXCk.exe

Path C:\Windows\System\DMEJXCk.exe
Size 6.0MB
SHA256 2fd18395757cf7ff5d3155b916607317929ec98349420af1ddc93c134034ab66
MD5 b2acbae0c5f8ba11151558db74a34ae3
SHA1 fc4ac890a93ad843e010744f0542f91c92cee99b
SHA512 633ba104251f530b58dfc026f1f7293723c8c02dbe4d50533e7b3475de4e487ccbead5354a1426de632a8e0182ef5d8123551232f0769a53ff8b66ff6c82c1b0
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:T+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

ITpCnUH.exe

Path C:\Windows\System\ITpCnUH.exe
Size 6.0MB
SHA256 6fc969f89b01e97b319ecf0a100fb3dac951d28fa7eb3ba18aca2c23e0488aba
MD5 cd80e7e20cd529398aa3627c1b99156d
SHA1 39fa559bcb47e3076f247a977288d24e58412e70
SHA512 75f6ffb3a954b2442a9a6a6a92047d1aede79f0c6597aea236aa81da2219172c4531d41b1ba4a23b6f90883b79eda6235f2dd15d34a585510971ac64e8b29462
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:T+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

LlDrurp.exe

Path C:\Windows\System\LlDrurp.exe
Size 6.0MB
SHA256 f28e211642cdfd8551b80a4316288e496de9063f9869ee3b421ab60c543d6906
MD5 9156660151e7c86fa3c829e889638b59
SHA1 790840256d4bb8b34c0b0428bbc5e087b0261ee0
SHA512 9088ef5d017f9376d15b9c1cb52836f94e4fbcb3c2d42c602a3d2717d9336d31cf86dbca9876ebee11a66948e8f243071725feca6078dc8088c811f7aaea0ee4
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:T+856utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

MQolYzD.exe

Path C:\Windows\System\MQolYzD.exe
Size 6.0MB
SHA256 1e3b87e47dededac09385f2021bc5f643a61f1c55bf59a2236d9105e41d87f0c
MD5 43c3a6fa54923e6f0cdf582aeb6b4fc9
SHA1 ce4a25f70928915031db5797c21b5d11ff7147cf
SHA512 a59b6a1c790bae58a1b4dd8e897c3ca612e9d8b92fc8bb402ec50c324d46a87161c79064219bb03090611326b5991fba03835cccf8c0e781bf9b87b6b8187cab
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:T+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

OxGZffy.exe

Path C:\Windows\System\OxGZffy.exe
Size 6.0MB
SHA256 9d69de4698f1c07835e74bf26d8e18750e502a59b66124772b835d13d5027515
MD5 5e6f8f6583c64c6557717a2aba025bdb
SHA1 47abc8ba618c836dfba8b731d827fb4cc22e690d
SHA512 a2ca5fac6cdb4fb1d691dd1cd50db94bf9fb481142dddfd08207d3362867481628947873febabbd4316108f7a8f39d692f058bbed6d199b1f5882ed5ac44d559
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:T+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

QkLYbfD.exe

Path C:\Windows\System\QkLYbfD.exe
Size 6.0MB
SHA256 64e443372c2df55946566b2987bd0029c3cbf4bb986bf93fd0883135f2a62a47
MD5 f8b1311e7aef8a2a8b07a9194e43cbbe
SHA1 dc31b6efa06682f1e09b418af5ba46a52d21cbf4
SHA512 398ba30b8bc5af7ddcafad4afc47f6d4a4c98d239ad79c036bddd753ab62b6e365ceab735a66859ea5a586d2ae5d224af132fe97e12ec4d009632326894b066c
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:T+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

aLpRTUe.exe

Path C:\Windows\System\aLpRTUe.exe
Size 6.0MB
SHA256 f91c75890a553eff400bf42df4434fdffedc992e05a28bbc1a50be55ee1bced5
MD5 143e4efcc905d4d9a337d2019c6c94d3
SHA1 dfae939420c4ccedb5091846fcb269c16ee62fdf
SHA512 710b6359da6e8d87937b2beb2d889cd1cea6192922f9890d5caaa8c5604944e02dd695a5c48845149f08ed76c0bdecc819835cb6a9c3a7aca290eb42f2e6a32f
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:T+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

gxTAIOZ.exe

Path C:\Windows\System\gxTAIOZ.exe
Size 6.0MB
SHA256 0369dd50349f4637a8acb3f9a06e9b8770d13d2f81947e8d9920755dd5f58757
MD5 a32cd300f16fc7a9a41936a19107bd02
SHA1 8a60eaa00c2b93f190df5d7de220da7be078a401
SHA512 ac3dad76aa613bbd776e9145db25bd2b33bf822d68e673781b3ca80a5069ce5432720caf991c23b8791600210ca0342dce4cb374e25c22c1f62169ed16041e2e
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:T+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

kRBTuhS.exe

Path C:\Windows\System\kRBTuhS.exe
Size 6.0MB
SHA256 f4fbddee140ad46e1646a3c06df36d20d0f25bc8db655a8e68e6f168f872bb4f
MD5 080c4ddba0dbe8de69567aa7397fe996
SHA1 6712903d8a5175f3b2d487293cd5a7380d50043d
SHA512 a6bcd3f9e8ca5a6efed381122280689263fb0bda47e63b4adf46be03f2232600ed55e9442a96143ff10f739a9fb526e2f5d511d55e0196c562d79d4c07f21c3e
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:T+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

mJkZlKX.exe

Path C:\Windows\System\mJkZlKX.exe
Size 6.0MB
SHA256 ce746606526b5db3dfc7e5a1cd3caf0a2bd412e6a31a2725332c6f94ce40c1ea
MD5 94e267683aa3b06a938aad068e8f05a7
SHA1 2a51de7bfce49533d1d2aaa9c9cab29266879f07
SHA512 b203df9749e64f5d52f6e408031e84454361a8dc833f8368420c6c11ac68867bb53c303fc4198736d3e1f994e73bfd916a7ba958a21b0f47398acbb883856488
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:T+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

owkIcVK.exe

Path C:\Windows\System\owkIcVK.exe
Size 6.0MB
SHA256 70db01fb5767b9fe3e348924a7041a8417352fc17733040f1f10ee83698383b4
MD5 498f8238dd867d453c5485d70ec5fd7a
SHA1 c2b97a7e55223eda051f4a504d5b11c316d24b94
SHA512 62aeb49a4312c4a3cfa3a3fcc01ee4a0952cd44be80bdba20b05e946db90f28dbe072cd5c633a6c63f648651f70b42d5808471f0c218d867140f18125acebf95
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:T+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

pvlpTnI.exe

Path C:\Windows\System\pvlpTnI.exe
Size 6.0MB
SHA256 2fb581834889b0eba637e8a1892528e0313b663eecdd915aef6e21df39c7a63b
MD5 f89233587eae2df42ffa55d2906aa387
SHA1 d4f9e83becf09884d58d3a17d8f16427bb00c689
SHA512 bd6caa296caf5c7dd4456395e1b302eae050d51823f56d6a3b2c52313963efe62ca241a4a5d112294041a48bda5717807880df44179fd85280dd9668e84aece3
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:T+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

qAVHaCq.exe

Path C:\Windows\System\qAVHaCq.exe
Size 6.0MB
SHA256 7d68f641fef9dc5b296232f61bb6eb49789ff27ad8a1ee69fa94b0f796687dcb
MD5 22a869780ee36e3b3e59ad393baab57f
SHA1 11d28ecf803a3212f0e61c49ece2a340aff552c5
SHA512 b80913c2338e664dd007730a8d01cb989595ea2cefbf202c54d39e5b986b606ce65e73152bb0651f2bdffbd9b33d8fdc98f533286e0aff3cc7e7f730cb3160a8
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:T+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

qzQdzaO.exe

Path C:\Windows\System\qzQdzaO.exe
Size 6.0MB
SHA256 bf916b216c9a95bb437b1a09683f9b3c855d05e96db83cf0367a2b5af44dec1d
MD5 44642e76af3f77c739326423740ed043
SHA1 927720e93cf1c4e3a1788d759d579af05a772de0
SHA512 25a7bb212fc2211a3ae94a78764c3f24328abfd0a2f880dd4ca3ea0ef86ec8968ad1f8338e6e70200482411623a12488ab0aa940712a2002935d91a68f7cae0c
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:T+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

tNsRpkJ.exe

Path C:\Windows\System\tNsRpkJ.exe
Size 6.0MB
SHA256 f77ce05f69afd5faaf0887fe22478657c6b6739098f50e1668dadc044a2bc23d
MD5 dc5468cbe299dbd7364ac5a640879b40
SHA1 4baf132758985127bd69307aaf2a5bf98c8cbdfa
SHA512 b4e1134c0ec7057d7a5b36148bc907d5b5660d1fc0a39d5e5360571b419fa847559a8d1dc28b7d4b269abb496fb7d6afb2be7402ac7eea719f025c8511297790
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:T+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

uzVIwhJ.exe

Path C:\Windows\System\uzVIwhJ.exe
Size 6.0MB
SHA256 11ad6ced57e227c33193c24ec379d504781f41111da32910723228b005859866
MD5 bb15655536accb0859b4a8ddc9006842
SHA1 955b61df51113caa7f37446b817aae68d698e777
SHA512 ce4afa4dfb7bc441ecb61d5d3c6a632bbd3c3b941e3fae30894b35c5a895d083ebbb77772d682ced57460f5218a2acf37a504783f7a613c34c121a70f5876bf3
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:T+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/216-154-0x00007FF653D70000-0x00007FF6540C4000-memory.dmp

Download

memory/216-115-0x00007FF653D70000-0x00007FF6540C4000-memory.dmp

Download

memory/432-14-0x00007FF63A010000-0x00007FF63A364000-memory.dmp

Download

memory/432-139-0x00007FF63A010000-0x00007FF63A364000-memory.dmp

Download

memory/432-76-0x00007FF63A010000-0x00007FF63A364000-memory.dmp

Download

memory/1376-129-0x00007FF7AE640000-0x00007FF7AE994000-memory.dmp

Download

memory/1376-156-0x00007FF7AE640000-0x00007FF7AE994000-memory.dmp

Download

memory/1584-70-0x00007FF62FE30000-0x00007FF630184000-memory.dmp

Download

memory/1584-133-0x00007FF62FE30000-0x00007FF630184000-memory.dmp

Download

memory/1584-149-0x00007FF62FE30000-0x00007FF630184000-memory.dmp

Download

memory/1604-8-0x00007FF7F00D0000-0x00007FF7F0424000-memory.dmp

Download

memory/1604-69-0x00007FF7F00D0000-0x00007FF7F0424000-memory.dmp

Download

memory/1604-138-0x00007FF7F00D0000-0x00007FF7F0424000-memory.dmp

Download

memory/1856-20-0x00007FF716A70000-0x00007FF716DC4000-memory.dmp

Download

memory/1856-140-0x00007FF716A70000-0x00007FF716DC4000-memory.dmp

Download

memory/1952-27-0x00007FF7DEE40000-0x00007FF7DF194000-memory.dmp

Download

memory/1952-141-0x00007FF7DEE40000-0x00007FF7DF194000-memory.dmp

Download

memory/2016-144-0x00007FF6948C0000-0x00007FF694C14000-memory.dmp

Download

memory/2016-45-0x00007FF6948C0000-0x00007FF694C14000-memory.dmp

Download

memory/2392-0-0x00007FF6B0CC0000-0x00007FF6B1014000-memory.dmp

Download

memory/2392-1-0x000001EF53950000-0x000001EF53960000-memory.dmp

Download

memory/2392-60-0x00007FF6B0CC0000-0x00007FF6B1014000-memory.dmp

Download

memory/2516-96-0x00007FF7CBA60000-0x00007FF7CBDB4000-memory.dmp

Download

memory/2516-152-0x00007FF7CBA60000-0x00007FF7CBDB4000-memory.dmp

Download

memory/2516-136-0x00007FF7CBA60000-0x00007FF7CBDB4000-memory.dmp

Download

memory/2564-89-0x00007FF7E79C0000-0x00007FF7E7D14000-memory.dmp

Download

memory/2564-150-0x00007FF7E79C0000-0x00007FF7E7D14000-memory.dmp

Download

memory/2564-135-0x00007FF7E79C0000-0x00007FF7E7D14000-memory.dmp

Download

memory/3312-83-0x00007FF6E61D0000-0x00007FF6E6524000-memory.dmp

Download

memory/3312-134-0x00007FF6E61D0000-0x00007FF6E6524000-memory.dmp

Download

memory/3312-151-0x00007FF6E61D0000-0x00007FF6E6524000-memory.dmp

Download

memory/3532-157-0x00007FF60C260000-0x00007FF60C5B4000-memory.dmp

Download

memory/3532-131-0x00007FF60C260000-0x00007FF60C5B4000-memory.dmp

Download

memory/3932-37-0x00007FF780D30000-0x00007FF781084000-memory.dmp

Download

memory/3932-101-0x00007FF780D30000-0x00007FF781084000-memory.dmp

Download

memory/3932-143-0x00007FF780D30000-0x00007FF781084000-memory.dmp

Download

memory/4184-155-0x00007FF644180000-0x00007FF6444D4000-memory.dmp

Download

memory/4184-130-0x00007FF644180000-0x00007FF6444D4000-memory.dmp

Download

memory/4252-145-0x00007FF6C2EB0000-0x00007FF6C3204000-memory.dmp

Download

memory/4252-57-0x00007FF6C2EB0000-0x00007FF6C3204000-memory.dmp

Download

memory/4356-153-0x00007FF629600000-0x00007FF629954000-memory.dmp

Download

memory/4356-104-0x00007FF629600000-0x00007FF629954000-memory.dmp

Download

memory/4400-137-0x00007FF613E40000-0x00007FF614194000-memory.dmp

Download

memory/4400-128-0x00007FF613E40000-0x00007FF614194000-memory.dmp

Download

memory/4400-158-0x00007FF613E40000-0x00007FF614194000-memory.dmp

Download

memory/4548-32-0x00007FF70EC30000-0x00007FF70EF84000-memory.dmp

Download

memory/4548-142-0x00007FF70EC30000-0x00007FF70EF84000-memory.dmp

Download

memory/4956-148-0x00007FF7F7600000-0x00007FF7F7954000-memory.dmp

Download

memory/4956-77-0x00007FF7F7600000-0x00007FF7F7954000-memory.dmp

Download

memory/4960-147-0x00007FF739260000-0x00007FF7395B4000-memory.dmp

Download

memory/4960-68-0x00007FF739260000-0x00007FF7395B4000-memory.dmp

Download

memory/4960-132-0x00007FF739260000-0x00007FF7395B4000-memory.dmp

Download

memory/5116-59-0x00007FF7262D0000-0x00007FF726624000-memory.dmp

Download

memory/5116-146-0x00007FF7262D0000-0x00007FF726624000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads