cobaltstrike | d092b2626996f40e184b1a4fe0a0a7cdc2157b0961addf8f2146c20227783d08

Analysis

max time kernel
137s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240531-e7rm2sgc44
SHA256 d092b2626996f40e184b1a4fe0a0a7cdc2157b0961addf8f2146c20227783d08
MD5 849831d9771b96b8b97a241085ce2be1
SHA1 08d7097ea3a69361d3f848fd32d86266e7703507
SHA512 c102e6d347c1bd5eb3c92aa27c1291722c213f87546ad38a481bd69bc2ebac313350bcaea407777c6927b16bb7ccdb93fe85fd7cb7cf8f3b1d4c7142f9de1a2b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x000b000000014b31-3.dat	cobalt_reflective_dll
behavioral1/files/0x00090000000155f7-7.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000015c3d-23.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000015c52-28.dat	cobalt_reflective_dll
behavioral1/files/0x000a000000015c6b-36.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000015b6f-22.dat	cobalt_reflective_dll
behavioral1/files/0x0009000000015c83-46.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000015c9f-53.dat	cobalt_reflective_dll
behavioral1/files/0x0009000000015616-60.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000015cb6-67.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000015cce-75.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000015cee-79.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015d0f-96.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015d07-92.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015d27-104.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015d31-122.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015d98-127.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015df1-130.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015d1a-120.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015cfe-90.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015cf6-85.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral1/files/0x000b000000014b31-3.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x00090000000155f7-7.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000015c3d-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000015c52-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x000a000000015c6b-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0008000000015b6f-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0009000000015c83-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0008000000015c9f-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0009000000015616-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000015cb6-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000015cce-75.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0007000000015cee-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015d0f-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015d07-92.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015d27-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015d31-122.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015d98-127.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015df1-130.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015d1a-120.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015cfe-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/files/0x0006000000015cf6-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 54 IoCs

resource	yara_rule
behavioral1/memory/1276-0-0x000000013F840000-0x000000013FB94000-memory.dmp	UPX
behavioral1/files/0x000b000000014b31-3.dat	UPX
behavioral1/files/0x00090000000155f7-7.dat	UPX
behavioral1/files/0x0007000000015c3d-23.dat	UPX
behavioral1/files/0x0007000000015c52-28.dat	UPX
behavioral1/memory/2676-41-0x000000013F320000-0x000000013F674000-memory.dmp	UPX
behavioral1/memory/2640-42-0x000000013F750000-0x000000013FAA4000-memory.dmp	UPX
behavioral1/files/0x000a000000015c6b-36.dat	UPX
behavioral1/memory/2384-32-0x000000013F130000-0x000000013F484000-memory.dmp	UPX
behavioral1/memory/2320-27-0x000000013F900000-0x000000013FC54000-memory.dmp	UPX
behavioral1/files/0x0008000000015b6f-22.dat	UPX
behavioral1/memory/3008-19-0x000000013F490000-0x000000013F7E4000-memory.dmp	UPX
behavioral1/memory/2760-12-0x000000013F0E0000-0x000000013F434000-memory.dmp	UPX
behavioral1/files/0x0009000000015c83-46.dat	UPX
behavioral1/files/0x0008000000015c9f-53.dat	UPX
behavioral1/memory/1276-55-0x000000013F840000-0x000000013FB94000-memory.dmp	UPX
behavioral1/memory/2616-56-0x000000013FC30000-0x000000013FF84000-memory.dmp	UPX
behavioral1/memory/2852-49-0x000000013FF20000-0x0000000140274000-memory.dmp	UPX
behavioral1/files/0x0009000000015616-60.dat	UPX
behavioral1/memory/2760-62-0x000000013F0E0000-0x000000013F434000-memory.dmp	UPX
behavioral1/files/0x0007000000015cb6-67.dat	UPX
behavioral1/memory/2520-71-0x000000013F9B0000-0x000000013FD04000-memory.dmp	UPX
behavioral1/files/0x0007000000015cce-75.dat	UPX
behavioral1/memory/2448-64-0x000000013F9F0000-0x000000013FD44000-memory.dmp	UPX
behavioral1/memory/2936-78-0x000000013F540000-0x000000013F894000-memory.dmp	UPX
behavioral1/files/0x0007000000015cee-79.dat	UPX
behavioral1/files/0x0006000000015d0f-96.dat	UPX
behavioral1/files/0x0006000000015d07-92.dat	UPX
behavioral1/memory/2676-94-0x000000013F320000-0x000000013F674000-memory.dmp	UPX
behavioral1/files/0x0006000000015d27-104.dat	UPX
behavioral1/files/0x0006000000015d31-122.dat	UPX
behavioral1/files/0x0006000000015d98-127.dat	UPX
behavioral1/files/0x0006000000015df1-130.dat	UPX
behavioral1/files/0x0006000000015d1a-120.dat	UPX
behavioral1/memory/2088-119-0x000000013FDD0000-0x0000000140124000-memory.dmp	UPX
behavioral1/memory/2688-116-0x000000013F7E0000-0x000000013FB34000-memory.dmp	UPX
behavioral1/memory/1556-111-0x000000013F080000-0x000000013F3D4000-memory.dmp	UPX
behavioral1/files/0x0006000000015cfe-90.dat	UPX
behavioral1/files/0x0006000000015cf6-85.dat	UPX
behavioral1/memory/1556-136-0x000000013F080000-0x000000013F3D4000-memory.dmp	UPX
behavioral1/memory/3008-137-0x000000013F490000-0x000000013F7E4000-memory.dmp	UPX
behavioral1/memory/2760-138-0x000000013F0E0000-0x000000013F434000-memory.dmp	UPX
behavioral1/memory/2320-139-0x000000013F900000-0x000000013FC54000-memory.dmp	UPX
behavioral1/memory/2384-140-0x000000013F130000-0x000000013F484000-memory.dmp	UPX
behavioral1/memory/2676-141-0x000000013F320000-0x000000013F674000-memory.dmp	UPX
behavioral1/memory/2640-142-0x000000013F750000-0x000000013FAA4000-memory.dmp	UPX
behavioral1/memory/2852-143-0x000000013FF20000-0x0000000140274000-memory.dmp	UPX
behavioral1/memory/2616-144-0x000000013FC30000-0x000000013FF84000-memory.dmp	UPX
behavioral1/memory/2448-145-0x000000013F9F0000-0x000000013FD44000-memory.dmp	UPX
behavioral1/memory/2520-146-0x000000013F9B0000-0x000000013FD04000-memory.dmp	UPX
behavioral1/memory/2936-147-0x000000013F540000-0x000000013F894000-memory.dmp	UPX
behavioral1/memory/2088-148-0x000000013FDD0000-0x0000000140124000-memory.dmp	UPX
behavioral1/memory/2688-149-0x000000013F7E0000-0x000000013FB34000-memory.dmp	UPX
behavioral1/memory/1556-150-0x000000013F080000-0x000000013F3D4000-memory.dmp	UPX

XMRig Miner payload 56 IoCs

miner

resource	yara_rule
behavioral1/memory/1276-0-0x000000013F840000-0x000000013FB94000-memory.dmp	xmrig
behavioral1/files/0x000b000000014b31-3.dat	xmrig
behavioral1/files/0x00090000000155f7-7.dat	xmrig
behavioral1/files/0x0007000000015c3d-23.dat	xmrig
behavioral1/files/0x0007000000015c52-28.dat	xmrig
behavioral1/memory/1276-35-0x000000013F320000-0x000000013F674000-memory.dmp	xmrig
behavioral1/memory/2676-41-0x000000013F320000-0x000000013F674000-memory.dmp	xmrig
behavioral1/memory/2640-42-0x000000013F750000-0x000000013FAA4000-memory.dmp	xmrig
behavioral1/files/0x000a000000015c6b-36.dat	xmrig
behavioral1/memory/2384-32-0x000000013F130000-0x000000013F484000-memory.dmp	xmrig
behavioral1/memory/2320-27-0x000000013F900000-0x000000013FC54000-memory.dmp	xmrig
behavioral1/files/0x0008000000015b6f-22.dat	xmrig
behavioral1/memory/3008-19-0x000000013F490000-0x000000013F7E4000-memory.dmp	xmrig
behavioral1/memory/2760-12-0x000000013F0E0000-0x000000013F434000-memory.dmp	xmrig
behavioral1/files/0x0009000000015c83-46.dat	xmrig
behavioral1/files/0x0008000000015c9f-53.dat	xmrig
behavioral1/memory/1276-55-0x000000013F840000-0x000000013FB94000-memory.dmp	xmrig
behavioral1/memory/2616-56-0x000000013FC30000-0x000000013FF84000-memory.dmp	xmrig
behavioral1/memory/2852-49-0x000000013FF20000-0x0000000140274000-memory.dmp	xmrig
behavioral1/files/0x0009000000015616-60.dat	xmrig
behavioral1/memory/2760-62-0x000000013F0E0000-0x000000013F434000-memory.dmp	xmrig
behavioral1/files/0x0007000000015cb6-67.dat	xmrig
behavioral1/memory/2520-71-0x000000013F9B0000-0x000000013FD04000-memory.dmp	xmrig
behavioral1/files/0x0007000000015cce-75.dat	xmrig
behavioral1/memory/2448-64-0x000000013F9F0000-0x000000013FD44000-memory.dmp	xmrig
behavioral1/memory/2936-78-0x000000013F540000-0x000000013F894000-memory.dmp	xmrig
behavioral1/files/0x0007000000015cee-79.dat	xmrig
behavioral1/files/0x0006000000015d0f-96.dat	xmrig
behavioral1/files/0x0006000000015d07-92.dat	xmrig
behavioral1/memory/2676-94-0x000000013F320000-0x000000013F674000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d27-104.dat	xmrig
behavioral1/files/0x0006000000015d31-122.dat	xmrig
behavioral1/files/0x0006000000015d98-127.dat	xmrig
behavioral1/files/0x0006000000015df1-130.dat	xmrig
behavioral1/files/0x0006000000015d1a-120.dat	xmrig
behavioral1/memory/2088-119-0x000000013FDD0000-0x0000000140124000-memory.dmp	xmrig
behavioral1/memory/2688-116-0x000000013F7E0000-0x000000013FB34000-memory.dmp	xmrig
behavioral1/memory/1276-113-0x0000000002390000-0x00000000026E4000-memory.dmp	xmrig
behavioral1/memory/1556-111-0x000000013F080000-0x000000013F3D4000-memory.dmp	xmrig
behavioral1/files/0x0006000000015cfe-90.dat	xmrig
behavioral1/files/0x0006000000015cf6-85.dat	xmrig
behavioral1/memory/1556-136-0x000000013F080000-0x000000013F3D4000-memory.dmp	xmrig
behavioral1/memory/3008-137-0x000000013F490000-0x000000013F7E4000-memory.dmp	xmrig
behavioral1/memory/2760-138-0x000000013F0E0000-0x000000013F434000-memory.dmp	xmrig
behavioral1/memory/2320-139-0x000000013F900000-0x000000013FC54000-memory.dmp	xmrig
behavioral1/memory/2384-140-0x000000013F130000-0x000000013F484000-memory.dmp	xmrig
behavioral1/memory/2676-141-0x000000013F320000-0x000000013F674000-memory.dmp	xmrig
behavioral1/memory/2640-142-0x000000013F750000-0x000000013FAA4000-memory.dmp	xmrig
behavioral1/memory/2852-143-0x000000013FF20000-0x0000000140274000-memory.dmp	xmrig
behavioral1/memory/2616-144-0x000000013FC30000-0x000000013FF84000-memory.dmp	xmrig
behavioral1/memory/2448-145-0x000000013F9F0000-0x000000013FD44000-memory.dmp	xmrig
behavioral1/memory/2520-146-0x000000013F9B0000-0x000000013FD04000-memory.dmp	xmrig
behavioral1/memory/2936-147-0x000000013F540000-0x000000013F894000-memory.dmp	xmrig
behavioral1/memory/2088-148-0x000000013FDD0000-0x0000000140124000-memory.dmp	xmrig
behavioral1/memory/2688-149-0x000000013F7E0000-0x000000013FB34000-memory.dmp	xmrig
behavioral1/memory/1556-150-0x000000013F080000-0x000000013F3D4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2760	lMrlvhA.exe
3008	kWqRWvS.exe
2384	CCbsmhg.exe
2320	tXSeFKX.exe
2676	rXPYDiA.exe
2640	zVnGLdL.exe
2852	XIFmPLo.exe
2616	oqsDAxS.exe
2448	rTncQHc.exe
2520	xrjcatZ.exe
2936	oLXfmHF.exe
2088	qaMlRKC.exe
1556	BNzvRpP.exe
2688	PzmGrqd.exe
856	YlKhHVF.exe
1924	mWUBkkU.exe
2692	vaBqAjS.exe
1112	ycarmHJ.exe
1668	tsfttmh.exe
2548	aOZvqGA.exe
772	JBKJiWp.exe

Loads dropped DLL 21 IoCs

pid	Process
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1276-0-0x000000013F840000-0x000000013FB94000-memory.dmp	upx
behavioral1/files/0x000b000000014b31-3.dat	upx
behavioral1/files/0x00090000000155f7-7.dat	upx
behavioral1/files/0x0007000000015c3d-23.dat	upx
behavioral1/files/0x0007000000015c52-28.dat	upx
behavioral1/memory/2676-41-0x000000013F320000-0x000000013F674000-memory.dmp	upx
behavioral1/memory/2640-42-0x000000013F750000-0x000000013FAA4000-memory.dmp	upx
behavioral1/files/0x000a000000015c6b-36.dat	upx
behavioral1/memory/2384-32-0x000000013F130000-0x000000013F484000-memory.dmp	upx
behavioral1/memory/2320-27-0x000000013F900000-0x000000013FC54000-memory.dmp	upx
behavioral1/files/0x0008000000015b6f-22.dat	upx
behavioral1/memory/3008-19-0x000000013F490000-0x000000013F7E4000-memory.dmp	upx
behavioral1/memory/2760-12-0x000000013F0E0000-0x000000013F434000-memory.dmp	upx
behavioral1/files/0x0009000000015c83-46.dat	upx
behavioral1/files/0x0008000000015c9f-53.dat	upx
behavioral1/memory/1276-55-0x000000013F840000-0x000000013FB94000-memory.dmp	upx
behavioral1/memory/2616-56-0x000000013FC30000-0x000000013FF84000-memory.dmp	upx
behavioral1/memory/2852-49-0x000000013FF20000-0x0000000140274000-memory.dmp	upx
behavioral1/files/0x0009000000015616-60.dat	upx
behavioral1/memory/2760-62-0x000000013F0E0000-0x000000013F434000-memory.dmp	upx
behavioral1/files/0x0007000000015cb6-67.dat	upx
behavioral1/memory/2520-71-0x000000013F9B0000-0x000000013FD04000-memory.dmp	upx
behavioral1/files/0x0007000000015cce-75.dat	upx
behavioral1/memory/2448-64-0x000000013F9F0000-0x000000013FD44000-memory.dmp	upx
behavioral1/memory/2936-78-0x000000013F540000-0x000000013F894000-memory.dmp	upx
behavioral1/files/0x0007000000015cee-79.dat	upx
behavioral1/files/0x0006000000015d0f-96.dat	upx
behavioral1/files/0x0006000000015d07-92.dat	upx
behavioral1/memory/2676-94-0x000000013F320000-0x000000013F674000-memory.dmp	upx
behavioral1/files/0x0006000000015d27-104.dat	upx
behavioral1/files/0x0006000000015d31-122.dat	upx
behavioral1/files/0x0006000000015d98-127.dat	upx
behavioral1/files/0x0006000000015df1-130.dat	upx
behavioral1/files/0x0006000000015d1a-120.dat	upx
behavioral1/memory/2088-119-0x000000013FDD0000-0x0000000140124000-memory.dmp	upx
behavioral1/memory/2688-116-0x000000013F7E0000-0x000000013FB34000-memory.dmp	upx
behavioral1/memory/1556-111-0x000000013F080000-0x000000013F3D4000-memory.dmp	upx
behavioral1/files/0x0006000000015cfe-90.dat	upx
behavioral1/files/0x0006000000015cf6-85.dat	upx
behavioral1/memory/1556-136-0x000000013F080000-0x000000013F3D4000-memory.dmp	upx
behavioral1/memory/3008-137-0x000000013F490000-0x000000013F7E4000-memory.dmp	upx
behavioral1/memory/2760-138-0x000000013F0E0000-0x000000013F434000-memory.dmp	upx
behavioral1/memory/2320-139-0x000000013F900000-0x000000013FC54000-memory.dmp	upx
behavioral1/memory/2384-140-0x000000013F130000-0x000000013F484000-memory.dmp	upx
behavioral1/memory/2676-141-0x000000013F320000-0x000000013F674000-memory.dmp	upx
behavioral1/memory/2640-142-0x000000013F750000-0x000000013FAA4000-memory.dmp	upx
behavioral1/memory/2852-143-0x000000013FF20000-0x0000000140274000-memory.dmp	upx
behavioral1/memory/2616-144-0x000000013FC30000-0x000000013FF84000-memory.dmp	upx
behavioral1/memory/2448-145-0x000000013F9F0000-0x000000013FD44000-memory.dmp	upx
behavioral1/memory/2520-146-0x000000013F9B0000-0x000000013FD04000-memory.dmp	upx
behavioral1/memory/2936-147-0x000000013F540000-0x000000013F894000-memory.dmp	upx
behavioral1/memory/2088-148-0x000000013FDD0000-0x0000000140124000-memory.dmp	upx
behavioral1/memory/2688-149-0x000000013F7E0000-0x000000013FB34000-memory.dmp	upx
behavioral1/memory/1556-150-0x000000013F080000-0x000000013F3D4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\tXSeFKX.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XIFmPLo.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ycarmHJ.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rTncQHc.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xrjcatZ.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BNzvRpP.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vaBqAjS.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YlKhHVF.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lMrlvhA.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kWqRWvS.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rXPYDiA.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mWUBkkU.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tsfttmh.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zVnGLdL.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PzmGrqd.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aOZvqGA.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qaMlRKC.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JBKJiWp.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CCbsmhg.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oqsDAxS.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oLXfmHF.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2760	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	29
PID 1276 wrote to memory of 2760	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	29
PID 1276 wrote to memory of 2760	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	29
PID 1276 wrote to memory of 3008	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	30
PID 1276 wrote to memory of 3008	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	30
PID 1276 wrote to memory of 3008	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	30
PID 1276 wrote to memory of 2384	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	31
PID 1276 wrote to memory of 2384	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	31
PID 1276 wrote to memory of 2384	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	31
PID 1276 wrote to memory of 2320	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	32
PID 1276 wrote to memory of 2320	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	32
PID 1276 wrote to memory of 2320	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	32
PID 1276 wrote to memory of 2640	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	33
PID 1276 wrote to memory of 2640	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	33
PID 1276 wrote to memory of 2640	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	33
PID 1276 wrote to memory of 2676	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	34
PID 1276 wrote to memory of 2676	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	34
PID 1276 wrote to memory of 2676	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	34
PID 1276 wrote to memory of 2852	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	35
PID 1276 wrote to memory of 2852	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	35
PID 1276 wrote to memory of 2852	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	35
PID 1276 wrote to memory of 2616	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	36
PID 1276 wrote to memory of 2616	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	36
PID 1276 wrote to memory of 2616	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	36
PID 1276 wrote to memory of 2448	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	37
PID 1276 wrote to memory of 2448	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	37
PID 1276 wrote to memory of 2448	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	37
PID 1276 wrote to memory of 2520	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	38
PID 1276 wrote to memory of 2520	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	38
PID 1276 wrote to memory of 2520	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	38
PID 1276 wrote to memory of 2936	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	39
PID 1276 wrote to memory of 2936	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	39
PID 1276 wrote to memory of 2936	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	39
PID 1276 wrote to memory of 2088	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	40
PID 1276 wrote to memory of 2088	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	40
PID 1276 wrote to memory of 2088	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	40
PID 1276 wrote to memory of 1556	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	41
PID 1276 wrote to memory of 1556	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	41
PID 1276 wrote to memory of 1556	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	41
PID 1276 wrote to memory of 2688	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	42
PID 1276 wrote to memory of 2688	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	42
PID 1276 wrote to memory of 2688	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	42
PID 1276 wrote to memory of 2692	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	43
PID 1276 wrote to memory of 2692	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	43
PID 1276 wrote to memory of 2692	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	43
PID 1276 wrote to memory of 856	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	44
PID 1276 wrote to memory of 856	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	44
PID 1276 wrote to memory of 856	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	44
PID 1276 wrote to memory of 1112	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	45
PID 1276 wrote to memory of 1112	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	45
PID 1276 wrote to memory of 1112	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	45
PID 1276 wrote to memory of 1924	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	46
PID 1276 wrote to memory of 1924	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	46
PID 1276 wrote to memory of 1924	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	46
PID 1276 wrote to memory of 1668	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	47
PID 1276 wrote to memory of 1668	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	47
PID 1276 wrote to memory of 1668	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	47
PID 1276 wrote to memory of 2548	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	48
PID 1276 wrote to memory of 2548	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	48
PID 1276 wrote to memory of 2548	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	48
PID 1276 wrote to memory of 772	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	49
PID 1276 wrote to memory of 772	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	49
PID 1276 wrote to memory of 772	1276	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	49

C:\Users\Admin\AppData\Local\Temp\2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\System\lMrlvhA.exe
  C:\Windows\System\lMrlvhA.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\kWqRWvS.exe
  C:\Windows\System\kWqRWvS.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\CCbsmhg.exe
  C:\Windows\System\CCbsmhg.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\tXSeFKX.exe
  C:\Windows\System\tXSeFKX.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\zVnGLdL.exe
  C:\Windows\System\zVnGLdL.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\rXPYDiA.exe
  C:\Windows\System\rXPYDiA.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\XIFmPLo.exe
  C:\Windows\System\XIFmPLo.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\oqsDAxS.exe
  C:\Windows\System\oqsDAxS.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\rTncQHc.exe
  C:\Windows\System\rTncQHc.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\xrjcatZ.exe
  C:\Windows\System\xrjcatZ.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\oLXfmHF.exe
  C:\Windows\System\oLXfmHF.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\qaMlRKC.exe
  C:\Windows\System\qaMlRKC.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\BNzvRpP.exe
  C:\Windows\System\BNzvRpP.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\PzmGrqd.exe
  C:\Windows\System\PzmGrqd.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\vaBqAjS.exe
  C:\Windows\System\vaBqAjS.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\YlKhHVF.exe
  C:\Windows\System\YlKhHVF.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\ycarmHJ.exe
  C:\Windows\System\ycarmHJ.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\mWUBkkU.exe
  C:\Windows\System\mWUBkkU.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\tsfttmh.exe
  C:\Windows\System\tsfttmh.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\aOZvqGA.exe
  C:\Windows\System\aOZvqGA.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\JBKJiWp.exe
  C:\Windows\System\JBKJiWp.exe
  2⤵
  - Executes dropped EXE
  PID:772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BNzvRpP.exe

Path C:\Windows\system\BNzvRpP.exe
Size 5.9MB
SHA256 8ada1dddc789b5d04f6cd52cded68f12799335805b49f6e5fbbc396b701323dc
MD5 4d58dbca7001b96401a28bbdb579f333
SHA1 ea5152eb80fa2c9cf623e58c9df3d158362d03d0
SHA512 a36413bd3832326a186eb2cd78874ebd24d94cca0c3223036ae5f092bad4c3a9f7fba2ef24684b338a16d729a464ca87fc7eb608cf7be57e8c982118fc1dbbc0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

CCbsmhg.exe

Path C:\Windows\system\CCbsmhg.exe
Size 5.9MB
SHA256 ebcabde5290cc0e6d33f58cf9f453c917146f7d7ffd8d44416ae11da17528fb9
MD5 bafee8677a08c9e1a0af13ca3eb4ec3f
SHA1 34fdd8abeff030b351e3201b76177e755f86b061
SHA512 7e72bac18579f08984860b6ecadfaf2ad05193ee86d0591e2662f60f2c2b436f93cf52d718ae468a31bd15ebf20e8709f33bd6e6bb12273fca08c6101e18b314
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

PzmGrqd.exe

Path C:\Windows\system\PzmGrqd.exe
Size 5.9MB
SHA256 0df365555579ea875a99a37be3b0266c399b9377fa0631b6d240643a85a610ac
MD5 40bfe6c03e1542f98b7678943ed5d333
SHA1 33a053883ba430c606d4ce84a5bf6925e475c708
SHA512 6fd8c24917fe70b5ba7f3e64373efe506ac2a2c74b59e80bde993401b7edfa2c33bc4291fd67b14d5edc30568a84c4b9523f79a3e78cac16de5507089f92a4a0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:Q+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

XIFmPLo.exe

Path C:\Windows\system\XIFmPLo.exe
Size 5.9MB
SHA256 c58eb9549e58d5033b678e338a5615d8cdcbc75cdbd12c48e61f6ec4f98ed855
MD5 450d2752817140d76dbc4812b9aede41
SHA1 63f012ca036a5db5d1804c505e6d1c9409c905dc
SHA512 f79b86ed6b7a761722384888e8c7abe7a201df61ec76cdf09144f20f77450059c9fba5535d3b3fd1e04ff6c7addc88e1f198075acb5216b6f562141c0e46e45f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

aOZvqGA.exe

Path C:\Windows\system\aOZvqGA.exe
Size 5.9MB
SHA256 df57b48042b92fb0864bb248bf06a5085b308721612eba31f60920e162db3e74
MD5 4275ca8125173294fc7138c82f64d01e
SHA1 902bf2dfef00ebf3b9eeb1ae39833fc71eac09b9
SHA512 0725ac0927ffb048ee88efe06bb4c89e9ae692205650df3aa97f63745aa6d3915a09bfc62b8e19111d06844df346ed98be2480c08ec7375448e00949a8340100
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

oLXfmHF.exe

Path C:\Windows\system\oLXfmHF.exe
Size 5.9MB
SHA256 4f2d5545710b93381238246120ff7ad26da21f9009d168336fd7976fb378433c
MD5 c9e33babeebcff6c620120c8d371b773
SHA1 e1b22f1e354811e41819e4f8b4c1a8b75a4916c4
SHA512 eaa415270afcee009b775a648d44cd1c38967399fbac9aba1db3ab4c68d84dc8c0ae543f8f5b8d23d32e788ab4ab880f6646f97c68d90ef8f2a394d502448ae5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:Q+856utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

oqsDAxS.exe

Path C:\Windows\system\oqsDAxS.exe
Size 5.9MB
SHA256 9d94704edb59918450df6e046237b6d72c13d869ee03b8cad055e462aa772ba1
MD5 87fccc0d6f475cc449d4b11342a185f6
SHA1 c4573e632f9fec7b4096c6a6983d8b8a6bccfecd
SHA512 35a5b34350214148f827be67a8e8998e7bc6fa68ebe1f9dfe61aca8a06222f8542f928fd69986de53fe6933faec14921e483ae5f47ac857fc333490021893be1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

rTncQHc.exe

Path C:\Windows\system\rTncQHc.exe
Size 5.9MB
SHA256 a5bc423cc35894816ba48d9ca385f92dcdf0fc75885ceb6d54aefd9f9336b7b9
MD5 06fde0e1386e5def255dbba92a878647
SHA1 9c007b0c6d004d823bddd4e717db82d9e792254e
SHA512 51cf6fe18e58a82aa5b9be97df78a8d677389abfcbd94d2647d2146a8f61fc216d34cbdb999c0c0c0bced11f215132b8d878686371e71bdbe74ee2bfdcdab353
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

rXPYDiA.exe

Path C:\Windows\system\rXPYDiA.exe
Size 5.9MB
SHA256 f2821a070974a4917b2c79a64f8a8851f8c16f0504fd01f303a4ebad3e516546
MD5 210d154996a87d06c8a3867a61f6f31d
SHA1 89bbb2fc7bafbd1f0ba56b6e770696415d76d6dd
SHA512 5d94a48ab777ac207584a041ccec15c7deefe719756de901e13fcc0613a42c0629552f40fdd3776cb7f89891e6ff93aa201b4fc920601a6612bcb47bebe93849
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:Q+856utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

tXSeFKX.exe

Path C:\Windows\system\tXSeFKX.exe
Size 5.9MB
SHA256 c62cce5515135f4387b636721d6e879b04b8dd32a84165a6ca092c62f796c9f2
MD5 57f20d81697e487f040758a43668eb81
SHA1 29b7fd33c2f880f65cc7e028aa0c04dadeb037d1
SHA512 8952eea7dfc5e7c56782136a3a03fecaf72ed19e081ea547361a679c6f32f7cd0e3bd572b0f296b1c4a7003c9517d929655c0faca3b952d570a7370331666064
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

tsfttmh.exe

Path C:\Windows\system\tsfttmh.exe
Size 5.9MB
SHA256 06e5057de1c41d5e1ad49a6f60f9677b4e61675326f84693bf5d9579f0c797b9
MD5 2a1c39ea2dfa53cd721ee8f914e1830e
SHA1 122f01da501b62987cb37acfcf3c34ae3b628319
SHA512 9610a838325777ae726fea10d8bbd0f7e54432daf816c16c1a084436aa4b66028fbe6b876d3024d081ea5ca418fbcb531dbc9047cfc49575caf24f27b4ade9ff
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

xrjcatZ.exe

Path C:\Windows\system\xrjcatZ.exe
Size 5.9MB
SHA256 7f22df6b0d0eb0ed79fb9ed9539cd983b1b24be24722f3da911934cbdd40d867
MD5 eac32806f444ddcc6af3c0fa8f6a81bd
SHA1 50c892ba71548218f0e1e4d4228aa61e43b79396
SHA512 29c76978902a61598154d53ee97331f3ca6d4c40bcce94c8f707f9094d77de245f1a44ccac894385646336e9a8de88f0bce8339ed5e8138e3c08c750d224de25
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

ycarmHJ.exe

Path C:\Windows\system\ycarmHJ.exe
Size 5.9MB
SHA256 03c14154e2628a9356fd35d8218e5db11c4e491627322f0b4a2645ef10eb791a
MD5 b8b7dd3ce7710a8e8a3cec21a4bf3868
SHA1 890e5c6e1f0ac3f51a8efa3f0bbaff4f5963acf8
SHA512 2d0db8db4ecfeb45e867591db1329558cd213f13e43e40beb3e8bc805063b1c1ed02ba7c23062eadd28a5afb163eb4e206417c5a631ed05a8c4b954bc0f94c91
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

JBKJiWp.exe

Path \Windows\system\JBKJiWp.exe
Size 5.9MB
SHA256 cdcc094a6a262456825f7bf3da8a60af1bfe3a7dc9fb8d12bdb0f6d7bc47aa52
MD5 02555d684aa05caef548714b831195cf
SHA1 3aee5e459e67ad75a3448cb00db45bbd727a08c0
SHA512 6bbcc56021e5483edda9c256126512b2aef180a04475776c9cafdb432f9ca7e9b1cf8fb8907cd1a5b13e903c15a5e7eab96e4bd7b9a39c94b7a5d32e424884db
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:Q+856utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

YlKhHVF.exe

Path \Windows\system\YlKhHVF.exe
Size 5.9MB
SHA256 7256edbe1749094ed5a7620b44c510f3e17fa2f61213f4508805dbb687f7e4d4
MD5 3fdf70cf32360127f72e9bb633216476
SHA1 38059def5d7451cda1e61d5cfc281f0ad23e6bf5
SHA512 907592ca4d33972f1cfd3ea8687dae762217131fddda20de763af16e13eed2a42d5d0e71f78fff00d3dd1d4e7049c49637f6a471d16a5dcaef6332146efeb87a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

kWqRWvS.exe

Path \Windows\system\kWqRWvS.exe
Size 5.9MB
SHA256 1d44d323890a167f5178815907c6553e0865d94a04fee7c116384c6b928e12cc
MD5 701e77f5b3795b38c926f048ec62e285
SHA1 61c876550eeb1bde4a7fe39010dc6c5e499755d0
SHA512 a3ea00c2a1e32e421b664f5bf19ff78715b39bb0ee9dbd7f14d3ace9c8669ec9df3e17adf00184dfeff56b45fe7ae1f1dfbe2aa9f349b3e273dc116250b7bcb5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

lMrlvhA.exe

Path \Windows\system\lMrlvhA.exe
Size 5.9MB
SHA256 037c9200b32b6f4fb90b961a58417e94030cdc5cabd44d053dd22188a42c9167
MD5 ad1ddf7d4208dfeaafad640558228b6c
SHA1 c79a877b21a4c3f0100c1e9e626e9fd5190260d7
SHA512 0aa9adfe5950b0a795971b782ef723b17da2adc4ae3312c16d57309c88939ef6d4242d01a2b802fec7fc60bdb58c9fa351488e8da178d44e8350c5cf671d2f65
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

mWUBkkU.exe

Path \Windows\system\mWUBkkU.exe
Size 5.9MB
SHA256 a6b557b962b74f452e07fe6a4b522c4a7957d79c839ce4b628068871c81676ab
MD5 aa055726aa1ebd0a2ae19b9f6b35a4e3
SHA1 9330f1bd09671586c295a0546bc4ee69f02ba227
SHA512 87e9d92383d975f5111b1e897aebd15fa0807844c9d8d564c1bbe394746f406282fdcb4acc76cb1be5ef4431d31d26639495a23126f33986366bbaf2d0bbb18e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

qaMlRKC.exe

Path \Windows\system\qaMlRKC.exe
Size 5.9MB
SHA256 19bb5be12fdcf2b3afb83a61ad111a79095942b282de6a59748ca00d17c4d98f
MD5 e1796ba888e8aa196cee4add0874d3b8
SHA1 f7893f7b523117e7a30cf94a1f3bea362be04f60
SHA512 667f04f064987d99de8452483057368bdf49c7f335d40d5db015224f41dbc5e8690579588362b7f0b38325e592ebbc92b6fe9ef7896de2a7a42455b627a440ef
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

vaBqAjS.exe

Path \Windows\system\vaBqAjS.exe
Size 5.9MB
SHA256 7b76297226620b682710e5ab2f3ce062503608c5e8730c57e918fc3e0325974b
MD5 0210264d114203d64d467922207b2f6c
SHA1 dd5a2ec6c021605304802caa3795e1d2d13c5308
SHA512 5026254fa44db0ababe0e8ef20d6d6b2c21d1d86e46dcdc68d928bb052924d8c9f38dd0386b064026d08b80209e501132a7dfdc431dd620d96f08eb4807cc118
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

zVnGLdL.exe

Path \Windows\system\zVnGLdL.exe
Size 5.9MB
SHA256 c19c4bdc5bc0e0dcc884d098e65b28d6a4854573feffca80e34e597826e8eded
MD5 52b8dccea00512af94b85bf46dc3c5ad
SHA1 783ee96a20a22e3e76add5e568a1c0522e9252a2
SHA512 101ca621df5d4bdc1094eda90ebef77d8da9618d8a85e196b9aa8d06563e268aa2941dc1e81382062eadfb34fbf67881b10ba96cf3a68fe02188b0fe08830f83
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1276-77-0x0000000002390000-0x00000000026E4000-memory.dmp

Download

memory/1276-70-0x000000013F490000-0x000000013F7E4000-memory.dmp

Download

memory/1276-135-0x0000000002390000-0x00000000026E4000-memory.dmp

Download

memory/1276-55-0x000000013F840000-0x000000013FB94000-memory.dmp

Download

memory/1276-63-0x0000000002390000-0x00000000026E4000-memory.dmp

Download

memory/1276-48-0x000000013FF20000-0x0000000140274000-memory.dmp

Download

memory/1276-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Download

memory/1276-107-0x000000013F080000-0x000000013F3D4000-memory.dmp

Download

memory/1276-15-0x000000013F490000-0x000000013F7E4000-memory.dmp

Download

memory/1276-26-0x0000000002390000-0x00000000026E4000-memory.dmp

Download

memory/1276-0-0x000000013F840000-0x000000013FB94000-memory.dmp

Download

memory/1276-35-0x000000013F320000-0x000000013F674000-memory.dmp

Download

memory/1276-118-0x000000013F1D0000-0x000000013F524000-memory.dmp

Download

memory/1276-113-0x0000000002390000-0x00000000026E4000-memory.dmp

Download

memory/1276-37-0x0000000002390000-0x00000000026E4000-memory.dmp

Download

memory/1556-111-0x000000013F080000-0x000000013F3D4000-memory.dmp

Download

memory/1556-150-0x000000013F080000-0x000000013F3D4000-memory.dmp

Download

memory/1556-136-0x000000013F080000-0x000000013F3D4000-memory.dmp

Download

memory/2088-148-0x000000013FDD0000-0x0000000140124000-memory.dmp

Download

memory/2088-119-0x000000013FDD0000-0x0000000140124000-memory.dmp

Download

memory/2320-27-0x000000013F900000-0x000000013FC54000-memory.dmp

Download

memory/2320-139-0x000000013F900000-0x000000013FC54000-memory.dmp

Download

memory/2384-32-0x000000013F130000-0x000000013F484000-memory.dmp

Download

memory/2384-140-0x000000013F130000-0x000000013F484000-memory.dmp

Download

memory/2448-64-0x000000013F9F0000-0x000000013FD44000-memory.dmp

Download

memory/2448-145-0x000000013F9F0000-0x000000013FD44000-memory.dmp

Download

memory/2520-71-0x000000013F9B0000-0x000000013FD04000-memory.dmp

Download

memory/2520-146-0x000000013F9B0000-0x000000013FD04000-memory.dmp

Download

memory/2616-56-0x000000013FC30000-0x000000013FF84000-memory.dmp

Download

memory/2616-144-0x000000013FC30000-0x000000013FF84000-memory.dmp

Download

memory/2640-42-0x000000013F750000-0x000000013FAA4000-memory.dmp

Download

memory/2640-142-0x000000013F750000-0x000000013FAA4000-memory.dmp

Download

memory/2676-41-0x000000013F320000-0x000000013F674000-memory.dmp

Download

memory/2676-141-0x000000013F320000-0x000000013F674000-memory.dmp

Download

memory/2676-94-0x000000013F320000-0x000000013F674000-memory.dmp

Download

memory/2688-116-0x000000013F7E0000-0x000000013FB34000-memory.dmp

Download

memory/2688-149-0x000000013F7E0000-0x000000013FB34000-memory.dmp

Download

memory/2760-62-0x000000013F0E0000-0x000000013F434000-memory.dmp

Download

memory/2760-138-0x000000013F0E0000-0x000000013F434000-memory.dmp

Download

memory/2760-12-0x000000013F0E0000-0x000000013F434000-memory.dmp

Download

memory/2852-49-0x000000013FF20000-0x0000000140274000-memory.dmp

Download

memory/2852-143-0x000000013FF20000-0x0000000140274000-memory.dmp

Download

memory/2936-147-0x000000013F540000-0x000000013F894000-memory.dmp

Download

memory/2936-78-0x000000013F540000-0x000000013F894000-memory.dmp

Download

memory/3008-19-0x000000013F490000-0x000000013F7E4000-memory.dmp

Download

memory/3008-137-0x000000013F490000-0x000000013F7E4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads