cobaltstrike | d092b2626996f40e184b1a4fe0a0a7cdc2157b0961addf8f2146c20227783d08

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240531-e7rm2sgc44
SHA256 d092b2626996f40e184b1a4fe0a0a7cdc2157b0961addf8f2146c20227783d08
MD5 849831d9771b96b8b97a241085ce2be1
SHA1 08d7097ea3a69361d3f848fd32d86266e7703507
SHA512 c102e6d347c1bd5eb3c92aa27c1291722c213f87546ad38a481bd69bc2ebac313350bcaea407777c6927b16bb7ccdb93fe85fd7cb7cf8f3b1d4c7142f9de1a2b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023437-5.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343b-8.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343c-7.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343e-21.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023438-28.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343f-35.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023440-41.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023441-47.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023442-53.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023443-55.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023444-64.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023445-72.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023447-82.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023446-75.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023448-93.dat	cobalt_reflective_dll
behavioral2/files/0x000b00000002339f-101.dat	cobalt_reflective_dll
behavioral2/files/0x00090000000233a1-105.dat	cobalt_reflective_dll
behavioral2/files/0x00090000000233a2-111.dat	cobalt_reflective_dll
behavioral2/files/0x000d0000000233a4-119.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023449-123.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344a-129.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023437-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343b-8.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343c-7.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343e-21.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023438-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343f-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023440-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023441-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023442-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023443-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023444-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023445-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023447-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023446-75.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023448-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b00000002339f-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00090000000233a1-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00090000000233a2-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d0000000233a4-119.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023449-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344a-129.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1776-0-0x00007FF66ABA0000-0x00007FF66AEF4000-memory.dmp	UPX
behavioral2/files/0x0008000000023437-5.dat	UPX
behavioral2/files/0x000700000002343b-8.dat	UPX
behavioral2/memory/3224-11-0x00007FF7AF910000-0x00007FF7AFC64000-memory.dmp	UPX
behavioral2/memory/4124-10-0x00007FF7FF6A0000-0x00007FF7FF9F4000-memory.dmp	UPX
behavioral2/files/0x000700000002343c-7.dat	UPX
behavioral2/files/0x000700000002343e-21.dat	UPX
behavioral2/memory/1380-18-0x00007FF6CB150000-0x00007FF6CB4A4000-memory.dmp	UPX
behavioral2/files/0x0008000000023438-28.dat	UPX
behavioral2/memory/3044-22-0x00007FF7579C0000-0x00007FF757D14000-memory.dmp	UPX
behavioral2/memory/2968-36-0x00007FF769F50000-0x00007FF76A2A4000-memory.dmp	UPX
behavioral2/files/0x000700000002343f-35.dat	UPX
behavioral2/files/0x0007000000023440-41.dat	UPX
behavioral2/memory/3652-39-0x00007FF7D2CD0000-0x00007FF7D3024000-memory.dmp	UPX
behavioral2/memory/4648-43-0x00007FF712460000-0x00007FF7127B4000-memory.dmp	UPX
behavioral2/files/0x0007000000023441-47.dat	UPX
behavioral2/memory/3672-48-0x00007FF6F1160000-0x00007FF6F14B4000-memory.dmp	UPX
behavioral2/files/0x0007000000023442-53.dat	UPX
behavioral2/files/0x0007000000023443-55.dat	UPX
behavioral2/files/0x0007000000023444-64.dat	UPX
behavioral2/files/0x0007000000023445-72.dat	UPX
behavioral2/memory/64-78-0x00007FF639BB0000-0x00007FF639F04000-memory.dmp	UPX
behavioral2/files/0x0007000000023447-82.dat	UPX
behavioral2/memory/3224-86-0x00007FF7AF910000-0x00007FF7AFC64000-memory.dmp	UPX
behavioral2/memory/1380-88-0x00007FF6CB150000-0x00007FF6CB4A4000-memory.dmp	UPX
behavioral2/memory/460-87-0x00007FF748E00000-0x00007FF749154000-memory.dmp	UPX
behavioral2/memory/4148-85-0x00007FF6FE0A0000-0x00007FF6FE3F4000-memory.dmp	UPX
behavioral2/memory/2600-80-0x00007FF635CE0000-0x00007FF636034000-memory.dmp	UPX
behavioral2/files/0x0007000000023446-75.dat	UPX
behavioral2/memory/3932-73-0x00007FF7A34C0000-0x00007FF7A3814000-memory.dmp	UPX
behavioral2/memory/4124-70-0x00007FF7FF6A0000-0x00007FF7FF9F4000-memory.dmp	UPX
behavioral2/memory/1776-62-0x00007FF66ABA0000-0x00007FF66AEF4000-memory.dmp	UPX
behavioral2/memory/3780-61-0x00007FF72E660000-0x00007FF72E9B4000-memory.dmp	UPX
behavioral2/files/0x0007000000023448-93.dat	UPX
behavioral2/files/0x000b00000002339f-101.dat	UPX
behavioral2/files/0x00090000000233a1-105.dat	UPX
behavioral2/files/0x00090000000233a2-111.dat	UPX
behavioral2/files/0x000d0000000233a4-119.dat	UPX
behavioral2/files/0x0007000000023449-123.dat	UPX
behavioral2/files/0x000700000002344a-129.dat	UPX
behavioral2/memory/3780-127-0x00007FF72E660000-0x00007FF72E9B4000-memory.dmp	UPX
behavioral2/memory/3672-124-0x00007FF6F1160000-0x00007FF6F14B4000-memory.dmp	UPX
behavioral2/memory/2424-114-0x00007FF69DE30000-0x00007FF69E184000-memory.dmp	UPX
behavioral2/memory/3144-109-0x00007FF771C20000-0x00007FF771F74000-memory.dmp	UPX
behavioral2/memory/3276-106-0x00007FF609370000-0x00007FF6096C4000-memory.dmp	UPX
behavioral2/memory/3180-100-0x00007FF721B80000-0x00007FF721ED4000-memory.dmp	UPX
behavioral2/memory/3044-95-0x00007FF7579C0000-0x00007FF757D14000-memory.dmp	UPX
behavioral2/memory/2556-132-0x00007FF6D3E50000-0x00007FF6D41A4000-memory.dmp	UPX
behavioral2/memory/4364-133-0x00007FF7553B0000-0x00007FF755704000-memory.dmp	UPX
behavioral2/memory/3696-134-0x00007FF66C0E0000-0x00007FF66C434000-memory.dmp	UPX
behavioral2/memory/2600-135-0x00007FF635CE0000-0x00007FF636034000-memory.dmp	UPX
behavioral2/memory/460-136-0x00007FF748E00000-0x00007FF749154000-memory.dmp	UPX
behavioral2/memory/3180-137-0x00007FF721B80000-0x00007FF721ED4000-memory.dmp	UPX
behavioral2/memory/3144-138-0x00007FF771C20000-0x00007FF771F74000-memory.dmp	UPX
behavioral2/memory/4124-139-0x00007FF7FF6A0000-0x00007FF7FF9F4000-memory.dmp	UPX
behavioral2/memory/3224-140-0x00007FF7AF910000-0x00007FF7AFC64000-memory.dmp	UPX
behavioral2/memory/1380-141-0x00007FF6CB150000-0x00007FF6CB4A4000-memory.dmp	UPX
behavioral2/memory/3044-142-0x00007FF7579C0000-0x00007FF757D14000-memory.dmp	UPX
behavioral2/memory/2968-143-0x00007FF769F50000-0x00007FF76A2A4000-memory.dmp	UPX
behavioral2/memory/3652-144-0x00007FF7D2CD0000-0x00007FF7D3024000-memory.dmp	UPX
behavioral2/memory/4648-145-0x00007FF712460000-0x00007FF7127B4000-memory.dmp	UPX
behavioral2/memory/3672-146-0x00007FF6F1160000-0x00007FF6F14B4000-memory.dmp	UPX
behavioral2/memory/3932-147-0x00007FF7A34C0000-0x00007FF7A3814000-memory.dmp	UPX
behavioral2/memory/3780-149-0x00007FF72E660000-0x00007FF72E9B4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1776-0-0x00007FF66ABA0000-0x00007FF66AEF4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023437-5.dat	xmrig
behavioral2/files/0x000700000002343b-8.dat	xmrig
behavioral2/memory/3224-11-0x00007FF7AF910000-0x00007FF7AFC64000-memory.dmp	xmrig
behavioral2/memory/4124-10-0x00007FF7FF6A0000-0x00007FF7FF9F4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343c-7.dat	xmrig
behavioral2/files/0x000700000002343e-21.dat	xmrig
behavioral2/memory/1380-18-0x00007FF6CB150000-0x00007FF6CB4A4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023438-28.dat	xmrig
behavioral2/memory/3044-22-0x00007FF7579C0000-0x00007FF757D14000-memory.dmp	xmrig
behavioral2/memory/2968-36-0x00007FF769F50000-0x00007FF76A2A4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343f-35.dat	xmrig
behavioral2/files/0x0007000000023440-41.dat	xmrig
behavioral2/memory/3652-39-0x00007FF7D2CD0000-0x00007FF7D3024000-memory.dmp	xmrig
behavioral2/memory/4648-43-0x00007FF712460000-0x00007FF7127B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023441-47.dat	xmrig
behavioral2/memory/3672-48-0x00007FF6F1160000-0x00007FF6F14B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023442-53.dat	xmrig
behavioral2/files/0x0007000000023443-55.dat	xmrig
behavioral2/files/0x0007000000023444-64.dat	xmrig
behavioral2/files/0x0007000000023445-72.dat	xmrig
behavioral2/memory/64-78-0x00007FF639BB0000-0x00007FF639F04000-memory.dmp	xmrig
behavioral2/files/0x0007000000023447-82.dat	xmrig
behavioral2/memory/3224-86-0x00007FF7AF910000-0x00007FF7AFC64000-memory.dmp	xmrig
behavioral2/memory/1380-88-0x00007FF6CB150000-0x00007FF6CB4A4000-memory.dmp	xmrig
behavioral2/memory/460-87-0x00007FF748E00000-0x00007FF749154000-memory.dmp	xmrig
behavioral2/memory/4148-85-0x00007FF6FE0A0000-0x00007FF6FE3F4000-memory.dmp	xmrig
behavioral2/memory/2600-80-0x00007FF635CE0000-0x00007FF636034000-memory.dmp	xmrig
behavioral2/files/0x0007000000023446-75.dat	xmrig
behavioral2/memory/3932-73-0x00007FF7A34C0000-0x00007FF7A3814000-memory.dmp	xmrig
behavioral2/memory/4124-70-0x00007FF7FF6A0000-0x00007FF7FF9F4000-memory.dmp	xmrig
behavioral2/memory/1776-62-0x00007FF66ABA0000-0x00007FF66AEF4000-memory.dmp	xmrig
behavioral2/memory/3780-61-0x00007FF72E660000-0x00007FF72E9B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023448-93.dat	xmrig
behavioral2/files/0x000b00000002339f-101.dat	xmrig
behavioral2/files/0x00090000000233a1-105.dat	xmrig
behavioral2/files/0x00090000000233a2-111.dat	xmrig
behavioral2/files/0x000d0000000233a4-119.dat	xmrig
behavioral2/files/0x0007000000023449-123.dat	xmrig
behavioral2/files/0x000700000002344a-129.dat	xmrig
behavioral2/memory/3780-127-0x00007FF72E660000-0x00007FF72E9B4000-memory.dmp	xmrig
behavioral2/memory/3672-124-0x00007FF6F1160000-0x00007FF6F14B4000-memory.dmp	xmrig
behavioral2/memory/2424-114-0x00007FF69DE30000-0x00007FF69E184000-memory.dmp	xmrig
behavioral2/memory/3144-109-0x00007FF771C20000-0x00007FF771F74000-memory.dmp	xmrig
behavioral2/memory/3276-106-0x00007FF609370000-0x00007FF6096C4000-memory.dmp	xmrig
behavioral2/memory/3180-100-0x00007FF721B80000-0x00007FF721ED4000-memory.dmp	xmrig
behavioral2/memory/3044-95-0x00007FF7579C0000-0x00007FF757D14000-memory.dmp	xmrig
behavioral2/memory/2556-132-0x00007FF6D3E50000-0x00007FF6D41A4000-memory.dmp	xmrig
behavioral2/memory/4364-133-0x00007FF7553B0000-0x00007FF755704000-memory.dmp	xmrig
behavioral2/memory/3696-134-0x00007FF66C0E0000-0x00007FF66C434000-memory.dmp	xmrig
behavioral2/memory/2600-135-0x00007FF635CE0000-0x00007FF636034000-memory.dmp	xmrig
behavioral2/memory/460-136-0x00007FF748E00000-0x00007FF749154000-memory.dmp	xmrig
behavioral2/memory/3180-137-0x00007FF721B80000-0x00007FF721ED4000-memory.dmp	xmrig
behavioral2/memory/3144-138-0x00007FF771C20000-0x00007FF771F74000-memory.dmp	xmrig
behavioral2/memory/4124-139-0x00007FF7FF6A0000-0x00007FF7FF9F4000-memory.dmp	xmrig
behavioral2/memory/3224-140-0x00007FF7AF910000-0x00007FF7AFC64000-memory.dmp	xmrig
behavioral2/memory/1380-141-0x00007FF6CB150000-0x00007FF6CB4A4000-memory.dmp	xmrig
behavioral2/memory/3044-142-0x00007FF7579C0000-0x00007FF757D14000-memory.dmp	xmrig
behavioral2/memory/2968-143-0x00007FF769F50000-0x00007FF76A2A4000-memory.dmp	xmrig
behavioral2/memory/3652-144-0x00007FF7D2CD0000-0x00007FF7D3024000-memory.dmp	xmrig
behavioral2/memory/4648-145-0x00007FF712460000-0x00007FF7127B4000-memory.dmp	xmrig
behavioral2/memory/3672-146-0x00007FF6F1160000-0x00007FF6F14B4000-memory.dmp	xmrig
behavioral2/memory/3932-147-0x00007FF7A34C0000-0x00007FF7A3814000-memory.dmp	xmrig
behavioral2/memory/3780-149-0x00007FF72E660000-0x00007FF72E9B4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4124	ibXGcGH.exe
3224	PnwRTMd.exe
1380	bKANVXU.exe
3044	LXoTkbm.exe
2968	juyLqDI.exe
3652	oGklhBo.exe
4648	NfICXdm.exe
3672	WiHzDuo.exe
3780	pjvNbpa.exe
3932	lJSUZow.exe
64	SArHzMK.exe
2600	yAQCdcT.exe
4148	vEjjxkV.exe
460	nugblTG.exe
3180	wuQtFUr.exe
3276	PFedAlK.exe
3144	hbUIQmW.exe
2424	gZpBcMG.exe
2556	ITfhvUQ.exe
4364	TerRtKv.exe
3696	FIDujLY.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1776-0-0x00007FF66ABA0000-0x00007FF66AEF4000-memory.dmp	upx
behavioral2/files/0x0008000000023437-5.dat	upx
behavioral2/files/0x000700000002343b-8.dat	upx
behavioral2/memory/3224-11-0x00007FF7AF910000-0x00007FF7AFC64000-memory.dmp	upx
behavioral2/memory/4124-10-0x00007FF7FF6A0000-0x00007FF7FF9F4000-memory.dmp	upx
behavioral2/files/0x000700000002343c-7.dat	upx
behavioral2/files/0x000700000002343e-21.dat	upx
behavioral2/memory/1380-18-0x00007FF6CB150000-0x00007FF6CB4A4000-memory.dmp	upx
behavioral2/files/0x0008000000023438-28.dat	upx
behavioral2/memory/3044-22-0x00007FF7579C0000-0x00007FF757D14000-memory.dmp	upx
behavioral2/memory/2968-36-0x00007FF769F50000-0x00007FF76A2A4000-memory.dmp	upx
behavioral2/files/0x000700000002343f-35.dat	upx
behavioral2/files/0x0007000000023440-41.dat	upx
behavioral2/memory/3652-39-0x00007FF7D2CD0000-0x00007FF7D3024000-memory.dmp	upx
behavioral2/memory/4648-43-0x00007FF712460000-0x00007FF7127B4000-memory.dmp	upx
behavioral2/files/0x0007000000023441-47.dat	upx
behavioral2/memory/3672-48-0x00007FF6F1160000-0x00007FF6F14B4000-memory.dmp	upx
behavioral2/files/0x0007000000023442-53.dat	upx
behavioral2/files/0x0007000000023443-55.dat	upx
behavioral2/files/0x0007000000023444-64.dat	upx
behavioral2/files/0x0007000000023445-72.dat	upx
behavioral2/memory/64-78-0x00007FF639BB0000-0x00007FF639F04000-memory.dmp	upx
behavioral2/files/0x0007000000023447-82.dat	upx
behavioral2/memory/3224-86-0x00007FF7AF910000-0x00007FF7AFC64000-memory.dmp	upx
behavioral2/memory/1380-88-0x00007FF6CB150000-0x00007FF6CB4A4000-memory.dmp	upx
behavioral2/memory/460-87-0x00007FF748E00000-0x00007FF749154000-memory.dmp	upx
behavioral2/memory/4148-85-0x00007FF6FE0A0000-0x00007FF6FE3F4000-memory.dmp	upx
behavioral2/memory/2600-80-0x00007FF635CE0000-0x00007FF636034000-memory.dmp	upx
behavioral2/files/0x0007000000023446-75.dat	upx
behavioral2/memory/3932-73-0x00007FF7A34C0000-0x00007FF7A3814000-memory.dmp	upx
behavioral2/memory/4124-70-0x00007FF7FF6A0000-0x00007FF7FF9F4000-memory.dmp	upx
behavioral2/memory/1776-62-0x00007FF66ABA0000-0x00007FF66AEF4000-memory.dmp	upx
behavioral2/memory/3780-61-0x00007FF72E660000-0x00007FF72E9B4000-memory.dmp	upx
behavioral2/files/0x0007000000023448-93.dat	upx
behavioral2/files/0x000b00000002339f-101.dat	upx
behavioral2/files/0x00090000000233a1-105.dat	upx
behavioral2/files/0x00090000000233a2-111.dat	upx
behavioral2/files/0x000d0000000233a4-119.dat	upx
behavioral2/files/0x0007000000023449-123.dat	upx
behavioral2/files/0x000700000002344a-129.dat	upx
behavioral2/memory/3780-127-0x00007FF72E660000-0x00007FF72E9B4000-memory.dmp	upx
behavioral2/memory/3672-124-0x00007FF6F1160000-0x00007FF6F14B4000-memory.dmp	upx
behavioral2/memory/2424-114-0x00007FF69DE30000-0x00007FF69E184000-memory.dmp	upx
behavioral2/memory/3144-109-0x00007FF771C20000-0x00007FF771F74000-memory.dmp	upx
behavioral2/memory/3276-106-0x00007FF609370000-0x00007FF6096C4000-memory.dmp	upx
behavioral2/memory/3180-100-0x00007FF721B80000-0x00007FF721ED4000-memory.dmp	upx
behavioral2/memory/3044-95-0x00007FF7579C0000-0x00007FF757D14000-memory.dmp	upx
behavioral2/memory/2556-132-0x00007FF6D3E50000-0x00007FF6D41A4000-memory.dmp	upx
behavioral2/memory/4364-133-0x00007FF7553B0000-0x00007FF755704000-memory.dmp	upx
behavioral2/memory/3696-134-0x00007FF66C0E0000-0x00007FF66C434000-memory.dmp	upx
behavioral2/memory/2600-135-0x00007FF635CE0000-0x00007FF636034000-memory.dmp	upx
behavioral2/memory/460-136-0x00007FF748E00000-0x00007FF749154000-memory.dmp	upx
behavioral2/memory/3180-137-0x00007FF721B80000-0x00007FF721ED4000-memory.dmp	upx
behavioral2/memory/3144-138-0x00007FF771C20000-0x00007FF771F74000-memory.dmp	upx
behavioral2/memory/4124-139-0x00007FF7FF6A0000-0x00007FF7FF9F4000-memory.dmp	upx
behavioral2/memory/3224-140-0x00007FF7AF910000-0x00007FF7AFC64000-memory.dmp	upx
behavioral2/memory/1380-141-0x00007FF6CB150000-0x00007FF6CB4A4000-memory.dmp	upx
behavioral2/memory/3044-142-0x00007FF7579C0000-0x00007FF757D14000-memory.dmp	upx
behavioral2/memory/2968-143-0x00007FF769F50000-0x00007FF76A2A4000-memory.dmp	upx
behavioral2/memory/3652-144-0x00007FF7D2CD0000-0x00007FF7D3024000-memory.dmp	upx
behavioral2/memory/4648-145-0x00007FF712460000-0x00007FF7127B4000-memory.dmp	upx
behavioral2/memory/3672-146-0x00007FF6F1160000-0x00007FF6F14B4000-memory.dmp	upx
behavioral2/memory/3932-147-0x00007FF7A34C0000-0x00007FF7A3814000-memory.dmp	upx
behavioral2/memory/3780-149-0x00007FF72E660000-0x00007FF72E9B4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\vEjjxkV.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nugblTG.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ITfhvUQ.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yAQCdcT.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oGklhBo.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lJSUZow.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wuQtFUr.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LXoTkbm.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PnwRTMd.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NfICXdm.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pjvNbpa.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PFedAlK.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hbUIQmW.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gZpBcMG.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TerRtKv.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ibXGcGH.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\juyLqDI.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WiHzDuo.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SArHzMK.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FIDujLY.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bKANVXU.exe	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 4124	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	84
PID 1776 wrote to memory of 4124	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	84
PID 1776 wrote to memory of 3224	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	85
PID 1776 wrote to memory of 3224	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	85
PID 1776 wrote to memory of 1380	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	86
PID 1776 wrote to memory of 1380	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	86
PID 1776 wrote to memory of 3044	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	87
PID 1776 wrote to memory of 3044	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	87
PID 1776 wrote to memory of 2968	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	88
PID 1776 wrote to memory of 2968	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	88
PID 1776 wrote to memory of 3652	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	89
PID 1776 wrote to memory of 3652	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	89
PID 1776 wrote to memory of 4648	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	90
PID 1776 wrote to memory of 4648	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	90
PID 1776 wrote to memory of 3672	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	91
PID 1776 wrote to memory of 3672	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	91
PID 1776 wrote to memory of 3780	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	92
PID 1776 wrote to memory of 3780	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	92
PID 1776 wrote to memory of 3932	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	93
PID 1776 wrote to memory of 3932	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	93
PID 1776 wrote to memory of 64	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	94
PID 1776 wrote to memory of 64	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	94
PID 1776 wrote to memory of 2600	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	95
PID 1776 wrote to memory of 2600	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	95
PID 1776 wrote to memory of 4148	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	96
PID 1776 wrote to memory of 4148	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	96
PID 1776 wrote to memory of 460	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	97
PID 1776 wrote to memory of 460	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	97
PID 1776 wrote to memory of 3180	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	99
PID 1776 wrote to memory of 3180	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	99
PID 1776 wrote to memory of 3276	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	104
PID 1776 wrote to memory of 3276	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	104
PID 1776 wrote to memory of 3144	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	105
PID 1776 wrote to memory of 3144	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	105
PID 1776 wrote to memory of 2424	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	106
PID 1776 wrote to memory of 2424	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	106
PID 1776 wrote to memory of 2556	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	107
PID 1776 wrote to memory of 2556	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	107
PID 1776 wrote to memory of 4364	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	108
PID 1776 wrote to memory of 4364	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	108
PID 1776 wrote to memory of 3696	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	110
PID 1776 wrote to memory of 3696	1776	2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe	110

C:\Users\Admin\AppData\Local\Temp\2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_849831d9771b96b8b97a241085ce2be1_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\System\ibXGcGH.exe
  C:\Windows\System\ibXGcGH.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\PnwRTMd.exe
  C:\Windows\System\PnwRTMd.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\bKANVXU.exe
  C:\Windows\System\bKANVXU.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\LXoTkbm.exe
  C:\Windows\System\LXoTkbm.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\juyLqDI.exe
  C:\Windows\System\juyLqDI.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\oGklhBo.exe
  C:\Windows\System\oGklhBo.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\NfICXdm.exe
  C:\Windows\System\NfICXdm.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\WiHzDuo.exe
  C:\Windows\System\WiHzDuo.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\pjvNbpa.exe
  C:\Windows\System\pjvNbpa.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\lJSUZow.exe
  C:\Windows\System\lJSUZow.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\SArHzMK.exe
  C:\Windows\System\SArHzMK.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\yAQCdcT.exe
  C:\Windows\System\yAQCdcT.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\vEjjxkV.exe
  C:\Windows\System\vEjjxkV.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\nugblTG.exe
  C:\Windows\System\nugblTG.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\wuQtFUr.exe
  C:\Windows\System\wuQtFUr.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\PFedAlK.exe
  C:\Windows\System\PFedAlK.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\hbUIQmW.exe
  C:\Windows\System\hbUIQmW.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\gZpBcMG.exe
  C:\Windows\System\gZpBcMG.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\ITfhvUQ.exe
  C:\Windows\System\ITfhvUQ.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\TerRtKv.exe
  C:\Windows\System\TerRtKv.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\FIDujLY.exe
  C:\Windows\System\FIDujLY.exe
  2⤵
  - Executes dropped EXE
  PID:3696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

FIDujLY.exe

Path C:\Windows\System\FIDujLY.exe
Size 5.9MB
SHA256 25af3f75d50837b136727c383c858295694d16226592f94e3eae4c9cab79e584
MD5 4aaa1387833efc2f721944a3e3c1ea6e
SHA1 82fffd11273f2b818ba1d7fd41bb79859b2b1e9a
SHA512 4c0c778e0ff150f7b0f1c84f518b5efc300634e6ae5267463e561729b06276fa00509e2296077dfbf5bb117780edac834332845fa51d73f777521f64bd3252fa
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

ITfhvUQ.exe

Path C:\Windows\System\ITfhvUQ.exe
Size 5.9MB
SHA256 c490dc4a546d3dcad442a73f6470464977d24571e459a5157f246f3ed7155055
MD5 e102e28aa42719f75b51c406f9c6d734
SHA1 5f1932961f1d6fc2aa347549ba7d7a4654188482
SHA512 420f5b5800aefe69e8d6e0ccdd2feb683bd2f709cafe813084ce422c551ff3309fc43ea6066b29d8d29db168372025b90279aa259f53bc17faa217fc0b29fd3c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:Q+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

LXoTkbm.exe

Path C:\Windows\System\LXoTkbm.exe
Size 5.9MB
SHA256 05f402db5b2bf8db96a966f039c77c8b3a1a68b893f5f83165fa66b90fbc32a1
MD5 99c57706fbb2c628d60f609d7d9d3b22
SHA1 59e562ef2d643366f3a32c6e5905682fc1be4bd4
SHA512 7fa0e10ecbceafc7a9ce9d7dcb38d098ca167c3f98a569ad361ccdff02e4e5a07e0ca7574b01d73191170ab67878b3d41ad49cfcf79933bce641f58a9c21020d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

NfICXdm.exe

Path C:\Windows\System\NfICXdm.exe
Size 5.9MB
SHA256 ade0910c0d4d3637a80d2377a33c5f835fb1f63ec981762376f464c62b13159c
MD5 7894aee40f84848c9d6652551ba6acf5
SHA1 8bccdc23037c15ff2aaaf4f15aa856d3d1c56a9f
SHA512 fe0ec08901a654dc1f933160ad1cd47930a4bee8383a8e3153c73c0f6abbcf61ce31de3c5aa695e9ac0a793352b69092e5a77edb7baee6582a49f0008d03830f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

PFedAlK.exe

Path C:\Windows\System\PFedAlK.exe
Size 5.9MB
SHA256 e836b49074d5a334b59c2c33515ee96c717e386e7a6ec8564028e2c572f81d1e
MD5 77f3819787675db9c10d28a08a116409
SHA1 eefa3e0bfef5cbad9642e1a99a769f2ad0790f02
SHA512 91ae9c38dd750307a5d0e1f00fd3721b086da95c6e0b0ab3db45680bebc166fceafb2b331d8b9aaecb7f529aea62768c4adf7d37b81024d0f56bb01c4d5c52ce
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

PnwRTMd.exe

Path C:\Windows\System\PnwRTMd.exe
Size 5.9MB
SHA256 1c79e94662d24bda4f42ea87dfed19c41b3b52682a38c06f20d9f6a6b5778d5c
MD5 d952be37782110e9c4ef3b940dd908dd
SHA1 eecbf04f3156f5bcb3ebafb29e818f01ce681675
SHA512 54905667611d48f163f75a32750209ca5cfc95784afbfdc9e8db315952479d2cce1cc6ba8ef24a1effbe9d52ecf38c1f452a66efab10079ddae1e6a6310ac288
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

SArHzMK.exe

Path C:\Windows\System\SArHzMK.exe
Size 5.9MB
SHA256 dd15cfdd96bf42a814cf94b9f0d80a51a2920867b39e1ca6038e30b568e8f1bc
MD5 9d6b0dd9503d143a86fad5516eb753ef
SHA1 5d17cee164946ba1697ae64d9ba63f213074ad24
SHA512 c2f89ccf150f263b5cbf7bd882c8b09237d30fe178b1e4086962bcff3438a7d57d57dc9f257507ef4a7e5b9fbecf0306f74da27664000cf8fb833d1a771077ce
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

TerRtKv.exe

Path C:\Windows\System\TerRtKv.exe
Size 5.9MB
SHA256 081a986a53e6843e93ce968d059aafa53ecd9b3824dc0c8f0b715fd5e26e5d57
MD5 3a3bec8b3155d5a7dcc999af3de86841
SHA1 406c67b20665d8dfbeaf88d6ca1081f53ba39e85
SHA512 64ffcd8b9b250f1f18f4328f12f22167c4ee1304a81b5ff5e5b20c0ddba5e7afdfca2ccf2dd9c88a82478e442969087347a3b491cff23ef9f5ea09ec6dc735dd
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

WiHzDuo.exe

Path C:\Windows\System\WiHzDuo.exe
Size 5.9MB
SHA256 b3d2a5cb403e2e21adb62c9f7a918f6d9a5248627a421b258e16c44206d7e6d9
MD5 de47899d84353bbc0faf3694aba90f2a
SHA1 59f50acbe4f110b2e16ef8d0c4a6124e124c5021
SHA512 1df672c43a087fc9457db7f6e241263aa3934a01f9c58b4c6c0d920e7fd06b83836303778a42d0efe4866b88b01017022d696968487af6ae30303561e9c46026
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:Q+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

bKANVXU.exe

Path C:\Windows\System\bKANVXU.exe
Size 5.9MB
SHA256 6ef9826c2c583abd0ddbcadcede1cebfe7ae46f0684dffaf6a46ccfe8ac34b47
MD5 e5597107d232ff2d72272aa976aa3ea4
SHA1 4a6eb4a356565c898f286c78c06eb4800d7393dc
SHA512 a5f6bb905ece84c32278b39f16cd27bc67ac06d49f3802330e916f14ab7fe68059e9d9632c89e2683f7d1db0b4d26c687a075b07ad3fa4adbb40d8173eecc289
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

gZpBcMG.exe

Path C:\Windows\System\gZpBcMG.exe
Size 5.9MB
SHA256 9031f6c9818d57cc14aec49a3cbb2747a098c9de68be30421943b3122b87038b
MD5 9ab0ec49f927160c13c4e8d0c8166623
SHA1 886ed531373db756c2d91635ddaf08354e626ef2
SHA512 744c44b5c8d2aa27078c70fbabc1ac8fe82c56b0e5007604ee31b067cdabb9b677c0ee34309f28405a22e2f5f1e70caca61b98b0c1fc4bc85b5315325dc25336
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

hbUIQmW.exe

Path C:\Windows\System\hbUIQmW.exe
Size 5.9MB
SHA256 1ed07e753f61311cfc40be5c8765c427e1bec228724b3fa6d8a7063e6b41bd51
MD5 0fa9e6fd28206986a99642952d049760
SHA1 faad39e3483c9acbadb05aa5e75a32b1ba7fd485
SHA512 de05db8dd93f07bab4bfb701991ab8111e4b9a9bae79c1d785fca9517471e88eacc7b734cb968efaf421b9a9cb442b83c81858dfaaf728f5d4154db3d7099ed3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

ibXGcGH.exe

Path C:\Windows\System\ibXGcGH.exe
Size 5.9MB
SHA256 324f12750446464b44550774cf5f37debb726c18e6904cd03940f51b53da059f
MD5 0cdc46bc1c195542341a982264515533
SHA1 97a388c71fdd9ed2b7280acdfbab119a3741092d
SHA512 b18c36d097a3422e1ebf15bbde86d1f796ec2b1c41a19bc909812a2421ea3abf02fee6dd9e97653031404962632130211bd99ce9e16978d43ae0c67455d8dbee
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:Q+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

juyLqDI.exe

Path C:\Windows\System\juyLqDI.exe
Size 5.9MB
SHA256 7686a995f537bb6cbda3a543789e856f15f0270962217247630a965cbdfab9c2
MD5 842115d6fc21417745af2d1b65d00843
SHA1 f37761d219f43dcc471e82cf57d73e993199fc20
SHA512 85bd81c56b522f531091483fc2364692c6d33f4cc981ba0326530f5f0cbff7cea13229185200d2b0d048099d095f8f357332561583fcaab5a9f88553df2a57e1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

lJSUZow.exe

Path C:\Windows\System\lJSUZow.exe
Size 5.9MB
SHA256 e740d648988c1225c3a38c248ddb6180a9b9d138c4a7a115a92099f0d0845515
MD5 e8da3245589084c868b631e65344b5dd
SHA1 164b8681b6f56510cf8e649f8371280e312015b2
SHA512 a3c46ab476442e96fef20335a02c9bc3d1c67d2fce7aba00fe3d91a2b64d30bf734eafbd84eaadda81e28ee2bc428df6a6bfd3239a4996721f27078df5825e79
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

nugblTG.exe

Path C:\Windows\System\nugblTG.exe
Size 5.9MB
SHA256 fd4660cc96f31d8529913f4e88d1691c000a3c0c9f9235b306dd3270c88166fc
MD5 3f15af88afbf6d56601c0ff0d10ccce6
SHA1 c0b225315e7acf4f4986f2a004742b3bd3ad4d82
SHA512 ef7d0d5e66026905abf5f0d2857726ce64625c9d2303dbb53a320a8503aa5ff773d3e84f7c79a27e53a18afc8da034ad6dfe7b73127783b0f64b3e4ae7df6ab7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

oGklhBo.exe

Path C:\Windows\System\oGklhBo.exe
Size 5.9MB
SHA256 2ea1c71b2cdfd3599eed6a6e15436af2bd570eb6a5c7892bd9b4722569bb18a9
MD5 777b43bf8ba6b1b54517ce2896f8c28f
SHA1 488f99d5fe766d03b12443abf2fc1ddc13555e2a
SHA512 e15d3bf2ada412006b8db19788103626df5425cbc6d8f09df46775b8321844c77c74d1e59b25059a752fc8661f4ab44637a29fa8c597af84ab8cd541642e0533
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

pjvNbpa.exe

Path C:\Windows\System\pjvNbpa.exe
Size 5.9MB
SHA256 a7970f04887a3314a97035511a25d7625c3f77948d99c044c8d0b26368396a60
MD5 68ee4c3d0c6e858b1364fd0abb5ef57d
SHA1 a8d237ca3158c490282a0ac8a273090172f5f8ca
SHA512 1ca8d918776c4ee93b77669f701af4f6f7b3110057c139ba4b71aade27960450259170e249378d1ce0d9124a85828e22f55738f61fe9f3985af6678d0f8146f5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

vEjjxkV.exe

Path C:\Windows\System\vEjjxkV.exe
Size 5.9MB
SHA256 d633bc1fceb98b065106022d60a6aaa176153a1b164252ac8f13a038cb81b9de
MD5 6557117f857c97a8222e138e850e60cc
SHA1 5e4557f2c48dc265292349313ff19481e997cc3b
SHA512 8d606cd6d67314c280df908afa5deaa1e38466d233ad0109a773e4a100a3e39c748402d91bb30ffeba16ca4a7c5c31af610e34cd5ffcafedb2ab5406a6fbcad5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:Q+856utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

wuQtFUr.exe

Path C:\Windows\System\wuQtFUr.exe
Size 5.9MB
SHA256 3c2218d28f6cc997044fb793d6db7df6d5d506a9f3ca95b9caf6c8c63a43704e
MD5 d1d8b50b8dd41d770f5919748a545c5a
SHA1 1daaa50e78299255d7c08935188a13b08506c1e2
SHA512 670137505f9523dc349a7ee8ad8fc8367ccc198bf19a4797b513fe213a5fb5a5dea81f74c6f136c13a20dbf03f860e35865e7effc7081df48243d5ff79026be5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

yAQCdcT.exe

Path C:\Windows\System\yAQCdcT.exe
Size 5.9MB
SHA256 5c8221b8fb11c4ef6f45505d444eb860367d2fe4d9d35ed3c467aa0c5fbc8194
MD5 b7f47761585987a0a5512fa6202b6cf5
SHA1 7cc6bf6dee6c792be60c4c2dff415854bb3704a6
SHA512 c637cc32664e7c2393086bef8af18b9cceb14c4ae580bc3afe2c6b7c1ef504a65dba28c10e183a43904487d8a31ed9dbc48fd4005e6d3b1f2a988aabefdbc6d8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/64-148-0x00007FF639BB0000-0x00007FF639F04000-memory.dmp

Download

memory/64-78-0x00007FF639BB0000-0x00007FF639F04000-memory.dmp

Download

memory/460-152-0x00007FF748E00000-0x00007FF749154000-memory.dmp

Download

memory/460-87-0x00007FF748E00000-0x00007FF749154000-memory.dmp

Download

memory/460-136-0x00007FF748E00000-0x00007FF749154000-memory.dmp

Download

memory/1380-141-0x00007FF6CB150000-0x00007FF6CB4A4000-memory.dmp

Download

memory/1380-88-0x00007FF6CB150000-0x00007FF6CB4A4000-memory.dmp

Download

memory/1380-18-0x00007FF6CB150000-0x00007FF6CB4A4000-memory.dmp

Download

memory/1776-1-0x000001E4C5E80000-0x000001E4C5E90000-memory.dmp

Download

memory/1776-0-0x00007FF66ABA0000-0x00007FF66AEF4000-memory.dmp

Download

memory/1776-62-0x00007FF66ABA0000-0x00007FF66AEF4000-memory.dmp

Download

memory/2424-114-0x00007FF69DE30000-0x00007FF69E184000-memory.dmp

Download

memory/2424-155-0x00007FF69DE30000-0x00007FF69E184000-memory.dmp

Download

memory/2556-132-0x00007FF6D3E50000-0x00007FF6D41A4000-memory.dmp

Download

memory/2556-156-0x00007FF6D3E50000-0x00007FF6D41A4000-memory.dmp

Download

memory/2600-135-0x00007FF635CE0000-0x00007FF636034000-memory.dmp

Download

memory/2600-80-0x00007FF635CE0000-0x00007FF636034000-memory.dmp

Download

memory/2600-150-0x00007FF635CE0000-0x00007FF636034000-memory.dmp

Download

memory/2968-36-0x00007FF769F50000-0x00007FF76A2A4000-memory.dmp

Download

memory/2968-143-0x00007FF769F50000-0x00007FF76A2A4000-memory.dmp

Download

memory/3044-95-0x00007FF7579C0000-0x00007FF757D14000-memory.dmp

Download

memory/3044-22-0x00007FF7579C0000-0x00007FF757D14000-memory.dmp

Download

memory/3044-142-0x00007FF7579C0000-0x00007FF757D14000-memory.dmp

Download

memory/3144-138-0x00007FF771C20000-0x00007FF771F74000-memory.dmp

Download

memory/3144-109-0x00007FF771C20000-0x00007FF771F74000-memory.dmp

Download

memory/3144-157-0x00007FF771C20000-0x00007FF771F74000-memory.dmp

Download

memory/3180-100-0x00007FF721B80000-0x00007FF721ED4000-memory.dmp

Download

memory/3180-153-0x00007FF721B80000-0x00007FF721ED4000-memory.dmp

Download

memory/3180-137-0x00007FF721B80000-0x00007FF721ED4000-memory.dmp

Download

memory/3224-11-0x00007FF7AF910000-0x00007FF7AFC64000-memory.dmp

Download

memory/3224-86-0x00007FF7AF910000-0x00007FF7AFC64000-memory.dmp

Download

memory/3224-140-0x00007FF7AF910000-0x00007FF7AFC64000-memory.dmp

Download

memory/3276-154-0x00007FF609370000-0x00007FF6096C4000-memory.dmp

Download

memory/3276-106-0x00007FF609370000-0x00007FF6096C4000-memory.dmp

Download

memory/3652-144-0x00007FF7D2CD0000-0x00007FF7D3024000-memory.dmp

Download

memory/3652-39-0x00007FF7D2CD0000-0x00007FF7D3024000-memory.dmp

Download

memory/3672-146-0x00007FF6F1160000-0x00007FF6F14B4000-memory.dmp

Download

memory/3672-124-0x00007FF6F1160000-0x00007FF6F14B4000-memory.dmp

Download

memory/3672-48-0x00007FF6F1160000-0x00007FF6F14B4000-memory.dmp

Download

memory/3696-159-0x00007FF66C0E0000-0x00007FF66C434000-memory.dmp

Download

memory/3696-134-0x00007FF66C0E0000-0x00007FF66C434000-memory.dmp

Download

memory/3780-149-0x00007FF72E660000-0x00007FF72E9B4000-memory.dmp

Download

memory/3780-127-0x00007FF72E660000-0x00007FF72E9B4000-memory.dmp

Download

memory/3780-61-0x00007FF72E660000-0x00007FF72E9B4000-memory.dmp

Download

memory/3932-73-0x00007FF7A34C0000-0x00007FF7A3814000-memory.dmp

Download

memory/3932-147-0x00007FF7A34C0000-0x00007FF7A3814000-memory.dmp

Download

memory/4124-10-0x00007FF7FF6A0000-0x00007FF7FF9F4000-memory.dmp

Download

memory/4124-139-0x00007FF7FF6A0000-0x00007FF7FF9F4000-memory.dmp

Download

memory/4124-70-0x00007FF7FF6A0000-0x00007FF7FF9F4000-memory.dmp

Download

memory/4148-85-0x00007FF6FE0A0000-0x00007FF6FE3F4000-memory.dmp

Download

memory/4148-151-0x00007FF6FE0A0000-0x00007FF6FE3F4000-memory.dmp

Download

memory/4364-158-0x00007FF7553B0000-0x00007FF755704000-memory.dmp

Download

memory/4364-133-0x00007FF7553B0000-0x00007FF755704000-memory.dmp

Download

memory/4648-145-0x00007FF712460000-0x00007FF7127B4000-memory.dmp

Download

memory/4648-43-0x00007FF712460000-0x00007FF7127B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads