cobaltstrike | 9e84af79375f4b4b912393586fbf5f289524ecec49f706fe397440b44d7e0f53

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240531-km9wsade27
SHA256 9e84af79375f4b4b912393586fbf5f289524ecec49f706fe397440b44d7e0f53
MD5 b80140c2cd9742541c827759b35f2eb2
SHA1 06ec38add1a4b4506473163096a558e59ee29350
SHA512 2fc58ee8b345670eee469d8ba04c469d9d70df9abef6cdcba744b1e7ee4f92da5883a25ab18a9294443466c63107c73f790de8251cebcefa12225b6efe76e7b9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:Q+856utgpPF8u/7I
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000600000002327c-5.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002343d-9.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343e-23.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023440-22.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343f-28.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023442-41.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023443-45.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023444-54.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023441-32.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023445-60.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002343b-65.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023448-68.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023449-76.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344a-86.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344b-89.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344c-101.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344d-100.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344e-114.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344f-123.dat	cobalt_reflective_dll
behavioral2/files/0x00040000000229cb-122.dat	cobalt_reflective_dll
behavioral2/files/0x000a0000000233a2-128.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000600000002327c-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002343d-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343e-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023440-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343f-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023442-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023443-45.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023444-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023441-32.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023445-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002343b-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023448-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023449-76.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344a-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344b-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344c-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344d-100.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344e-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344f-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00040000000229cb-122.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a0000000233a2-128.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3136-0-0x00007FF6CCC50000-0x00007FF6CCFA4000-memory.dmp	UPX
behavioral2/files/0x000600000002327c-5.dat	UPX
behavioral2/memory/900-6-0x00007FF737BC0000-0x00007FF737F14000-memory.dmp	UPX
behavioral2/files/0x000800000002343d-9.dat	UPX
behavioral2/files/0x000700000002343e-23.dat	UPX
behavioral2/files/0x0007000000023440-22.dat	UPX
behavioral2/files/0x000700000002343f-28.dat	UPX
behavioral2/memory/2340-37-0x00007FF662080000-0x00007FF6623D4000-memory.dmp	UPX
behavioral2/files/0x0007000000023442-41.dat	UPX
behavioral2/files/0x0007000000023443-45.dat	UPX
behavioral2/memory/2948-51-0x00007FF6194E0000-0x00007FF619834000-memory.dmp	UPX
behavioral2/memory/1496-53-0x00007FF648F60000-0x00007FF6492B4000-memory.dmp	UPX
behavioral2/memory/4876-56-0x00007FF7E7F70000-0x00007FF7E82C4000-memory.dmp	UPX
behavioral2/files/0x0007000000023444-54.dat	UPX
behavioral2/memory/3048-52-0x00007FF698230000-0x00007FF698584000-memory.dmp	UPX
behavioral2/files/0x0007000000023441-32.dat	UPX
behavioral2/memory/3852-31-0x00007FF742290000-0x00007FF7425E4000-memory.dmp	UPX
behavioral2/memory/1660-24-0x00007FF60D050000-0x00007FF60D3A4000-memory.dmp	UPX
behavioral2/memory/4780-15-0x00007FF644450000-0x00007FF6447A4000-memory.dmp	UPX
behavioral2/files/0x0007000000023445-60.dat	UPX
behavioral2/memory/2384-62-0x00007FF74E560000-0x00007FF74E8B4000-memory.dmp	UPX
behavioral2/files/0x000800000002343b-65.dat	UPX
behavioral2/files/0x0007000000023448-68.dat	UPX
behavioral2/memory/2028-72-0x00007FF61B7A0000-0x00007FF61BAF4000-memory.dmp	UPX
behavioral2/memory/1520-66-0x00007FF781CB0000-0x00007FF782004000-memory.dmp	UPX
behavioral2/files/0x0007000000023449-76.dat	UPX
behavioral2/memory/8-80-0x00007FF7361C0000-0x00007FF736514000-memory.dmp	UPX
behavioral2/files/0x000700000002344a-86.dat	UPX
behavioral2/files/0x000700000002344b-89.dat	UPX
behavioral2/memory/744-94-0x00007FF6D6AB0000-0x00007FF6D6E04000-memory.dmp	UPX
behavioral2/memory/900-91-0x00007FF737BC0000-0x00007FF737F14000-memory.dmp	UPX
behavioral2/memory/2364-90-0x00007FF6E17B0000-0x00007FF6E1B04000-memory.dmp	UPX
behavioral2/files/0x000700000002344c-101.dat	UPX
behavioral2/files/0x000700000002344d-100.dat	UPX
behavioral2/memory/4780-105-0x00007FF644450000-0x00007FF6447A4000-memory.dmp	UPX
behavioral2/memory/3900-111-0x00007FF72B910000-0x00007FF72BC64000-memory.dmp	UPX
behavioral2/files/0x000700000002344e-114.dat	UPX
behavioral2/memory/1256-113-0x00007FF66DC60000-0x00007FF66DFB4000-memory.dmp	UPX
behavioral2/memory/1340-112-0x00007FF725570000-0x00007FF7258C4000-memory.dmp	UPX
behavioral2/memory/3852-107-0x00007FF742290000-0x00007FF7425E4000-memory.dmp	UPX
behavioral2/memory/1660-106-0x00007FF60D050000-0x00007FF60D3A4000-memory.dmp	UPX
behavioral2/memory/3136-85-0x00007FF6CCC50000-0x00007FF6CCFA4000-memory.dmp	UPX
behavioral2/memory/852-121-0x00007FF7F7170000-0x00007FF7F74C4000-memory.dmp	UPX
behavioral2/files/0x000700000002344f-123.dat	UPX
behavioral2/files/0x00040000000229cb-122.dat	UPX
behavioral2/memory/1552-131-0x00007FF6F5CE0000-0x00007FF6F6034000-memory.dmp	UPX
behavioral2/memory/1388-132-0x00007FF6C2CC0000-0x00007FF6C3014000-memory.dmp	UPX
behavioral2/files/0x000a0000000233a2-128.dat	UPX
behavioral2/memory/4876-126-0x00007FF7E7F70000-0x00007FF7E82C4000-memory.dmp	UPX
behavioral2/memory/1520-134-0x00007FF781CB0000-0x00007FF782004000-memory.dmp	UPX
behavioral2/memory/2028-135-0x00007FF61B7A0000-0x00007FF61BAF4000-memory.dmp	UPX
behavioral2/memory/744-136-0x00007FF6D6AB0000-0x00007FF6D6E04000-memory.dmp	UPX
behavioral2/memory/1256-137-0x00007FF66DC60000-0x00007FF66DFB4000-memory.dmp	UPX
behavioral2/memory/852-138-0x00007FF7F7170000-0x00007FF7F74C4000-memory.dmp	UPX
behavioral2/memory/1552-139-0x00007FF6F5CE0000-0x00007FF6F6034000-memory.dmp	UPX
behavioral2/memory/900-140-0x00007FF737BC0000-0x00007FF737F14000-memory.dmp	UPX
behavioral2/memory/4780-141-0x00007FF644450000-0x00007FF6447A4000-memory.dmp	UPX
behavioral2/memory/2340-142-0x00007FF662080000-0x00007FF6623D4000-memory.dmp	UPX
behavioral2/memory/1660-143-0x00007FF60D050000-0x00007FF60D3A4000-memory.dmp	UPX
behavioral2/memory/3852-145-0x00007FF742290000-0x00007FF7425E4000-memory.dmp	UPX
behavioral2/memory/2948-144-0x00007FF6194E0000-0x00007FF619834000-memory.dmp	UPX
behavioral2/memory/1496-146-0x00007FF648F60000-0x00007FF6492B4000-memory.dmp	UPX
behavioral2/memory/3048-147-0x00007FF698230000-0x00007FF698584000-memory.dmp	UPX
behavioral2/memory/4876-148-0x00007FF7E7F70000-0x00007FF7E82C4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3136-0-0x00007FF6CCC50000-0x00007FF6CCFA4000-memory.dmp	xmrig
behavioral2/files/0x000600000002327c-5.dat	xmrig
behavioral2/memory/900-6-0x00007FF737BC0000-0x00007FF737F14000-memory.dmp	xmrig
behavioral2/files/0x000800000002343d-9.dat	xmrig
behavioral2/files/0x000700000002343e-23.dat	xmrig
behavioral2/files/0x0007000000023440-22.dat	xmrig
behavioral2/files/0x000700000002343f-28.dat	xmrig
behavioral2/memory/2340-37-0x00007FF662080000-0x00007FF6623D4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023442-41.dat	xmrig
behavioral2/files/0x0007000000023443-45.dat	xmrig
behavioral2/memory/2948-51-0x00007FF6194E0000-0x00007FF619834000-memory.dmp	xmrig
behavioral2/memory/1496-53-0x00007FF648F60000-0x00007FF6492B4000-memory.dmp	xmrig
behavioral2/memory/4876-56-0x00007FF7E7F70000-0x00007FF7E82C4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023444-54.dat	xmrig
behavioral2/memory/3048-52-0x00007FF698230000-0x00007FF698584000-memory.dmp	xmrig
behavioral2/files/0x0007000000023441-32.dat	xmrig
behavioral2/memory/3852-31-0x00007FF742290000-0x00007FF7425E4000-memory.dmp	xmrig
behavioral2/memory/1660-24-0x00007FF60D050000-0x00007FF60D3A4000-memory.dmp	xmrig
behavioral2/memory/4780-15-0x00007FF644450000-0x00007FF6447A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023445-60.dat	xmrig
behavioral2/memory/2384-62-0x00007FF74E560000-0x00007FF74E8B4000-memory.dmp	xmrig
behavioral2/files/0x000800000002343b-65.dat	xmrig
behavioral2/files/0x0007000000023448-68.dat	xmrig
behavioral2/memory/2028-72-0x00007FF61B7A0000-0x00007FF61BAF4000-memory.dmp	xmrig
behavioral2/memory/1520-66-0x00007FF781CB0000-0x00007FF782004000-memory.dmp	xmrig
behavioral2/files/0x0007000000023449-76.dat	xmrig
behavioral2/memory/8-80-0x00007FF7361C0000-0x00007FF736514000-memory.dmp	xmrig
behavioral2/files/0x000700000002344a-86.dat	xmrig
behavioral2/files/0x000700000002344b-89.dat	xmrig
behavioral2/memory/744-94-0x00007FF6D6AB0000-0x00007FF6D6E04000-memory.dmp	xmrig
behavioral2/memory/900-91-0x00007FF737BC0000-0x00007FF737F14000-memory.dmp	xmrig
behavioral2/memory/2364-90-0x00007FF6E17B0000-0x00007FF6E1B04000-memory.dmp	xmrig
behavioral2/files/0x000700000002344c-101.dat	xmrig
behavioral2/files/0x000700000002344d-100.dat	xmrig
behavioral2/memory/4780-105-0x00007FF644450000-0x00007FF6447A4000-memory.dmp	xmrig
behavioral2/memory/3900-111-0x00007FF72B910000-0x00007FF72BC64000-memory.dmp	xmrig
behavioral2/files/0x000700000002344e-114.dat	xmrig
behavioral2/memory/1256-113-0x00007FF66DC60000-0x00007FF66DFB4000-memory.dmp	xmrig
behavioral2/memory/1340-112-0x00007FF725570000-0x00007FF7258C4000-memory.dmp	xmrig
behavioral2/memory/3852-107-0x00007FF742290000-0x00007FF7425E4000-memory.dmp	xmrig
behavioral2/memory/1660-106-0x00007FF60D050000-0x00007FF60D3A4000-memory.dmp	xmrig
behavioral2/memory/3136-85-0x00007FF6CCC50000-0x00007FF6CCFA4000-memory.dmp	xmrig
behavioral2/memory/852-121-0x00007FF7F7170000-0x00007FF7F74C4000-memory.dmp	xmrig
behavioral2/files/0x000700000002344f-123.dat	xmrig
behavioral2/files/0x00040000000229cb-122.dat	xmrig
behavioral2/memory/1552-131-0x00007FF6F5CE0000-0x00007FF6F6034000-memory.dmp	xmrig
behavioral2/memory/1388-132-0x00007FF6C2CC0000-0x00007FF6C3014000-memory.dmp	xmrig
behavioral2/files/0x000a0000000233a2-128.dat	xmrig
behavioral2/memory/4876-126-0x00007FF7E7F70000-0x00007FF7E82C4000-memory.dmp	xmrig
behavioral2/memory/1520-134-0x00007FF781CB0000-0x00007FF782004000-memory.dmp	xmrig
behavioral2/memory/2028-135-0x00007FF61B7A0000-0x00007FF61BAF4000-memory.dmp	xmrig
behavioral2/memory/744-136-0x00007FF6D6AB0000-0x00007FF6D6E04000-memory.dmp	xmrig
behavioral2/memory/1256-137-0x00007FF66DC60000-0x00007FF66DFB4000-memory.dmp	xmrig
behavioral2/memory/852-138-0x00007FF7F7170000-0x00007FF7F74C4000-memory.dmp	xmrig
behavioral2/memory/1552-139-0x00007FF6F5CE0000-0x00007FF6F6034000-memory.dmp	xmrig
behavioral2/memory/900-140-0x00007FF737BC0000-0x00007FF737F14000-memory.dmp	xmrig
behavioral2/memory/4780-141-0x00007FF644450000-0x00007FF6447A4000-memory.dmp	xmrig
behavioral2/memory/2340-142-0x00007FF662080000-0x00007FF6623D4000-memory.dmp	xmrig
behavioral2/memory/1660-143-0x00007FF60D050000-0x00007FF60D3A4000-memory.dmp	xmrig
behavioral2/memory/3852-145-0x00007FF742290000-0x00007FF7425E4000-memory.dmp	xmrig
behavioral2/memory/2948-144-0x00007FF6194E0000-0x00007FF619834000-memory.dmp	xmrig
behavioral2/memory/1496-146-0x00007FF648F60000-0x00007FF6492B4000-memory.dmp	xmrig
behavioral2/memory/3048-147-0x00007FF698230000-0x00007FF698584000-memory.dmp	xmrig
behavioral2/memory/4876-148-0x00007FF7E7F70000-0x00007FF7E82C4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
900	soJgPQi.exe
4780	WjcDXIK.exe
1660	dJcMLHr.exe
2340	owcjaQP.exe
3852	QrgvCrA.exe
2948	QfTeSHi.exe
1496	jhdGalJ.exe
3048	mFdLbAl.exe
4876	HyXwJrm.exe
2384	rwVbeGz.exe
1520	kwZTHvp.exe
2028	MKvragO.exe
8	BbbqLRF.exe
2364	LsNTVPw.exe
744	oWFTDwX.exe
3900	dOGijlf.exe
1340	mmwMOXj.exe
1256	HHomPjo.exe
852	amywwJV.exe
1552	UbEQXAJ.exe
1388	NxXcXag.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3136-0-0x00007FF6CCC50000-0x00007FF6CCFA4000-memory.dmp	upx
behavioral2/files/0x000600000002327c-5.dat	upx
behavioral2/memory/900-6-0x00007FF737BC0000-0x00007FF737F14000-memory.dmp	upx
behavioral2/files/0x000800000002343d-9.dat	upx
behavioral2/files/0x000700000002343e-23.dat	upx
behavioral2/files/0x0007000000023440-22.dat	upx
behavioral2/files/0x000700000002343f-28.dat	upx
behavioral2/memory/2340-37-0x00007FF662080000-0x00007FF6623D4000-memory.dmp	upx
behavioral2/files/0x0007000000023442-41.dat	upx
behavioral2/files/0x0007000000023443-45.dat	upx
behavioral2/memory/2948-51-0x00007FF6194E0000-0x00007FF619834000-memory.dmp	upx
behavioral2/memory/1496-53-0x00007FF648F60000-0x00007FF6492B4000-memory.dmp	upx
behavioral2/memory/4876-56-0x00007FF7E7F70000-0x00007FF7E82C4000-memory.dmp	upx
behavioral2/files/0x0007000000023444-54.dat	upx
behavioral2/memory/3048-52-0x00007FF698230000-0x00007FF698584000-memory.dmp	upx
behavioral2/files/0x0007000000023441-32.dat	upx
behavioral2/memory/3852-31-0x00007FF742290000-0x00007FF7425E4000-memory.dmp	upx
behavioral2/memory/1660-24-0x00007FF60D050000-0x00007FF60D3A4000-memory.dmp	upx
behavioral2/memory/4780-15-0x00007FF644450000-0x00007FF6447A4000-memory.dmp	upx
behavioral2/files/0x0007000000023445-60.dat	upx
behavioral2/memory/2384-62-0x00007FF74E560000-0x00007FF74E8B4000-memory.dmp	upx
behavioral2/files/0x000800000002343b-65.dat	upx
behavioral2/files/0x0007000000023448-68.dat	upx
behavioral2/memory/2028-72-0x00007FF61B7A0000-0x00007FF61BAF4000-memory.dmp	upx
behavioral2/memory/1520-66-0x00007FF781CB0000-0x00007FF782004000-memory.dmp	upx
behavioral2/files/0x0007000000023449-76.dat	upx
behavioral2/memory/8-80-0x00007FF7361C0000-0x00007FF736514000-memory.dmp	upx
behavioral2/files/0x000700000002344a-86.dat	upx
behavioral2/files/0x000700000002344b-89.dat	upx
behavioral2/memory/744-94-0x00007FF6D6AB0000-0x00007FF6D6E04000-memory.dmp	upx
behavioral2/memory/900-91-0x00007FF737BC0000-0x00007FF737F14000-memory.dmp	upx
behavioral2/memory/2364-90-0x00007FF6E17B0000-0x00007FF6E1B04000-memory.dmp	upx
behavioral2/files/0x000700000002344c-101.dat	upx
behavioral2/files/0x000700000002344d-100.dat	upx
behavioral2/memory/4780-105-0x00007FF644450000-0x00007FF6447A4000-memory.dmp	upx
behavioral2/memory/3900-111-0x00007FF72B910000-0x00007FF72BC64000-memory.dmp	upx
behavioral2/files/0x000700000002344e-114.dat	upx
behavioral2/memory/1256-113-0x00007FF66DC60000-0x00007FF66DFB4000-memory.dmp	upx
behavioral2/memory/1340-112-0x00007FF725570000-0x00007FF7258C4000-memory.dmp	upx
behavioral2/memory/3852-107-0x00007FF742290000-0x00007FF7425E4000-memory.dmp	upx
behavioral2/memory/1660-106-0x00007FF60D050000-0x00007FF60D3A4000-memory.dmp	upx
behavioral2/memory/3136-85-0x00007FF6CCC50000-0x00007FF6CCFA4000-memory.dmp	upx
behavioral2/memory/852-121-0x00007FF7F7170000-0x00007FF7F74C4000-memory.dmp	upx
behavioral2/files/0x000700000002344f-123.dat	upx
behavioral2/files/0x00040000000229cb-122.dat	upx
behavioral2/memory/1552-131-0x00007FF6F5CE0000-0x00007FF6F6034000-memory.dmp	upx
behavioral2/memory/1388-132-0x00007FF6C2CC0000-0x00007FF6C3014000-memory.dmp	upx
behavioral2/files/0x000a0000000233a2-128.dat	upx
behavioral2/memory/4876-126-0x00007FF7E7F70000-0x00007FF7E82C4000-memory.dmp	upx
behavioral2/memory/1520-134-0x00007FF781CB0000-0x00007FF782004000-memory.dmp	upx
behavioral2/memory/2028-135-0x00007FF61B7A0000-0x00007FF61BAF4000-memory.dmp	upx
behavioral2/memory/744-136-0x00007FF6D6AB0000-0x00007FF6D6E04000-memory.dmp	upx
behavioral2/memory/1256-137-0x00007FF66DC60000-0x00007FF66DFB4000-memory.dmp	upx
behavioral2/memory/852-138-0x00007FF7F7170000-0x00007FF7F74C4000-memory.dmp	upx
behavioral2/memory/1552-139-0x00007FF6F5CE0000-0x00007FF6F6034000-memory.dmp	upx
behavioral2/memory/900-140-0x00007FF737BC0000-0x00007FF737F14000-memory.dmp	upx
behavioral2/memory/4780-141-0x00007FF644450000-0x00007FF6447A4000-memory.dmp	upx
behavioral2/memory/2340-142-0x00007FF662080000-0x00007FF6623D4000-memory.dmp	upx
behavioral2/memory/1660-143-0x00007FF60D050000-0x00007FF60D3A4000-memory.dmp	upx
behavioral2/memory/3852-145-0x00007FF742290000-0x00007FF7425E4000-memory.dmp	upx
behavioral2/memory/2948-144-0x00007FF6194E0000-0x00007FF619834000-memory.dmp	upx
behavioral2/memory/1496-146-0x00007FF648F60000-0x00007FF6492B4000-memory.dmp	upx
behavioral2/memory/3048-147-0x00007FF698230000-0x00007FF698584000-memory.dmp	upx
behavioral2/memory/4876-148-0x00007FF7E7F70000-0x00007FF7E82C4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\rwVbeGz.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kwZTHvp.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LsNTVPw.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mmwMOXj.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HHomPjo.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\soJgPQi.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\owcjaQP.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mFdLbAl.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UbEQXAJ.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NxXcXag.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HyXwJrm.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oWFTDwX.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\amywwJV.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WjcDXIK.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dJcMLHr.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QfTeSHi.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QrgvCrA.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dOGijlf.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jhdGalJ.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MKvragO.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BbbqLRF.exe	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 900	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	82
PID 3136 wrote to memory of 900	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	82
PID 3136 wrote to memory of 4780	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	83
PID 3136 wrote to memory of 4780	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	83
PID 3136 wrote to memory of 3852	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	84
PID 3136 wrote to memory of 3852	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	84
PID 3136 wrote to memory of 1660	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	85
PID 3136 wrote to memory of 1660	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	85
PID 3136 wrote to memory of 2340	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	86
PID 3136 wrote to memory of 2340	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	86
PID 3136 wrote to memory of 2948	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	87
PID 3136 wrote to memory of 2948	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	87
PID 3136 wrote to memory of 1496	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	88
PID 3136 wrote to memory of 1496	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	88
PID 3136 wrote to memory of 3048	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	89
PID 3136 wrote to memory of 3048	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	89
PID 3136 wrote to memory of 4876	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	90
PID 3136 wrote to memory of 4876	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	90
PID 3136 wrote to memory of 2384	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	91
PID 3136 wrote to memory of 2384	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	91
PID 3136 wrote to memory of 1520	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	93
PID 3136 wrote to memory of 1520	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	93
PID 3136 wrote to memory of 2028	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	95
PID 3136 wrote to memory of 2028	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	95
PID 3136 wrote to memory of 8	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	96
PID 3136 wrote to memory of 8	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	96
PID 3136 wrote to memory of 2364	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	97
PID 3136 wrote to memory of 2364	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	97
PID 3136 wrote to memory of 744	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	98
PID 3136 wrote to memory of 744	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	98
PID 3136 wrote to memory of 3900	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	99
PID 3136 wrote to memory of 3900	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	99
PID 3136 wrote to memory of 1340	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	100
PID 3136 wrote to memory of 1340	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	100
PID 3136 wrote to memory of 1256	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	101
PID 3136 wrote to memory of 1256	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	101
PID 3136 wrote to memory of 852	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	102
PID 3136 wrote to memory of 852	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	102
PID 3136 wrote to memory of 1552	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	106
PID 3136 wrote to memory of 1552	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	106
PID 3136 wrote to memory of 1388	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	107
PID 3136 wrote to memory of 1388	3136	2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe	107

C:\Users\Admin\AppData\Local\Temp\2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_b80140c2cd9742541c827759b35f2eb2_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\System\soJgPQi.exe
  C:\Windows\System\soJgPQi.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\WjcDXIK.exe
  C:\Windows\System\WjcDXIK.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\QrgvCrA.exe
  C:\Windows\System\QrgvCrA.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\dJcMLHr.exe
  C:\Windows\System\dJcMLHr.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\owcjaQP.exe
  C:\Windows\System\owcjaQP.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\QfTeSHi.exe
  C:\Windows\System\QfTeSHi.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\jhdGalJ.exe
  C:\Windows\System\jhdGalJ.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\mFdLbAl.exe
  C:\Windows\System\mFdLbAl.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\HyXwJrm.exe
  C:\Windows\System\HyXwJrm.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\rwVbeGz.exe
  C:\Windows\System\rwVbeGz.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\kwZTHvp.exe
  C:\Windows\System\kwZTHvp.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\MKvragO.exe
  C:\Windows\System\MKvragO.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\BbbqLRF.exe
  C:\Windows\System\BbbqLRF.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\LsNTVPw.exe
  C:\Windows\System\LsNTVPw.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\oWFTDwX.exe
  C:\Windows\System\oWFTDwX.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\dOGijlf.exe
  C:\Windows\System\dOGijlf.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\mmwMOXj.exe
  C:\Windows\System\mmwMOXj.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\HHomPjo.exe
  C:\Windows\System\HHomPjo.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\amywwJV.exe
  C:\Windows\System\amywwJV.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\UbEQXAJ.exe
  C:\Windows\System\UbEQXAJ.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\NxXcXag.exe
  C:\Windows\System\NxXcXag.exe
  2⤵
  - Executes dropped EXE
  PID:1388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BbbqLRF.exe

Path C:\Windows\System\BbbqLRF.exe
Size 5.9MB
SHA256 6efd86b488e7590c65cc326d876ee36594bdbd7b0061a34a634536e5ee29263c
MD5 d0095b9f5bb333ea851faad80f9046cb
SHA1 d9af16a2d3d93fecc27974ce02aa31ae5d716880
SHA512 1e445ae959a514b7e9d399a857f68d645dd8de6e716e0d1c10b07edf31a7119f1cc87496b3378cd317208ac26641a4782212c198a0260f5e6835465e7e73c9e3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

HHomPjo.exe

Path C:\Windows\System\HHomPjo.exe
Size 5.9MB
SHA256 86b973a2773964d4c121b49a0223197027369ea7cf9a6b2c2da8ac65a219bac4
MD5 ede19938a4c607422296ef2b37adf185
SHA1 8020e4c743b2bc4a9d8b6f298673b22f95f58fbf
SHA512 28405ee9f9468559c30da61a63c3f697502b99704aab38f7602216f93256235c87857efa986e55b96f2013314782ba2e72d53df58ea88e0034e9ce68c82e7ac8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

HyXwJrm.exe

Path C:\Windows\System\HyXwJrm.exe
Size 5.9MB
SHA256 434e3252ad7e0d3da85d4bcce61c7e18f8827a425326c081c6357b9dec649b27
MD5 3f6af312b3bb71b5cc5d8aec9f59fc27
SHA1 ea6ecbe5d8c086fd193a81f4cc7723e09a67a14b
SHA512 0ebce1d9b0bc3352094663bda56d8a41018650c7426ed929a587035fb7ae606f3dfa5012e016dc044df2ed7dc24b9208e84056f686678f57dd732075cd1aafe2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

LsNTVPw.exe

Path C:\Windows\System\LsNTVPw.exe
Size 5.9MB
SHA256 c865d1dbcedf8985b6adc97d0377108f81b6306c0487be4640b1d281aefa2f14
MD5 59f65dc402e59e9d8da107651645664b
SHA1 f72c218f269b36c92a72fedd1a9922d5b7603f61
SHA512 bcdddd8c6a2a81aedd08b85014c00da678831db78058d60dd245318f66c6cc468d6e80488327f3cca1ca1983bfe787cc972c9036981f01360d98476705c531f6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

MKvragO.exe

Path C:\Windows\System\MKvragO.exe
Size 5.9MB
SHA256 8cf43539c0f21ad4dd1c722433f1868c9fd0c16e315f804f00f27a24a70e239f
MD5 f8d9d7d9a644c823916ad5b70c3a7a0e
SHA1 2fb4f223c3f9a3362fd47c00b767c4600042377d
SHA512 536cb1fb686c716e6d1b88adf2c74e5a87b4484c03e641e85fb99eaefa39f1e26d4e3b3a9e99cdf89b1b6da9e3c7ad5317914ea0a849b6832552dc02d86862af
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

NxXcXag.exe

Path C:\Windows\System\NxXcXag.exe
Size 5.9MB
SHA256 540a7ecf6f5d11a96da172ebe8f2b69417a656882f53b6f7b556212ff7488cfb
MD5 c2d63713a660a42a687fa996eb5ba291
SHA1 1af5ddcddf0aa291282d66f0b74b063854239359
SHA512 3fc2182946d1ff3342965426ca0347fbf0adbafdd27614ad318ee33dfe15f6c69b03799c8527cbc7182bc8077d1ffef242577f05e8bb17cfe1aed321dd2a2573
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

QfTeSHi.exe

Path C:\Windows\System\QfTeSHi.exe
Size 5.9MB
SHA256 c0b03ed58a47302586f85accb2ae49fef651d39e7bf8315e87b3cf87a40d7b15
MD5 c62740f46b1b853c406a5568deb5aaac
SHA1 d9c2baf28d14081f4276d141d6a0a5ec4baee2df
SHA512 41b7ff26d15e0a0b64c2345c7bec5d984187018b62441b9ec4fcf57299b3161095cf9f49ac88b61574aace604a15246729d363c3dd749cee26d9d4b2c8da77b8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:Q+856utgpPF8u/7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

QrgvCrA.exe

Path C:\Windows\System\QrgvCrA.exe
Size 5.9MB
SHA256 5667415809df081b2261a0876023d339163e78f93d5255c3d653580cb11a1b78
MD5 a6cd2b661a4aade877767b844b757359
SHA1 2521138b07f71f325aade47e51242f77b57b1106
SHA512 94177cdd97e3614cbb125b135f41b9c8bae45d6d78a44774f0c5511448100c9bb62debc6c4a7bd1e0b00d7da42e09848087e597985ac8ee76fda328e65845aef
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

UbEQXAJ.exe

Path C:\Windows\System\UbEQXAJ.exe
Size 5.9MB
SHA256 6c61b8570e4495fe1eb4e334b4702da152805baefaa3d05801cbe4d538781ea3
MD5 a24a9a5c8154bf95a6c56f2c6a6f0f87
SHA1 400bd7a4bdc818420fb852edd2b3bf552b4d0ac8
SHA512 78899502714e80074caa9b723d2d5c5d5f33bdbf4f8f77c272bce6d5ef93a05acceb06e300dc90633485402fde122050b671cdfa8bb12b2d26544434a061bea2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

WjcDXIK.exe

Path C:\Windows\System\WjcDXIK.exe
Size 5.9MB
SHA256 d7746fd108bdd3104c7817afc22e5b2777bed684d39d0b5e11c7047d49cd7e51
MD5 64c0de92cf87f5e6fe4a0dfa5ba3453b
SHA1 fe33bb22848d333aa268ccbea10ca9e0093d1268
SHA512 40dd5b434b99585b193b961655b12b3b83648bff28cc9caace4b7cd963aac9f649fc43285f6fe8ae2c770d4575c7c4ba8451171b90abde08e553d59d9f783d5f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

amywwJV.exe

Path C:\Windows\System\amywwJV.exe
Size 5.9MB
SHA256 26daa389236293418fde7815ebba21ce0b7f7e4abdb3cedfda1fa52440b2f77b
MD5 6d9ee522df884b6d16ac2846adfe9886
SHA1 2c27cd4ca2d73ae4e9e40ca54446447b47ae8e8e
SHA512 d3768d047e38ed6628dca937d363d270aafc683746e7ff8e6dbb3b4be3bca5c8ea4c5595f67fee5c13de8c502cd8d6643e7651e13d6737fe8766cbf8c118616e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

dJcMLHr.exe

Path C:\Windows\System\dJcMLHr.exe
Size 5.9MB
SHA256 2bb3a5bd06c1f4d84979dd5e432243725fd4dede70c060113abad8969e5e754e
MD5 ff77fe1266ffc53c6cf66f749da32f8f
SHA1 5385a816911e750ec2b2136005a5566bf7bfdd5f
SHA512 aad05ce2c9022cfaf97f5311c44df0db6230d81929af4e28c5158664b4c8125fa51d5bbf31a258c89f6e6b71a06af8fc645dea4fb0c0af5910303c79eb291486
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU5:Q+856utgpPF8u/75
MD5 SHA1 SHA512 SSDEEP

Submit Download

dOGijlf.exe

Path C:\Windows\System\dOGijlf.exe
Size 5.9MB
SHA256 311ab91d309a8d0f142c5e99546252543e0cca1844b92ff702c5902935476231
MD5 d787c3d4a44880984ee78d56b634f2d0
SHA1 d81f9d2696ff802cf701192fcbce43153d5e7bb2
SHA512 49eb1329bf3f7d564c716f93d867fdf4605346889ef4b923b6814891143ca2aee5c639ec0e61b0469acec2cf40aed4b99450c5ee12e5428d6904e2a80124edec
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhdGalJ.exe

Path C:\Windows\System\jhdGalJ.exe
Size 5.9MB
SHA256 83583504407ed48886eeefc2d8f3b19cbf3c628a89c4e651e5cd0ebdc2818f9b
MD5 787206cc5d60a7cc998fef59248500fd
SHA1 99f5023924e48a2ecd642bbae6b9742a2cb80ea0
SHA512 be55faeb568666ef51c579067b743574c3a2b4ab47b4ea0dc20b0f6f94eb3a43829b9c2473d58e7c67732fd59afb73d43ea4c7109d582ccb6b1e2c8e25c8277a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

kwZTHvp.exe

Path C:\Windows\System\kwZTHvp.exe
Size 5.9MB
SHA256 3e64ede973714e3abc76406d36588d01403de44e9aef44514cc6bdb4cbe892fe
MD5 9199b41e09f7f0b95e6e2dea0dbd48f2
SHA1 497f001c2d85adb6cc3bb4874ce31e792bf28e8e
SHA512 7d40041040534309fd0bc3d05d706fa33bca547704a539e6169e5f6e23521db1cd5ff3372516606dbb3b3ec6573fc237fa79f584cb3a48ea494f2334a7997621
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

mFdLbAl.exe

Path C:\Windows\System\mFdLbAl.exe
Size 5.9MB
SHA256 45229eb59ca85d69f12ac1e9c4f07465af09d7b6c8eaa3c471d7d414acd7c08b
MD5 564d2e8a6588aa05b27978ed0bad45ac
SHA1 b9909dfecfd40b3de40d1911fb6598c0494a8ee6
SHA512 61a91ce8eb2b2d3839ec2196ef064d1211c4f1ab60169e8d3e7e9cd7205c3ea1fe817ae86f2de9a37c4cf2c593bac89fb20da90499a46524004ecc42bb2293a7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

mmwMOXj.exe

Path C:\Windows\System\mmwMOXj.exe
Size 5.9MB
SHA256 ae13fa4aa5fa572fa23aaf61e7570d4d497921ff2b0f4db005376599884bc855
MD5 ae2c0971346cc4082c08ae75f509f675
SHA1 7057905b7d0851c27321289d33d0ea224476eb53
SHA512 5dacb2a7805e5261433428426c22065286dcf7b4cd9988794752f3e9f61e24cae0d6090b403b7151b1113510cd538802ada77a2e614727eadce02a54f25f000a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

oWFTDwX.exe

Path C:\Windows\System\oWFTDwX.exe
Size 5.9MB
SHA256 33c2c37b08e78daaffcf78144c842b908914a3af25b8f037aa6b07e8f5fcebd7
MD5 324745719006b9d31f7b47c1a59f7cbf
SHA1 af052ee862ad2cd3056d27917408c97267a5b25d
SHA512 50f5db5abd63d4eda21984d9e437075c4060c3b031590888e49b9b189be623ea949588b3b45e014c12c26b7e4ba44f5c42caa4989310e966d38d09bc97aa6241
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

owcjaQP.exe

Path C:\Windows\System\owcjaQP.exe
Size 5.9MB
SHA256 e733483de83504ea0c44f23d3fb6717dd88ab12ae5fda0b3f386be8ebc416dee
MD5 5af6822ddb9b1f4ab96c3b5c0d37b070
SHA1 f01eb685a9b5ed6ee24d60c9e67576ceb7e738e4
SHA512 2bb38e17af878c9394c9ce5a3cba9dd5bfadade0389f3ffc9cc0a0f8a87b14d688918fad5c7038eed1f353e3258520f74122c47c0b00111ad7d8e03e0ae79260
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

rwVbeGz.exe

Path C:\Windows\System\rwVbeGz.exe
Size 5.9MB
SHA256 a43f8ca902d85f5591f6ac16ac80ab7b1b3e2729419f78f9f6c9874f330815a4
MD5 45b002056887ce9f10f9d81be4ab719c
SHA1 4aa3cc37d7351949b076486ef66b71e102dd9b97
SHA512 3121d5813a5862db9ef77df5630400e668686e786241af974208cbb751a8fd4edf9d5d5eba4bd20a37d2718ee4d3d4b4e91ff77cbe9e35cb8472e199ac0752f8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

soJgPQi.exe

Path C:\Windows\System\soJgPQi.exe
Size 5.9MB
SHA256 5706b02bafd71fda53f0d9d315ab05a22136abc03a012f5b49af368f69b08420
MD5 92eb9c86f7c6f605a965ae8bb50fcb4a
SHA1 7318864af161525ff9e594596ca5b6bdd41efd1d
SHA512 22fdb73f1c8a4fdbe02c2c4a560d840412338a6bf64704999dca9743c9fa7f05b654ad7cfa2b4c1a8f1f42a7945d8832f4f957377863decb95b969e5d9c3d106
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-80-0x00007FF7361C0000-0x00007FF736514000-memory.dmp

Download

memory/8-152-0x00007FF7361C0000-0x00007FF736514000-memory.dmp

Download

memory/744-94-0x00007FF6D6AB0000-0x00007FF6D6E04000-memory.dmp

Download

memory/744-136-0x00007FF6D6AB0000-0x00007FF6D6E04000-memory.dmp

Download

memory/744-154-0x00007FF6D6AB0000-0x00007FF6D6E04000-memory.dmp

Download

memory/852-158-0x00007FF7F7170000-0x00007FF7F74C4000-memory.dmp

Download

memory/852-121-0x00007FF7F7170000-0x00007FF7F74C4000-memory.dmp

Download

memory/852-138-0x00007FF7F7170000-0x00007FF7F74C4000-memory.dmp

Download

memory/900-140-0x00007FF737BC0000-0x00007FF737F14000-memory.dmp

Download

memory/900-6-0x00007FF737BC0000-0x00007FF737F14000-memory.dmp

Download

memory/900-91-0x00007FF737BC0000-0x00007FF737F14000-memory.dmp

Download

memory/1256-113-0x00007FF66DC60000-0x00007FF66DFB4000-memory.dmp

Download

memory/1256-137-0x00007FF66DC60000-0x00007FF66DFB4000-memory.dmp

Download

memory/1256-157-0x00007FF66DC60000-0x00007FF66DFB4000-memory.dmp

Download

memory/1340-112-0x00007FF725570000-0x00007FF7258C4000-memory.dmp

Download

memory/1340-156-0x00007FF725570000-0x00007FF7258C4000-memory.dmp

Download

memory/1388-159-0x00007FF6C2CC0000-0x00007FF6C3014000-memory.dmp

Download

memory/1388-132-0x00007FF6C2CC0000-0x00007FF6C3014000-memory.dmp

Download

memory/1496-53-0x00007FF648F60000-0x00007FF6492B4000-memory.dmp

Download

memory/1496-146-0x00007FF648F60000-0x00007FF6492B4000-memory.dmp

Download

memory/1520-66-0x00007FF781CB0000-0x00007FF782004000-memory.dmp

Download

memory/1520-134-0x00007FF781CB0000-0x00007FF782004000-memory.dmp

Download

memory/1520-150-0x00007FF781CB0000-0x00007FF782004000-memory.dmp

Download

memory/1552-139-0x00007FF6F5CE0000-0x00007FF6F6034000-memory.dmp

Download

memory/1552-160-0x00007FF6F5CE0000-0x00007FF6F6034000-memory.dmp

Download

memory/1552-131-0x00007FF6F5CE0000-0x00007FF6F6034000-memory.dmp

Download

memory/1660-24-0x00007FF60D050000-0x00007FF60D3A4000-memory.dmp

Download

memory/1660-106-0x00007FF60D050000-0x00007FF60D3A4000-memory.dmp

Download

memory/1660-143-0x00007FF60D050000-0x00007FF60D3A4000-memory.dmp

Download

memory/2028-72-0x00007FF61B7A0000-0x00007FF61BAF4000-memory.dmp

Download

memory/2028-135-0x00007FF61B7A0000-0x00007FF61BAF4000-memory.dmp

Download

memory/2028-151-0x00007FF61B7A0000-0x00007FF61BAF4000-memory.dmp

Download

memory/2340-37-0x00007FF662080000-0x00007FF6623D4000-memory.dmp

Download

memory/2340-142-0x00007FF662080000-0x00007FF6623D4000-memory.dmp

Download

memory/2364-153-0x00007FF6E17B0000-0x00007FF6E1B04000-memory.dmp

Download

memory/2364-90-0x00007FF6E17B0000-0x00007FF6E1B04000-memory.dmp

Download

memory/2384-149-0x00007FF74E560000-0x00007FF74E8B4000-memory.dmp

Download

memory/2384-62-0x00007FF74E560000-0x00007FF74E8B4000-memory.dmp

Download

memory/2948-51-0x00007FF6194E0000-0x00007FF619834000-memory.dmp

Download

memory/2948-144-0x00007FF6194E0000-0x00007FF619834000-memory.dmp

Download

memory/3048-52-0x00007FF698230000-0x00007FF698584000-memory.dmp

Download

memory/3048-147-0x00007FF698230000-0x00007FF698584000-memory.dmp

Download

memory/3136-1-0x0000022338610000-0x0000022338620000-memory.dmp

Download

memory/3136-85-0x00007FF6CCC50000-0x00007FF6CCFA4000-memory.dmp

Download

memory/3136-0-0x00007FF6CCC50000-0x00007FF6CCFA4000-memory.dmp

Download

memory/3852-145-0x00007FF742290000-0x00007FF7425E4000-memory.dmp

Download

memory/3852-31-0x00007FF742290000-0x00007FF7425E4000-memory.dmp

Download

memory/3852-107-0x00007FF742290000-0x00007FF7425E4000-memory.dmp

Download

memory/3900-155-0x00007FF72B910000-0x00007FF72BC64000-memory.dmp

Download

memory/3900-111-0x00007FF72B910000-0x00007FF72BC64000-memory.dmp

Download

memory/4780-15-0x00007FF644450000-0x00007FF6447A4000-memory.dmp

Download

memory/4780-105-0x00007FF644450000-0x00007FF6447A4000-memory.dmp

Download

memory/4780-141-0x00007FF644450000-0x00007FF6447A4000-memory.dmp

Download

memory/4876-148-0x00007FF7E7F70000-0x00007FF7E82C4000-memory.dmp

Download

memory/4876-56-0x00007FF7E7F70000-0x00007FF7E82C4000-memory.dmp

Download

memory/4876-126-0x00007FF7E7F70000-0x00007FF7E82C4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads