cobaltstrike | 9f8f0f7d757fca67fdf300c639815bfab3df3ce4d2d966e2449855da054cf1c7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
Size 5.2MB
Sample240531-kpe47ade52
SHA256 9f8f0f7d757fca67fdf300c639815bfab3df3ce4d2d966e2449855da054cf1c7
MD5 e15c77048395370fda5de21be36c4411
SHA1 1baf800efda77e87844911966b9e253fa9e4c7df
SHA512 f272ab541e3fec6e9a7f3eff9afc718ba65496953064a766a14aaf0a25a1f30fedf3bc12b2aaf51fdea48f636a20ae134691ba2a15fe450d5ad83a1185ea1f2d
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023489-5.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002348e-8.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002348d-13.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002348f-23.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002348a-29.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023490-36.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023491-41.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023493-46.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023494-55.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023495-59.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023498-73.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023499-86.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023497-78.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023496-66.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349a-91.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349c-102.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349f-123.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349b-121.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349e-120.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349d-116.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a0-128.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023489-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002348e-8.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002348d-13.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002348f-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002348a-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023490-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023491-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023493-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023494-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023495-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023498-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023499-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023497-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023496-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349a-91.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349c-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349f-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349b-121.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349e-120.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349d-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000234a0-128.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2268-0-0x00007FF7B1BA0000-0x00007FF7B1EF1000-memory.dmp	UPX
behavioral2/files/0x0008000000023489-5.dat	UPX
behavioral2/files/0x000700000002348e-8.dat	UPX
behavioral2/memory/3592-11-0x00007FF76D570000-0x00007FF76D8C1000-memory.dmp	UPX
behavioral2/files/0x000700000002348d-13.dat	UPX
behavioral2/memory/3356-12-0x00007FF7EA4E0000-0x00007FF7EA831000-memory.dmp	UPX
behavioral2/memory/3844-20-0x00007FF7CDD10000-0x00007FF7CE061000-memory.dmp	UPX
behavioral2/files/0x000700000002348f-23.dat	UPX
behavioral2/files/0x000800000002348a-29.dat	UPX
behavioral2/memory/4268-28-0x00007FF726840000-0x00007FF726B91000-memory.dmp	UPX
behavioral2/files/0x0007000000023490-36.dat	UPX
behavioral2/memory/1416-34-0x00007FF6674E0000-0x00007FF667831000-memory.dmp	UPX
behavioral2/memory/1280-38-0x00007FF7A1590000-0x00007FF7A18E1000-memory.dmp	UPX
behavioral2/files/0x0007000000023491-41.dat	UPX
behavioral2/files/0x0007000000023493-46.dat	UPX
behavioral2/memory/1192-51-0x00007FF72F4E0000-0x00007FF72F831000-memory.dmp	UPX
behavioral2/memory/4336-53-0x00007FF7E1860000-0x00007FF7E1BB1000-memory.dmp	UPX
behavioral2/files/0x0007000000023494-55.dat	UPX
behavioral2/memory/988-54-0x00007FF60A980000-0x00007FF60ACD1000-memory.dmp	UPX
behavioral2/files/0x0007000000023495-59.dat	UPX
behavioral2/memory/512-64-0x00007FF7CE200000-0x00007FF7CE551000-memory.dmp	UPX
behavioral2/files/0x0007000000023498-73.dat	UPX
behavioral2/memory/2268-76-0x00007FF7B1BA0000-0x00007FF7B1EF1000-memory.dmp	UPX
behavioral2/files/0x0007000000023499-86.dat	UPX
behavioral2/memory/2444-84-0x00007FF79DA20000-0x00007FF79DD71000-memory.dmp	UPX
behavioral2/files/0x0007000000023497-78.dat	UPX
behavioral2/memory/3592-77-0x00007FF76D570000-0x00007FF76D8C1000-memory.dmp	UPX
behavioral2/memory/5088-75-0x00007FF6429B0000-0x00007FF642D01000-memory.dmp	UPX
behavioral2/memory/4692-71-0x00007FF773EE0000-0x00007FF774231000-memory.dmp	UPX
behavioral2/files/0x0007000000023496-66.dat	UPX
behavioral2/files/0x000700000002349a-91.dat	UPX
behavioral2/files/0x000700000002349c-102.dat	UPX
behavioral2/memory/3976-105-0x00007FF74EB80000-0x00007FF74EED1000-memory.dmp	UPX
behavioral2/memory/1248-114-0x00007FF726730000-0x00007FF726A81000-memory.dmp	UPX
behavioral2/memory/3916-118-0x00007FF7FBA60000-0x00007FF7FBDB1000-memory.dmp	UPX
behavioral2/files/0x000700000002349f-123.dat	UPX
behavioral2/memory/1392-122-0x00007FF626690000-0x00007FF6269E1000-memory.dmp	UPX
behavioral2/files/0x000700000002349b-121.dat	UPX
behavioral2/files/0x000700000002349e-120.dat	UPX
behavioral2/files/0x000700000002349d-116.dat	UPX
behavioral2/memory/4268-113-0x00007FF726840000-0x00007FF726B91000-memory.dmp	UPX
behavioral2/memory/5024-108-0x00007FF64F780000-0x00007FF64FAD1000-memory.dmp	UPX
behavioral2/memory/3524-95-0x00007FF707B60000-0x00007FF707EB1000-memory.dmp	UPX
behavioral2/memory/3356-94-0x00007FF7EA4E0000-0x00007FF7EA831000-memory.dmp	UPX
behavioral2/memory/3796-90-0x00007FF7B97B0000-0x00007FF7B9B01000-memory.dmp	UPX
behavioral2/files/0x00070000000234a0-128.dat	UPX
behavioral2/memory/4716-138-0x00007FF607680000-0x00007FF6079D1000-memory.dmp	UPX
behavioral2/memory/2268-129-0x00007FF7B1BA0000-0x00007FF7B1EF1000-memory.dmp	UPX
behavioral2/memory/988-143-0x00007FF60A980000-0x00007FF60ACD1000-memory.dmp	UPX
behavioral2/memory/2444-145-0x00007FF79DA20000-0x00007FF79DD71000-memory.dmp	UPX
behavioral2/memory/3524-148-0x00007FF707B60000-0x00007FF707EB1000-memory.dmp	UPX
behavioral2/memory/5088-146-0x00007FF6429B0000-0x00007FF642D01000-memory.dmp	UPX
behavioral2/memory/5024-155-0x00007FF64F780000-0x00007FF64FAD1000-memory.dmp	UPX
behavioral2/memory/1392-157-0x00007FF626690000-0x00007FF6269E1000-memory.dmp	UPX
behavioral2/memory/4716-158-0x00007FF607680000-0x00007FF6079D1000-memory.dmp	UPX
behavioral2/memory/3916-156-0x00007FF7FBA60000-0x00007FF7FBDB1000-memory.dmp	UPX
behavioral2/memory/3976-154-0x00007FF74EB80000-0x00007FF74EED1000-memory.dmp	UPX
behavioral2/memory/1248-153-0x00007FF726730000-0x00007FF726A81000-memory.dmp	UPX
behavioral2/memory/2268-149-0x00007FF7B1BA0000-0x00007FF7B1EF1000-memory.dmp	UPX
behavioral2/memory/3592-204-0x00007FF76D570000-0x00007FF76D8C1000-memory.dmp	UPX
behavioral2/memory/3356-206-0x00007FF7EA4E0000-0x00007FF7EA831000-memory.dmp	UPX
behavioral2/memory/3844-208-0x00007FF7CDD10000-0x00007FF7CE061000-memory.dmp	UPX
behavioral2/memory/4268-214-0x00007FF726840000-0x00007FF726B91000-memory.dmp	UPX
behavioral2/memory/1416-216-0x00007FF6674E0000-0x00007FF667831000-memory.dmp	UPX

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/3592-11-0x00007FF76D570000-0x00007FF76D8C1000-memory.dmp	xmrig
behavioral2/memory/3844-20-0x00007FF7CDD10000-0x00007FF7CE061000-memory.dmp	xmrig
behavioral2/memory/4268-28-0x00007FF726840000-0x00007FF726B91000-memory.dmp	xmrig
behavioral2/memory/1416-34-0x00007FF6674E0000-0x00007FF667831000-memory.dmp	xmrig
behavioral2/memory/1280-38-0x00007FF7A1590000-0x00007FF7A18E1000-memory.dmp	xmrig
behavioral2/memory/1192-51-0x00007FF72F4E0000-0x00007FF72F831000-memory.dmp	xmrig
behavioral2/memory/4336-53-0x00007FF7E1860000-0x00007FF7E1BB1000-memory.dmp	xmrig
behavioral2/memory/512-64-0x00007FF7CE200000-0x00007FF7CE551000-memory.dmp	xmrig
behavioral2/memory/2268-76-0x00007FF7B1BA0000-0x00007FF7B1EF1000-memory.dmp	xmrig
behavioral2/memory/3592-77-0x00007FF76D570000-0x00007FF76D8C1000-memory.dmp	xmrig
behavioral2/memory/4692-71-0x00007FF773EE0000-0x00007FF774231000-memory.dmp	xmrig
behavioral2/memory/4268-113-0x00007FF726840000-0x00007FF726B91000-memory.dmp	xmrig
behavioral2/memory/3356-94-0x00007FF7EA4E0000-0x00007FF7EA831000-memory.dmp	xmrig
behavioral2/memory/3796-90-0x00007FF7B97B0000-0x00007FF7B9B01000-memory.dmp	xmrig
behavioral2/memory/4716-138-0x00007FF607680000-0x00007FF6079D1000-memory.dmp	xmrig
behavioral2/memory/2268-129-0x00007FF7B1BA0000-0x00007FF7B1EF1000-memory.dmp	xmrig
behavioral2/memory/988-143-0x00007FF60A980000-0x00007FF60ACD1000-memory.dmp	xmrig
behavioral2/memory/2444-145-0x00007FF79DA20000-0x00007FF79DD71000-memory.dmp	xmrig
behavioral2/memory/3524-148-0x00007FF707B60000-0x00007FF707EB1000-memory.dmp	xmrig
behavioral2/memory/5088-146-0x00007FF6429B0000-0x00007FF642D01000-memory.dmp	xmrig
behavioral2/memory/5024-155-0x00007FF64F780000-0x00007FF64FAD1000-memory.dmp	xmrig
behavioral2/memory/1392-157-0x00007FF626690000-0x00007FF6269E1000-memory.dmp	xmrig
behavioral2/memory/4716-158-0x00007FF607680000-0x00007FF6079D1000-memory.dmp	xmrig
behavioral2/memory/3916-156-0x00007FF7FBA60000-0x00007FF7FBDB1000-memory.dmp	xmrig
behavioral2/memory/3976-154-0x00007FF74EB80000-0x00007FF74EED1000-memory.dmp	xmrig
behavioral2/memory/1248-153-0x00007FF726730000-0x00007FF726A81000-memory.dmp	xmrig
behavioral2/memory/2268-149-0x00007FF7B1BA0000-0x00007FF7B1EF1000-memory.dmp	xmrig
behavioral2/memory/3592-204-0x00007FF76D570000-0x00007FF76D8C1000-memory.dmp	xmrig
behavioral2/memory/3356-206-0x00007FF7EA4E0000-0x00007FF7EA831000-memory.dmp	xmrig
behavioral2/memory/3844-208-0x00007FF7CDD10000-0x00007FF7CE061000-memory.dmp	xmrig
behavioral2/memory/4268-214-0x00007FF726840000-0x00007FF726B91000-memory.dmp	xmrig
behavioral2/memory/1416-216-0x00007FF6674E0000-0x00007FF667831000-memory.dmp	xmrig
behavioral2/memory/1280-218-0x00007FF7A1590000-0x00007FF7A18E1000-memory.dmp	xmrig
behavioral2/memory/4336-220-0x00007FF7E1860000-0x00007FF7E1BB1000-memory.dmp	xmrig
behavioral2/memory/1192-222-0x00007FF72F4E0000-0x00007FF72F831000-memory.dmp	xmrig
behavioral2/memory/988-224-0x00007FF60A980000-0x00007FF60ACD1000-memory.dmp	xmrig
behavioral2/memory/512-227-0x00007FF7CE200000-0x00007FF7CE551000-memory.dmp	xmrig
behavioral2/memory/4692-234-0x00007FF773EE0000-0x00007FF774231000-memory.dmp	xmrig
behavioral2/memory/2444-236-0x00007FF79DA20000-0x00007FF79DD71000-memory.dmp	xmrig
behavioral2/memory/5088-238-0x00007FF6429B0000-0x00007FF642D01000-memory.dmp	xmrig
behavioral2/memory/3796-240-0x00007FF7B97B0000-0x00007FF7B9B01000-memory.dmp	xmrig
behavioral2/memory/3524-242-0x00007FF707B60000-0x00007FF707EB1000-memory.dmp	xmrig
behavioral2/memory/3976-244-0x00007FF74EB80000-0x00007FF74EED1000-memory.dmp	xmrig
behavioral2/memory/5024-246-0x00007FF64F780000-0x00007FF64FAD1000-memory.dmp	xmrig
behavioral2/memory/1392-248-0x00007FF626690000-0x00007FF6269E1000-memory.dmp	xmrig
behavioral2/memory/3916-250-0x00007FF7FBA60000-0x00007FF7FBDB1000-memory.dmp	xmrig
behavioral2/memory/1248-252-0x00007FF726730000-0x00007FF726A81000-memory.dmp	xmrig
behavioral2/memory/4716-256-0x00007FF607680000-0x00007FF6079D1000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3592	hOuTeuq.exe
3356	nPJqFRD.exe
3844	OQGPUrB.exe
4268	KWvKdij.exe
1416	NhJTtpC.exe
1280	cXyzjkI.exe
4336	ddjUuwV.exe
1192	JHEAUcS.exe
988	APKlPUy.exe
512	MsPmreG.exe
4692	MCynUbW.exe
2444	skLsbqp.exe
5088	aRNdczY.exe
3796	rMeOvRJ.exe
3524	cXdziXT.exe
3976	FKfZAXY.exe
1248	OMkmKbc.exe
5024	ZbMbZzC.exe
3916	rthNJSz.exe
1392	arLrKkP.exe
4716	hbxFiqo.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2268-0-0x00007FF7B1BA0000-0x00007FF7B1EF1000-memory.dmp	upx
behavioral2/files/0x0008000000023489-5.dat	upx
behavioral2/files/0x000700000002348e-8.dat	upx
behavioral2/memory/3592-11-0x00007FF76D570000-0x00007FF76D8C1000-memory.dmp	upx
behavioral2/files/0x000700000002348d-13.dat	upx
behavioral2/memory/3356-12-0x00007FF7EA4E0000-0x00007FF7EA831000-memory.dmp	upx
behavioral2/memory/3844-20-0x00007FF7CDD10000-0x00007FF7CE061000-memory.dmp	upx
behavioral2/files/0x000700000002348f-23.dat	upx
behavioral2/files/0x000800000002348a-29.dat	upx
behavioral2/memory/4268-28-0x00007FF726840000-0x00007FF726B91000-memory.dmp	upx
behavioral2/files/0x0007000000023490-36.dat	upx
behavioral2/memory/1416-34-0x00007FF6674E0000-0x00007FF667831000-memory.dmp	upx
behavioral2/memory/1280-38-0x00007FF7A1590000-0x00007FF7A18E1000-memory.dmp	upx
behavioral2/files/0x0007000000023491-41.dat	upx
behavioral2/files/0x0007000000023493-46.dat	upx
behavioral2/memory/1192-51-0x00007FF72F4E0000-0x00007FF72F831000-memory.dmp	upx
behavioral2/memory/4336-53-0x00007FF7E1860000-0x00007FF7E1BB1000-memory.dmp	upx
behavioral2/files/0x0007000000023494-55.dat	upx
behavioral2/memory/988-54-0x00007FF60A980000-0x00007FF60ACD1000-memory.dmp	upx
behavioral2/files/0x0007000000023495-59.dat	upx
behavioral2/memory/512-64-0x00007FF7CE200000-0x00007FF7CE551000-memory.dmp	upx
behavioral2/files/0x0007000000023498-73.dat	upx
behavioral2/memory/2268-76-0x00007FF7B1BA0000-0x00007FF7B1EF1000-memory.dmp	upx
behavioral2/files/0x0007000000023499-86.dat	upx
behavioral2/memory/2444-84-0x00007FF79DA20000-0x00007FF79DD71000-memory.dmp	upx
behavioral2/files/0x0007000000023497-78.dat	upx
behavioral2/memory/3592-77-0x00007FF76D570000-0x00007FF76D8C1000-memory.dmp	upx
behavioral2/memory/5088-75-0x00007FF6429B0000-0x00007FF642D01000-memory.dmp	upx
behavioral2/memory/4692-71-0x00007FF773EE0000-0x00007FF774231000-memory.dmp	upx
behavioral2/files/0x0007000000023496-66.dat	upx
behavioral2/files/0x000700000002349a-91.dat	upx
behavioral2/files/0x000700000002349c-102.dat	upx
behavioral2/memory/3976-105-0x00007FF74EB80000-0x00007FF74EED1000-memory.dmp	upx
behavioral2/memory/1248-114-0x00007FF726730000-0x00007FF726A81000-memory.dmp	upx
behavioral2/memory/3916-118-0x00007FF7FBA60000-0x00007FF7FBDB1000-memory.dmp	upx
behavioral2/files/0x000700000002349f-123.dat	upx
behavioral2/memory/1392-122-0x00007FF626690000-0x00007FF6269E1000-memory.dmp	upx
behavioral2/files/0x000700000002349b-121.dat	upx
behavioral2/files/0x000700000002349e-120.dat	upx
behavioral2/files/0x000700000002349d-116.dat	upx
behavioral2/memory/4268-113-0x00007FF726840000-0x00007FF726B91000-memory.dmp	upx
behavioral2/memory/5024-108-0x00007FF64F780000-0x00007FF64FAD1000-memory.dmp	upx
behavioral2/memory/3524-95-0x00007FF707B60000-0x00007FF707EB1000-memory.dmp	upx
behavioral2/memory/3356-94-0x00007FF7EA4E0000-0x00007FF7EA831000-memory.dmp	upx
behavioral2/memory/3796-90-0x00007FF7B97B0000-0x00007FF7B9B01000-memory.dmp	upx
behavioral2/files/0x00070000000234a0-128.dat	upx
behavioral2/memory/4716-138-0x00007FF607680000-0x00007FF6079D1000-memory.dmp	upx
behavioral2/memory/2268-129-0x00007FF7B1BA0000-0x00007FF7B1EF1000-memory.dmp	upx
behavioral2/memory/988-143-0x00007FF60A980000-0x00007FF60ACD1000-memory.dmp	upx
behavioral2/memory/2444-145-0x00007FF79DA20000-0x00007FF79DD71000-memory.dmp	upx
behavioral2/memory/3524-148-0x00007FF707B60000-0x00007FF707EB1000-memory.dmp	upx
behavioral2/memory/5088-146-0x00007FF6429B0000-0x00007FF642D01000-memory.dmp	upx
behavioral2/memory/5024-155-0x00007FF64F780000-0x00007FF64FAD1000-memory.dmp	upx
behavioral2/memory/1392-157-0x00007FF626690000-0x00007FF6269E1000-memory.dmp	upx
behavioral2/memory/4716-158-0x00007FF607680000-0x00007FF6079D1000-memory.dmp	upx
behavioral2/memory/3916-156-0x00007FF7FBA60000-0x00007FF7FBDB1000-memory.dmp	upx
behavioral2/memory/3976-154-0x00007FF74EB80000-0x00007FF74EED1000-memory.dmp	upx
behavioral2/memory/1248-153-0x00007FF726730000-0x00007FF726A81000-memory.dmp	upx
behavioral2/memory/2268-149-0x00007FF7B1BA0000-0x00007FF7B1EF1000-memory.dmp	upx
behavioral2/memory/3592-204-0x00007FF76D570000-0x00007FF76D8C1000-memory.dmp	upx
behavioral2/memory/3356-206-0x00007FF7EA4E0000-0x00007FF7EA831000-memory.dmp	upx
behavioral2/memory/3844-208-0x00007FF7CDD10000-0x00007FF7CE061000-memory.dmp	upx
behavioral2/memory/4268-214-0x00007FF726840000-0x00007FF726B91000-memory.dmp	upx
behavioral2/memory/1416-216-0x00007FF6674E0000-0x00007FF667831000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\cXyzjkI.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rMeOvRJ.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FKfZAXY.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZbMbZzC.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NhJTtpC.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\APKlPUy.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rthNJSz.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hbxFiqo.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JHEAUcS.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MCynUbW.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aRNdczY.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OMkmKbc.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hOuTeuq.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nPJqFRD.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KWvKdij.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ddjUuwV.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\arLrKkP.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OQGPUrB.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MsPmreG.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\skLsbqp.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\cXdziXT.exe	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 3592	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	83
PID 2268 wrote to memory of 3592	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	83
PID 2268 wrote to memory of 3356	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	84
PID 2268 wrote to memory of 3356	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	84
PID 2268 wrote to memory of 3844	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	85
PID 2268 wrote to memory of 3844	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	85
PID 2268 wrote to memory of 4268	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	86
PID 2268 wrote to memory of 4268	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	86
PID 2268 wrote to memory of 1416	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	87
PID 2268 wrote to memory of 1416	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	87
PID 2268 wrote to memory of 1280	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	88
PID 2268 wrote to memory of 1280	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	88
PID 2268 wrote to memory of 4336	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	89
PID 2268 wrote to memory of 4336	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	89
PID 2268 wrote to memory of 1192	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	90
PID 2268 wrote to memory of 1192	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	90
PID 2268 wrote to memory of 988	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	92
PID 2268 wrote to memory of 988	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	92
PID 2268 wrote to memory of 512	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	93
PID 2268 wrote to memory of 512	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	93
PID 2268 wrote to memory of 4692	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	95
PID 2268 wrote to memory of 4692	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	95
PID 2268 wrote to memory of 2444	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	96
PID 2268 wrote to memory of 2444	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	96
PID 2268 wrote to memory of 5088	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	97
PID 2268 wrote to memory of 5088	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	97
PID 2268 wrote to memory of 3796	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	98
PID 2268 wrote to memory of 3796	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	98
PID 2268 wrote to memory of 3524	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	99
PID 2268 wrote to memory of 3524	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	99
PID 2268 wrote to memory of 1248	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	101
PID 2268 wrote to memory of 1248	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	101
PID 2268 wrote to memory of 3976	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	102
PID 2268 wrote to memory of 3976	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	102
PID 2268 wrote to memory of 5024	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	103
PID 2268 wrote to memory of 5024	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	103
PID 2268 wrote to memory of 3916	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	104
PID 2268 wrote to memory of 3916	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	104
PID 2268 wrote to memory of 1392	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	105
PID 2268 wrote to memory of 1392	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	105
PID 2268 wrote to memory of 4716	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	106
PID 2268 wrote to memory of 4716	2268	2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe	106

C:\Users\Admin\AppData\Local\Temp\2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_e15c77048395370fda5de21be36c4411_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\System\hOuTeuq.exe
  C:\Windows\System\hOuTeuq.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\nPJqFRD.exe
  C:\Windows\System\nPJqFRD.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\OQGPUrB.exe
  C:\Windows\System\OQGPUrB.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\KWvKdij.exe
  C:\Windows\System\KWvKdij.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\NhJTtpC.exe
  C:\Windows\System\NhJTtpC.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\cXyzjkI.exe
  C:\Windows\System\cXyzjkI.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\ddjUuwV.exe
  C:\Windows\System\ddjUuwV.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\JHEAUcS.exe
  C:\Windows\System\JHEAUcS.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\APKlPUy.exe
  C:\Windows\System\APKlPUy.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\MsPmreG.exe
  C:\Windows\System\MsPmreG.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\MCynUbW.exe
  C:\Windows\System\MCynUbW.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\skLsbqp.exe
  C:\Windows\System\skLsbqp.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\aRNdczY.exe
  C:\Windows\System\aRNdczY.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\rMeOvRJ.exe
  C:\Windows\System\rMeOvRJ.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\cXdziXT.exe
  C:\Windows\System\cXdziXT.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\OMkmKbc.exe
  C:\Windows\System\OMkmKbc.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\FKfZAXY.exe
  C:\Windows\System\FKfZAXY.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\ZbMbZzC.exe
  C:\Windows\System\ZbMbZzC.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\rthNJSz.exe
  C:\Windows\System\rthNJSz.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\arLrKkP.exe
  C:\Windows\System\arLrKkP.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\hbxFiqo.exe
  C:\Windows\System\hbxFiqo.exe
  2⤵
  - Executes dropped EXE
  PID:4716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

APKlPUy.exe

Path C:\Windows\System\APKlPUy.exe
Size 5.2MB
SHA256 415bcdbe728e60df2eb95f6abedd4433247e4bf2a415ebf1487c2924fdce4abd
MD5 1260b6a6828a98c389ff8f8fcbb7f057
SHA1 9c4a831e1ea3885fe7bf22ae405fdb280f80da8b
SHA512 fef5c349290414bcaf851ceaa124192e89a27e4420ffb50a96e64ced6493d49ff205ce4206eeb7d253717a7b3029dfc19720d19f598c0b79c2d55c349da8de80
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibf56utgpPFotBER/mQ32lUz
MD5 SHA1 SHA512 SSDEEP

Submit Download

FKfZAXY.exe

Path C:\Windows\System\FKfZAXY.exe
Size 5.2MB
SHA256 c6f163281cd105b74da97e96581663e7958d1c7a70f64d7520d2b43ce4417fd6
MD5 981b184bc31be8ba5a717f0a6d672421
SHA1 c6bdb4a61c5ccd015d4fdb8e3f69abd7435def80
SHA512 879eb37bb28b8628ee7ccc1753ab0bc32b456ebf69c96b6dbde51e028496dc897b9c87cea2a1e39ca66207b332dede78cd50be56714034e73d9735c81b1769e2
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibf56utgpPFotBER/mQ32lUN
MD5 SHA1 SHA512 SSDEEP

Submit Download

JHEAUcS.exe

Path C:\Windows\System\JHEAUcS.exe
Size 5.2MB
SHA256 5afb3df6a9d7d08680a7c84e1574512151183620b2546bce89f2fb2a1ff71109
MD5 7222fe00bfdcbc3736d4c14fa4ded1d7
SHA1 66d2022a41f56e55d478ec0ddb09c33feec90044
SHA512 ba4886c92bd9d031d9579280c0f5bf6a26cca51517bbe7f71ec4f10b702551bebe0fa68726283336a2aa61adf2f1be908cd77e2b7ade4f252e8a44740f232f0a
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lX:RWWBibf56utgpPFotBER/mQ32lUj
MD5 SHA1 SHA512 SSDEEP

Submit Download

KWvKdij.exe

Path C:\Windows\System\KWvKdij.exe
Size 5.2MB
SHA256 0b2baad014583dc9b656fd49e5813be3c2ade7e4fd632fcde6846c85a5e04b6d
MD5 0cedd22a76c150332d8b9f0336cbcd95
SHA1 9deea6ee591e005ef73f0cf099c8879953d661a5
SHA512 62fdc9a550d56f1202085a8ff62304f32ef19603de751268805ce06f3424d5a31ba1591c9a7e54f714ac65b0e5e29b99fe5d3c74b51496029e73d68f09b6c4bc
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lG:RWWBibf56utgpPFotBER/mQ32lUK
MD5 SHA1 SHA512 SSDEEP

Submit Download

MCynUbW.exe

Path C:\Windows\System\MCynUbW.exe
Size 5.2MB
SHA256 fa6249a75105ca5f8925e007f36a692427675eac93e96e71deebdb55777ebccc
MD5 5fc9c6b7ba8e7e6bdc0ef502770c9c14
SHA1 4d99f6104d9c6420341ac3d1736c74a682bca43c
SHA512 8f079585ab199b3a7e786274fe1bc08f86fdc9771b8703b2dceb7a390c3bcb1f2152b0d1b75369d457e9866e110fe7788ac2285970483f0075e3c17d1b14e44c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lE:RWWBibf56utgpPFotBER/mQ32lUg
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsPmreG.exe

Path C:\Windows\System\MsPmreG.exe
Size 5.2MB
SHA256 b180975e7e1f1ce9d76500a626f448a68596d9f754e267ed0839861ad11264f8
MD5 3e17e5b63cfdbb6909e739f8bbb60ded
SHA1 eedcfc2aca4d2e05873a1e4bafc9579acbd7dc05
SHA512 2a295e2c3d5a28031dce5d769ecd37c1b7e1e534c936e0fa4706ff8bbb36d07bec76e04a5752a18ab0f75c4fcff13f0a51b9ea87764b281385717e64521242a2
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lL:RWWBibf56utgpPFotBER/mQ32lUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

NhJTtpC.exe

Path C:\Windows\System\NhJTtpC.exe
Size 5.2MB
SHA256 a9e0bd65575163d77cf39e3614d3fe0fb17806c6bfbdd21fe10f57789daf6fc1
MD5 83a71fe19102f3e28edb24ab7e713603
SHA1 93a743f5dc2e6a81f91a39ac536b5971c75cb93a
SHA512 fc23bc66819abbbe7334dc5e632873443aeeeaac35ec7e045d0b4e9ca2e16d19939b9850c778753252b5fd73c0598a5fbbf5ee14fcca207507b0a59b9c683ef4
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lp:RWWBibf56utgpPFotBER/mQ32lUN
MD5 SHA1 SHA512 SSDEEP

Submit Download

OMkmKbc.exe

Path C:\Windows\System\OMkmKbc.exe
Size 5.2MB
SHA256 2ad68c192fcb4f1de05e8a14e31051aa19ed9e5c877996ad304de460a8d37b1c
MD5 4553ebed2c35caa595566898602f88e9
SHA1 7c3cbf2252c3e2f974140933b8ff6baba1171d57
SHA512 5460902bc1ba23702530d873c3b17ced4946a5b974cc1c7d8f5288f235080de8adfd87a77a9c1a94164f86e8dedd8f230c87ca05ca226372046f628e65279eb7
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lw:RWWBibf56utgpPFotBER/mQ32lU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

OQGPUrB.exe

Path C:\Windows\System\OQGPUrB.exe
Size 5.2MB
SHA256 f4efcb36a091fb854a8fb49d9d3c420cb6834975f0a5873f51905af444e8598c
MD5 06be8cad13519084ee417c41055275fe
SHA1 1ed0658b4e1caecd75aa6a1f81b69a35b9d4fec6
SHA512 d02ae236e0ac4e6bea40228b047a9d7a711233c819e0a4496aa1235e68ab9ca8e019d9e95bea7677c339fd61731d789b3d7d27e9435e315dd785819f48d9a68c
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l8:RWWBibf56utgpPFotBER/mQ32lU4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZbMbZzC.exe

Path C:\Windows\System\ZbMbZzC.exe
Size 5.2MB
SHA256 67f6a864a0d1695fd5b446284ebcc9bba576038afb2d4a08e6cfb39bdaa9ddc3
MD5 7ed66e0236926b8fae84d84fa61cffd0
SHA1 2232b63a2f106eaa471b8ac2ec5e57954bbd51fb
SHA512 7fccd32983bdcf520fd6aa6c2d9cbeb495820e5f55f51f65e9764a9613768dcf30dcb674805b147b8ca05282998b948b6ab19b189220e6d13fad3cba565990f1
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lP:RWWBibf56utgpPFotBER/mQ32lUr
MD5 SHA1 SHA512 SSDEEP

Submit Download

aRNdczY.exe

Path C:\Windows\System\aRNdczY.exe
Size 5.2MB
SHA256 abf755f82ba4984d9706ab4a63c4420923126af05bd51429260d42819fb7147e
MD5 76743db7f63bf606ebb81c7798813b7f
SHA1 c23103dcd936396d0a437cee74a77c0037b2858b
SHA512 0966abaa8efe910d2da5dfc78578cb86138e6b8369ef991aaa6e0081e5da2fd36ef216a86d75bb6538bbf9fade373801b0ba4127429085132d57601d9620601f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6ld:RWWBibf56utgpPFotBER/mQ32lUh
MD5 SHA1 SHA512 SSDEEP

Submit Download

arLrKkP.exe

Path C:\Windows\System\arLrKkP.exe
Size 5.2MB
SHA256 e0283e595f92e4c10b52e083b445f745f40cbbb088d88c337998015667d010ae
MD5 73476b90a9bc59a2f6c617b63055f9f9
SHA1 5a09d4b589c397684d2ff5d7939c290531f503b6
SHA512 56dd53877eb97c3c0fce45c68388e59be23eb79ff5e332a94cadbc7ddb2c62f51bea570024e921321f1f8dbb00616944ed6a049a637deb6f2e2d4011d9d80402
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lH:RWWBibf56utgpPFotBER/mQ32lUj
MD5 SHA1 SHA512 SSDEEP

Submit Download

cXdziXT.exe

Path C:\Windows\System\cXdziXT.exe
Size 5.2MB
SHA256 a745e62452a9fb515f56f5db527b7e45c538d543cf67941efd6f1063df3cae1f
MD5 11c3b1ec39ba32ce0d8df4d67bcd1b06
SHA1 d6e8f4f9bdc3729d034b4374d7f56714b2af4e91
SHA512 a31752db693340a40698e3fb0ce1a2dbaa9407b8764564ef776a2a6e1db989361a6437c4809e54caa7521a9ce692c499cefc37a575e0b82881440bae7685f0a0
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lD:RWWBibf56utgpPFotBER/mQ32lU/
MD5 SHA1 SHA512 SSDEEP

Submit Download

cXyzjkI.exe

Path C:\Windows\System\cXyzjkI.exe
Size 5.2MB
SHA256 ae5f17e03effd7b34f4804e5a0bb8cfe92e21897f3750c0344980f7b4efebdc9
MD5 1d2b5467fb0324779f495596e5e81717
SHA1 2763f263b40e17dd44917cf2d49c9fe361c2ec14
SHA512 2105e9aa1c1eead25df1a87c72ef334f170c1a690c5069983c07ab96a6fae111c10dbe0939a8926315605015bf2331ade6c4016b62c5a219723480ce7dba7e0e
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lt:RWWBibf56utgpPFotBER/mQ32lUh
MD5 SHA1 SHA512 SSDEEP

Submit Download

ddjUuwV.exe

Path C:\Windows\System\ddjUuwV.exe
Size 5.2MB
SHA256 f5cb6cea4a3ce59e5937a4f5b2f2c1ba493b8dc2b44cf3669ae736f62a2b8680
MD5 270c7f93ca6c1aec6e075b946bd78769
SHA1 143d0ba6a096299de4ed174694c62891e61497be
SHA512 fd1925b4ea46e84f61b39403472384e8c9057bc8918c0817023bc1c4ebf38107415b9155d9763a22e6506cb8992fee5228698aac701e267e7bfd3d54409212a2
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l/:RWWBibf56utgpPFotBER/mQ32lUj
MD5 SHA1 SHA512 SSDEEP

Submit Download

hOuTeuq.exe

Path C:\Windows\System\hOuTeuq.exe
Size 5.2MB
SHA256 097fbcc1ca01d165e5d2f7174922742fc721eccc7bf0ad425d4bfd7e15da0319
MD5 9a535590b26bc26a7173194a93a2f705
SHA1 55e0b42f164de1a2ac5eebfeb1be34bbb3b554e8
SHA512 6b8124a7ba1da255a0174b9c6bd7f3605da5616f62f8a1949724650ba23f1309538a75eb0397541e52b95b0a02d159ba67de7733a9614306a3a373333971e07a
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lG:RWWBibf56utgpPFotBER/mQ32lUC
MD5 SHA1 SHA512 SSDEEP

Submit Download

hbxFiqo.exe

Path C:\Windows\System\hbxFiqo.exe
Size 5.2MB
SHA256 db7c82ad001d240a0e5b15b80914ac2ef71ceb05c3ce52c491f1a03ab55983e8
MD5 66ca505a6f1909d107f4a79648a6157f
SHA1 5089f74e89d349d9fd9dc0392d2d38a1893a0a3c
SHA512 07b0b06842ba62434f83821d7f97e8a2eccb3c66730a2196ba9dc29daabc19417b69fa425ab3c4e70232893a295b37ab6bf774139f9247bac32c516035c9805f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lY:RWWBibf56utgpPFotBER/mQ32lU0
MD5 SHA1 SHA512 SSDEEP

Submit Download

nPJqFRD.exe

Path C:\Windows\System\nPJqFRD.exe
Size 5.2MB
SHA256 e2a0af518943bbf3981a1da5a1467377a6ffeda19f31f94e12121cd87e89d95d
MD5 7d81c3df995c0f8dd18ab047637cf387
SHA1 c883491007726e72677f6857ab3445a2bb7e95cf
SHA512 b0fcb4b523777ad665f269ff918fb371de542c40d69b1bdba3f6e13186891966b3b5e353b77180ab458e34d67a1d049887ad109f7f1133d3d81069748aea0b96
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lJ:RWWBibf56utgpPFotBER/mQ32lUt
MD5 SHA1 SHA512 SSDEEP

Submit Download

rMeOvRJ.exe

Path C:\Windows\System\rMeOvRJ.exe
Size 5.2MB
SHA256 be4703f463f604c7857602bbf4911abb250be7c93f8e260e2dc0c1b9611ddd0f
MD5 9d9ff383eadfc9ec1a0500692db19c9b
SHA1 86fa6bd4f0a4f8e2b4da4e9876ff56beb58632e7
SHA512 312645b9a1a2a30ac8720eda26aac1c324a374e6baace99268efc2c5c869842969bd27107e28b41d0099856135bd633944b6f78b13e935f7955caa6e2a15a95f
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lT:RWWBibf56utgpPFotBER/mQ32lUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

rthNJSz.exe

Path C:\Windows\System\rthNJSz.exe
Size 5.2MB
SHA256 e49bf6375ff2c96ad73db588b6cc77dc11eb8ab2b9eebd5530f886d3eefc9116
MD5 fb58dbc7d7810d80c94ab5f5d3afb345
SHA1 55e0c165410a84e4e493b0bbcb44107059fb8198
SHA512 a397822a3690983e076cfb9b0cb2df8aa3f0f98dc128f7b499281e37969606753ceac0345925054d5e85ba3dd51908bd243a2396d0013842f784923952070316
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lQ:RWWBibf56utgpPFotBER/mQ32lUk
MD5 SHA1 SHA512 SSDEEP

Submit Download

skLsbqp.exe

Path C:\Windows\System\skLsbqp.exe
Size 5.2MB
SHA256 d1a5a74044b7a3148a3e9f8bd666d2d213ca08c81c1800c59d086b1af4053bb9
MD5 fe098aaa94d7d4611f244161c3423863
SHA1 7be537d460ca5ca9f30568e20b6c01ccdb382d1c
SHA512 e47bf786dd7bff5e0da98db8231264422a96fd58210a88c2056d0eef26ef7217ac0b4c8e91299a2022a2d6d72e05983508f8276ff21cfd5e8c540e5c094ae3a9
SSDEEP 49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lG:RWWBibf56utgpPFotBER/mQ32lUK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/512-64-0x00007FF7CE200000-0x00007FF7CE551000-memory.dmp

Download

memory/512-227-0x00007FF7CE200000-0x00007FF7CE551000-memory.dmp

Download

memory/988-143-0x00007FF60A980000-0x00007FF60ACD1000-memory.dmp

Download

memory/988-54-0x00007FF60A980000-0x00007FF60ACD1000-memory.dmp

Download

memory/988-224-0x00007FF60A980000-0x00007FF60ACD1000-memory.dmp

Download

memory/1192-222-0x00007FF72F4E0000-0x00007FF72F831000-memory.dmp

Download

memory/1192-51-0x00007FF72F4E0000-0x00007FF72F831000-memory.dmp

Download

memory/1248-252-0x00007FF726730000-0x00007FF726A81000-memory.dmp

Download

memory/1248-153-0x00007FF726730000-0x00007FF726A81000-memory.dmp

Download

memory/1248-114-0x00007FF726730000-0x00007FF726A81000-memory.dmp

Download

memory/1280-218-0x00007FF7A1590000-0x00007FF7A18E1000-memory.dmp

Download

memory/1280-38-0x00007FF7A1590000-0x00007FF7A18E1000-memory.dmp

Download

memory/1392-122-0x00007FF626690000-0x00007FF6269E1000-memory.dmp

Download

memory/1392-248-0x00007FF626690000-0x00007FF6269E1000-memory.dmp

Download

memory/1392-157-0x00007FF626690000-0x00007FF6269E1000-memory.dmp

Download

memory/1416-34-0x00007FF6674E0000-0x00007FF667831000-memory.dmp

Download

memory/1416-216-0x00007FF6674E0000-0x00007FF667831000-memory.dmp

Download

memory/2268-149-0x00007FF7B1BA0000-0x00007FF7B1EF1000-memory.dmp

Download

memory/2268-1-0x000001FABF020000-0x000001FABF030000-memory.dmp

Download

memory/2268-0-0x00007FF7B1BA0000-0x00007FF7B1EF1000-memory.dmp

Download

memory/2268-76-0x00007FF7B1BA0000-0x00007FF7B1EF1000-memory.dmp

Download

memory/2268-129-0x00007FF7B1BA0000-0x00007FF7B1EF1000-memory.dmp

Download

memory/2444-145-0x00007FF79DA20000-0x00007FF79DD71000-memory.dmp

Download

memory/2444-236-0x00007FF79DA20000-0x00007FF79DD71000-memory.dmp

Download

memory/2444-84-0x00007FF79DA20000-0x00007FF79DD71000-memory.dmp

Download

memory/3356-206-0x00007FF7EA4E0000-0x00007FF7EA831000-memory.dmp

Download

memory/3356-94-0x00007FF7EA4E0000-0x00007FF7EA831000-memory.dmp

Download

memory/3356-12-0x00007FF7EA4E0000-0x00007FF7EA831000-memory.dmp

Download

memory/3524-95-0x00007FF707B60000-0x00007FF707EB1000-memory.dmp

Download

memory/3524-242-0x00007FF707B60000-0x00007FF707EB1000-memory.dmp

Download

memory/3524-148-0x00007FF707B60000-0x00007FF707EB1000-memory.dmp

Download

memory/3592-11-0x00007FF76D570000-0x00007FF76D8C1000-memory.dmp

Download

memory/3592-77-0x00007FF76D570000-0x00007FF76D8C1000-memory.dmp

Download

memory/3592-204-0x00007FF76D570000-0x00007FF76D8C1000-memory.dmp

Download

memory/3796-240-0x00007FF7B97B0000-0x00007FF7B9B01000-memory.dmp

Download

memory/3796-90-0x00007FF7B97B0000-0x00007FF7B9B01000-memory.dmp

Download

memory/3844-208-0x00007FF7CDD10000-0x00007FF7CE061000-memory.dmp

Download

memory/3844-20-0x00007FF7CDD10000-0x00007FF7CE061000-memory.dmp

Download

memory/3916-250-0x00007FF7FBA60000-0x00007FF7FBDB1000-memory.dmp

Download

memory/3916-156-0x00007FF7FBA60000-0x00007FF7FBDB1000-memory.dmp

Download

memory/3916-118-0x00007FF7FBA60000-0x00007FF7FBDB1000-memory.dmp

Download

memory/3976-105-0x00007FF74EB80000-0x00007FF74EED1000-memory.dmp

Download

memory/3976-154-0x00007FF74EB80000-0x00007FF74EED1000-memory.dmp

Download

memory/3976-244-0x00007FF74EB80000-0x00007FF74EED1000-memory.dmp

Download

memory/4268-113-0x00007FF726840000-0x00007FF726B91000-memory.dmp

Download

memory/4268-28-0x00007FF726840000-0x00007FF726B91000-memory.dmp

Download

memory/4268-214-0x00007FF726840000-0x00007FF726B91000-memory.dmp

Download

memory/4336-220-0x00007FF7E1860000-0x00007FF7E1BB1000-memory.dmp

Download

memory/4336-53-0x00007FF7E1860000-0x00007FF7E1BB1000-memory.dmp

Download

memory/4692-71-0x00007FF773EE0000-0x00007FF774231000-memory.dmp

Download

memory/4692-234-0x00007FF773EE0000-0x00007FF774231000-memory.dmp

Download

memory/4716-158-0x00007FF607680000-0x00007FF6079D1000-memory.dmp

Download

memory/4716-256-0x00007FF607680000-0x00007FF6079D1000-memory.dmp

Download

memory/4716-138-0x00007FF607680000-0x00007FF6079D1000-memory.dmp

Download

memory/5024-155-0x00007FF64F780000-0x00007FF64FAD1000-memory.dmp

Download

memory/5024-246-0x00007FF64F780000-0x00007FF64FAD1000-memory.dmp

Download

memory/5024-108-0x00007FF64F780000-0x00007FF64FAD1000-memory.dmp

Download

memory/5088-238-0x00007FF6429B0000-0x00007FF642D01000-memory.dmp

Download

memory/5088-146-0x00007FF6429B0000-0x00007FF642D01000-memory.dmp

Download

memory/5088-75-0x00007FF6429B0000-0x00007FF642D01000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads