cobaltstrike | 56337f49aef519e0a121bc2a06d2fd503d175202763909ab6ca1a8485923fa8d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240531-s2qqfsdd75
SHA256 56337f49aef519e0a121bc2a06d2fd503d175202763909ab6ca1a8485923fa8d
MD5 3923c06684741e1e7b8fe76ce917af2a
SHA1 4ac5a002cf43a3ed3a12f385e5ca0817471d936a
SHA512 b23554b8b358756054640d0fc9b364e9cad9bb9e2c32cd7114645b19df3214caab6952d2a5e406f184e4d6dabd403f557d5b29c2c1691b608eec74ca377c8ea5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000a0000000233f2-5.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fb-10.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fc-11.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fd-22.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fe-29.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ff-33.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023400-38.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023401-46.dat	cobalt_reflective_dll
behavioral2/files/0x000a0000000233f3-54.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023403-61.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023405-67.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023406-70.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023407-77.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023408-83.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023409-94.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340a-108.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340c-118.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340e-127.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340f-130.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340d-117.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340b-113.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000a0000000233f2-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fb-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fc-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fd-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fe-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ff-33.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023400-38.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023401-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a0000000233f3-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023403-61.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023405-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023406-70.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023407-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023408-83.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023409-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340a-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340c-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340e-127.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340f-130.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340d-117.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340b-113.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3380-0-0x00007FF6BE000000-0x00007FF6BE354000-memory.dmp	UPX
behavioral2/files/0x000a0000000233f2-5.dat	UPX
behavioral2/files/0x00070000000233fb-10.dat	UPX
behavioral2/files/0x00070000000233fc-11.dat	UPX
behavioral2/memory/1224-15-0x00007FF7F7570000-0x00007FF7F78C4000-memory.dmp	UPX
behavioral2/files/0x00070000000233fd-22.dat	UPX
behavioral2/files/0x00070000000233fe-29.dat	UPX
behavioral2/files/0x00070000000233ff-33.dat	UPX
behavioral2/files/0x0007000000023400-38.dat	UPX
behavioral2/memory/2792-40-0x00007FF6EDB10000-0x00007FF6EDE64000-memory.dmp	UPX
behavioral2/memory/1680-43-0x00007FF713DD0000-0x00007FF714124000-memory.dmp	UPX
behavioral2/memory/4652-39-0x00007FF6C0710000-0x00007FF6C0A64000-memory.dmp	UPX
behavioral2/memory/2088-34-0x00007FF764CF0000-0x00007FF765044000-memory.dmp	UPX
behavioral2/memory/2132-24-0x00007FF6D0B10000-0x00007FF6D0E64000-memory.dmp	UPX
behavioral2/memory/1080-6-0x00007FF7349B0000-0x00007FF734D04000-memory.dmp	UPX
behavioral2/files/0x0007000000023401-46.dat	UPX
behavioral2/files/0x000a0000000233f3-54.dat	UPX
behavioral2/memory/3020-52-0x00007FF7FBDB0000-0x00007FF7FC104000-memory.dmp	UPX
behavioral2/files/0x0007000000023403-61.dat	UPX
behavioral2/memory/4832-60-0x00007FF6F3750000-0x00007FF6F3AA4000-memory.dmp	UPX
behavioral2/memory/696-64-0x00007FF702CA0000-0x00007FF702FF4000-memory.dmp	UPX
behavioral2/files/0x0007000000023405-67.dat	UPX
behavioral2/files/0x0007000000023406-70.dat	UPX
behavioral2/files/0x0007000000023407-77.dat	UPX
behavioral2/files/0x0007000000023408-83.dat	UPX
behavioral2/memory/2132-86-0x00007FF6D0B10000-0x00007FF6D0E64000-memory.dmp	UPX
behavioral2/memory/4852-85-0x00007FF6030D0000-0x00007FF603424000-memory.dmp	UPX
behavioral2/memory/4464-84-0x00007FF661AB0000-0x00007FF661E04000-memory.dmp	UPX
behavioral2/memory/1224-82-0x00007FF7F7570000-0x00007FF7F78C4000-memory.dmp	UPX
behavioral2/memory/1080-81-0x00007FF7349B0000-0x00007FF734D04000-memory.dmp	UPX
behavioral2/memory/3668-80-0x00007FF7600D0000-0x00007FF760424000-memory.dmp	UPX
behavioral2/memory/3380-75-0x00007FF6BE000000-0x00007FF6BE354000-memory.dmp	UPX
behavioral2/memory/3924-66-0x00007FF608010000-0x00007FF608364000-memory.dmp	UPX
behavioral2/files/0x0007000000023409-94.dat	UPX
behavioral2/files/0x000700000002340a-108.dat	UPX
behavioral2/files/0x000700000002340c-118.dat	UPX
behavioral2/files/0x000700000002340e-127.dat	UPX
behavioral2/files/0x000700000002340f-130.dat	UPX
behavioral2/memory/3928-125-0x00007FF73F0F0000-0x00007FF73F444000-memory.dmp	UPX
behavioral2/memory/3604-124-0x00007FF713C20000-0x00007FF713F74000-memory.dmp	UPX
behavioral2/memory/1680-123-0x00007FF713DD0000-0x00007FF714124000-memory.dmp	UPX
behavioral2/files/0x000700000002340d-117.dat	UPX
behavioral2/memory/1648-111-0x00007FF7CC8E0000-0x00007FF7CCC34000-memory.dmp	UPX
behavioral2/memory/3880-110-0x00007FF695B00000-0x00007FF695E54000-memory.dmp	UPX
behavioral2/files/0x000700000002340b-113.dat	UPX
behavioral2/memory/4648-105-0x00007FF663FA0000-0x00007FF6642F4000-memory.dmp	UPX
behavioral2/memory/2088-98-0x00007FF764CF0000-0x00007FF765044000-memory.dmp	UPX
behavioral2/memory/4872-132-0x00007FF733FB0000-0x00007FF734304000-memory.dmp	UPX
behavioral2/memory/436-133-0x00007FF767060000-0x00007FF7673B4000-memory.dmp	UPX
behavioral2/memory/696-134-0x00007FF702CA0000-0x00007FF702FF4000-memory.dmp	UPX
behavioral2/memory/3924-135-0x00007FF608010000-0x00007FF608364000-memory.dmp	UPX
behavioral2/memory/4464-136-0x00007FF661AB0000-0x00007FF661E04000-memory.dmp	UPX
behavioral2/memory/4852-137-0x00007FF6030D0000-0x00007FF603424000-memory.dmp	UPX
behavioral2/memory/3880-138-0x00007FF695B00000-0x00007FF695E54000-memory.dmp	UPX
behavioral2/memory/1648-139-0x00007FF7CC8E0000-0x00007FF7CCC34000-memory.dmp	UPX
behavioral2/memory/3928-140-0x00007FF73F0F0000-0x00007FF73F444000-memory.dmp	UPX
behavioral2/memory/1080-141-0x00007FF7349B0000-0x00007FF734D04000-memory.dmp	UPX
behavioral2/memory/1224-142-0x00007FF7F7570000-0x00007FF7F78C4000-memory.dmp	UPX
behavioral2/memory/2132-143-0x00007FF6D0B10000-0x00007FF6D0E64000-memory.dmp	UPX
behavioral2/memory/2088-144-0x00007FF764CF0000-0x00007FF765044000-memory.dmp	UPX
behavioral2/memory/2792-145-0x00007FF6EDB10000-0x00007FF6EDE64000-memory.dmp	UPX
behavioral2/memory/4652-146-0x00007FF6C0710000-0x00007FF6C0A64000-memory.dmp	UPX
behavioral2/memory/1680-147-0x00007FF713DD0000-0x00007FF714124000-memory.dmp	UPX
behavioral2/memory/3020-148-0x00007FF7FBDB0000-0x00007FF7FC104000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3380-0-0x00007FF6BE000000-0x00007FF6BE354000-memory.dmp	xmrig
behavioral2/files/0x000a0000000233f2-5.dat	xmrig
behavioral2/files/0x00070000000233fb-10.dat	xmrig
behavioral2/files/0x00070000000233fc-11.dat	xmrig
behavioral2/memory/1224-15-0x00007FF7F7570000-0x00007FF7F78C4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fd-22.dat	xmrig
behavioral2/files/0x00070000000233fe-29.dat	xmrig
behavioral2/files/0x00070000000233ff-33.dat	xmrig
behavioral2/files/0x0007000000023400-38.dat	xmrig
behavioral2/memory/2792-40-0x00007FF6EDB10000-0x00007FF6EDE64000-memory.dmp	xmrig
behavioral2/memory/1680-43-0x00007FF713DD0000-0x00007FF714124000-memory.dmp	xmrig
behavioral2/memory/4652-39-0x00007FF6C0710000-0x00007FF6C0A64000-memory.dmp	xmrig
behavioral2/memory/2088-34-0x00007FF764CF0000-0x00007FF765044000-memory.dmp	xmrig
behavioral2/memory/2132-24-0x00007FF6D0B10000-0x00007FF6D0E64000-memory.dmp	xmrig
behavioral2/memory/1080-6-0x00007FF7349B0000-0x00007FF734D04000-memory.dmp	xmrig
behavioral2/files/0x0007000000023401-46.dat	xmrig
behavioral2/files/0x000a0000000233f3-54.dat	xmrig
behavioral2/memory/3020-52-0x00007FF7FBDB0000-0x00007FF7FC104000-memory.dmp	xmrig
behavioral2/files/0x0007000000023403-61.dat	xmrig
behavioral2/memory/4832-60-0x00007FF6F3750000-0x00007FF6F3AA4000-memory.dmp	xmrig
behavioral2/memory/696-64-0x00007FF702CA0000-0x00007FF702FF4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023405-67.dat	xmrig
behavioral2/files/0x0007000000023406-70.dat	xmrig
behavioral2/files/0x0007000000023407-77.dat	xmrig
behavioral2/files/0x0007000000023408-83.dat	xmrig
behavioral2/memory/2132-86-0x00007FF6D0B10000-0x00007FF6D0E64000-memory.dmp	xmrig
behavioral2/memory/4852-85-0x00007FF6030D0000-0x00007FF603424000-memory.dmp	xmrig
behavioral2/memory/4464-84-0x00007FF661AB0000-0x00007FF661E04000-memory.dmp	xmrig
behavioral2/memory/1224-82-0x00007FF7F7570000-0x00007FF7F78C4000-memory.dmp	xmrig
behavioral2/memory/1080-81-0x00007FF7349B0000-0x00007FF734D04000-memory.dmp	xmrig
behavioral2/memory/3668-80-0x00007FF7600D0000-0x00007FF760424000-memory.dmp	xmrig
behavioral2/memory/3380-75-0x00007FF6BE000000-0x00007FF6BE354000-memory.dmp	xmrig
behavioral2/memory/3924-66-0x00007FF608010000-0x00007FF608364000-memory.dmp	xmrig
behavioral2/files/0x0007000000023409-94.dat	xmrig
behavioral2/files/0x000700000002340a-108.dat	xmrig
behavioral2/files/0x000700000002340c-118.dat	xmrig
behavioral2/files/0x000700000002340e-127.dat	xmrig
behavioral2/files/0x000700000002340f-130.dat	xmrig
behavioral2/memory/3928-125-0x00007FF73F0F0000-0x00007FF73F444000-memory.dmp	xmrig
behavioral2/memory/3604-124-0x00007FF713C20000-0x00007FF713F74000-memory.dmp	xmrig
behavioral2/memory/1680-123-0x00007FF713DD0000-0x00007FF714124000-memory.dmp	xmrig
behavioral2/files/0x000700000002340d-117.dat	xmrig
behavioral2/memory/1648-111-0x00007FF7CC8E0000-0x00007FF7CCC34000-memory.dmp	xmrig
behavioral2/memory/3880-110-0x00007FF695B00000-0x00007FF695E54000-memory.dmp	xmrig
behavioral2/files/0x000700000002340b-113.dat	xmrig
behavioral2/memory/4648-105-0x00007FF663FA0000-0x00007FF6642F4000-memory.dmp	xmrig
behavioral2/memory/2088-98-0x00007FF764CF0000-0x00007FF765044000-memory.dmp	xmrig
behavioral2/memory/4872-132-0x00007FF733FB0000-0x00007FF734304000-memory.dmp	xmrig
behavioral2/memory/436-133-0x00007FF767060000-0x00007FF7673B4000-memory.dmp	xmrig
behavioral2/memory/696-134-0x00007FF702CA0000-0x00007FF702FF4000-memory.dmp	xmrig
behavioral2/memory/3924-135-0x00007FF608010000-0x00007FF608364000-memory.dmp	xmrig
behavioral2/memory/4464-136-0x00007FF661AB0000-0x00007FF661E04000-memory.dmp	xmrig
behavioral2/memory/4852-137-0x00007FF6030D0000-0x00007FF603424000-memory.dmp	xmrig
behavioral2/memory/3880-138-0x00007FF695B00000-0x00007FF695E54000-memory.dmp	xmrig
behavioral2/memory/1648-139-0x00007FF7CC8E0000-0x00007FF7CCC34000-memory.dmp	xmrig
behavioral2/memory/3928-140-0x00007FF73F0F0000-0x00007FF73F444000-memory.dmp	xmrig
behavioral2/memory/1080-141-0x00007FF7349B0000-0x00007FF734D04000-memory.dmp	xmrig
behavioral2/memory/1224-142-0x00007FF7F7570000-0x00007FF7F78C4000-memory.dmp	xmrig
behavioral2/memory/2132-143-0x00007FF6D0B10000-0x00007FF6D0E64000-memory.dmp	xmrig
behavioral2/memory/2088-144-0x00007FF764CF0000-0x00007FF765044000-memory.dmp	xmrig
behavioral2/memory/2792-145-0x00007FF6EDB10000-0x00007FF6EDE64000-memory.dmp	xmrig
behavioral2/memory/4652-146-0x00007FF6C0710000-0x00007FF6C0A64000-memory.dmp	xmrig
behavioral2/memory/1680-147-0x00007FF713DD0000-0x00007FF714124000-memory.dmp	xmrig
behavioral2/memory/3020-148-0x00007FF7FBDB0000-0x00007FF7FC104000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1080	lgxriOZ.exe
1224	jQgnmew.exe
2132	BooaBbs.exe
2088	AhejmSr.exe
2792	dnLpWhd.exe
4652	bVyiVAB.exe
1680	ghOEbNl.exe
3020	OQDnvRU.exe
4832	RxbKxxc.exe
696	cNxzwsl.exe
3924	RSBbGAj.exe
3668	XzsWkzu.exe
4464	xVWujMu.exe
4852	yeYtesh.exe
4648	CChJSRz.exe
3880	olAsaUT.exe
1648	reGweQq.exe
3604	DqANLqT.exe
4872	rvFOcLY.exe
3928	owNOgxU.exe
436	DPltpoX.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3380-0-0x00007FF6BE000000-0x00007FF6BE354000-memory.dmp	upx
behavioral2/files/0x000a0000000233f2-5.dat	upx
behavioral2/files/0x00070000000233fb-10.dat	upx
behavioral2/files/0x00070000000233fc-11.dat	upx
behavioral2/memory/1224-15-0x00007FF7F7570000-0x00007FF7F78C4000-memory.dmp	upx
behavioral2/files/0x00070000000233fd-22.dat	upx
behavioral2/files/0x00070000000233fe-29.dat	upx
behavioral2/files/0x00070000000233ff-33.dat	upx
behavioral2/files/0x0007000000023400-38.dat	upx
behavioral2/memory/2792-40-0x00007FF6EDB10000-0x00007FF6EDE64000-memory.dmp	upx
behavioral2/memory/1680-43-0x00007FF713DD0000-0x00007FF714124000-memory.dmp	upx
behavioral2/memory/4652-39-0x00007FF6C0710000-0x00007FF6C0A64000-memory.dmp	upx
behavioral2/memory/2088-34-0x00007FF764CF0000-0x00007FF765044000-memory.dmp	upx
behavioral2/memory/2132-24-0x00007FF6D0B10000-0x00007FF6D0E64000-memory.dmp	upx
behavioral2/memory/1080-6-0x00007FF7349B0000-0x00007FF734D04000-memory.dmp	upx
behavioral2/files/0x0007000000023401-46.dat	upx
behavioral2/files/0x000a0000000233f3-54.dat	upx
behavioral2/memory/3020-52-0x00007FF7FBDB0000-0x00007FF7FC104000-memory.dmp	upx
behavioral2/files/0x0007000000023403-61.dat	upx
behavioral2/memory/4832-60-0x00007FF6F3750000-0x00007FF6F3AA4000-memory.dmp	upx
behavioral2/memory/696-64-0x00007FF702CA0000-0x00007FF702FF4000-memory.dmp	upx
behavioral2/files/0x0007000000023405-67.dat	upx
behavioral2/files/0x0007000000023406-70.dat	upx
behavioral2/files/0x0007000000023407-77.dat	upx
behavioral2/files/0x0007000000023408-83.dat	upx
behavioral2/memory/2132-86-0x00007FF6D0B10000-0x00007FF6D0E64000-memory.dmp	upx
behavioral2/memory/4852-85-0x00007FF6030D0000-0x00007FF603424000-memory.dmp	upx
behavioral2/memory/4464-84-0x00007FF661AB0000-0x00007FF661E04000-memory.dmp	upx
behavioral2/memory/1224-82-0x00007FF7F7570000-0x00007FF7F78C4000-memory.dmp	upx
behavioral2/memory/1080-81-0x00007FF7349B0000-0x00007FF734D04000-memory.dmp	upx
behavioral2/memory/3668-80-0x00007FF7600D0000-0x00007FF760424000-memory.dmp	upx
behavioral2/memory/3380-75-0x00007FF6BE000000-0x00007FF6BE354000-memory.dmp	upx
behavioral2/memory/3924-66-0x00007FF608010000-0x00007FF608364000-memory.dmp	upx
behavioral2/files/0x0007000000023409-94.dat	upx
behavioral2/files/0x000700000002340a-108.dat	upx
behavioral2/files/0x000700000002340c-118.dat	upx
behavioral2/files/0x000700000002340e-127.dat	upx
behavioral2/files/0x000700000002340f-130.dat	upx
behavioral2/memory/3928-125-0x00007FF73F0F0000-0x00007FF73F444000-memory.dmp	upx
behavioral2/memory/3604-124-0x00007FF713C20000-0x00007FF713F74000-memory.dmp	upx
behavioral2/memory/1680-123-0x00007FF713DD0000-0x00007FF714124000-memory.dmp	upx
behavioral2/files/0x000700000002340d-117.dat	upx
behavioral2/memory/1648-111-0x00007FF7CC8E0000-0x00007FF7CCC34000-memory.dmp	upx
behavioral2/memory/3880-110-0x00007FF695B00000-0x00007FF695E54000-memory.dmp	upx
behavioral2/files/0x000700000002340b-113.dat	upx
behavioral2/memory/4648-105-0x00007FF663FA0000-0x00007FF6642F4000-memory.dmp	upx
behavioral2/memory/2088-98-0x00007FF764CF0000-0x00007FF765044000-memory.dmp	upx
behavioral2/memory/4872-132-0x00007FF733FB0000-0x00007FF734304000-memory.dmp	upx
behavioral2/memory/436-133-0x00007FF767060000-0x00007FF7673B4000-memory.dmp	upx
behavioral2/memory/696-134-0x00007FF702CA0000-0x00007FF702FF4000-memory.dmp	upx
behavioral2/memory/3924-135-0x00007FF608010000-0x00007FF608364000-memory.dmp	upx
behavioral2/memory/4464-136-0x00007FF661AB0000-0x00007FF661E04000-memory.dmp	upx
behavioral2/memory/4852-137-0x00007FF6030D0000-0x00007FF603424000-memory.dmp	upx
behavioral2/memory/3880-138-0x00007FF695B00000-0x00007FF695E54000-memory.dmp	upx
behavioral2/memory/1648-139-0x00007FF7CC8E0000-0x00007FF7CCC34000-memory.dmp	upx
behavioral2/memory/3928-140-0x00007FF73F0F0000-0x00007FF73F444000-memory.dmp	upx
behavioral2/memory/1080-141-0x00007FF7349B0000-0x00007FF734D04000-memory.dmp	upx
behavioral2/memory/1224-142-0x00007FF7F7570000-0x00007FF7F78C4000-memory.dmp	upx
behavioral2/memory/2132-143-0x00007FF6D0B10000-0x00007FF6D0E64000-memory.dmp	upx
behavioral2/memory/2088-144-0x00007FF764CF0000-0x00007FF765044000-memory.dmp	upx
behavioral2/memory/2792-145-0x00007FF6EDB10000-0x00007FF6EDE64000-memory.dmp	upx
behavioral2/memory/4652-146-0x00007FF6C0710000-0x00007FF6C0A64000-memory.dmp	upx
behavioral2/memory/1680-147-0x00007FF713DD0000-0x00007FF714124000-memory.dmp	upx
behavioral2/memory/3020-148-0x00007FF7FBDB0000-0x00007FF7FC104000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\RSBbGAj.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yeYtesh.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rvFOcLY.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dnLpWhd.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ghOEbNl.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OQDnvRU.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\cNxzwsl.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DqANLqT.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DPltpoX.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jQgnmew.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AhejmSr.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XzsWkzu.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xVWujMu.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\olAsaUT.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\reGweQq.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\owNOgxU.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BooaBbs.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bVyiVAB.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RxbKxxc.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CChJSRz.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lgxriOZ.exe	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 1080	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	85
PID 3380 wrote to memory of 1080	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	85
PID 3380 wrote to memory of 1224	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	86
PID 3380 wrote to memory of 1224	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	86
PID 3380 wrote to memory of 2132	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	87
PID 3380 wrote to memory of 2132	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	87
PID 3380 wrote to memory of 2088	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	88
PID 3380 wrote to memory of 2088	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	88
PID 3380 wrote to memory of 2792	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	89
PID 3380 wrote to memory of 2792	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	89
PID 3380 wrote to memory of 4652	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	90
PID 3380 wrote to memory of 4652	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	90
PID 3380 wrote to memory of 1680	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	91
PID 3380 wrote to memory of 1680	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	91
PID 3380 wrote to memory of 3020	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	94
PID 3380 wrote to memory of 3020	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	94
PID 3380 wrote to memory of 4832	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	96
PID 3380 wrote to memory of 4832	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	96
PID 3380 wrote to memory of 696	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	97
PID 3380 wrote to memory of 696	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	97
PID 3380 wrote to memory of 3924	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	98
PID 3380 wrote to memory of 3924	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	98
PID 3380 wrote to memory of 3668	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	99
PID 3380 wrote to memory of 3668	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	99
PID 3380 wrote to memory of 4464	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	100
PID 3380 wrote to memory of 4464	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	100
PID 3380 wrote to memory of 4852	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	101
PID 3380 wrote to memory of 4852	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	101
PID 3380 wrote to memory of 4648	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	102
PID 3380 wrote to memory of 4648	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	102
PID 3380 wrote to memory of 3880	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	103
PID 3380 wrote to memory of 3880	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	103
PID 3380 wrote to memory of 1648	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	104
PID 3380 wrote to memory of 1648	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	104
PID 3380 wrote to memory of 3604	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	105
PID 3380 wrote to memory of 3604	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	105
PID 3380 wrote to memory of 4872	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	106
PID 3380 wrote to memory of 4872	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	106
PID 3380 wrote to memory of 3928	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	107
PID 3380 wrote to memory of 3928	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	107
PID 3380 wrote to memory of 436	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	108
PID 3380 wrote to memory of 436	3380	2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe	108

C:\Users\Admin\AppData\Local\Temp\2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_3923c06684741e1e7b8fe76ce917af2a_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\System\lgxriOZ.exe
  C:\Windows\System\lgxriOZ.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\jQgnmew.exe
  C:\Windows\System\jQgnmew.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\BooaBbs.exe
  C:\Windows\System\BooaBbs.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\AhejmSr.exe
  C:\Windows\System\AhejmSr.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\dnLpWhd.exe
  C:\Windows\System\dnLpWhd.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\bVyiVAB.exe
  C:\Windows\System\bVyiVAB.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\ghOEbNl.exe
  C:\Windows\System\ghOEbNl.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\OQDnvRU.exe
  C:\Windows\System\OQDnvRU.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\RxbKxxc.exe
  C:\Windows\System\RxbKxxc.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\cNxzwsl.exe
  C:\Windows\System\cNxzwsl.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\RSBbGAj.exe
  C:\Windows\System\RSBbGAj.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\XzsWkzu.exe
  C:\Windows\System\XzsWkzu.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\xVWujMu.exe
  C:\Windows\System\xVWujMu.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\yeYtesh.exe
  C:\Windows\System\yeYtesh.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\CChJSRz.exe
  C:\Windows\System\CChJSRz.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\olAsaUT.exe
  C:\Windows\System\olAsaUT.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\reGweQq.exe
  C:\Windows\System\reGweQq.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\DqANLqT.exe
  C:\Windows\System\DqANLqT.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\rvFOcLY.exe
  C:\Windows\System\rvFOcLY.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\owNOgxU.exe
  C:\Windows\System\owNOgxU.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\DPltpoX.exe
  C:\Windows\System\DPltpoX.exe
  2⤵
  - Executes dropped EXE
  PID:436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AhejmSr.exe

Path C:\Windows\System\AhejmSr.exe
Size 5.9MB
SHA256 1546aac282788057fea4a620cf6fd468b5878bfc64cb7d0f326b487c4c2fc5d2
MD5 ea26a514643451d2bc8d7793178b5a47
SHA1 d51d64e5466ae012d7a44609fa4fb5b997182043
SHA512 49548fc7ea4eb7efcf38131b52499315bb691f1c7bce11336048a399bef72640bbe295acb7f0cdb857699a1bbd34784f3b6fa1f9965c5e65a4c772c6b4a12370
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

BooaBbs.exe

Path C:\Windows\System\BooaBbs.exe
Size 5.9MB
SHA256 f2c5988e00bd8b4711a2147ade195f7171fe68134bcef53503c747ba882b88cb
MD5 96161a9f7b7195e3e49e56dd743c6dce
SHA1 96d8091d36ccf1ad4231180c4c65648a7805bec6
SHA512 b169d00f8512b5e8991832ab632b130580896a41be7d6c92444fccb96a21e6609d8386a93b327376a59f20f62f3d578d1446b7c823e86104c69268da6fab7152
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

CChJSRz.exe

Path C:\Windows\System\CChJSRz.exe
Size 5.9MB
SHA256 fb5fa14264d0b5cedd63a9f4d3745abe0e365dd7fd8a52c767bd3751a4e6c4e1
MD5 078d9de5f928aea784a0892ade16da84
SHA1 c1c7b1628e6909807ec03802320e81e6bd532129
SHA512 5c45ad6054c0b737981c82d869d753ee812697887dc1288ab085a1c5f75baa65877483f876e62e79d38083a8f39a2fdc55144ae588c3ab052801dee73912a877
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

DPltpoX.exe

Path C:\Windows\System\DPltpoX.exe
Size 5.9MB
SHA256 f639b18f9ba3fe2655daeecf23d3e0b3e04606006bdb9bbd538402124dbed5c6
MD5 bfe13a93b10f34a33226bc0305c86189
SHA1 54ab2a08035a74d5490a1dc8d4f4fe7d0fe9ba05
SHA512 471fff4a451f3a4c5b0c80010b62aa14d425d446118f403cb18d6d074195ee519775c9e4b5e8a58ad4d71cc3aa6b4d1869123012e6b14e42e00a78d0b7c26562
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

DqANLqT.exe

Path C:\Windows\System\DqANLqT.exe
Size 5.9MB
SHA256 dfef3e243f90242a9b9c65fcb10a54d87fb38b71ce8905c5745bb2833d0f19ff
MD5 65bae87142f73cb42b55bd8a4906614b
SHA1 aee340691eea57e2a032e38e3facf135075a70dc
SHA512 073cd530ac10d353b76bdce038d6f465e5e74224512b994d14d8dca156b0a803ecc69f07797b3c9bcdc80fc3b64224d8b4b4cc4a42f75f92a27d1649a2d6daef
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

OQDnvRU.exe

Path C:\Windows\System\OQDnvRU.exe
Size 5.9MB
SHA256 0a28167f8fa58fa4bbc6aa96564403289aed8359562402100013c0e1a10afc13
MD5 a691df0e49fa3a47378ca5ba6de52a2f
SHA1 6b3c0ae5b95c635da9e468f697614530e4feecbc
SHA512 96cd35e9dd710ba23e0b0434ed0648c4c55a94015da1f3868cda9798e434000e968d3d4bbb176c9c3a39a9007907a78d836c0660445cf944fdb06179181e0d0d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

RSBbGAj.exe

Path C:\Windows\System\RSBbGAj.exe
Size 5.9MB
SHA256 086cbe2eddaf49451c81acdd6bb27f384401a7c2d7fb3cbc5c2756760996ee09
MD5 84c975317d077f8fbd7a21c045ba0a1a
SHA1 881e2ce9f94965f649f526d88013987c4c9bf757
SHA512 05f9628521ca11afa588dd692718046405e57a577dd7c37b2806f1f75d38fade66b24a9895be76248331214a4afa4fb5ad9e2fab9cb9ddf493f0b0a27dd1fa30
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

RxbKxxc.exe

Path C:\Windows\System\RxbKxxc.exe
Size 5.9MB
SHA256 c2ec5a5feb73e3d875b9904a09f5bd1f3ff07da99c378090c769a8dbaba67fef
MD5 fc3e7fee35b4a7aafb5cf6982f02c1db
SHA1 f2051885bbe1c3ac1708d044b3807b2c5df01324
SHA512 05f70be4facdb2f56bda9abec852a1551330b07ce3de3b4f4e3586c691f46a01380143042b3f02cb6a80fdc30cd762a835c71eef8e26a8ce343a1dc4666696fb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

XzsWkzu.exe

Path C:\Windows\System\XzsWkzu.exe
Size 5.9MB
SHA256 b9fbc68c1260a52e601c2c5288c824fb507719c75740c35e8280665d05153114
MD5 b57cb9a8cb021ca695fe67d202b22edc
SHA1 14db06591253aceb174c85376eeb4c452a1da137
SHA512 486ebc40ac67b4af1b983a45e3d00fcb00a3a66975a907899604e846bd018cb4556a841e503e6a51db0aee0dfe581a6774d3bb6d31b3d851f99ec62aebb1b97a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

bVyiVAB.exe

Path C:\Windows\System\bVyiVAB.exe
Size 5.9MB
SHA256 f08c349b18a4f78fc333b748ee79385f23de488fcadcd576435b106d47afd9a2
MD5 071a1e21b74e6977907a95408b11c798
SHA1 b5205e64dc4f05f7d67e5445229d126e8c1f88a7
SHA512 53f86e636d672aeb70379facab42ceff74d227d7eed8c985e7cfffe10c929f353f8c6c3085a587bf1abd284011f0a6ecff150a43b7b0e17f0e6856d473c9f83c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

cNxzwsl.exe

Path C:\Windows\System\cNxzwsl.exe
Size 5.9MB
SHA256 920ea02e359f21dd59ddc8b732abe0893e649d27b2b95f6ecc7c0fe6442c32c8
MD5 67280534bdca53b416765af10a211c73
SHA1 aecabe981f174d3ff2ccc2bca65dbe9b8f913dac
SHA512 521c33f4df5e90878a6e252a70330945a96600128863cad2331e73cd6b5c0b25238d566ca9c370c592f4fe9608dfd6f7d2a968dc0e6479604df14be7b2cc7faa
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

dnLpWhd.exe

Path C:\Windows\System\dnLpWhd.exe
Size 5.9MB
SHA256 f6637fce799284dc4ea21c2efc1b35699995bfe860e6270550441be001c348b7
MD5 4f1e06520171e0d948f2c8c4dff945b2
SHA1 a5689dfa72a7b56ca516db427c54a4bd23a64b50
SHA512 e6a3c44529883c5de6ecdc0811a35dbf703c43e6a11c96cfacf51b8dea4cf311949f82d8fd5c9add437e1b55fee7dbf68050a84ca579fe52550ec9e1504602f0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghOEbNl.exe

Path C:\Windows\System\ghOEbNl.exe
Size 5.9MB
SHA256 6b839874c8d2beae26988b1ffb2a214024943364f20b39cc225cdd6f735b81b5
MD5 9fc4b39dca3e999475b79cb4e1d7e393
SHA1 685b0d2c4b5c059fc9efe3b92ac9e7d886055fcb
SHA512 5400c81bbdc1e051d602c2375941c5a4e1f45ff44b7a14d36faadcc0a466ff8ec7cc3656df1ba8e821594faf2855eeccbb43dad80514c45f79eb987d35c7c6d4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

jQgnmew.exe

Path C:\Windows\System\jQgnmew.exe
Size 5.9MB
SHA256 801d4ec0d9c5d4b55ad82914e5bed9877efd5ca2140bb5154902cdc7e25d1bf5
MD5 0eda40bf57d212844af1ba83be476b58
SHA1 aafb6dbb4868ec1a995cea9ac18a94aa3337f139
SHA512 ad05ce4f5b23598c03e54b5d73ac0777823a3f07c35573c0b2fbb0f218878f803473f00d219b26b4571d53b0f2ea8a824c97a547d78c9275035011a23c0fa6f7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

lgxriOZ.exe

Path C:\Windows\System\lgxriOZ.exe
Size 5.9MB
SHA256 1939c1bee474d972ba5ad05fec91edd395bf782acfdc6367a6f03eb6444edd38
MD5 8fceb0aeb5dfd6a9ab0dfaaa9cb9b7f8
SHA1 ca905b07cd42eea43d130e9e7f6a9e49afd6d5ce
SHA512 837d070eac10982a5f6d4e8634b863670254834c1a8344f329c68b606d56a0242f7085b0e3799c5b5b3c88b4b0d15943276cbf30dc2813d79d1c58ee1efc2836
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:Q+856utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

olAsaUT.exe

Path C:\Windows\System\olAsaUT.exe
Size 5.9MB
SHA256 c7f421d67786555facd61c6fea567350766e0a06eb3a590ea4ba341482566f84
MD5 393018e10139e6a45aa07d3ff384a64f
SHA1 8d3a55de5d59372f19ca1c2c9dde571b6ea30c29
SHA512 eace15af12043911c7b4376d622aa95282bd8f02b5f05f197706bd0d2e52f35200f071670235e9ffed43f2a52d72dfd310c982daf72d8f8fdc9034704eee52d6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

owNOgxU.exe

Path C:\Windows\System\owNOgxU.exe
Size 5.9MB
SHA256 a4a06eb66bf0fc1ae718efa8c0150f83bd5cf39ee1876417d15dc2084e7294cc
MD5 ee7f2b2d289a6efacb31da77085108eb
SHA1 9fa2466661c11b49ded0fc3e4e2ed2b798d63125
SHA512 b9debe102e21f216e4b57efa1aeeadadae4f6cffab24dfe38c0385578e49f53a96f1dc9467da989cff5ad6315ef6a20402a1389b7ab7a61ee3734354d082bc44
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

reGweQq.exe

Path C:\Windows\System\reGweQq.exe
Size 5.9MB
SHA256 19a3d839e16c9aa243c99db9d501322165894c4261fdbcfd7ab60440ad82460f
MD5 3dc9d52aff8e8395de64bc7436a1e6f6
SHA1 15c7f7ad3dd6d03d357df43c75d65b0648f5bc01
SHA512 28a6bf8290b9ec227bf974769717c91f8995d8476908624fc0d5a977751808acf33dbd796f6281ed2263cc30e56bc8bf2ca22ce201533405e91ddecf721c3978
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

rvFOcLY.exe

Path C:\Windows\System\rvFOcLY.exe
Size 5.9MB
SHA256 93d85b7871673820b7dc054ab09623dec295ecc355fdf00240a02e503edba48b
MD5 ae7f56a164c7d17c8865f51599efc83c
SHA1 135795f4a156f3952532a2d5b6d17eeab8230c46
SHA512 c1888c2d5e7eeeece63407ea016bffa6f0de8815267500aa4728c367efbdc4514a0cdae8df848c5f13a9bc655b2effb482ffa8e42a1290aa18cbb8858614bcc8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

xVWujMu.exe

Path C:\Windows\System\xVWujMu.exe
Size 5.9MB
SHA256 9217c115a7b00cbec932d8de857225401422418a46528aa6043dc5cecfd81d22
MD5 bef6e4a6634020c985cf784ea7456f00
SHA1 1ca42f98369745cb1e75bc59d2b01c66b164d500
SHA512 f9ab482bc96cad7edbd6c8e7691a4dcc9ca2c451f0e30f60a410b5271d491c75985cfc03caee42bd8b7b3a4c98297bb4d7d0e562a13b1b868f5fc97898b26695
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

yeYtesh.exe

Path C:\Windows\System\yeYtesh.exe
Size 5.9MB
SHA256 a272f30809b5178cd9efecc88cf8eadf5a83faa4ad1990fdefe800fba995c00e
MD5 8545780a118d1534494c07a2934cbb5e
SHA1 05190c1f680c5b13bbc4b886763b73fc4bd12576
SHA512 b4428bf4173f59661f1675b39fe1fc0c69a497516e9983a42d7f1fa884b2dd22fbfd53db1bb3292d2b07f0a6e3188d508f685f6743ce57a3bf2b01f4f4fcde7f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/436-133-0x00007FF767060000-0x00007FF7673B4000-memory.dmp

Download

memory/436-159-0x00007FF767060000-0x00007FF7673B4000-memory.dmp

Download

memory/696-64-0x00007FF702CA0000-0x00007FF702FF4000-memory.dmp

Download

memory/696-134-0x00007FF702CA0000-0x00007FF702FF4000-memory.dmp

Download

memory/696-150-0x00007FF702CA0000-0x00007FF702FF4000-memory.dmp

Download

memory/1080-6-0x00007FF7349B0000-0x00007FF734D04000-memory.dmp

Download

memory/1080-81-0x00007FF7349B0000-0x00007FF734D04000-memory.dmp

Download

memory/1080-141-0x00007FF7349B0000-0x00007FF734D04000-memory.dmp

Download

memory/1224-142-0x00007FF7F7570000-0x00007FF7F78C4000-memory.dmp

Download

memory/1224-15-0x00007FF7F7570000-0x00007FF7F78C4000-memory.dmp

Download

memory/1224-82-0x00007FF7F7570000-0x00007FF7F78C4000-memory.dmp

Download

memory/1648-157-0x00007FF7CC8E0000-0x00007FF7CCC34000-memory.dmp

Download

memory/1648-139-0x00007FF7CC8E0000-0x00007FF7CCC34000-memory.dmp

Download

memory/1648-111-0x00007FF7CC8E0000-0x00007FF7CCC34000-memory.dmp

Download

memory/1680-123-0x00007FF713DD0000-0x00007FF714124000-memory.dmp

Download

memory/1680-147-0x00007FF713DD0000-0x00007FF714124000-memory.dmp

Download

memory/1680-43-0x00007FF713DD0000-0x00007FF714124000-memory.dmp

Download

memory/2088-144-0x00007FF764CF0000-0x00007FF765044000-memory.dmp

Download

memory/2088-98-0x00007FF764CF0000-0x00007FF765044000-memory.dmp

Download

memory/2088-34-0x00007FF764CF0000-0x00007FF765044000-memory.dmp

Download

memory/2132-24-0x00007FF6D0B10000-0x00007FF6D0E64000-memory.dmp

Download

memory/2132-86-0x00007FF6D0B10000-0x00007FF6D0E64000-memory.dmp

Download

memory/2132-143-0x00007FF6D0B10000-0x00007FF6D0E64000-memory.dmp

Download

memory/2792-145-0x00007FF6EDB10000-0x00007FF6EDE64000-memory.dmp

Download

memory/2792-40-0x00007FF6EDB10000-0x00007FF6EDE64000-memory.dmp

Download

memory/3020-52-0x00007FF7FBDB0000-0x00007FF7FC104000-memory.dmp

Download

memory/3020-148-0x00007FF7FBDB0000-0x00007FF7FC104000-memory.dmp

Download

memory/3380-1-0x0000020520FD0000-0x0000020520FE0000-memory.dmp

Download

memory/3380-75-0x00007FF6BE000000-0x00007FF6BE354000-memory.dmp

Download

memory/3380-0-0x00007FF6BE000000-0x00007FF6BE354000-memory.dmp

Download

memory/3604-124-0x00007FF713C20000-0x00007FF713F74000-memory.dmp

Download

memory/3604-158-0x00007FF713C20000-0x00007FF713F74000-memory.dmp

Download

memory/3668-80-0x00007FF7600D0000-0x00007FF760424000-memory.dmp

Download

memory/3668-152-0x00007FF7600D0000-0x00007FF760424000-memory.dmp

Download

memory/3880-156-0x00007FF695B00000-0x00007FF695E54000-memory.dmp

Download

memory/3880-138-0x00007FF695B00000-0x00007FF695E54000-memory.dmp

Download

memory/3880-110-0x00007FF695B00000-0x00007FF695E54000-memory.dmp

Download

memory/3924-151-0x00007FF608010000-0x00007FF608364000-memory.dmp

Download

memory/3924-135-0x00007FF608010000-0x00007FF608364000-memory.dmp

Download

memory/3924-66-0x00007FF608010000-0x00007FF608364000-memory.dmp

Download

memory/3928-140-0x00007FF73F0F0000-0x00007FF73F444000-memory.dmp

Download

memory/3928-160-0x00007FF73F0F0000-0x00007FF73F444000-memory.dmp

Download

memory/3928-125-0x00007FF73F0F0000-0x00007FF73F444000-memory.dmp

Download

memory/4464-84-0x00007FF661AB0000-0x00007FF661E04000-memory.dmp

Download

memory/4464-154-0x00007FF661AB0000-0x00007FF661E04000-memory.dmp

Download

memory/4464-136-0x00007FF661AB0000-0x00007FF661E04000-memory.dmp

Download

memory/4648-105-0x00007FF663FA0000-0x00007FF6642F4000-memory.dmp

Download

memory/4648-155-0x00007FF663FA0000-0x00007FF6642F4000-memory.dmp

Download

memory/4652-39-0x00007FF6C0710000-0x00007FF6C0A64000-memory.dmp

Download

memory/4652-146-0x00007FF6C0710000-0x00007FF6C0A64000-memory.dmp

Download

memory/4832-149-0x00007FF6F3750000-0x00007FF6F3AA4000-memory.dmp

Download

memory/4832-60-0x00007FF6F3750000-0x00007FF6F3AA4000-memory.dmp

Download

memory/4852-137-0x00007FF6030D0000-0x00007FF603424000-memory.dmp

Download

memory/4852-153-0x00007FF6030D0000-0x00007FF603424000-memory.dmp

Download

memory/4852-85-0x00007FF6030D0000-0x00007FF603424000-memory.dmp

Download

memory/4872-132-0x00007FF733FB0000-0x00007FF734304000-memory.dmp

Download

memory/4872-161-0x00007FF733FB0000-0x00007FF734304000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads