cobaltstrike | 0997e5e3e6d60a59ac442d4f1197c027bcf927ef708d9a3d5d418e77abd84bed

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240531-th2jaaeb29
SHA256 0997e5e3e6d60a59ac442d4f1197c027bcf927ef708d9a3d5d418e77abd84bed
MD5 27042aa1ba9a8f4dae8166a1b78eb6e5
SHA1 04e5ba5ffb56fc306746b8ace117882799e50c68
SHA512 215280022d0dbba4cda4e3a151ccad511cca26386744162297b06a9ff4eec010dd02d8b987d9d463911ac516ce833a3349f1cd121e04a6c5935be5e7214766a2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000500000002326f-5.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233c8-7.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233c7-9.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233c9-23.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233cb-35.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ca-33.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233cc-41.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000233c4-48.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ce-52.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d0-71.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d3-79.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d4-87.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d5-98.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d8-114.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d7-112.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d6-110.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d2-81.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d1-77.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233cf-63.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d9-123.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233da-127.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000500000002326f-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233c8-7.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233c7-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233c9-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233cb-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ca-33.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233cc-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00080000000233c4-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ce-52.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d0-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d3-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d4-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d5-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d8-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d7-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d6-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d2-81.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d1-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233cf-63.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d9-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233da-127.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2744-0-0x00007FF78A770000-0x00007FF78AAC4000-memory.dmp	UPX
behavioral2/files/0x000500000002326f-5.dat	UPX
behavioral2/files/0x00070000000233c8-7.dat	UPX
behavioral2/files/0x00070000000233c7-9.dat	UPX
behavioral2/files/0x00070000000233c9-23.dat	UPX
behavioral2/files/0x00070000000233cb-35.dat	UPX
behavioral2/files/0x00070000000233ca-33.dat	UPX
behavioral2/memory/1044-30-0x00007FF68D890000-0x00007FF68DBE4000-memory.dmp	UPX
behavioral2/memory/1868-17-0x00007FF652720000-0x00007FF652A74000-memory.dmp	UPX
behavioral2/memory/4644-13-0x00007FF74EBC0000-0x00007FF74EF14000-memory.dmp	UPX
behavioral2/memory/4560-8-0x00007FF6BD300000-0x00007FF6BD654000-memory.dmp	UPX
behavioral2/memory/2512-38-0x00007FF712E20000-0x00007FF713174000-memory.dmp	UPX
behavioral2/memory/1860-37-0x00007FF658710000-0x00007FF658A64000-memory.dmp	UPX
behavioral2/files/0x00070000000233cc-41.dat	UPX
behavioral2/files/0x00080000000233c4-48.dat	UPX
behavioral2/files/0x00070000000233ce-52.dat	UPX
behavioral2/memory/3608-60-0x00007FF7ABB60000-0x00007FF7ABEB4000-memory.dmp	UPX
behavioral2/memory/3180-68-0x00007FF640250000-0x00007FF6405A4000-memory.dmp	UPX
behavioral2/files/0x00070000000233d0-71.dat	UPX
behavioral2/files/0x00070000000233d3-79.dat	UPX
behavioral2/files/0x00070000000233d4-87.dat	UPX
behavioral2/memory/2924-91-0x00007FF762D10000-0x00007FF763064000-memory.dmp	UPX
behavioral2/files/0x00070000000233d5-98.dat	UPX
behavioral2/files/0x00070000000233d8-114.dat	UPX
behavioral2/memory/1528-118-0x00007FF70AA60000-0x00007FF70ADB4000-memory.dmp	UPX
behavioral2/memory/4920-119-0x00007FF73F410000-0x00007FF73F764000-memory.dmp	UPX
behavioral2/memory/4116-117-0x00007FF7887D0000-0x00007FF788B24000-memory.dmp	UPX
behavioral2/memory/4168-116-0x00007FF7CE8F0000-0x00007FF7CEC44000-memory.dmp	UPX
behavioral2/files/0x00070000000233d7-112.dat	UPX
behavioral2/files/0x00070000000233d6-110.dat	UPX
behavioral2/memory/4644-109-0x00007FF74EBC0000-0x00007FF74EF14000-memory.dmp	UPX
behavioral2/memory/3148-94-0x00007FF60F520000-0x00007FF60F874000-memory.dmp	UPX
behavioral2/memory/4560-88-0x00007FF6BD300000-0x00007FF6BD654000-memory.dmp	UPX
behavioral2/memory/4660-85-0x00007FF6DF390000-0x00007FF6DF6E4000-memory.dmp	UPX
behavioral2/memory/3800-83-0x00007FF6A4DD0000-0x00007FF6A5124000-memory.dmp	UPX
behavioral2/files/0x00070000000233d2-81.dat	UPX
behavioral2/memory/2744-76-0x00007FF78A770000-0x00007FF78AAC4000-memory.dmp	UPX
behavioral2/memory/4752-75-0x00007FF66E9C0000-0x00007FF66ED14000-memory.dmp	UPX
behavioral2/files/0x00070000000233d1-77.dat	UPX
behavioral2/files/0x00070000000233cf-63.dat	UPX
behavioral2/memory/2740-47-0x00007FF7D86C0000-0x00007FF7D8A14000-memory.dmp	UPX
behavioral2/memory/4192-43-0x00007FF691080000-0x00007FF6913D4000-memory.dmp	UPX
behavioral2/files/0x00070000000233d9-123.dat	UPX
behavioral2/files/0x00070000000233da-127.dat	UPX
behavioral2/memory/1868-124-0x00007FF652720000-0x00007FF652A74000-memory.dmp	UPX
behavioral2/memory/2032-128-0x00007FF705E10000-0x00007FF706164000-memory.dmp	UPX
behavioral2/memory/1156-131-0x00007FF7EE830000-0x00007FF7EEB84000-memory.dmp	UPX
behavioral2/memory/4192-132-0x00007FF691080000-0x00007FF6913D4000-memory.dmp	UPX
behavioral2/memory/2740-133-0x00007FF7D86C0000-0x00007FF7D8A14000-memory.dmp	UPX
behavioral2/memory/4752-134-0x00007FF66E9C0000-0x00007FF66ED14000-memory.dmp	UPX
behavioral2/memory/3180-135-0x00007FF640250000-0x00007FF6405A4000-memory.dmp	UPX
behavioral2/memory/3800-136-0x00007FF6A4DD0000-0x00007FF6A5124000-memory.dmp	UPX
behavioral2/memory/2924-137-0x00007FF762D10000-0x00007FF763064000-memory.dmp	UPX
behavioral2/memory/3148-138-0x00007FF60F520000-0x00007FF60F874000-memory.dmp	UPX
behavioral2/memory/4560-139-0x00007FF6BD300000-0x00007FF6BD654000-memory.dmp	UPX
behavioral2/memory/1868-140-0x00007FF652720000-0x00007FF652A74000-memory.dmp	UPX
behavioral2/memory/4644-141-0x00007FF74EBC0000-0x00007FF74EF14000-memory.dmp	UPX
behavioral2/memory/1044-144-0x00007FF68D890000-0x00007FF68DBE4000-memory.dmp	UPX
behavioral2/memory/1860-143-0x00007FF658710000-0x00007FF658A64000-memory.dmp	UPX
behavioral2/memory/2512-142-0x00007FF712E20000-0x00007FF713174000-memory.dmp	UPX
behavioral2/memory/4192-145-0x00007FF691080000-0x00007FF6913D4000-memory.dmp	UPX
behavioral2/memory/2740-146-0x00007FF7D86C0000-0x00007FF7D8A14000-memory.dmp	UPX
behavioral2/memory/3608-147-0x00007FF7ABB60000-0x00007FF7ABEB4000-memory.dmp	UPX
behavioral2/memory/3180-148-0x00007FF640250000-0x00007FF6405A4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2744-0-0x00007FF78A770000-0x00007FF78AAC4000-memory.dmp	xmrig
behavioral2/files/0x000500000002326f-5.dat	xmrig
behavioral2/files/0x00070000000233c8-7.dat	xmrig
behavioral2/files/0x00070000000233c7-9.dat	xmrig
behavioral2/files/0x00070000000233c9-23.dat	xmrig
behavioral2/files/0x00070000000233cb-35.dat	xmrig
behavioral2/files/0x00070000000233ca-33.dat	xmrig
behavioral2/memory/1044-30-0x00007FF68D890000-0x00007FF68DBE4000-memory.dmp	xmrig
behavioral2/memory/1868-17-0x00007FF652720000-0x00007FF652A74000-memory.dmp	xmrig
behavioral2/memory/4644-13-0x00007FF74EBC0000-0x00007FF74EF14000-memory.dmp	xmrig
behavioral2/memory/4560-8-0x00007FF6BD300000-0x00007FF6BD654000-memory.dmp	xmrig
behavioral2/memory/2512-38-0x00007FF712E20000-0x00007FF713174000-memory.dmp	xmrig
behavioral2/memory/1860-37-0x00007FF658710000-0x00007FF658A64000-memory.dmp	xmrig
behavioral2/files/0x00070000000233cc-41.dat	xmrig
behavioral2/files/0x00080000000233c4-48.dat	xmrig
behavioral2/files/0x00070000000233ce-52.dat	xmrig
behavioral2/memory/3608-60-0x00007FF7ABB60000-0x00007FF7ABEB4000-memory.dmp	xmrig
behavioral2/memory/3180-68-0x00007FF640250000-0x00007FF6405A4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d0-71.dat	xmrig
behavioral2/files/0x00070000000233d3-79.dat	xmrig
behavioral2/files/0x00070000000233d4-87.dat	xmrig
behavioral2/memory/2924-91-0x00007FF762D10000-0x00007FF763064000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d5-98.dat	xmrig
behavioral2/files/0x00070000000233d8-114.dat	xmrig
behavioral2/memory/1528-118-0x00007FF70AA60000-0x00007FF70ADB4000-memory.dmp	xmrig
behavioral2/memory/4920-119-0x00007FF73F410000-0x00007FF73F764000-memory.dmp	xmrig
behavioral2/memory/4116-117-0x00007FF7887D0000-0x00007FF788B24000-memory.dmp	xmrig
behavioral2/memory/4168-116-0x00007FF7CE8F0000-0x00007FF7CEC44000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d7-112.dat	xmrig
behavioral2/files/0x00070000000233d6-110.dat	xmrig
behavioral2/memory/4644-109-0x00007FF74EBC0000-0x00007FF74EF14000-memory.dmp	xmrig
behavioral2/memory/3148-94-0x00007FF60F520000-0x00007FF60F874000-memory.dmp	xmrig
behavioral2/memory/4560-88-0x00007FF6BD300000-0x00007FF6BD654000-memory.dmp	xmrig
behavioral2/memory/4660-85-0x00007FF6DF390000-0x00007FF6DF6E4000-memory.dmp	xmrig
behavioral2/memory/3800-83-0x00007FF6A4DD0000-0x00007FF6A5124000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d2-81.dat	xmrig
behavioral2/memory/2744-76-0x00007FF78A770000-0x00007FF78AAC4000-memory.dmp	xmrig
behavioral2/memory/4752-75-0x00007FF66E9C0000-0x00007FF66ED14000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d1-77.dat	xmrig
behavioral2/files/0x00070000000233cf-63.dat	xmrig
behavioral2/memory/2740-47-0x00007FF7D86C0000-0x00007FF7D8A14000-memory.dmp	xmrig
behavioral2/memory/4192-43-0x00007FF691080000-0x00007FF6913D4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d9-123.dat	xmrig
behavioral2/files/0x00070000000233da-127.dat	xmrig
behavioral2/memory/1868-124-0x00007FF652720000-0x00007FF652A74000-memory.dmp	xmrig
behavioral2/memory/2032-128-0x00007FF705E10000-0x00007FF706164000-memory.dmp	xmrig
behavioral2/memory/1156-131-0x00007FF7EE830000-0x00007FF7EEB84000-memory.dmp	xmrig
behavioral2/memory/4192-132-0x00007FF691080000-0x00007FF6913D4000-memory.dmp	xmrig
behavioral2/memory/2740-133-0x00007FF7D86C0000-0x00007FF7D8A14000-memory.dmp	xmrig
behavioral2/memory/4752-134-0x00007FF66E9C0000-0x00007FF66ED14000-memory.dmp	xmrig
behavioral2/memory/3180-135-0x00007FF640250000-0x00007FF6405A4000-memory.dmp	xmrig
behavioral2/memory/3800-136-0x00007FF6A4DD0000-0x00007FF6A5124000-memory.dmp	xmrig
behavioral2/memory/2924-137-0x00007FF762D10000-0x00007FF763064000-memory.dmp	xmrig
behavioral2/memory/3148-138-0x00007FF60F520000-0x00007FF60F874000-memory.dmp	xmrig
behavioral2/memory/4560-139-0x00007FF6BD300000-0x00007FF6BD654000-memory.dmp	xmrig
behavioral2/memory/1868-140-0x00007FF652720000-0x00007FF652A74000-memory.dmp	xmrig
behavioral2/memory/4644-141-0x00007FF74EBC0000-0x00007FF74EF14000-memory.dmp	xmrig
behavioral2/memory/1044-144-0x00007FF68D890000-0x00007FF68DBE4000-memory.dmp	xmrig
behavioral2/memory/1860-143-0x00007FF658710000-0x00007FF658A64000-memory.dmp	xmrig
behavioral2/memory/2512-142-0x00007FF712E20000-0x00007FF713174000-memory.dmp	xmrig
behavioral2/memory/4192-145-0x00007FF691080000-0x00007FF6913D4000-memory.dmp	xmrig
behavioral2/memory/2740-146-0x00007FF7D86C0000-0x00007FF7D8A14000-memory.dmp	xmrig
behavioral2/memory/3608-147-0x00007FF7ABB60000-0x00007FF7ABEB4000-memory.dmp	xmrig
behavioral2/memory/3180-148-0x00007FF640250000-0x00007FF6405A4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4560	WFMhZOy.exe
4644	RuWNRvS.exe
1868	odqheZC.exe
1044	PlRaQSQ.exe
1860	YmBAFMo.exe
2512	GaFuXVW.exe
4192	LyHiBpD.exe
2740	XZRpTgp.exe
3608	kgAUvxQ.exe
3180	CSYriAD.exe
3800	LXrPQwN.exe
4752	mukcOzR.exe
4660	mAdmGiw.exe
2924	cagQeSp.exe
3148	BbNGOYd.exe
4168	bRzXEMF.exe
4116	jRnvdpy.exe
1528	bIvmoMd.exe
4920	XpNNytB.exe
2032	WjGkeaf.exe
1156	SHnmxyt.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2744-0-0x00007FF78A770000-0x00007FF78AAC4000-memory.dmp	upx
behavioral2/files/0x000500000002326f-5.dat	upx
behavioral2/files/0x00070000000233c8-7.dat	upx
behavioral2/files/0x00070000000233c7-9.dat	upx
behavioral2/files/0x00070000000233c9-23.dat	upx
behavioral2/files/0x00070000000233cb-35.dat	upx
behavioral2/files/0x00070000000233ca-33.dat	upx
behavioral2/memory/1044-30-0x00007FF68D890000-0x00007FF68DBE4000-memory.dmp	upx
behavioral2/memory/1868-17-0x00007FF652720000-0x00007FF652A74000-memory.dmp	upx
behavioral2/memory/4644-13-0x00007FF74EBC0000-0x00007FF74EF14000-memory.dmp	upx
behavioral2/memory/4560-8-0x00007FF6BD300000-0x00007FF6BD654000-memory.dmp	upx
behavioral2/memory/2512-38-0x00007FF712E20000-0x00007FF713174000-memory.dmp	upx
behavioral2/memory/1860-37-0x00007FF658710000-0x00007FF658A64000-memory.dmp	upx
behavioral2/files/0x00070000000233cc-41.dat	upx
behavioral2/files/0x00080000000233c4-48.dat	upx
behavioral2/files/0x00070000000233ce-52.dat	upx
behavioral2/memory/3608-60-0x00007FF7ABB60000-0x00007FF7ABEB4000-memory.dmp	upx
behavioral2/memory/3180-68-0x00007FF640250000-0x00007FF6405A4000-memory.dmp	upx
behavioral2/files/0x00070000000233d0-71.dat	upx
behavioral2/files/0x00070000000233d3-79.dat	upx
behavioral2/files/0x00070000000233d4-87.dat	upx
behavioral2/memory/2924-91-0x00007FF762D10000-0x00007FF763064000-memory.dmp	upx
behavioral2/files/0x00070000000233d5-98.dat	upx
behavioral2/files/0x00070000000233d8-114.dat	upx
behavioral2/memory/1528-118-0x00007FF70AA60000-0x00007FF70ADB4000-memory.dmp	upx
behavioral2/memory/4920-119-0x00007FF73F410000-0x00007FF73F764000-memory.dmp	upx
behavioral2/memory/4116-117-0x00007FF7887D0000-0x00007FF788B24000-memory.dmp	upx
behavioral2/memory/4168-116-0x00007FF7CE8F0000-0x00007FF7CEC44000-memory.dmp	upx
behavioral2/files/0x00070000000233d7-112.dat	upx
behavioral2/files/0x00070000000233d6-110.dat	upx
behavioral2/memory/4644-109-0x00007FF74EBC0000-0x00007FF74EF14000-memory.dmp	upx
behavioral2/memory/3148-94-0x00007FF60F520000-0x00007FF60F874000-memory.dmp	upx
behavioral2/memory/4560-88-0x00007FF6BD300000-0x00007FF6BD654000-memory.dmp	upx
behavioral2/memory/4660-85-0x00007FF6DF390000-0x00007FF6DF6E4000-memory.dmp	upx
behavioral2/memory/3800-83-0x00007FF6A4DD0000-0x00007FF6A5124000-memory.dmp	upx
behavioral2/files/0x00070000000233d2-81.dat	upx
behavioral2/memory/2744-76-0x00007FF78A770000-0x00007FF78AAC4000-memory.dmp	upx
behavioral2/memory/4752-75-0x00007FF66E9C0000-0x00007FF66ED14000-memory.dmp	upx
behavioral2/files/0x00070000000233d1-77.dat	upx
behavioral2/files/0x00070000000233cf-63.dat	upx
behavioral2/memory/2740-47-0x00007FF7D86C0000-0x00007FF7D8A14000-memory.dmp	upx
behavioral2/memory/4192-43-0x00007FF691080000-0x00007FF6913D4000-memory.dmp	upx
behavioral2/files/0x00070000000233d9-123.dat	upx
behavioral2/files/0x00070000000233da-127.dat	upx
behavioral2/memory/1868-124-0x00007FF652720000-0x00007FF652A74000-memory.dmp	upx
behavioral2/memory/2032-128-0x00007FF705E10000-0x00007FF706164000-memory.dmp	upx
behavioral2/memory/1156-131-0x00007FF7EE830000-0x00007FF7EEB84000-memory.dmp	upx
behavioral2/memory/4192-132-0x00007FF691080000-0x00007FF6913D4000-memory.dmp	upx
behavioral2/memory/2740-133-0x00007FF7D86C0000-0x00007FF7D8A14000-memory.dmp	upx
behavioral2/memory/4752-134-0x00007FF66E9C0000-0x00007FF66ED14000-memory.dmp	upx
behavioral2/memory/3180-135-0x00007FF640250000-0x00007FF6405A4000-memory.dmp	upx
behavioral2/memory/3800-136-0x00007FF6A4DD0000-0x00007FF6A5124000-memory.dmp	upx
behavioral2/memory/2924-137-0x00007FF762D10000-0x00007FF763064000-memory.dmp	upx
behavioral2/memory/3148-138-0x00007FF60F520000-0x00007FF60F874000-memory.dmp	upx
behavioral2/memory/4560-139-0x00007FF6BD300000-0x00007FF6BD654000-memory.dmp	upx
behavioral2/memory/1868-140-0x00007FF652720000-0x00007FF652A74000-memory.dmp	upx
behavioral2/memory/4644-141-0x00007FF74EBC0000-0x00007FF74EF14000-memory.dmp	upx
behavioral2/memory/1044-144-0x00007FF68D890000-0x00007FF68DBE4000-memory.dmp	upx
behavioral2/memory/1860-143-0x00007FF658710000-0x00007FF658A64000-memory.dmp	upx
behavioral2/memory/2512-142-0x00007FF712E20000-0x00007FF713174000-memory.dmp	upx
behavioral2/memory/4192-145-0x00007FF691080000-0x00007FF6913D4000-memory.dmp	upx
behavioral2/memory/2740-146-0x00007FF7D86C0000-0x00007FF7D8A14000-memory.dmp	upx
behavioral2/memory/3608-147-0x00007FF7ABB60000-0x00007FF7ABEB4000-memory.dmp	upx
behavioral2/memory/3180-148-0x00007FF640250000-0x00007FF6405A4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\bRzXEMF.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XpNNytB.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WjGkeaf.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WFMhZOy.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\odqheZC.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CSYriAD.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YmBAFMo.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LyHiBpD.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mukcOzR.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\cagQeSp.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BbNGOYd.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bIvmoMd.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SHnmxyt.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kgAUvxQ.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LXrPQwN.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GaFuXVW.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XZRpTgp.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mAdmGiw.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jRnvdpy.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RuWNRvS.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PlRaQSQ.exe	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 4560	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	83
PID 2744 wrote to memory of 4560	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	83
PID 2744 wrote to memory of 4644	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	84
PID 2744 wrote to memory of 4644	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	84
PID 2744 wrote to memory of 1868	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	85
PID 2744 wrote to memory of 1868	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	85
PID 2744 wrote to memory of 1044	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	86
PID 2744 wrote to memory of 1044	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	86
PID 2744 wrote to memory of 1860	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	87
PID 2744 wrote to memory of 1860	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	87
PID 2744 wrote to memory of 2512	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	88
PID 2744 wrote to memory of 2512	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	88
PID 2744 wrote to memory of 4192	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	89
PID 2744 wrote to memory of 4192	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	89
PID 2744 wrote to memory of 2740	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	90
PID 2744 wrote to memory of 2740	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	90
PID 2744 wrote to memory of 3608	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	91
PID 2744 wrote to memory of 3608	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	91
PID 2744 wrote to memory of 3180	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	92
PID 2744 wrote to memory of 3180	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	92
PID 2744 wrote to memory of 3800	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	93
PID 2744 wrote to memory of 3800	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	93
PID 2744 wrote to memory of 4752	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	94
PID 2744 wrote to memory of 4752	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	94
PID 2744 wrote to memory of 4660	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	95
PID 2744 wrote to memory of 4660	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	95
PID 2744 wrote to memory of 2924	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	96
PID 2744 wrote to memory of 2924	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	96
PID 2744 wrote to memory of 3148	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	97
PID 2744 wrote to memory of 3148	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	97
PID 2744 wrote to memory of 4168	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	98
PID 2744 wrote to memory of 4168	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	98
PID 2744 wrote to memory of 4116	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	99
PID 2744 wrote to memory of 4116	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	99
PID 2744 wrote to memory of 1528	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	100
PID 2744 wrote to memory of 1528	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	100
PID 2744 wrote to memory of 4920	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	101
PID 2744 wrote to memory of 4920	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	101
PID 2744 wrote to memory of 2032	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	102
PID 2744 wrote to memory of 2032	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	102
PID 2744 wrote to memory of 1156	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	103
PID 2744 wrote to memory of 1156	2744	2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe	103

C:\Users\Admin\AppData\Local\Temp\2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_27042aa1ba9a8f4dae8166a1b78eb6e5_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\System\WFMhZOy.exe
  C:\Windows\System\WFMhZOy.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\RuWNRvS.exe
  C:\Windows\System\RuWNRvS.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\odqheZC.exe
  C:\Windows\System\odqheZC.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\PlRaQSQ.exe
  C:\Windows\System\PlRaQSQ.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\YmBAFMo.exe
  C:\Windows\System\YmBAFMo.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\GaFuXVW.exe
  C:\Windows\System\GaFuXVW.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\LyHiBpD.exe
  C:\Windows\System\LyHiBpD.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\XZRpTgp.exe
  C:\Windows\System\XZRpTgp.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\kgAUvxQ.exe
  C:\Windows\System\kgAUvxQ.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\CSYriAD.exe
  C:\Windows\System\CSYriAD.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\LXrPQwN.exe
  C:\Windows\System\LXrPQwN.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\mukcOzR.exe
  C:\Windows\System\mukcOzR.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\mAdmGiw.exe
  C:\Windows\System\mAdmGiw.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\cagQeSp.exe
  C:\Windows\System\cagQeSp.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\BbNGOYd.exe
  C:\Windows\System\BbNGOYd.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\bRzXEMF.exe
  C:\Windows\System\bRzXEMF.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\jRnvdpy.exe
  C:\Windows\System\jRnvdpy.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\bIvmoMd.exe
  C:\Windows\System\bIvmoMd.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\XpNNytB.exe
  C:\Windows\System\XpNNytB.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\WjGkeaf.exe
  C:\Windows\System\WjGkeaf.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\SHnmxyt.exe
  C:\Windows\System\SHnmxyt.exe
  2⤵
  - Executes dropped EXE
  PID:1156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BbNGOYd.exe

Path C:\Windows\System\BbNGOYd.exe
Size 5.9MB
SHA256 acf05907668747e72b4238ecf9777e7edd979e1ea2a47883475e84d7f194b95e
MD5 86989e16f92d31e8020e898e84cde0ab
SHA1 77a29c79d0c30ecc2f68d7e287ca442e929a9d4e
SHA512 2140fe20534cae33eee947b9d214c384b55c9d02e0dc7c772c0c7220bdf9a9758a440fd5269a8dac9cd76d09e707f0b48834c4f09a27424ea3d07f01f51f1e7d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSYriAD.exe

Path C:\Windows\System\CSYriAD.exe
Size 5.9MB
SHA256 7364c62422870c9af1b23f41bdec50368079b69b5ae3520a98b303d2dee6c1fc
MD5 f02984946ee548098f58bb08130c55f8
SHA1 646ba6a610e8ab7c1ed2c7c0c2c0c516d4e7a5ac
SHA512 770f5a6ae939bcb81bc7beea96305f506839562f3f10a9d79239ce03b3e7bb49d3075f9e4466ec7d76e3c17911f3ecc8c192c3852de8ca5ceb6bc81e1e4c3f5f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

GaFuXVW.exe

Path C:\Windows\System\GaFuXVW.exe
Size 5.9MB
SHA256 af5615e7eedd7b5828199a6061f9c147e3aeb09a635333ba59853a6b1b4981da
MD5 1c3baf2948cee42fec51677a72396da0
SHA1 fca1718dc63cd7463082908e2fef7b20b642676e
SHA512 b3fb674fb7213e2d653745956795c43f9bb7d0f80ae294b05551dc3661a79ec82123bb9c2a2829c7c23136b472b4f79b2a379e6302c113103a2798c2d5e3850c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

LXrPQwN.exe

Path C:\Windows\System\LXrPQwN.exe
Size 5.9MB
SHA256 95cb2dcd90ad7a288e6e0bed3f5ce035d10dd1c8d8f17f13702f9b1fa338c151
MD5 96192a2695c81acd820ea42d9c66ca87
SHA1 8607ed2dd370ef7400b0f7ccf1625a3ebe5ed1b4
SHA512 3c7242486559edbcc0ab22b02f75e3f79212f613f048cb2e93915131fa1882ebb56a6229902222dc323273e1352e288c564851668cdb26a57d4f7ce6699fd79f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

LyHiBpD.exe

Path C:\Windows\System\LyHiBpD.exe
Size 5.9MB
SHA256 0ebd5854717221e67d946777a771870488e9da8cf61b7e7758ed6d317e608134
MD5 432ba350545082cab0a3f25b2035629e
SHA1 70605148b18d94517da8a519ddb38fda44703ae0
SHA512 ab9163de355ad2b93e3d47d65b42698cfb303f509527fc6fbc519106903a9f508bae1aac3c23df7295ac9c018d6e1bf7fbbd3dbbddaef8c27989c29fe7496609
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:Q+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

PlRaQSQ.exe

Path C:\Windows\System\PlRaQSQ.exe
Size 5.9MB
SHA256 53cf113f0bc8d3cd373e56b3eb46b596fb71d2d23e8c2eab1e37cabf2b43d666
MD5 ca544cc798364eeeaf7601580c7b87bd
SHA1 98e44836f063ce967384be1f0709c7cac1dae54f
SHA512 6616f77c69bca4e126dd5a0f445e5b6eb59496ffcf4285ca0826703f35dab8d942aa4ad36c9decba8276b6140cec32a21f3e1298a94ffa8123be96acf2513f99
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

RuWNRvS.exe

Path C:\Windows\System\RuWNRvS.exe
Size 5.9MB
SHA256 76997f315a8c6eaf87dcdb49d3a8a1034d668d719151977dd06f1dee6f26adf6
MD5 ce7b695798097a3bca7582212b145a1c
SHA1 4f3c4878c31e2721844c7aed4e0f0fa243d7a19b
SHA512 f710c08833a8262bbc9d32795736d2b6c126c09881c1a5e85cf71ec43e1e26d828064dacf7411bd0dacb94a92320fec87ea2b791f22df29156f2c51d0e1ffa21
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

SHnmxyt.exe

Path C:\Windows\System\SHnmxyt.exe
Size 5.9MB
SHA256 ad5f35246d5befed54e8eaba991f5360dba43b7e4b5949610c0f2b9420992e4b
MD5 6eb6ac445ae15a79cc13a49cc5c8a281
SHA1 f367152ea5c69044d6892226062309aa5d87d3a7
SHA512 5a2a7ef102609c7a8a03b76c1680d8ee046a74ffef6b863c3342771d11ca02367e965fc5fae3b205dfed8a8f40cb388e181b3a018742e4742d4d51e44090a597
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

WFMhZOy.exe

Path C:\Windows\System\WFMhZOy.exe
Size 5.9MB
SHA256 2193440636a826c802a8e95527f5386b36a3cd0031640cb6e6dca41c43392480
MD5 5fd39c6d42e1f026583353d2966e415d
SHA1 171929d15a905bcac9e4ed06dc1bac4c92cd3373
SHA512 91709d52b7beaf1319c2e927abe0f65ead144af53c542d20a64606ea275345d98ec968b36a8a82bb5ec27036bea42ea7d4f2551fb90a40fbd4b80a48f9d53aad
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

WjGkeaf.exe

Path C:\Windows\System\WjGkeaf.exe
Size 5.9MB
SHA256 69483676848abbed2aa5c74b031f04d2704dc352431e137db737ab586e2291fd
MD5 2988f2e2ff1c4d1dcdfed9eb6f73a7b6
SHA1 f30c1904828db4c1be980f2290af1c5834bac639
SHA512 097f782fda3680f7b92b5ce1ce9c8e045316e30a81ef5875d50a26b6fb94bc87e3afd91ba4dc73f296bc8dd6dcac4d46775a577d3782ba5a290ac924aa6bf55c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

XZRpTgp.exe

Path C:\Windows\System\XZRpTgp.exe
Size 5.9MB
SHA256 b8e73fae1c6dbe09ecb0c0a095c628b040bf0d21a04368b5d2c30b12d3b986c4
MD5 398150ba3832aae87176379395fff5fe
SHA1 2246155abca2f39abf02df91761f7ff2901b015e
SHA512 876aab808059de42c0046d5d8369028bf84d6a5695c9b06501de47791b4d83edec46890db99512221e5023c3518620c390376dac200b075ececba0f1be3a3e68
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

XpNNytB.exe

Path C:\Windows\System\XpNNytB.exe
Size 5.9MB
SHA256 c8c74f9077a42c16ab13b8001ba16c5d9a0b2034544e85288e8e0e33bb9a6e12
MD5 012a6653b3d13ced8d9e4747620108a6
SHA1 480ffcce1d5170a2ee4538abd9c8abe87ddbba4b
SHA512 718fccfecd2339da822e1a67ae49c75e44be0bd69f11362cf10f270528b498bd617ee069a31583931aa93746f974c463c306fd6a0b3f1dc922e73ef40b452f7d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

YmBAFMo.exe

Path C:\Windows\System\YmBAFMo.exe
Size 5.9MB
SHA256 ee17f6a4017a28f3798cbb1624f3b3a380685abfdfb8748b59c5cbe4c07bb00c
MD5 a1efcc7a66b0509811646f3019d04049
SHA1 e26b848f81918f2140ffe5212e9e38a33afb91f4
SHA512 8abb3e1cf0e31d93e3d22f9e007c119f6379a0e3aec08c2c742a80c8c01d8231eb5ad55d7d7c6cb96c4381961dc2ecc189cd43c4eea48d90c5475f5bab3a20de
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

bIvmoMd.exe

Path C:\Windows\System\bIvmoMd.exe
Size 5.9MB
SHA256 779086d7897fafa065954c720586f24377e5559e6d264a5fde47b7ec08263ae4
MD5 d83ce33be6a653993eeb92713b1efb70
SHA1 852fd86259a70ea495d80a7a73e278e03ba5cd95
SHA512 1d700425424b60694a4e8c834de15746d578a699bb1c12aa46c331ddac0b5848469e6bd4431e9aa4e0aee4948b6cba3218b5a2cc415ac70380980ded9d427eff
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

bRzXEMF.exe

Path C:\Windows\System\bRzXEMF.exe
Size 5.9MB
SHA256 2b838ea8333ff4f75b94699351002fc92c9d0c2527c987d1397290853f99c224
MD5 7cb4db9f655e2ecc028061805834f846
SHA1 37de56254e7a00015e4202c621e9602324c9a050
SHA512 f34aeceb89aacb947268cc851e3f25c9656d454c4f0b97575aa334bb5630398418795fb87e46a735c0a4eda6df5533325fa497ab1133870a78c14df0df3752da
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:Q+856utgpPF8u/7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

cagQeSp.exe

Path C:\Windows\System\cagQeSp.exe
Size 5.9MB
SHA256 97ab41526d7747d8e571343c47670964dc460f134d21d136fc2d517bb0d7986a
MD5 c4a98cb80654fb2e7dc4a425d2c72a6d
SHA1 c5f528dcbecd9d28fa6afa08b40fce7549367f64
SHA512 50f4a95b2696b33fddb7f7f3bb7ec0b54be4d182b0b18772badcf6c2e2fdea9e65fae2f009b3981b293cd85882e9a5344f19613329d815afd5a5119267d9336d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

jRnvdpy.exe

Path C:\Windows\System\jRnvdpy.exe
Size 5.9MB
SHA256 3b28eaeb23a7ee1ccea0f013eab1d6e0edd25c94a859e26250b3ec0375da20d4
MD5 b13cffa356cfee1cd624802adb790869
SHA1 b89af17e120b968671e6bf03ecee73a241aa7682
SHA512 f64b42376072198a9bf5bd15ba2b5b5c96f4127ef211e2bab56a7a75407e2b003f61be770ff3849f06745ddf08e2601b20136c3c3cc62fa52a6dbfb22344966c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

kgAUvxQ.exe

Path C:\Windows\System\kgAUvxQ.exe
Size 5.9MB
SHA256 a780e0ba4f54122e9b1cdaf640865ce93ac857921f234d8f39d411ffdd4027b0
MD5 c2c9d76e929a5721b6758a1ac66f1be5
SHA1 313b0d87aa5164e8ad01e5505f9a16112ae201a4
SHA512 db5f86e078df71d46e183d6876a36c3bf8980a3366213dba0f912827ef4c840bb7d4f75b54a71243866e247a157dc551abef73f31eaacaf509a946a3ea1b4c12
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

mAdmGiw.exe

Path C:\Windows\System\mAdmGiw.exe
Size 5.9MB
SHA256 b032fc895ba2a653fd9cc180c42e576b8a40413cda98104b8331081f5e417540
MD5 01261eb98787a13d83ce9aa203ea503f
SHA1 c634effd38b62169c5f876f7e69568b267d1c5c3
SHA512 4b631025a264cdb8bafa13b0cda4cd37ced9d409f6aa5724ccd29445f9aa1f1ac898911abc3a3c03bb0a77cbd3ff95b55ae100babcecf1cf0b52787e108b3cbf
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

mukcOzR.exe

Path C:\Windows\System\mukcOzR.exe
Size 5.9MB
SHA256 caac0e1274e493fe91af3e5dcc1a8fa7198f1c9e88a8ebd7f9dc680b6f47f23c
MD5 a3a9d9cfbb3be3cfa1063e9cc2c89d89
SHA1 23df7591656332921e15f1f8edf7510803f3a94e
SHA512 5f0568330ef5d40e8264954ac57bb3d73792110f9e5eea0cd20bdc864128606eda53f1613d2eb0d10d486eeac38997899d8f8b4a4f9ed2ff7b0a30f03eab37d5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

odqheZC.exe

Path C:\Windows\System\odqheZC.exe
Size 5.9MB
SHA256 756ff74c09c85ab67afea26e0f2a00ca4b5f220a5b317e8759cdd29f9d46dc8e
MD5 c7108003f523ba142120e0d7b0ea8c59
SHA1 aa890a272597c7d0c2e33d8f5563abb83748b67d
SHA512 efb77281bdaaef33e224a13b5b9353710de6a7d3f7f0f8d9dea90045f2be13f956124c3acdd9cd191f40a0cf40b3bcfc4c349fa97872aec50dd47507226adb82
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1044-30-0x00007FF68D890000-0x00007FF68DBE4000-memory.dmp

Download

memory/1044-144-0x00007FF68D890000-0x00007FF68DBE4000-memory.dmp

Download

memory/1156-159-0x00007FF7EE830000-0x00007FF7EEB84000-memory.dmp

Download

memory/1156-131-0x00007FF7EE830000-0x00007FF7EEB84000-memory.dmp

Download

memory/1528-156-0x00007FF70AA60000-0x00007FF70ADB4000-memory.dmp

Download

memory/1528-118-0x00007FF70AA60000-0x00007FF70ADB4000-memory.dmp

Download

memory/1860-37-0x00007FF658710000-0x00007FF658A64000-memory.dmp

Download

memory/1860-143-0x00007FF658710000-0x00007FF658A64000-memory.dmp

Download

memory/1868-140-0x00007FF652720000-0x00007FF652A74000-memory.dmp

Download

memory/1868-17-0x00007FF652720000-0x00007FF652A74000-memory.dmp

Download

memory/1868-124-0x00007FF652720000-0x00007FF652A74000-memory.dmp

Download

memory/2032-158-0x00007FF705E10000-0x00007FF706164000-memory.dmp

Download

memory/2032-128-0x00007FF705E10000-0x00007FF706164000-memory.dmp

Download

memory/2512-142-0x00007FF712E20000-0x00007FF713174000-memory.dmp

Download

memory/2512-38-0x00007FF712E20000-0x00007FF713174000-memory.dmp

Download

memory/2740-133-0x00007FF7D86C0000-0x00007FF7D8A14000-memory.dmp

Download

memory/2740-146-0x00007FF7D86C0000-0x00007FF7D8A14000-memory.dmp

Download

memory/2740-47-0x00007FF7D86C0000-0x00007FF7D8A14000-memory.dmp

Download

memory/2744-1-0x0000021CFE460000-0x0000021CFE470000-memory.dmp

Download

memory/2744-76-0x00007FF78A770000-0x00007FF78AAC4000-memory.dmp

Download

memory/2744-0-0x00007FF78A770000-0x00007FF78AAC4000-memory.dmp

Download

memory/2924-91-0x00007FF762D10000-0x00007FF763064000-memory.dmp

Download

memory/2924-153-0x00007FF762D10000-0x00007FF763064000-memory.dmp

Download

memory/2924-137-0x00007FF762D10000-0x00007FF763064000-memory.dmp

Download

memory/3148-152-0x00007FF60F520000-0x00007FF60F874000-memory.dmp

Download

memory/3148-138-0x00007FF60F520000-0x00007FF60F874000-memory.dmp

Download

memory/3148-94-0x00007FF60F520000-0x00007FF60F874000-memory.dmp

Download

memory/3180-68-0x00007FF640250000-0x00007FF6405A4000-memory.dmp

Download

memory/3180-135-0x00007FF640250000-0x00007FF6405A4000-memory.dmp

Download

memory/3180-148-0x00007FF640250000-0x00007FF6405A4000-memory.dmp

Download

memory/3608-147-0x00007FF7ABB60000-0x00007FF7ABEB4000-memory.dmp

Download

memory/3608-60-0x00007FF7ABB60000-0x00007FF7ABEB4000-memory.dmp

Download

memory/3800-83-0x00007FF6A4DD0000-0x00007FF6A5124000-memory.dmp

Download

memory/3800-136-0x00007FF6A4DD0000-0x00007FF6A5124000-memory.dmp

Download

memory/3800-151-0x00007FF6A4DD0000-0x00007FF6A5124000-memory.dmp

Download

memory/4116-157-0x00007FF7887D0000-0x00007FF788B24000-memory.dmp

Download

memory/4116-117-0x00007FF7887D0000-0x00007FF788B24000-memory.dmp

Download

memory/4168-116-0x00007FF7CE8F0000-0x00007FF7CEC44000-memory.dmp

Download

memory/4168-154-0x00007FF7CE8F0000-0x00007FF7CEC44000-memory.dmp

Download

memory/4192-132-0x00007FF691080000-0x00007FF6913D4000-memory.dmp

Download

memory/4192-43-0x00007FF691080000-0x00007FF6913D4000-memory.dmp

Download

memory/4192-145-0x00007FF691080000-0x00007FF6913D4000-memory.dmp

Download

memory/4560-8-0x00007FF6BD300000-0x00007FF6BD654000-memory.dmp

Download

memory/4560-139-0x00007FF6BD300000-0x00007FF6BD654000-memory.dmp

Download

memory/4560-88-0x00007FF6BD300000-0x00007FF6BD654000-memory.dmp

Download

memory/4644-13-0x00007FF74EBC0000-0x00007FF74EF14000-memory.dmp

Download

memory/4644-141-0x00007FF74EBC0000-0x00007FF74EF14000-memory.dmp

Download

memory/4644-109-0x00007FF74EBC0000-0x00007FF74EF14000-memory.dmp

Download

memory/4660-150-0x00007FF6DF390000-0x00007FF6DF6E4000-memory.dmp

Download

memory/4660-85-0x00007FF6DF390000-0x00007FF6DF6E4000-memory.dmp

Download

memory/4752-75-0x00007FF66E9C0000-0x00007FF66ED14000-memory.dmp

Download

memory/4752-149-0x00007FF66E9C0000-0x00007FF66ED14000-memory.dmp

Download

memory/4752-134-0x00007FF66E9C0000-0x00007FF66ED14000-memory.dmp

Download

memory/4920-119-0x00007FF73F410000-0x00007FF73F764000-memory.dmp

Download

memory/4920-155-0x00007FF73F410000-0x00007FF73F764000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads