cobaltstrike | 2e4185a0f5b0b647941a3647ecf94f8124debc2b89f292ccb3ea45cc2bd41349

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240531-thp59add7v
SHA256 2e4185a0f5b0b647941a3647ecf94f8124debc2b89f292ccb3ea45cc2bd41349
MD5 e6c7967425730e449f6f85bb1e0ad716
SHA1 c8259ee3923228260bc2aa9eb376f66cb6f2f705
SHA512 ab4add41db7f4f10d822a307107a94e6b649ebce58b35f384108deb32022a9f6c5a963cdd26e4ec9598ac02e54737ea4ff4602b113320a414b0457234e21227e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000600000002326f-5.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023400-9.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340a-23.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340b-29.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023409-21.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340c-35.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023401-40.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340d-48.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340e-53.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023411-59.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023412-66.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023413-75.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023414-80.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023415-87.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023416-93.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341a-118.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341b-128.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023419-119.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023418-109.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-104.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341c-131.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000600000002326f-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0009000000023400-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340a-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340b-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023409-21.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340c-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0009000000023401-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340d-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340e-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023411-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023412-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023413-75.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023414-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023415-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023416-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341a-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341b-128.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023419-119.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023418-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341c-131.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4256-0-0x00007FF7DCC40000-0x00007FF7DCF94000-memory.dmp	UPX
behavioral2/files/0x000600000002326f-5.dat	UPX
behavioral2/memory/4732-6-0x00007FF688D10000-0x00007FF689064000-memory.dmp	UPX
behavioral2/files/0x0009000000023400-9.dat	UPX
behavioral2/files/0x000700000002340a-23.dat	UPX
behavioral2/files/0x000700000002340b-29.dat	UPX
behavioral2/memory/1340-26-0x00007FF6C2CC0000-0x00007FF6C3014000-memory.dmp	UPX
behavioral2/memory/452-32-0x00007FF7A2350000-0x00007FF7A26A4000-memory.dmp	UPX
behavioral2/files/0x0007000000023409-21.dat	UPX
behavioral2/memory/3216-20-0x00007FF66D0A0000-0x00007FF66D3F4000-memory.dmp	UPX
behavioral2/memory/2996-16-0x00007FF67A570000-0x00007FF67A8C4000-memory.dmp	UPX
behavioral2/files/0x000700000002340c-35.dat	UPX
behavioral2/memory/4144-36-0x00007FF78EFC0000-0x00007FF78F314000-memory.dmp	UPX
behavioral2/files/0x0009000000023401-40.dat	UPX
behavioral2/memory/4780-42-0x00007FF6116D0000-0x00007FF611A24000-memory.dmp	UPX
behavioral2/files/0x000700000002340d-48.dat	UPX
behavioral2/memory/2480-50-0x00007FF7F8040000-0x00007FF7F8394000-memory.dmp	UPX
behavioral2/files/0x000700000002340e-53.dat	UPX
behavioral2/memory/2036-56-0x00007FF7574D0000-0x00007FF757824000-memory.dmp	UPX
behavioral2/files/0x0007000000023411-59.dat	UPX
behavioral2/memory/692-63-0x00007FF68F4E0000-0x00007FF68F834000-memory.dmp	UPX
behavioral2/files/0x0007000000023412-66.dat	UPX
behavioral2/memory/4344-72-0x00007FF70D300000-0x00007FF70D654000-memory.dmp	UPX
behavioral2/files/0x0007000000023413-75.dat	UPX
behavioral2/memory/4960-74-0x00007FF7A0E40000-0x00007FF7A1194000-memory.dmp	UPX
behavioral2/memory/2996-73-0x00007FF67A570000-0x00007FF67A8C4000-memory.dmp	UPX
behavioral2/memory/4732-69-0x00007FF688D10000-0x00007FF689064000-memory.dmp	UPX
behavioral2/memory/4256-62-0x00007FF7DCC40000-0x00007FF7DCF94000-memory.dmp	UPX
behavioral2/files/0x0007000000023414-80.dat	UPX
behavioral2/memory/4748-84-0x00007FF7D9EF0000-0x00007FF7DA244000-memory.dmp	UPX
behavioral2/files/0x0007000000023415-87.dat	UPX
behavioral2/memory/3216-83-0x00007FF66D0A0000-0x00007FF66D3F4000-memory.dmp	UPX
behavioral2/memory/3772-88-0x00007FF7C20B0000-0x00007FF7C2404000-memory.dmp	UPX
behavioral2/files/0x0007000000023416-93.dat	UPX
behavioral2/files/0x000700000002341a-118.dat	UPX
behavioral2/memory/2828-122-0x00007FF7681C0000-0x00007FF768514000-memory.dmp	UPX
behavioral2/memory/3756-126-0x00007FF6ECCF0000-0x00007FF6ED044000-memory.dmp	UPX
behavioral2/memory/2036-127-0x00007FF7574D0000-0x00007FF757824000-memory.dmp	UPX
behavioral2/files/0x000700000002341b-128.dat	UPX
behavioral2/memory/5016-125-0x00007FF71C610000-0x00007FF71C964000-memory.dmp	UPX
behavioral2/memory/4244-116-0x00007FF7387C0000-0x00007FF738B14000-memory.dmp	UPX
behavioral2/files/0x0007000000023419-119.dat	UPX
behavioral2/memory/4780-111-0x00007FF6116D0000-0x00007FF611A24000-memory.dmp	UPX
behavioral2/files/0x0007000000023418-109.dat	UPX
behavioral2/memory/4144-101-0x00007FF78EFC0000-0x00007FF78F314000-memory.dmp	UPX
behavioral2/files/0x0007000000023417-104.dat	UPX
behavioral2/memory/2368-102-0x00007FF6BA250000-0x00007FF6BA5A4000-memory.dmp	UPX
behavioral2/memory/1072-97-0x00007FF668ED0000-0x00007FF669224000-memory.dmp	UPX
behavioral2/files/0x000700000002341c-131.dat	UPX
behavioral2/memory/2924-134-0x00007FF6AF630000-0x00007FF6AF984000-memory.dmp	UPX
behavioral2/memory/4960-135-0x00007FF7A0E40000-0x00007FF7A1194000-memory.dmp	UPX
behavioral2/memory/3772-136-0x00007FF7C20B0000-0x00007FF7C2404000-memory.dmp	UPX
behavioral2/memory/1072-137-0x00007FF668ED0000-0x00007FF669224000-memory.dmp	UPX
behavioral2/memory/2368-138-0x00007FF6BA250000-0x00007FF6BA5A4000-memory.dmp	UPX
behavioral2/memory/4244-139-0x00007FF7387C0000-0x00007FF738B14000-memory.dmp	UPX
behavioral2/memory/2828-140-0x00007FF7681C0000-0x00007FF768514000-memory.dmp	UPX
behavioral2/memory/3756-141-0x00007FF6ECCF0000-0x00007FF6ED044000-memory.dmp	UPX
behavioral2/memory/2996-142-0x00007FF67A570000-0x00007FF67A8C4000-memory.dmp	UPX
behavioral2/memory/4732-143-0x00007FF688D10000-0x00007FF689064000-memory.dmp	UPX
behavioral2/memory/1340-144-0x00007FF6C2CC0000-0x00007FF6C3014000-memory.dmp	UPX
behavioral2/memory/3216-145-0x00007FF66D0A0000-0x00007FF66D3F4000-memory.dmp	UPX
behavioral2/memory/452-146-0x00007FF7A2350000-0x00007FF7A26A4000-memory.dmp	UPX
behavioral2/memory/4144-147-0x00007FF78EFC0000-0x00007FF78F314000-memory.dmp	UPX
behavioral2/memory/4780-148-0x00007FF6116D0000-0x00007FF611A24000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4256-0-0x00007FF7DCC40000-0x00007FF7DCF94000-memory.dmp	xmrig
behavioral2/files/0x000600000002326f-5.dat	xmrig
behavioral2/memory/4732-6-0x00007FF688D10000-0x00007FF689064000-memory.dmp	xmrig
behavioral2/files/0x0009000000023400-9.dat	xmrig
behavioral2/files/0x000700000002340a-23.dat	xmrig
behavioral2/files/0x000700000002340b-29.dat	xmrig
behavioral2/memory/1340-26-0x00007FF6C2CC0000-0x00007FF6C3014000-memory.dmp	xmrig
behavioral2/memory/452-32-0x00007FF7A2350000-0x00007FF7A26A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023409-21.dat	xmrig
behavioral2/memory/3216-20-0x00007FF66D0A0000-0x00007FF66D3F4000-memory.dmp	xmrig
behavioral2/memory/2996-16-0x00007FF67A570000-0x00007FF67A8C4000-memory.dmp	xmrig
behavioral2/files/0x000700000002340c-35.dat	xmrig
behavioral2/memory/4144-36-0x00007FF78EFC0000-0x00007FF78F314000-memory.dmp	xmrig
behavioral2/files/0x0009000000023401-40.dat	xmrig
behavioral2/memory/4780-42-0x00007FF6116D0000-0x00007FF611A24000-memory.dmp	xmrig
behavioral2/files/0x000700000002340d-48.dat	xmrig
behavioral2/memory/2480-50-0x00007FF7F8040000-0x00007FF7F8394000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-53.dat	xmrig
behavioral2/memory/2036-56-0x00007FF7574D0000-0x00007FF757824000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-59.dat	xmrig
behavioral2/memory/692-63-0x00007FF68F4E0000-0x00007FF68F834000-memory.dmp	xmrig
behavioral2/files/0x0007000000023412-66.dat	xmrig
behavioral2/memory/4344-72-0x00007FF70D300000-0x00007FF70D654000-memory.dmp	xmrig
behavioral2/files/0x0007000000023413-75.dat	xmrig
behavioral2/memory/4960-74-0x00007FF7A0E40000-0x00007FF7A1194000-memory.dmp	xmrig
behavioral2/memory/2996-73-0x00007FF67A570000-0x00007FF67A8C4000-memory.dmp	xmrig
behavioral2/memory/4732-69-0x00007FF688D10000-0x00007FF689064000-memory.dmp	xmrig
behavioral2/memory/4256-62-0x00007FF7DCC40000-0x00007FF7DCF94000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-80.dat	xmrig
behavioral2/memory/4748-84-0x00007FF7D9EF0000-0x00007FF7DA244000-memory.dmp	xmrig
behavioral2/files/0x0007000000023415-87.dat	xmrig
behavioral2/memory/3216-83-0x00007FF66D0A0000-0x00007FF66D3F4000-memory.dmp	xmrig
behavioral2/memory/3772-88-0x00007FF7C20B0000-0x00007FF7C2404000-memory.dmp	xmrig
behavioral2/files/0x0007000000023416-93.dat	xmrig
behavioral2/files/0x000700000002341a-118.dat	xmrig
behavioral2/memory/2828-122-0x00007FF7681C0000-0x00007FF768514000-memory.dmp	xmrig
behavioral2/memory/3756-126-0x00007FF6ECCF0000-0x00007FF6ED044000-memory.dmp	xmrig
behavioral2/memory/2036-127-0x00007FF7574D0000-0x00007FF757824000-memory.dmp	xmrig
behavioral2/files/0x000700000002341b-128.dat	xmrig
behavioral2/memory/5016-125-0x00007FF71C610000-0x00007FF71C964000-memory.dmp	xmrig
behavioral2/memory/4244-116-0x00007FF7387C0000-0x00007FF738B14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023419-119.dat	xmrig
behavioral2/memory/4780-111-0x00007FF6116D0000-0x00007FF611A24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023418-109.dat	xmrig
behavioral2/memory/4144-101-0x00007FF78EFC0000-0x00007FF78F314000-memory.dmp	xmrig
behavioral2/files/0x0007000000023417-104.dat	xmrig
behavioral2/memory/2368-102-0x00007FF6BA250000-0x00007FF6BA5A4000-memory.dmp	xmrig
behavioral2/memory/1072-97-0x00007FF668ED0000-0x00007FF669224000-memory.dmp	xmrig
behavioral2/files/0x000700000002341c-131.dat	xmrig
behavioral2/memory/2924-134-0x00007FF6AF630000-0x00007FF6AF984000-memory.dmp	xmrig
behavioral2/memory/4960-135-0x00007FF7A0E40000-0x00007FF7A1194000-memory.dmp	xmrig
behavioral2/memory/3772-136-0x00007FF7C20B0000-0x00007FF7C2404000-memory.dmp	xmrig
behavioral2/memory/1072-137-0x00007FF668ED0000-0x00007FF669224000-memory.dmp	xmrig
behavioral2/memory/2368-138-0x00007FF6BA250000-0x00007FF6BA5A4000-memory.dmp	xmrig
behavioral2/memory/4244-139-0x00007FF7387C0000-0x00007FF738B14000-memory.dmp	xmrig
behavioral2/memory/2828-140-0x00007FF7681C0000-0x00007FF768514000-memory.dmp	xmrig
behavioral2/memory/3756-141-0x00007FF6ECCF0000-0x00007FF6ED044000-memory.dmp	xmrig
behavioral2/memory/2996-142-0x00007FF67A570000-0x00007FF67A8C4000-memory.dmp	xmrig
behavioral2/memory/4732-143-0x00007FF688D10000-0x00007FF689064000-memory.dmp	xmrig
behavioral2/memory/1340-144-0x00007FF6C2CC0000-0x00007FF6C3014000-memory.dmp	xmrig
behavioral2/memory/3216-145-0x00007FF66D0A0000-0x00007FF66D3F4000-memory.dmp	xmrig
behavioral2/memory/452-146-0x00007FF7A2350000-0x00007FF7A26A4000-memory.dmp	xmrig
behavioral2/memory/4144-147-0x00007FF78EFC0000-0x00007FF78F314000-memory.dmp	xmrig
behavioral2/memory/4780-148-0x00007FF6116D0000-0x00007FF611A24000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4732	VMjzePD.exe
2996	UfUnrfq.exe
3216	qFnVYNZ.exe
1340	UNEhvkb.exe
452	oyhWOnT.exe
4144	gNOUfZX.exe
4780	ecRnTHM.exe
2480	aLZCyif.exe
2036	bxgrHuR.exe
692	WdwRrWe.exe
4344	dWyCwIb.exe
4960	kuZyvOr.exe
4748	VYNCTZm.exe
3772	vboWUFg.exe
1072	wKjkomp.exe
2368	SfhzodF.exe
4244	ljbRdwy.exe
2828	QnSYHJb.exe
5016	TOEnpnF.exe
3756	mgPaxVT.exe
2924	ppVXmPy.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4256-0-0x00007FF7DCC40000-0x00007FF7DCF94000-memory.dmp	upx
behavioral2/files/0x000600000002326f-5.dat	upx
behavioral2/memory/4732-6-0x00007FF688D10000-0x00007FF689064000-memory.dmp	upx
behavioral2/files/0x0009000000023400-9.dat	upx
behavioral2/files/0x000700000002340a-23.dat	upx
behavioral2/files/0x000700000002340b-29.dat	upx
behavioral2/memory/1340-26-0x00007FF6C2CC0000-0x00007FF6C3014000-memory.dmp	upx
behavioral2/memory/452-32-0x00007FF7A2350000-0x00007FF7A26A4000-memory.dmp	upx
behavioral2/files/0x0007000000023409-21.dat	upx
behavioral2/memory/3216-20-0x00007FF66D0A0000-0x00007FF66D3F4000-memory.dmp	upx
behavioral2/memory/2996-16-0x00007FF67A570000-0x00007FF67A8C4000-memory.dmp	upx
behavioral2/files/0x000700000002340c-35.dat	upx
behavioral2/memory/4144-36-0x00007FF78EFC0000-0x00007FF78F314000-memory.dmp	upx
behavioral2/files/0x0009000000023401-40.dat	upx
behavioral2/memory/4780-42-0x00007FF6116D0000-0x00007FF611A24000-memory.dmp	upx
behavioral2/files/0x000700000002340d-48.dat	upx
behavioral2/memory/2480-50-0x00007FF7F8040000-0x00007FF7F8394000-memory.dmp	upx
behavioral2/files/0x000700000002340e-53.dat	upx
behavioral2/memory/2036-56-0x00007FF7574D0000-0x00007FF757824000-memory.dmp	upx
behavioral2/files/0x0007000000023411-59.dat	upx
behavioral2/memory/692-63-0x00007FF68F4E0000-0x00007FF68F834000-memory.dmp	upx
behavioral2/files/0x0007000000023412-66.dat	upx
behavioral2/memory/4344-72-0x00007FF70D300000-0x00007FF70D654000-memory.dmp	upx
behavioral2/files/0x0007000000023413-75.dat	upx
behavioral2/memory/4960-74-0x00007FF7A0E40000-0x00007FF7A1194000-memory.dmp	upx
behavioral2/memory/2996-73-0x00007FF67A570000-0x00007FF67A8C4000-memory.dmp	upx
behavioral2/memory/4732-69-0x00007FF688D10000-0x00007FF689064000-memory.dmp	upx
behavioral2/memory/4256-62-0x00007FF7DCC40000-0x00007FF7DCF94000-memory.dmp	upx
behavioral2/files/0x0007000000023414-80.dat	upx
behavioral2/memory/4748-84-0x00007FF7D9EF0000-0x00007FF7DA244000-memory.dmp	upx
behavioral2/files/0x0007000000023415-87.dat	upx
behavioral2/memory/3216-83-0x00007FF66D0A0000-0x00007FF66D3F4000-memory.dmp	upx
behavioral2/memory/3772-88-0x00007FF7C20B0000-0x00007FF7C2404000-memory.dmp	upx
behavioral2/files/0x0007000000023416-93.dat	upx
behavioral2/files/0x000700000002341a-118.dat	upx
behavioral2/memory/2828-122-0x00007FF7681C0000-0x00007FF768514000-memory.dmp	upx
behavioral2/memory/3756-126-0x00007FF6ECCF0000-0x00007FF6ED044000-memory.dmp	upx
behavioral2/memory/2036-127-0x00007FF7574D0000-0x00007FF757824000-memory.dmp	upx
behavioral2/files/0x000700000002341b-128.dat	upx
behavioral2/memory/5016-125-0x00007FF71C610000-0x00007FF71C964000-memory.dmp	upx
behavioral2/memory/4244-116-0x00007FF7387C0000-0x00007FF738B14000-memory.dmp	upx
behavioral2/files/0x0007000000023419-119.dat	upx
behavioral2/memory/4780-111-0x00007FF6116D0000-0x00007FF611A24000-memory.dmp	upx
behavioral2/files/0x0007000000023418-109.dat	upx
behavioral2/memory/4144-101-0x00007FF78EFC0000-0x00007FF78F314000-memory.dmp	upx
behavioral2/files/0x0007000000023417-104.dat	upx
behavioral2/memory/2368-102-0x00007FF6BA250000-0x00007FF6BA5A4000-memory.dmp	upx
behavioral2/memory/1072-97-0x00007FF668ED0000-0x00007FF669224000-memory.dmp	upx
behavioral2/files/0x000700000002341c-131.dat	upx
behavioral2/memory/2924-134-0x00007FF6AF630000-0x00007FF6AF984000-memory.dmp	upx
behavioral2/memory/4960-135-0x00007FF7A0E40000-0x00007FF7A1194000-memory.dmp	upx
behavioral2/memory/3772-136-0x00007FF7C20B0000-0x00007FF7C2404000-memory.dmp	upx
behavioral2/memory/1072-137-0x00007FF668ED0000-0x00007FF669224000-memory.dmp	upx
behavioral2/memory/2368-138-0x00007FF6BA250000-0x00007FF6BA5A4000-memory.dmp	upx
behavioral2/memory/4244-139-0x00007FF7387C0000-0x00007FF738B14000-memory.dmp	upx
behavioral2/memory/2828-140-0x00007FF7681C0000-0x00007FF768514000-memory.dmp	upx
behavioral2/memory/3756-141-0x00007FF6ECCF0000-0x00007FF6ED044000-memory.dmp	upx
behavioral2/memory/2996-142-0x00007FF67A570000-0x00007FF67A8C4000-memory.dmp	upx
behavioral2/memory/4732-143-0x00007FF688D10000-0x00007FF689064000-memory.dmp	upx
behavioral2/memory/1340-144-0x00007FF6C2CC0000-0x00007FF6C3014000-memory.dmp	upx
behavioral2/memory/3216-145-0x00007FF66D0A0000-0x00007FF66D3F4000-memory.dmp	upx
behavioral2/memory/452-146-0x00007FF7A2350000-0x00007FF7A26A4000-memory.dmp	upx
behavioral2/memory/4144-147-0x00007FF78EFC0000-0x00007FF78F314000-memory.dmp	upx
behavioral2/memory/4780-148-0x00007FF6116D0000-0x00007FF611A24000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\QnSYHJb.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oyhWOnT.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ecRnTHM.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aLZCyif.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dWyCwIb.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kuZyvOr.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vboWUFg.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ppVXmPy.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VMjzePD.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qFnVYNZ.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UNEhvkb.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bxgrHuR.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WdwRrWe.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TOEnpnF.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mgPaxVT.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UfUnrfq.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gNOUfZX.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wKjkomp.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SfhzodF.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ljbRdwy.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VYNCTZm.exe	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4732	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	84
PID 4256 wrote to memory of 4732	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	84
PID 4256 wrote to memory of 2996	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	85
PID 4256 wrote to memory of 2996	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	85
PID 4256 wrote to memory of 3216	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	86
PID 4256 wrote to memory of 3216	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	86
PID 4256 wrote to memory of 1340	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	87
PID 4256 wrote to memory of 1340	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	87
PID 4256 wrote to memory of 452	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	88
PID 4256 wrote to memory of 452	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	88
PID 4256 wrote to memory of 4144	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	89
PID 4256 wrote to memory of 4144	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	89
PID 4256 wrote to memory of 4780	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	90
PID 4256 wrote to memory of 4780	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	90
PID 4256 wrote to memory of 2480	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	91
PID 4256 wrote to memory of 2480	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	91
PID 4256 wrote to memory of 2036	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	92
PID 4256 wrote to memory of 2036	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	92
PID 4256 wrote to memory of 692	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	93
PID 4256 wrote to memory of 692	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	93
PID 4256 wrote to memory of 4344	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	95
PID 4256 wrote to memory of 4344	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	95
PID 4256 wrote to memory of 4960	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	96
PID 4256 wrote to memory of 4960	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	96
PID 4256 wrote to memory of 4748	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	98
PID 4256 wrote to memory of 4748	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	98
PID 4256 wrote to memory of 3772	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	99
PID 4256 wrote to memory of 3772	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	99
PID 4256 wrote to memory of 1072	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	100
PID 4256 wrote to memory of 1072	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	100
PID 4256 wrote to memory of 2368	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	101
PID 4256 wrote to memory of 2368	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	101
PID 4256 wrote to memory of 4244	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	102
PID 4256 wrote to memory of 4244	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	102
PID 4256 wrote to memory of 2828	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	103
PID 4256 wrote to memory of 2828	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	103
PID 4256 wrote to memory of 5016	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	104
PID 4256 wrote to memory of 5016	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	104
PID 4256 wrote to memory of 3756	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	105
PID 4256 wrote to memory of 3756	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	105
PID 4256 wrote to memory of 2924	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	106
PID 4256 wrote to memory of 2924	4256	2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe	106

C:\Users\Admin\AppData\Local\Temp\2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_e6c7967425730e449f6f85bb1e0ad716_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\System\VMjzePD.exe
  C:\Windows\System\VMjzePD.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\UfUnrfq.exe
  C:\Windows\System\UfUnrfq.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\qFnVYNZ.exe
  C:\Windows\System\qFnVYNZ.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\UNEhvkb.exe
  C:\Windows\System\UNEhvkb.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\oyhWOnT.exe
  C:\Windows\System\oyhWOnT.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\gNOUfZX.exe
  C:\Windows\System\gNOUfZX.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\ecRnTHM.exe
  C:\Windows\System\ecRnTHM.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\aLZCyif.exe
  C:\Windows\System\aLZCyif.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\bxgrHuR.exe
  C:\Windows\System\bxgrHuR.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\WdwRrWe.exe
  C:\Windows\System\WdwRrWe.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\dWyCwIb.exe
  C:\Windows\System\dWyCwIb.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\kuZyvOr.exe
  C:\Windows\System\kuZyvOr.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\VYNCTZm.exe
  C:\Windows\System\VYNCTZm.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\vboWUFg.exe
  C:\Windows\System\vboWUFg.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\wKjkomp.exe
  C:\Windows\System\wKjkomp.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\SfhzodF.exe
  C:\Windows\System\SfhzodF.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\ljbRdwy.exe
  C:\Windows\System\ljbRdwy.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\QnSYHJb.exe
  C:\Windows\System\QnSYHJb.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\TOEnpnF.exe
  C:\Windows\System\TOEnpnF.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\mgPaxVT.exe
  C:\Windows\System\mgPaxVT.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\ppVXmPy.exe
  C:\Windows\System\ppVXmPy.exe
  2⤵
  - Executes dropped EXE
  PID:2924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

QnSYHJb.exe

Path C:\Windows\System\QnSYHJb.exe
Size 5.9MB
SHA256 5142f66a45f845572eea2640951b835a3e69a89fddcde729d6e741c020290d3d
MD5 61f9d7ca1d575baa1ca782014056d564
SHA1 e039e9b69ef64eb21b5e1b24d261fde025f6b01d
SHA512 13834dfb93ecbaf768703b46fe6804b9cc7c8b3574640b7389819feb0676f396265e6378578cd3488cd63c3196f0a1785ca20b0230781485ff3a5bfb47fa12ef
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

SfhzodF.exe

Path C:\Windows\System\SfhzodF.exe
Size 5.9MB
SHA256 09cd207c4a3e41fdf32b0c0d4c6826e69dc6f89feaed9ba703a23baa75389b24
MD5 4e29273b08af6c6709df626d6a128a76
SHA1 7a12aa58d192f3c3ccd7c9bd2ccdbc55a85e0946
SHA512 f7cfef6d4ab650db9006e447bbe1043ccad1869b94a940f9a9f4af18d5de8d587036be0f0881c55ad3ba0a5890dae0286454b96e3f54f19c892def42ad4b30fb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

TOEnpnF.exe

Path C:\Windows\System\TOEnpnF.exe
Size 5.9MB
SHA256 4bd2fc1423c911853ca9ac9f48939b7cf7a80d8585d4802154b21a0f5bdd24a1
MD5 2a03677f61305dd1bc8c79f38cff1e7e
SHA1 b4a4f82caa6c16b509582b709e78c07bfa6c9652
SHA512 74da081f4c9ba33ad3afd3c02d9debf9b9f8c9227529882ac57a7be52ebf62fc29abc0bfdc244ffdc8536779d55d3b344c2fcfe6613e7aa2bae6d83137be1d72
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

UNEhvkb.exe

Path C:\Windows\System\UNEhvkb.exe
Size 5.9MB
SHA256 036534f10430f91cb86a8f3a8afb70920edc17e76c6c965a1c211cdbb83ae494
MD5 01b023adc71c99954ff3f69e9db68be6
SHA1 417a88d2fc4acb695b90493953f4f4a9369ebec8
SHA512 e0a1080f48ee05d0a9bd248d7ead608cff9fcc1630b15c298c657d38afe16232ac4853285444c3c601a560a55748de7c19aa75cd7a7d63e85e54a21ef9811357
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

UfUnrfq.exe

Path C:\Windows\System\UfUnrfq.exe
Size 5.9MB
SHA256 a8b62492a23bc9e8783e751ec7da469abf7cf51eef673ceed17e19939832b923
MD5 82cfc8def176ee164b422ba944276b59
SHA1 fffd263efed897ee72592d299cb188aaa44929b3
SHA512 ddc466c762ae8839b101e1e9c1ad01e0a4e3811498d97ea23f4b712f0d04dd17ba6dc193094dee5bbd0eb57a67ea9a00e44e04eadecb9a6e5900fe75c0510591
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

VMjzePD.exe

Path C:\Windows\System\VMjzePD.exe
Size 5.9MB
SHA256 4df7b37b8877cf99155838ca8d099f6b29426d4f4046baebf4defd826be99023
MD5 14a7388072aeda6133c2a88be754e6f9
SHA1 e11cc6b28df61787df14acb6997adf810ebdfa67
SHA512 29b35663864fd6c33f794131e3e8834eb8ec636808f207503768f6af58c9f460e08fba186383d56312319b21881f688d47ba0fc2f444cbbe6c2f2ee26e164f6f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

VYNCTZm.exe

Path C:\Windows\System\VYNCTZm.exe
Size 5.9MB
SHA256 d3db0edf509093c3c682c4b4852bd2f2560437ff4a48cfa12cbe2d4cfd5a4cdc
MD5 ca7b354f62c4b7314732a376e9502719
SHA1 588136020f3d74e26c08ce27298d83d8206ac527
SHA512 dd4e9337c9b2aa83cb680af9b83381dcd4341d789c2734b3344880d8c83edf9baf1a838123ccdc3e43a79d5309c3053cfc80d03f2a669044ab54fbb672b2bbbf
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

WdwRrWe.exe

Path C:\Windows\System\WdwRrWe.exe
Size 5.9MB
SHA256 f62b4281003c73e5134c66fd78a6390dbd4527f0d31dc9a7314c8f982678fc2d
MD5 88be9be0629587f620f85322cca2c31f
SHA1 45cda40c6a3382fbe666b35abdc0bd8e509a1ffa
SHA512 eea58cfee1a43a3924117a5b2b1af0b4348581de065d0d5c9366104b7012a3c772406368b08b99fda9ea2eb73da1b918ce9aebe2826a1d2e99c66a15a4575f20
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

aLZCyif.exe

Path C:\Windows\System\aLZCyif.exe
Size 5.9MB
SHA256 fdb7eee89511eec8d568dc439cfa215506e2c42e1803b28c3af7716bbdc797b1
MD5 e1c052df0c82b53da6163403a6c24508
SHA1 88de123de56935f1f854f3e0c2d5b0648525fdc4
SHA512 f9ceeb7686af57c252f6a69dc7bee5652b5fc19dceb803a44b0b1fbcc7e151abaf07e41a078b9c4f09708ccf748923f19a6bfe6496727efd16aa8c7a33d6fa1e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

bxgrHuR.exe

Path C:\Windows\System\bxgrHuR.exe
Size 5.9MB
SHA256 68360e1af37e0eb097eb625fbd05772f28fc019e6e38f7e0c5f6900509c8fd91
MD5 a80795b0e3c0f2bee58935a3b3b3dfa9
SHA1 2792796d6a9bedd5fb8395f620e7aba5b02c4593
SHA512 5f8ffb7c29ea476677c7c87ad0c2f1978b187c879f43ddcb55b1719e81f18544c66194389c1730c32de6ccab8da3ce712606ab9f13fecf92640baea70727e7e3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

dWyCwIb.exe

Path C:\Windows\System\dWyCwIb.exe
Size 5.9MB
SHA256 e26d5ed9339fc05ef750bb443ed3b59b4951edce3358b5d10f163a7f1a4e870b
MD5 69db244155891eae3a8c4a9fb231b41d
SHA1 44f05b2f8248df3b1377aadc86c1b6c1aca44152
SHA512 765ddb3ec63b80f3125340ef3230a6f62b387d434221268a1807c6f5b5b6b98acad56a288d05d2b9bc30a66320122eb6568d35eb943949ccd9b4a588befe2d95
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

ecRnTHM.exe

Path C:\Windows\System\ecRnTHM.exe
Size 5.9MB
SHA256 14f921be09f34f44fdf1977ae7bcf64d396761c9bbfd24ad1f3d498971663a11
MD5 6fa19953c35fc1caa70c16230de5a869
SHA1 f382e603f01647af67717677ed1eaf0d9360f0d2
SHA512 a6c2382fae60428c8f9454e348b612411c5665fafea39a45f662c06480b9f5e81cdc4ab85f0beb2f7156b5b55073450f943cbbf935f21094a80bef8376b14dc6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

gNOUfZX.exe

Path C:\Windows\System\gNOUfZX.exe
Size 5.9MB
SHA256 89dc8f1e6de91777fc7ce378bf98a5071dc99fd752ffc25777e6d2ac77a01a27
MD5 9175f32b75bfadf17f4ef8782bf20b76
SHA1 dd2eb50da44740702b7cd5797671399d36c720ed
SHA512 472441e59a0b3f754af8b0b9cfa36bc8d4025834d0b1295b2427a2831c59d609660d0d4eb67f38732a077df09f3e64e5f815c93bb6fe75ce621e5467bf97b90f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

kuZyvOr.exe

Path C:\Windows\System\kuZyvOr.exe
Size 5.9MB
SHA256 0c9d7fe85b6483195ad4cbd5ce96203d1ab6763cffe0d49b5efd798c7116d6ec
MD5 f9bf2395d0fb6c94b7e504b0185ecff4
SHA1 efda293518462fa3d722d8486e86bbc724274d90
SHA512 504e2905cebb1f54b08c9a8899960f638fe2967d2537914741214f4f20beaeba95de0e04622cb0f96563434d63d28f025ba90579eebd865a32b771016a3f7f79
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

ljbRdwy.exe

Path C:\Windows\System\ljbRdwy.exe
Size 5.9MB
SHA256 e5063d5aaae9ce121b4a6387a1fea0231481a9898cbf5d90702e4f7cdc1be9d5
MD5 1e08b02f298228085b2091085ce9f138
SHA1 6f73cb66cf5506ceea142c6161f07d765312bda5
SHA512 09addb96049c76f8e2090f52551c7cced1859a77d71694f39e244c52ace48f3a8428da1d95cb7d69b9afcb0877c9bea7356c22ef9b76e0c6ccc58174ab1a4a14
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

mgPaxVT.exe

Path C:\Windows\System\mgPaxVT.exe
Size 5.9MB
SHA256 06bfc6449a8d770651a423acbb64d34b1e05e18d3212e64049fcdb2e7cf82696
MD5 22f45f427a67871fd54c647910ee7f36
SHA1 556303de47dcc90e76761a34291d48f89b688142
SHA512 c9d87daa1915489b2f7c4da350466a0b3ec72c47582f67d505739079874ff2fdf5f3c48ad1f51e626e49746b266371371476f93ca9764ce62aa263a861040e0e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

oyhWOnT.exe

Path C:\Windows\System\oyhWOnT.exe
Size 5.9MB
SHA256 95f27b086c7ac1695b8950cbb419389340435e880e6b0ba828c6f161ef7146d1
MD5 919503af7b485d42ee6fb13a5d4f3d00
SHA1 ae5e984255bf6b5165ea70a512b1454fcf8a52fa
SHA512 30f42da47f412fa891985899912db8f7541f0a0382e8b131eb048a92c97819631c7e2782a21f006b538124667839c3cf7882792c425787639c04dd32e157352c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:Q+856utgpPF8u/7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

ppVXmPy.exe

Path C:\Windows\System\ppVXmPy.exe
Size 5.9MB
SHA256 4a0ce9e55bcacbd27d74e104d7b2ccd6d917a5e0d829519a2b20b912ebd22591
MD5 b77be837021ea9f6b4b0739a01215886
SHA1 22b5dab7a668bbcb99021b8a1e0aea24dc2b43bd
SHA512 5a6769aaf63bde77f71c6e3c5575e51ed1a92edee1871955e892fe4542d2bd7a4cfd80cc926318b5f0b92d3d1beba9db7eca8f97a72a9929ea8dd080cf256405
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

qFnVYNZ.exe

Path C:\Windows\System\qFnVYNZ.exe
Size 5.9MB
SHA256 08e0992efde51e070492e7131be85fd93cd40a8a50a607aad128eb200411469e
MD5 9889017e76e2fdc93ddfd470e24ed822
SHA1 64deacd779bf613f88f0a1bd230fa933cbdf23b2
SHA512 04c9942551580a4bbff3a6019fb3522594bb8235de3e5eef14268b41829e079a5b31cd25682d2f3f5145a09e564222fa3c5dc7b5d31e022df339cd509e6bab58
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

vboWUFg.exe

Path C:\Windows\System\vboWUFg.exe
Size 5.9MB
SHA256 5acbced9d74eb3d476e2ca91a6c5d86cbc85952a6c790e4a9c0ae8b50d30897a
MD5 a03de499bb062f609acfc372f516cf49
SHA1 6791cfae823a3216602f306dcc9a32ea7ea78dea
SHA512 279e4891cd1caaf0f400da766ba9e3daafc820de58d89647e4ed4d69564d240472f6e88bfcdef1b6ccc81b29189914f38b7e583b2a20467409bb35eab664e8f3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

wKjkomp.exe

Path C:\Windows\System\wKjkomp.exe
Size 5.9MB
SHA256 8f59f23f10cdf5c974a94ee4b1c9fe6d35f3c8f8db63f6a3c880e057a901551d
MD5 279d1dfe68ebf09327ccaf49d4bd12fc
SHA1 8772faa250544f1b7025228699213542ccf9fd74
SHA512 9232d2b5cce7db35ae74b25fc36f13836843175e305d5063ecac046f0c43d1ab8535523c82e7e601fe35434e039e5d618287c0aaa4082117dd1c1f2aa8326d12
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/452-146-0x00007FF7A2350000-0x00007FF7A26A4000-memory.dmp

Download

memory/452-32-0x00007FF7A2350000-0x00007FF7A26A4000-memory.dmp

Download

memory/692-63-0x00007FF68F4E0000-0x00007FF68F834000-memory.dmp

Download

memory/692-151-0x00007FF68F4E0000-0x00007FF68F834000-memory.dmp

Download

memory/1072-97-0x00007FF668ED0000-0x00007FF669224000-memory.dmp

Download

memory/1072-137-0x00007FF668ED0000-0x00007FF669224000-memory.dmp

Download

memory/1072-157-0x00007FF668ED0000-0x00007FF669224000-memory.dmp

Download

memory/1340-144-0x00007FF6C2CC0000-0x00007FF6C3014000-memory.dmp

Download

memory/1340-26-0x00007FF6C2CC0000-0x00007FF6C3014000-memory.dmp

Download

memory/2036-127-0x00007FF7574D0000-0x00007FF757824000-memory.dmp

Download

memory/2036-56-0x00007FF7574D0000-0x00007FF757824000-memory.dmp

Download

memory/2036-150-0x00007FF7574D0000-0x00007FF757824000-memory.dmp

Download

memory/2368-138-0x00007FF6BA250000-0x00007FF6BA5A4000-memory.dmp

Download

memory/2368-156-0x00007FF6BA250000-0x00007FF6BA5A4000-memory.dmp

Download

memory/2368-102-0x00007FF6BA250000-0x00007FF6BA5A4000-memory.dmp

Download

memory/2480-149-0x00007FF7F8040000-0x00007FF7F8394000-memory.dmp

Download

memory/2480-50-0x00007FF7F8040000-0x00007FF7F8394000-memory.dmp

Download

memory/2828-140-0x00007FF7681C0000-0x00007FF768514000-memory.dmp

Download

memory/2828-122-0x00007FF7681C0000-0x00007FF768514000-memory.dmp

Download

memory/2828-160-0x00007FF7681C0000-0x00007FF768514000-memory.dmp

Download

memory/2924-162-0x00007FF6AF630000-0x00007FF6AF984000-memory.dmp

Download

memory/2924-134-0x00007FF6AF630000-0x00007FF6AF984000-memory.dmp

Download

memory/2996-73-0x00007FF67A570000-0x00007FF67A8C4000-memory.dmp

Download

memory/2996-16-0x00007FF67A570000-0x00007FF67A8C4000-memory.dmp

Download

memory/2996-142-0x00007FF67A570000-0x00007FF67A8C4000-memory.dmp

Download

memory/3216-145-0x00007FF66D0A0000-0x00007FF66D3F4000-memory.dmp

Download

memory/3216-83-0x00007FF66D0A0000-0x00007FF66D3F4000-memory.dmp

Download

memory/3216-20-0x00007FF66D0A0000-0x00007FF66D3F4000-memory.dmp

Download

memory/3756-141-0x00007FF6ECCF0000-0x00007FF6ED044000-memory.dmp

Download

memory/3756-161-0x00007FF6ECCF0000-0x00007FF6ED044000-memory.dmp

Download

memory/3756-126-0x00007FF6ECCF0000-0x00007FF6ED044000-memory.dmp

Download

memory/3772-136-0x00007FF7C20B0000-0x00007FF7C2404000-memory.dmp

Download

memory/3772-88-0x00007FF7C20B0000-0x00007FF7C2404000-memory.dmp

Download

memory/3772-155-0x00007FF7C20B0000-0x00007FF7C2404000-memory.dmp

Download

memory/4144-36-0x00007FF78EFC0000-0x00007FF78F314000-memory.dmp

Download

memory/4144-147-0x00007FF78EFC0000-0x00007FF78F314000-memory.dmp

Download

memory/4144-101-0x00007FF78EFC0000-0x00007FF78F314000-memory.dmp

Download

memory/4244-139-0x00007FF7387C0000-0x00007FF738B14000-memory.dmp

Download

memory/4244-116-0x00007FF7387C0000-0x00007FF738B14000-memory.dmp

Download

memory/4244-158-0x00007FF7387C0000-0x00007FF738B14000-memory.dmp

Download

memory/4256-1-0x000001A1F3720000-0x000001A1F3730000-memory.dmp

Download

memory/4256-62-0x00007FF7DCC40000-0x00007FF7DCF94000-memory.dmp

Download

memory/4256-0-0x00007FF7DCC40000-0x00007FF7DCF94000-memory.dmp

Download

memory/4344-152-0x00007FF70D300000-0x00007FF70D654000-memory.dmp

Download

memory/4344-72-0x00007FF70D300000-0x00007FF70D654000-memory.dmp

Download

memory/4732-6-0x00007FF688D10000-0x00007FF689064000-memory.dmp

Download

memory/4732-143-0x00007FF688D10000-0x00007FF689064000-memory.dmp

Download

memory/4732-69-0x00007FF688D10000-0x00007FF689064000-memory.dmp

Download

memory/4748-84-0x00007FF7D9EF0000-0x00007FF7DA244000-memory.dmp

Download

memory/4748-154-0x00007FF7D9EF0000-0x00007FF7DA244000-memory.dmp

Download

memory/4780-148-0x00007FF6116D0000-0x00007FF611A24000-memory.dmp

Download

memory/4780-42-0x00007FF6116D0000-0x00007FF611A24000-memory.dmp

Download

memory/4780-111-0x00007FF6116D0000-0x00007FF611A24000-memory.dmp

Download

memory/4960-153-0x00007FF7A0E40000-0x00007FF7A1194000-memory.dmp

Download

memory/4960-135-0x00007FF7A0E40000-0x00007FF7A1194000-memory.dmp

Download

memory/4960-74-0x00007FF7A0E40000-0x00007FF7A1194000-memory.dmp

Download

memory/5016-159-0x00007FF71C610000-0x00007FF71C964000-memory.dmp

Download

memory/5016-125-0x00007FF71C610000-0x00007FF71C964000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads