cobaltstrike | 47194c9029827ba0ec2197a81b8014ffbd0f6d73782e1c36ba9cc5ce64ef38ab

Analysis

max time kernel
135s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240531-tkdv1ade3z
SHA256 47194c9029827ba0ec2197a81b8014ffbd0f6d73782e1c36ba9cc5ce64ef38ab
MD5 3ce7f71fd9527fedd288c668e9eeb6e7
SHA1 060aef7eeb29be33ebecc24b44e3d5ec41e36226
SHA512 9064a52fd33d1960c9cd0d4eec2bcf8838bd18011ff702eaad217dbd5f40a2a2515dd9b8c381fe1f59fef31097e871356c86a2e61d9f8627c26f5508a49b1623
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 17 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000700000002327d-4.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f5-16.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f6-24.dat	cobalt_reflective_dll
behavioral2/files/0x000b000000023362-53.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fa-48.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f8-36.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f7-29.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fb-59.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fc-67.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000233f1-74.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ff-95.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fe-86.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fd-83.dat	cobalt_reflective_dll
behavioral2/files/0x00090000000006cf-106.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023401-124.dat	cobalt_reflective_dll
behavioral2/files/0x000b0000000226ef-111.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023400-99.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 17 IoCs

resource	yara_rule
behavioral2/files/0x000700000002327d-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f5-16.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f6-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b000000023362-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fa-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f8-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f7-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fb-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fc-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00080000000233f1-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ff-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fe-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fd-83.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00090000000006cf-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023401-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b0000000226ef-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023400-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/files/0x000700000002327d-4.dat	UPX
behavioral2/files/0x000700000002327d-6.dat	UPX
behavioral2/files/0x00070000000233f4-12.dat	UPX
behavioral2/memory/2244-14-0x00007FF6E1100000-0x00007FF6E1454000-memory.dmp	UPX
behavioral2/files/0x00070000000233f5-16.dat	UPX
behavioral2/files/0x00070000000233f6-24.dat	UPX
behavioral2/memory/4648-26-0x00007FF6F4850000-0x00007FF6F4BA4000-memory.dmp	UPX
behavioral2/memory/3200-32-0x00007FF642D50000-0x00007FF6430A4000-memory.dmp	UPX
behavioral2/files/0x00070000000233f9-40.dat	UPX
behavioral2/files/0x00070000000233f9-41.dat	UPX
behavioral2/memory/1604-38-0x00007FF700DA0000-0x00007FF7010F4000-memory.dmp	UPX
behavioral2/memory/4364-44-0x00007FF604B90000-0x00007FF604EE4000-memory.dmp	UPX
behavioral2/memory/4120-50-0x00007FF7BD400000-0x00007FF7BD754000-memory.dmp	UPX
behavioral2/memory/2212-56-0x00007FF716EE0000-0x00007FF717234000-memory.dmp	UPX
behavioral2/files/0x000b000000023362-53.dat	UPX
behavioral2/files/0x00070000000233fa-48.dat	UPX
behavioral2/files/0x00070000000233f8-36.dat	UPX
behavioral2/files/0x00070000000233f7-29.dat	UPX
behavioral2/files/0x00070000000233fb-59.dat	UPX
behavioral2/files/0x00070000000233fc-67.dat	UPX
behavioral2/files/0x00080000000233f1-74.dat	UPX
behavioral2/memory/3944-81-0x00007FF717E80000-0x00007FF7181D4000-memory.dmp	UPX
behavioral2/memory/3644-90-0x00007FF60C000000-0x00007FF60C354000-memory.dmp	UPX
behavioral2/memory/1512-93-0x00007FF601420000-0x00007FF601774000-memory.dmp	UPX
behavioral2/files/0x00070000000233ff-95.dat	UPX
behavioral2/files/0x00070000000233ff-92.dat	UPX
behavioral2/files/0x00070000000233fe-87.dat	UPX
behavioral2/files/0x00070000000233fe-86.dat	UPX
behavioral2/files/0x00070000000233fd-83.dat	UPX
behavioral2/memory/4484-82-0x00007FF60A250000-0x00007FF60A5A4000-memory.dmp	UPX
behavioral2/memory/4396-77-0x00007FF6B7F80000-0x00007FF6B82D4000-memory.dmp	UPX
behavioral2/memory/2244-76-0x00007FF6E1100000-0x00007FF6E1454000-memory.dmp	UPX
behavioral2/memory/5112-72-0x00007FF7C8C20000-0x00007FF7C8F74000-memory.dmp	UPX
behavioral2/memory/2632-69-0x00007FF7A4460000-0x00007FF7A47B4000-memory.dmp	UPX
behavioral2/memory/1688-61-0x00007FF630560000-0x00007FF6308B4000-memory.dmp	UPX
behavioral2/memory/1800-60-0x00007FF6D5AB0000-0x00007FF6D5E04000-memory.dmp	UPX
behavioral2/files/0x0007000000023400-100.dat	UPX
behavioral2/files/0x00090000000006cf-106.dat	UPX
behavioral2/memory/4248-120-0x00007FF764830000-0x00007FF764B84000-memory.dmp	UPX
behavioral2/files/0x0007000000023401-124.dat	UPX
behavioral2/memory/988-116-0x00007FF683310000-0x00007FF683664000-memory.dmp	UPX
behavioral2/files/0x000b0000000226ef-111.dat	UPX
behavioral2/memory/740-109-0x00007FF6144A0000-0x00007FF6147F4000-memory.dmp	UPX
behavioral2/memory/2248-102-0x00007FF631830000-0x00007FF631B84000-memory.dmp	UPX
behavioral2/memory/608-127-0x00007FF7794F0000-0x00007FF779844000-memory.dmp	UPX
behavioral2/memory/408-132-0x00007FF64DAA0000-0x00007FF64DDF4000-memory.dmp	UPX
behavioral2/files/0x0007000000023403-129.dat	UPX
behavioral2/memory/1688-126-0x00007FF630560000-0x00007FF6308B4000-memory.dmp	UPX
behavioral2/files/0x0007000000023400-99.dat	UPX
behavioral2/files/0x00070000000233f6-23.dat	UPX
behavioral2/memory/3944-20-0x00007FF717E80000-0x00007FF7181D4000-memory.dmp	UPX
behavioral2/files/0x00070000000233f4-11.dat	UPX
behavioral2/memory/2632-8-0x00007FF7A4460000-0x00007FF7A47B4000-memory.dmp	UPX
behavioral2/memory/1800-0-0x00007FF6D5AB0000-0x00007FF6D5E04000-memory.dmp	UPX
behavioral2/memory/4484-133-0x00007FF60A250000-0x00007FF60A5A4000-memory.dmp	UPX
behavioral2/memory/1512-134-0x00007FF601420000-0x00007FF601774000-memory.dmp	UPX
behavioral2/memory/2632-135-0x00007FF7A4460000-0x00007FF7A47B4000-memory.dmp	UPX
behavioral2/memory/2244-136-0x00007FF6E1100000-0x00007FF6E1454000-memory.dmp	UPX
behavioral2/memory/3944-137-0x00007FF717E80000-0x00007FF7181D4000-memory.dmp	UPX
behavioral2/memory/4648-138-0x00007FF6F4850000-0x00007FF6F4BA4000-memory.dmp	UPX
behavioral2/memory/3200-139-0x00007FF642D50000-0x00007FF6430A4000-memory.dmp	UPX
behavioral2/memory/1604-140-0x00007FF700DA0000-0x00007FF7010F4000-memory.dmp	UPX
behavioral2/memory/4364-141-0x00007FF604B90000-0x00007FF604EE4000-memory.dmp	UPX
behavioral2/memory/4120-142-0x00007FF7BD400000-0x00007FF7BD754000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/files/0x000700000002327d-4.dat	xmrig
behavioral2/files/0x000700000002327d-6.dat	xmrig
behavioral2/files/0x00070000000233f4-12.dat	xmrig
behavioral2/memory/2244-14-0x00007FF6E1100000-0x00007FF6E1454000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f5-16.dat	xmrig
behavioral2/files/0x00070000000233f6-24.dat	xmrig
behavioral2/memory/4648-26-0x00007FF6F4850000-0x00007FF6F4BA4000-memory.dmp	xmrig
behavioral2/memory/3200-32-0x00007FF642D50000-0x00007FF6430A4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f9-40.dat	xmrig
behavioral2/files/0x00070000000233f9-41.dat	xmrig
behavioral2/memory/1604-38-0x00007FF700DA0000-0x00007FF7010F4000-memory.dmp	xmrig
behavioral2/memory/4364-44-0x00007FF604B90000-0x00007FF604EE4000-memory.dmp	xmrig
behavioral2/memory/4120-50-0x00007FF7BD400000-0x00007FF7BD754000-memory.dmp	xmrig
behavioral2/memory/2212-56-0x00007FF716EE0000-0x00007FF717234000-memory.dmp	xmrig
behavioral2/files/0x000b000000023362-53.dat	xmrig
behavioral2/files/0x00070000000233fa-48.dat	xmrig
behavioral2/files/0x00070000000233f8-36.dat	xmrig
behavioral2/files/0x00070000000233f7-29.dat	xmrig
behavioral2/files/0x00070000000233fb-59.dat	xmrig
behavioral2/files/0x00070000000233fc-67.dat	xmrig
behavioral2/files/0x00080000000233f1-74.dat	xmrig
behavioral2/memory/3944-81-0x00007FF717E80000-0x00007FF7181D4000-memory.dmp	xmrig
behavioral2/memory/3644-90-0x00007FF60C000000-0x00007FF60C354000-memory.dmp	xmrig
behavioral2/memory/1512-93-0x00007FF601420000-0x00007FF601774000-memory.dmp	xmrig
behavioral2/files/0x00070000000233ff-95.dat	xmrig
behavioral2/files/0x00070000000233ff-92.dat	xmrig
behavioral2/files/0x00070000000233fe-87.dat	xmrig
behavioral2/files/0x00070000000233fe-86.dat	xmrig
behavioral2/files/0x00070000000233fd-83.dat	xmrig
behavioral2/memory/4484-82-0x00007FF60A250000-0x00007FF60A5A4000-memory.dmp	xmrig
behavioral2/memory/4396-77-0x00007FF6B7F80000-0x00007FF6B82D4000-memory.dmp	xmrig
behavioral2/memory/2244-76-0x00007FF6E1100000-0x00007FF6E1454000-memory.dmp	xmrig
behavioral2/memory/5112-72-0x00007FF7C8C20000-0x00007FF7C8F74000-memory.dmp	xmrig
behavioral2/memory/2632-69-0x00007FF7A4460000-0x00007FF7A47B4000-memory.dmp	xmrig
behavioral2/memory/1688-61-0x00007FF630560000-0x00007FF6308B4000-memory.dmp	xmrig
behavioral2/memory/1800-60-0x00007FF6D5AB0000-0x00007FF6D5E04000-memory.dmp	xmrig
behavioral2/files/0x0007000000023400-100.dat	xmrig
behavioral2/files/0x00090000000006cf-106.dat	xmrig
behavioral2/memory/4248-120-0x00007FF764830000-0x00007FF764B84000-memory.dmp	xmrig
behavioral2/files/0x0007000000023401-124.dat	xmrig
behavioral2/memory/988-116-0x00007FF683310000-0x00007FF683664000-memory.dmp	xmrig
behavioral2/files/0x000b0000000226ef-111.dat	xmrig
behavioral2/memory/740-109-0x00007FF6144A0000-0x00007FF6147F4000-memory.dmp	xmrig
behavioral2/memory/2248-102-0x00007FF631830000-0x00007FF631B84000-memory.dmp	xmrig
behavioral2/memory/608-127-0x00007FF7794F0000-0x00007FF779844000-memory.dmp	xmrig
behavioral2/memory/408-132-0x00007FF64DAA0000-0x00007FF64DDF4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023403-129.dat	xmrig
behavioral2/memory/1688-126-0x00007FF630560000-0x00007FF6308B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023400-99.dat	xmrig
behavioral2/files/0x00070000000233f6-23.dat	xmrig
behavioral2/memory/3944-20-0x00007FF717E80000-0x00007FF7181D4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f4-11.dat	xmrig
behavioral2/memory/2632-8-0x00007FF7A4460000-0x00007FF7A47B4000-memory.dmp	xmrig
behavioral2/memory/1800-0-0x00007FF6D5AB0000-0x00007FF6D5E04000-memory.dmp	xmrig
behavioral2/memory/4484-133-0x00007FF60A250000-0x00007FF60A5A4000-memory.dmp	xmrig
behavioral2/memory/1512-134-0x00007FF601420000-0x00007FF601774000-memory.dmp	xmrig
behavioral2/memory/2632-135-0x00007FF7A4460000-0x00007FF7A47B4000-memory.dmp	xmrig
behavioral2/memory/2244-136-0x00007FF6E1100000-0x00007FF6E1454000-memory.dmp	xmrig
behavioral2/memory/3944-137-0x00007FF717E80000-0x00007FF7181D4000-memory.dmp	xmrig
behavioral2/memory/4648-138-0x00007FF6F4850000-0x00007FF6F4BA4000-memory.dmp	xmrig
behavioral2/memory/3200-139-0x00007FF642D50000-0x00007FF6430A4000-memory.dmp	xmrig
behavioral2/memory/1604-140-0x00007FF700DA0000-0x00007FF7010F4000-memory.dmp	xmrig
behavioral2/memory/4364-141-0x00007FF604B90000-0x00007FF604EE4000-memory.dmp	xmrig
behavioral2/memory/4120-142-0x00007FF7BD400000-0x00007FF7BD754000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2632	SPQAOiK.exe
2244	iDzFmZe.exe
3944	vtzvweY.exe
4648	LrYCfoD.exe
3200	zAAocxY.exe
1604	gINEUPQ.exe
4364	TXztKbd.exe
4120	ZDTqsYD.exe
2212	pngDhqX.exe
1688	oNdooDK.exe
5112	EfVJrfA.exe
4396	tycRPOm.exe
4484	rVilIbR.exe
3644	ZqItasN.exe
1512	qQAIfNa.exe
2248	keiWRhE.exe
740	hqaThoK.exe
988	agNMUSl.exe
4248	FZbyAzY.exe
608	QZGVSFx.exe
408	chaJuZg.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002327d-4.dat	upx
behavioral2/files/0x000700000002327d-6.dat	upx
behavioral2/files/0x00070000000233f4-12.dat	upx
behavioral2/memory/2244-14-0x00007FF6E1100000-0x00007FF6E1454000-memory.dmp	upx
behavioral2/files/0x00070000000233f5-16.dat	upx
behavioral2/files/0x00070000000233f6-24.dat	upx
behavioral2/memory/4648-26-0x00007FF6F4850000-0x00007FF6F4BA4000-memory.dmp	upx
behavioral2/memory/3200-32-0x00007FF642D50000-0x00007FF6430A4000-memory.dmp	upx
behavioral2/files/0x00070000000233f9-40.dat	upx
behavioral2/files/0x00070000000233f9-41.dat	upx
behavioral2/memory/1604-38-0x00007FF700DA0000-0x00007FF7010F4000-memory.dmp	upx
behavioral2/memory/4364-44-0x00007FF604B90000-0x00007FF604EE4000-memory.dmp	upx
behavioral2/memory/4120-50-0x00007FF7BD400000-0x00007FF7BD754000-memory.dmp	upx
behavioral2/memory/2212-56-0x00007FF716EE0000-0x00007FF717234000-memory.dmp	upx
behavioral2/files/0x000b000000023362-53.dat	upx
behavioral2/files/0x00070000000233fa-48.dat	upx
behavioral2/files/0x00070000000233f8-36.dat	upx
behavioral2/files/0x00070000000233f7-29.dat	upx
behavioral2/files/0x00070000000233fb-59.dat	upx
behavioral2/files/0x00070000000233fc-67.dat	upx
behavioral2/files/0x00080000000233f1-74.dat	upx
behavioral2/memory/3944-81-0x00007FF717E80000-0x00007FF7181D4000-memory.dmp	upx
behavioral2/memory/3644-90-0x00007FF60C000000-0x00007FF60C354000-memory.dmp	upx
behavioral2/memory/1512-93-0x00007FF601420000-0x00007FF601774000-memory.dmp	upx
behavioral2/files/0x00070000000233ff-95.dat	upx
behavioral2/files/0x00070000000233ff-92.dat	upx
behavioral2/files/0x00070000000233fe-87.dat	upx
behavioral2/files/0x00070000000233fe-86.dat	upx
behavioral2/files/0x00070000000233fd-83.dat	upx
behavioral2/memory/4484-82-0x00007FF60A250000-0x00007FF60A5A4000-memory.dmp	upx
behavioral2/memory/4396-77-0x00007FF6B7F80000-0x00007FF6B82D4000-memory.dmp	upx
behavioral2/memory/2244-76-0x00007FF6E1100000-0x00007FF6E1454000-memory.dmp	upx
behavioral2/memory/5112-72-0x00007FF7C8C20000-0x00007FF7C8F74000-memory.dmp	upx
behavioral2/memory/2632-69-0x00007FF7A4460000-0x00007FF7A47B4000-memory.dmp	upx
behavioral2/memory/1688-61-0x00007FF630560000-0x00007FF6308B4000-memory.dmp	upx
behavioral2/memory/1800-60-0x00007FF6D5AB0000-0x00007FF6D5E04000-memory.dmp	upx
behavioral2/files/0x0007000000023400-100.dat	upx
behavioral2/files/0x00090000000006cf-106.dat	upx
behavioral2/memory/4248-120-0x00007FF764830000-0x00007FF764B84000-memory.dmp	upx
behavioral2/files/0x0007000000023401-124.dat	upx
behavioral2/memory/988-116-0x00007FF683310000-0x00007FF683664000-memory.dmp	upx
behavioral2/files/0x000b0000000226ef-111.dat	upx
behavioral2/memory/740-109-0x00007FF6144A0000-0x00007FF6147F4000-memory.dmp	upx
behavioral2/memory/2248-102-0x00007FF631830000-0x00007FF631B84000-memory.dmp	upx
behavioral2/memory/608-127-0x00007FF7794F0000-0x00007FF779844000-memory.dmp	upx
behavioral2/memory/408-132-0x00007FF64DAA0000-0x00007FF64DDF4000-memory.dmp	upx
behavioral2/files/0x0007000000023403-129.dat	upx
behavioral2/memory/1688-126-0x00007FF630560000-0x00007FF6308B4000-memory.dmp	upx
behavioral2/files/0x0007000000023400-99.dat	upx
behavioral2/files/0x00070000000233f6-23.dat	upx
behavioral2/memory/3944-20-0x00007FF717E80000-0x00007FF7181D4000-memory.dmp	upx
behavioral2/files/0x00070000000233f4-11.dat	upx
behavioral2/memory/2632-8-0x00007FF7A4460000-0x00007FF7A47B4000-memory.dmp	upx
behavioral2/memory/1800-0-0x00007FF6D5AB0000-0x00007FF6D5E04000-memory.dmp	upx
behavioral2/memory/4484-133-0x00007FF60A250000-0x00007FF60A5A4000-memory.dmp	upx
behavioral2/memory/1512-134-0x00007FF601420000-0x00007FF601774000-memory.dmp	upx
behavioral2/memory/2632-135-0x00007FF7A4460000-0x00007FF7A47B4000-memory.dmp	upx
behavioral2/memory/2244-136-0x00007FF6E1100000-0x00007FF6E1454000-memory.dmp	upx
behavioral2/memory/3944-137-0x00007FF717E80000-0x00007FF7181D4000-memory.dmp	upx
behavioral2/memory/4648-138-0x00007FF6F4850000-0x00007FF6F4BA4000-memory.dmp	upx
behavioral2/memory/3200-139-0x00007FF642D50000-0x00007FF6430A4000-memory.dmp	upx
behavioral2/memory/1604-140-0x00007FF700DA0000-0x00007FF7010F4000-memory.dmp	upx
behavioral2/memory/4364-141-0x00007FF604B90000-0x00007FF604EE4000-memory.dmp	upx
behavioral2/memory/4120-142-0x00007FF7BD400000-0x00007FF7BD754000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\iDzFmZe.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LrYCfoD.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zAAocxY.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZDTqsYD.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EfVJrfA.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZqItasN.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qQAIfNa.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gINEUPQ.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pngDhqX.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oNdooDK.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tycRPOm.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\keiWRhE.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hqaThoK.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FZbyAzY.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\chaJuZg.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TXztKbd.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\agNMUSl.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SPQAOiK.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vtzvweY.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rVilIbR.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QZGVSFx.exe	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2632	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	83
PID 1800 wrote to memory of 2632	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	83
PID 1800 wrote to memory of 2244	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	85
PID 1800 wrote to memory of 2244	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	85
PID 1800 wrote to memory of 3944	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	87
PID 1800 wrote to memory of 3944	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	87
PID 1800 wrote to memory of 4648	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	88
PID 1800 wrote to memory of 4648	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	88
PID 1800 wrote to memory of 3200	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	90
PID 1800 wrote to memory of 3200	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	90
PID 1800 wrote to memory of 1604	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	91
PID 1800 wrote to memory of 1604	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	91
PID 1800 wrote to memory of 4364	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	92
PID 1800 wrote to memory of 4364	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	92
PID 1800 wrote to memory of 4120	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	93
PID 1800 wrote to memory of 4120	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	93
PID 1800 wrote to memory of 2212	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	94
PID 1800 wrote to memory of 2212	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	94
PID 1800 wrote to memory of 1688	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	95
PID 1800 wrote to memory of 1688	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	95
PID 1800 wrote to memory of 5112	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	96
PID 1800 wrote to memory of 5112	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	96
PID 1800 wrote to memory of 4396	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	97
PID 1800 wrote to memory of 4396	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	97
PID 1800 wrote to memory of 4484	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	98
PID 1800 wrote to memory of 4484	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	98
PID 1800 wrote to memory of 3644	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	99
PID 1800 wrote to memory of 3644	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	99
PID 1800 wrote to memory of 1512	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	100
PID 1800 wrote to memory of 1512	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	100
PID 1800 wrote to memory of 2248	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	101
PID 1800 wrote to memory of 2248	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	101
PID 1800 wrote to memory of 740	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	102
PID 1800 wrote to memory of 740	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	102
PID 1800 wrote to memory of 988	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	103
PID 1800 wrote to memory of 988	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	103
PID 1800 wrote to memory of 4248	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	104
PID 1800 wrote to memory of 4248	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	104
PID 1800 wrote to memory of 608	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	105
PID 1800 wrote to memory of 608	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	105
PID 1800 wrote to memory of 408	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	106
PID 1800 wrote to memory of 408	1800	2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe	106

C:\Users\Admin\AppData\Local\Temp\2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_3ce7f71fd9527fedd288c668e9eeb6e7_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\System\SPQAOiK.exe
  C:\Windows\System\SPQAOiK.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\iDzFmZe.exe
  C:\Windows\System\iDzFmZe.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\vtzvweY.exe
  C:\Windows\System\vtzvweY.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\LrYCfoD.exe
  C:\Windows\System\LrYCfoD.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\zAAocxY.exe
  C:\Windows\System\zAAocxY.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\gINEUPQ.exe
  C:\Windows\System\gINEUPQ.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\TXztKbd.exe
  C:\Windows\System\TXztKbd.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\ZDTqsYD.exe
  C:\Windows\System\ZDTqsYD.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\pngDhqX.exe
  C:\Windows\System\pngDhqX.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\oNdooDK.exe
  C:\Windows\System\oNdooDK.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\EfVJrfA.exe
  C:\Windows\System\EfVJrfA.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\tycRPOm.exe
  C:\Windows\System\tycRPOm.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\rVilIbR.exe
  C:\Windows\System\rVilIbR.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\ZqItasN.exe
  C:\Windows\System\ZqItasN.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\qQAIfNa.exe
  C:\Windows\System\qQAIfNa.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\keiWRhE.exe
  C:\Windows\System\keiWRhE.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\hqaThoK.exe
  C:\Windows\System\hqaThoK.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\agNMUSl.exe
  C:\Windows\System\agNMUSl.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\FZbyAzY.exe
  C:\Windows\System\FZbyAzY.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\QZGVSFx.exe
  C:\Windows\System\QZGVSFx.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\chaJuZg.exe
  C:\Windows\System\chaJuZg.exe
  2⤵
  - Executes dropped EXE
  PID:408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

EfVJrfA.exe

Path C:\Windows\System\EfVJrfA.exe
Size 5.9MB
SHA256 52008c88d3029763e2b84d781b5552f5bf7a362c30a4998d962c21814e6415c0
MD5 e192572e58a61677bc14ec24c7786ce1
SHA1 6d4d6b4430cdaf980c5f5badb98e3126febbe03a
SHA512 944b616c7492ce7cb78d046d99167e5f9be6b7f334014a40aa5a1bf7c7f1491dcab86c2bf6a1fb2a65dd59ec4ce81958226397ac6730ceb31ee4090d3d93ad42
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

LrYCfoD.exe

Path C:\Windows\System\LrYCfoD.exe
Size 2.0MB
SHA256 593e7bd118d819d8e39ef2651ab132601260307c705634ada0a2db317b292576
MD5 ce95ecfd82cad989d07f01bb5a4e0e62
SHA1 9c404e62c6a147d88e2c4214a4a0c1206972e9c1
SHA512 c2ff795a22229b7c15805b1e961a5dfe271dec3d9731c58be06511c88be95cff0caaac2a29a6db9c14604bb11c8d799f874a0f83a490e055a4995d26515db084
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIt56uL3pgrCEdMKPg:BemTLkNdfE0pZrt56utgpPg
MD5 SHA1 SHA512 SSDEEP

Submit Download

LrYCfoD.exe

Path C:\Windows\System\LrYCfoD.exe
Size 5.9MB
SHA256 609e3d74ebb06b1d3a51fb32fadfda44350eb495867875b8d9343f65fb47bd63
MD5 2162097a5bc6aadf9f5c9a9b7c87ea08
SHA1 0c6ec3f6264fad9947c01823ef500aa3dc33ac2e
SHA512 2da6f0a806c36250fc42d7ff00435d985bb64c106be24a252daf41fd442bddfe1ae299b82d0b452dd0da8fa5e85846819fb6b86f05a635b6390140f35f6c225d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

QZGVSFx.exe

Path C:\Windows\System\QZGVSFx.exe
Size 5.9MB
SHA256 12dee8e11ef9292c2a55b9b80e56981941051c84acc444571a15d01aec4de018
MD5 61d5bf0ecfb9507a04dbf4ae250334ae
SHA1 bb45ef013bd70ac8887296e4ad3bd3c6a104efd1
SHA512 8b643a6c9a55d896e60cd2de8a1822d470be3cb0504516e9d4428826ea6892c62b6df65d6cef2ea639eca5a3e5680eb189bc62552a382cbe5732b4d3214eb9a6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

SPQAOiK.exe

Path C:\Windows\System\SPQAOiK.exe
Size 5.9MB
SHA256 17ed271b079878ab07f056c08f704c0f56c190e4c6776f459e63dd922f28aa05
MD5 6ab597574e145e8020fb8cdcbba441b7
SHA1 6679db44a22d28488bb3c63b10bded263bacd2a6
SHA512 364331a651be54e751d60d33960596e3660098e164ffbf97b229252f5251fcef79dd698604f1e2976ce895666e6193e26656e436e2fa70c48d457f7e0fb59797
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

SPQAOiK.exe

Path C:\Windows\System\SPQAOiK.exe
Size 5.6MB
SHA256 ddb3f57945f3929208b2b32e9fb1bc992b84f62c9f6d825404b952bbb20eee72
MD5 38e1b7b0b9aa649f5c14f03127a6d132
SHA1 3917ca36707cd2c4dba6b6926d34a14a7bb117b1
SHA512 47f8cf2986d63387cdc2751aeb8271afa2f9ce56ab0a21337ea9677985ff041ab00a0daf7ea6b9731948111f864f618de503be2edb6c7c0b58599566140c22a0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32w:Q+856utgpPF8u/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

TXztKbd.exe

Path C:\Windows\System\TXztKbd.exe
Size 5.8MB
SHA256 0d4a824efda706db87b77805c320758f4772451fa0404efc091a4e3040c61068
MD5 984a8cf637fc9f46a5be1646493a183b
SHA1 eff3045fcb5d0b4a9321004fdd3e94f3f336f5af
SHA512 f10e98d33b97922d86b629662f92ca9b0747603db9cee26627e84885ca9797232c0f5349bf7b35b6812a24bc6e60bd825c6020365d2a762c823adc6158a78b7d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32l5:Q+856utgpPF8u/O
MD5 SHA1 SHA512 SSDEEP

Submit Download

TXztKbd.exe

Path C:\Windows\System\TXztKbd.exe
Size 5.4MB
SHA256 caa068826195e26df36f4f536e4c6574635de1b7a9a02c85ee8ca5d8d8224bf8
MD5 8003c8ca1c6255c4a9df50b61d369786
SHA1 ef521c59d5519424152618453d9a1ec413a267cf
SHA512 0384a1e885e5629a148689a8b4027e18c5b2d083fe94b00bac0956a112bba29ab292c390c9a09436cf2e74109a83853e787b70a1e1be9d9ef015a376f3eba795
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32I:Q+856utgpPF8u/h
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZDTqsYD.exe

Path C:\Windows\System\ZDTqsYD.exe
Size 5.9MB
SHA256 341134fbf4a58b7327a7b7dd5a22adb2a255b5b509a2415c691a1bf67132d49d
MD5 e7ce3955673e768ea5848b71e665933b
SHA1 04094fb84c696035ae7ceb0aaf6c1156c344799e
SHA512 66e2fdfeb8ae72fb67ffc8b835f04e47196e78cf56c83bdbf7bbde4d8bd91058ac40046bd6089a295d9dc91a4d2d52e39a7d16f06ae6aa7d66d50dc620410570
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZqItasN.exe

Path C:\Windows\System\ZqItasN.exe
Size 5.9MB
SHA256 48e56c990d58212acbb85a4834bd377374a1b22c4d5482b996ac20915374f235
MD5 673c43cfde286515f936e26529c312ae
SHA1 e0315de73852a34c2dbf3b2591af8fb0bebe2c72
SHA512 0a10698df9a268937675147b0ab6adb17e1d1c79258e8ca73b19c3402cebcd5aa264e15694f18b1e744bf0ba1e83f4f195b98f522b881d41248a96c1105e5f5d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:Q+856utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZqItasN.exe

Path C:\Windows\System\ZqItasN.exe
Size 3.6MB
SHA256 6f83751bb7dc13a49d7ca6c6a874635ca4829b15e2d7e8a8c8ddaf2890ac09c0
MD5 0628374c349921c969043e8b725a574d
SHA1 d4d4b61d7abb11c25e423140f9a833a035819e3d
SHA512 2db578fa7a962b14aae5c857e6974664cd647108bf44f83523c1fc47be8f0f23756b21e5f42a2231cc51d1daf9889177945ad8eab23827274ef49200ad4dd7a1
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIt56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA0:BemTLkNdfE0pZrt56utgpPFotBER/W
MD5 SHA1 SHA512 SSDEEP

Submit Download

agNMUSl.exe

Path C:\Windows\System\agNMUSl.exe
Size 5.9MB
SHA256 3e1ca6cab9b6cc7d39b963f53a43ae650a495a9d2dc97cc2ca1f01ea30a74449
MD5 4430612b58e59d44242dc2ab1b6e07b4
SHA1 760b014c7b3ff31490ade34a1db086f6e2a9ffc4
SHA512 3d123a0adea6ddedb2b64a5fc5d02e3bd771e92131d25ecb7566b48787104b3232ddb00bdad949f23f0ad80ebd5c244638f6c0c756ab400e260126eee90daec6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

chaJuZg.exe

Path C:\Windows\System\chaJuZg.exe
Size 5.3MB
SHA256 cea51cc96156d8e8255e2ccada29ae7300a3315f995e7ba6d44446f87dc9a09d
MD5 e8c4508a392ccf08590d3627a36cc3c3
SHA1 3a57dd6c92ebc54582acaafd15cc9311eb0d15a2
SHA512 f92387e78f5fe98543d9e60ae371868a188c86c9137b7d0a0d3bf28026dbd3fc59a4eb30687c1a9721f81959fcdee80d280162f492d355d2ec0e6a7c5d939410
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32S:Q+856utgpPF8u/X
MD5 SHA1 SHA512 SSDEEP

Submit Download

gINEUPQ.exe

Path C:\Windows\System\gINEUPQ.exe
Size 5.9MB
SHA256 5cbc3f1f436503fade0175febd9006dbaf671696794c39a7dd91c650dce87460
MD5 0a07a6fb7e7b40050bf6b8f50b465136
SHA1 b4c3b0d8a7d6e5fedd6ddf1be7658bb15488c5b2
SHA512 8808af0256e1dd51fb394d2c0f7b8da77054edaad043b9bd67942341b663f6c3799c752dab45cf0dfe235ee7199c25970bacf3ee6f6e3e232bad85e55c290314
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

hqaThoK.exe

Path C:\Windows\System\hqaThoK.exe
Size 5.9MB
SHA256 ba8176e937db0df06da8620a74ede3290eae9f301aab93893fc30f98b4b5381e
MD5 19f9f86e045840e163f2756d8a377688
SHA1 f75ffbe69bd6df608e979619b101c851de762f10
SHA512 564ac8bdd9a3321c035c550b1d4010d16f394b173206acfec0af76ba5a47d5c937ffb3b879ab500ead0252cee8d750ec9662ef60fab026f0158b8db61da99657
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

iDzFmZe.exe

Path C:\Windows\System\iDzFmZe.exe
Size 5.4MB
SHA256 b26b72ca0ef6d18aef032253470a78a13f48dcd486b2eb6e1570c96324293e82
MD5 6fb6863d9548f3879b1ba1b64fc45a68
SHA1 0dc40616de903c417cc9a8b581f9078af09ea60a
SHA512 cf09c13915872b96dcf1f62eac8174c1c1dfa4aabd64fb9272008df1f24e451a988f1edb48cb6ca8b7ef84d58508cf13cc3d0e709b84acf2687dd5617c6c3a61
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32c:Q+856utgpPF8u/p
MD5 SHA1 SHA512 SSDEEP

Submit Download

iDzFmZe.exe

Path C:\Windows\System\iDzFmZe.exe
Size 2.4MB
SHA256 8937d79446003663139b48fb488b397b86db6056b10f97b4b51376a75074f295
MD5 ffafad94c04d076c16e861ff07a4cb57
SHA1 c3501d64aef8c1b093200710a06e749c69db782a
SHA512 64f6a6b1b0b877c82172b2c14c03c94dd8e19ddfeb29793c31f8e0d87bb2bb2fc63432b7cfddd5451417062117de8a69817c2cc596bd537558b9b01636a48700
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIt56uL3pgrCEdMKPFots6:BemTLkNdfE0pZrt56utgpPFotn
MD5 SHA1 SHA512 SSDEEP

Submit Download

keiWRhE.exe

Path C:\Windows\System\keiWRhE.exe
Size 2.2MB
SHA256 2237948f07e37d90442b50a92836356588f3ae1e31ae0d8dac227315cf2c7f65
MD5 90be846177ebce09b1bfa8b40630684a
SHA1 43a2c66ff47d9e295f18f8c18fe76b69e8850154
SHA512 f4ff566c9eaa4a50bcad3cfa87bbb92d072dc2249f94ae304b8cb104e61cee98dba9f3ef0ceebfe48bef05c9c2df36d9188d043c7aa83ca58742993e634b68a6
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIt56uL3pgrCEdMKPFoH:BemTLkNdfE0pZrt56utgpPFoH
MD5 SHA1 SHA512 SSDEEP

Submit Download

keiWRhE.exe

Path C:\Windows\System\keiWRhE.exe
Size 5.9MB
SHA256 ae694c3d9eb45531b33d48c639e6baf5f1e479b5a6cedb9372cf3fef0b231f4b
MD5 09aac2ca94bf6fe3a18725c7e8217304
SHA1 849c1eaf83fbd882a07d35382d31e419aea271cb
SHA512 916eb00a47faafed3978b26ff4afa6f3aa40faa4e83917b88bb814544aa487929bf9907fe7cbb90d3ca6d106303d8ed051692fc08842901d0770b22ba1222cd5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

oNdooDK.exe

Path C:\Windows\System\oNdooDK.exe
Size 5.9MB
SHA256 c819c0894a15f0a68bebd11ec97b0f68a49ff89612ce95d1bc3451a7454d504e
MD5 22d6b554d9bb09dab9823eedcbe45139
SHA1 eaacadfaaebd537badb7864bac29319e0d40f025
SHA512 2218c070727440af1d6be19882ade05c14ba1ac761311d7d81189e7805c6e91f6495e020f511369834956e23c299cedb2c557d34b37b9596a7e329a08b0bd41d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

pngDhqX.exe

Path C:\Windows\System\pngDhqX.exe
Size 5.9MB
SHA256 fabcf1d46e9d58b6faaefeb195729bd790f4ae252af00012d5d6aa4a05617823
MD5 712d2c37426319b1ccc71272273185af
SHA1 d12bef574f4069e3ffba896b03f74cc3006faad7
SHA512 c6e330cd802c3cd5f1996a57b4467f449fd7d9ae7bd9d71198e9e4649adc957377689b4fc647dcaba88a2816ef9e3d4e99f7b7f9e98a7cb3d71819aaa7d21d28
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

qQAIfNa.exe

Path C:\Windows\System\qQAIfNa.exe
Size 5.9MB
SHA256 05dd3d926d8f7a6b3411e38a31ef4f8229eb7d780b830e3fca3bbab5124eef86
MD5 f6cdfb3d88537b367792cbd894bd98ed
SHA1 3d3f99c94c72c456dffcf949bc5d30603a7e936c
SHA512 0da483abd45f0fc31271e46184ea3a074b58fa3e0dc6bb0072318eee13b5c0ffc1280f1aa582bb4e78cf8a2c355408182d9725282b3a73e6e2dadc9f4f43faa3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

qQAIfNa.exe

Path C:\Windows\System\qQAIfNa.exe
Size 5.9MB
SHA256 c9705b5f07a7cc7ce0cce14e29110db4c8f9ac52a2628ad4428234510aa29a3e
MD5 cb5a36a514643c8073b4892a5273f26d
SHA1 7bfbf712290ce94b46366e07ecab279e07b2f424
SHA512 13fa78cde0791f0ed5b9785e5499da34bf0acaf789714b6e8d1816d83ffe8ec8a0d7af6537f03988d0f93de1f37201e5f16cf31f4180f0ee1bde0d13b53ad370
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

rVilIbR.exe

Path C:\Windows\System\rVilIbR.exe
Size 5.9MB
SHA256 9266d212f5433f4eb7d277dc89491569903bc89160328b9c647ba24917c7a4d5
MD5 046ec329e123e4857d69453abc322d0a
SHA1 3e1493b826f12682df9ebbcd11227d8725c0ce20
SHA512 b780b248ad5ad335b1498d86ca58f5a788c9933c69b42e79aa84f613e97150ebab93fef99e2bcb50db90fa246ab79158b928f4ecb17cfa3248a88121914dcca1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

tycRPOm.exe

Path C:\Windows\System\tycRPOm.exe
Size 5.9MB
SHA256 8f1cf6b5756ab51f10b9e01468a5e4d55589c5eefb83ca3d25a9fa5715da3cf6
MD5 da4c2579a1739bc7207b698fbfd08f40
SHA1 0ce0abbfe9158c3ac12acbc0be4d6012ebb06a9c
SHA512 0b4728c12854e4222868848c51cd0683efe43f8073cdcccb8b064810e0711e2268970d641b2f20f72364546e5f3093366b761a72eafc35914e6291117050b821
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

vtzvweY.exe

Path C:\Windows\System\vtzvweY.exe
Size 5.9MB
SHA256 1498108463e72f1117b1e07a82f520a109d3174a17950757b64f24b444a79c1c
MD5 d8b87334a45772b26d322efe4a8d703d
SHA1 a46fbd17f9347ee9e2a4f1d08792e4a6bf10aab4
SHA512 a3821a2350ae599c3e9fe28899b96f5556d0a05e0fb8bb3b4db58e2db5db09bfb3eb59e8bbc746c0bc5ce9dc1e64ddc5e73a67d209fde840f5e77ab52cc0c28d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

zAAocxY.exe

Path C:\Windows\System\zAAocxY.exe
Size 5.9MB
SHA256 f4694e92d97664fb286f2f62a68f8b5d3c6c9cbf693f73a02506f205cbc4229a
MD5 b3b5941455ec20b9003fd709e58f0e2b
SHA1 7d2025c66005d79e5c4be24d4aabcfd6bf20ec9c
SHA512 61d46f2d721485d60aeac723acff06e82e742c0c3275c4543cb043cd19a0206f1670df1efae54d5e78d6345b2eddacf9f1ea57452b0e5bb8e95bb05f128e7be6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/408-155-0x00007FF64DAA0000-0x00007FF64DDF4000-memory.dmp

Download

memory/408-132-0x00007FF64DAA0000-0x00007FF64DDF4000-memory.dmp

Download

memory/608-154-0x00007FF7794F0000-0x00007FF779844000-memory.dmp

Download

memory/608-127-0x00007FF7794F0000-0x00007FF779844000-memory.dmp

Download

memory/740-151-0x00007FF6144A0000-0x00007FF6147F4000-memory.dmp

Download

memory/740-109-0x00007FF6144A0000-0x00007FF6147F4000-memory.dmp

Download

memory/988-116-0x00007FF683310000-0x00007FF683664000-memory.dmp

Download

memory/988-152-0x00007FF683310000-0x00007FF683664000-memory.dmp

Download

memory/1512-149-0x00007FF601420000-0x00007FF601774000-memory.dmp

Download

memory/1512-134-0x00007FF601420000-0x00007FF601774000-memory.dmp

Download

memory/1512-93-0x00007FF601420000-0x00007FF601774000-memory.dmp

Download

memory/1604-38-0x00007FF700DA0000-0x00007FF7010F4000-memory.dmp

Download

memory/1604-140-0x00007FF700DA0000-0x00007FF7010F4000-memory.dmp

Download

memory/1688-126-0x00007FF630560000-0x00007FF6308B4000-memory.dmp

Download

memory/1688-144-0x00007FF630560000-0x00007FF6308B4000-memory.dmp

Download

memory/1688-61-0x00007FF630560000-0x00007FF6308B4000-memory.dmp

Download

memory/1800-0-0x00007FF6D5AB0000-0x00007FF6D5E04000-memory.dmp

Download

memory/1800-60-0x00007FF6D5AB0000-0x00007FF6D5E04000-memory.dmp

Download

memory/1800-1-0x0000016CB4C80000-0x0000016CB4C90000-memory.dmp

Download

memory/2212-56-0x00007FF716EE0000-0x00007FF717234000-memory.dmp

Download

memory/2212-143-0x00007FF716EE0000-0x00007FF717234000-memory.dmp

Download

memory/2244-76-0x00007FF6E1100000-0x00007FF6E1454000-memory.dmp

Download

memory/2244-136-0x00007FF6E1100000-0x00007FF6E1454000-memory.dmp

Download

memory/2244-14-0x00007FF6E1100000-0x00007FF6E1454000-memory.dmp

Download

memory/2248-150-0x00007FF631830000-0x00007FF631B84000-memory.dmp

Download

memory/2248-102-0x00007FF631830000-0x00007FF631B84000-memory.dmp

Download

memory/2632-8-0x00007FF7A4460000-0x00007FF7A47B4000-memory.dmp

Download

memory/2632-69-0x00007FF7A4460000-0x00007FF7A47B4000-memory.dmp

Download

memory/2632-135-0x00007FF7A4460000-0x00007FF7A47B4000-memory.dmp

Download

memory/3200-32-0x00007FF642D50000-0x00007FF6430A4000-memory.dmp

Download

memory/3200-139-0x00007FF642D50000-0x00007FF6430A4000-memory.dmp

Download

memory/3644-148-0x00007FF60C000000-0x00007FF60C354000-memory.dmp

Download

memory/3644-90-0x00007FF60C000000-0x00007FF60C354000-memory.dmp

Download

memory/3944-20-0x00007FF717E80000-0x00007FF7181D4000-memory.dmp

Download

memory/3944-137-0x00007FF717E80000-0x00007FF7181D4000-memory.dmp

Download

memory/3944-81-0x00007FF717E80000-0x00007FF7181D4000-memory.dmp

Download

memory/4120-50-0x00007FF7BD400000-0x00007FF7BD754000-memory.dmp

Download

memory/4120-142-0x00007FF7BD400000-0x00007FF7BD754000-memory.dmp

Download

memory/4248-153-0x00007FF764830000-0x00007FF764B84000-memory.dmp

Download

memory/4248-120-0x00007FF764830000-0x00007FF764B84000-memory.dmp

Download

memory/4364-44-0x00007FF604B90000-0x00007FF604EE4000-memory.dmp

Download

memory/4364-141-0x00007FF604B90000-0x00007FF604EE4000-memory.dmp

Download

memory/4396-146-0x00007FF6B7F80000-0x00007FF6B82D4000-memory.dmp

Download

memory/4396-77-0x00007FF6B7F80000-0x00007FF6B82D4000-memory.dmp

Download

memory/4484-147-0x00007FF60A250000-0x00007FF60A5A4000-memory.dmp

Download

memory/4484-133-0x00007FF60A250000-0x00007FF60A5A4000-memory.dmp

Download

memory/4484-82-0x00007FF60A250000-0x00007FF60A5A4000-memory.dmp

Download

memory/4648-26-0x00007FF6F4850000-0x00007FF6F4BA4000-memory.dmp

Download

memory/4648-138-0x00007FF6F4850000-0x00007FF6F4BA4000-memory.dmp

Download

memory/5112-145-0x00007FF7C8C20000-0x00007FF7C8F74000-memory.dmp

Download

memory/5112-72-0x00007FF7C8C20000-0x00007FF7C8F74000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads