cobaltstrike | d1ab6f2c2b63875eb5c042f246840ac200bf1e97216dae4b24661b2952a1152a

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240531-tlcdkaeb93
SHA256 d1ab6f2c2b63875eb5c042f246840ac200bf1e97216dae4b24661b2952a1152a
MD5 f2eaa60334818cbfb2bfe4bb4772ec4e
SHA1 b95b18f006c1f5d35a30de225473920ece45ae6f
SHA512 e5a56b9b34f9011987c2b5cca242b1e07826c4ba01a95c17e415efc7fe66e7e340d2b0163cd1d88cdb3892dea8f02b17c1a84ed3482313af04cb7033a1d54906
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023245-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023246-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023247-10.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023243-22.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023248-30.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023249-36.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002324a-41.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002324c-46.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002324e-55.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002324d-58.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002324f-65.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023250-68.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023251-75.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023252-84.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023253-90.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023254-98.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023255-106.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023256-110.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023257-118.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023258-122.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023259-126.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023245-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023246-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023247-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023243-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023248-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023249-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002324a-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002324c-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002324e-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002324d-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002324f-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023250-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023251-75.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023252-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023253-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023254-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023255-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023256-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023257-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023258-122.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023259-126.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1448-0-0x00007FF6B7720000-0x00007FF6B7A74000-memory.dmp	UPX
behavioral2/files/0x0008000000023245-4.dat	UPX
behavioral2/memory/408-8-0x00007FF67D4D0000-0x00007FF67D824000-memory.dmp	UPX
behavioral2/files/0x0007000000023246-11.dat	UPX
behavioral2/memory/4560-13-0x00007FF7D0380000-0x00007FF7D06D4000-memory.dmp	UPX
behavioral2/files/0x0007000000023247-10.dat	UPX
behavioral2/memory/3604-17-0x00007FF6B26D0000-0x00007FF6B2A24000-memory.dmp	UPX
behavioral2/files/0x0008000000023243-22.dat	UPX
behavioral2/memory/4392-26-0x00007FF60A160000-0x00007FF60A4B4000-memory.dmp	UPX
behavioral2/files/0x0007000000023248-30.dat	UPX
behavioral2/memory/1812-32-0x00007FF668060000-0x00007FF6683B4000-memory.dmp	UPX
behavioral2/files/0x0007000000023249-36.dat	UPX
behavioral2/memory/2872-38-0x00007FF7B22B0000-0x00007FF7B2604000-memory.dmp	UPX
behavioral2/memory/2248-42-0x00007FF7C5B60000-0x00007FF7C5EB4000-memory.dmp	UPX
behavioral2/files/0x000700000002324a-41.dat	UPX
behavioral2/files/0x000700000002324c-46.dat	UPX
behavioral2/memory/3200-51-0x00007FF6AB6D0000-0x00007FF6ABA24000-memory.dmp	UPX
behavioral2/files/0x000700000002324e-55.dat	UPX
behavioral2/files/0x000700000002324d-58.dat	UPX
behavioral2/memory/4816-63-0x00007FF723540000-0x00007FF723894000-memory.dmp	UPX
behavioral2/files/0x000700000002324f-65.dat	UPX
behavioral2/files/0x0007000000023250-68.dat	UPX
behavioral2/files/0x0007000000023251-75.dat	UPX
behavioral2/memory/1448-74-0x00007FF6B7720000-0x00007FF6B7A74000-memory.dmp	UPX
behavioral2/memory/2268-80-0x00007FF7C6DB0000-0x00007FF7C7104000-memory.dmp	UPX
behavioral2/memory/4372-79-0x00007FF770EA0000-0x00007FF7711F4000-memory.dmp	UPX
behavioral2/memory/4828-77-0x00007FF70C470000-0x00007FF70C7C4000-memory.dmp	UPX
behavioral2/memory/1656-64-0x00007FF705220000-0x00007FF705574000-memory.dmp	UPX
behavioral2/files/0x0007000000023252-84.dat	UPX
behavioral2/memory/4560-86-0x00007FF7D0380000-0x00007FF7D06D4000-memory.dmp	UPX
behavioral2/memory/3840-91-0x00007FF7C7960000-0x00007FF7C7CB4000-memory.dmp	UPX
behavioral2/files/0x0007000000023253-90.dat	UPX
behavioral2/memory/2564-95-0x00007FF7E5A10000-0x00007FF7E5D64000-memory.dmp	UPX
behavioral2/memory/3604-94-0x00007FF6B26D0000-0x00007FF6B2A24000-memory.dmp	UPX
behavioral2/files/0x0007000000023254-98.dat	UPX
behavioral2/memory/4392-101-0x00007FF60A160000-0x00007FF60A4B4000-memory.dmp	UPX
behavioral2/files/0x0007000000023255-106.dat	UPX
behavioral2/memory/1308-104-0x00007FF6A18C0000-0x00007FF6A1C14000-memory.dmp	UPX
behavioral2/files/0x0007000000023256-110.dat	UPX
behavioral2/files/0x0007000000023257-118.dat	UPX
behavioral2/memory/3196-120-0x00007FF66AA70000-0x00007FF66ADC4000-memory.dmp	UPX
behavioral2/memory/2872-123-0x00007FF7B22B0000-0x00007FF7B2604000-memory.dmp	UPX
behavioral2/files/0x0007000000023258-122.dat	UPX
behavioral2/files/0x0007000000023259-126.dat	UPX
behavioral2/memory/1820-127-0x00007FF611DC0000-0x00007FF612114000-memory.dmp	UPX
behavioral2/memory/1768-130-0x00007FF7F0A10000-0x00007FF7F0D64000-memory.dmp	UPX
behavioral2/memory/2248-132-0x00007FF7C5B60000-0x00007FF7C5EB4000-memory.dmp	UPX
behavioral2/memory/984-131-0x00007FF791B50000-0x00007FF791EA4000-memory.dmp	UPX
behavioral2/memory/2616-133-0x00007FF7C94E0000-0x00007FF7C9834000-memory.dmp	UPX
behavioral2/memory/3200-134-0x00007FF6AB6D0000-0x00007FF6ABA24000-memory.dmp	UPX
behavioral2/memory/2268-135-0x00007FF7C6DB0000-0x00007FF7C7104000-memory.dmp	UPX
behavioral2/memory/408-136-0x00007FF67D4D0000-0x00007FF67D824000-memory.dmp	UPX
behavioral2/memory/4560-137-0x00007FF7D0380000-0x00007FF7D06D4000-memory.dmp	UPX
behavioral2/memory/3604-138-0x00007FF6B26D0000-0x00007FF6B2A24000-memory.dmp	UPX
behavioral2/memory/4392-139-0x00007FF60A160000-0x00007FF60A4B4000-memory.dmp	UPX
behavioral2/memory/1812-140-0x00007FF668060000-0x00007FF6683B4000-memory.dmp	UPX
behavioral2/memory/2872-141-0x00007FF7B22B0000-0x00007FF7B2604000-memory.dmp	UPX
behavioral2/memory/2248-142-0x00007FF7C5B60000-0x00007FF7C5EB4000-memory.dmp	UPX
behavioral2/memory/3200-143-0x00007FF6AB6D0000-0x00007FF6ABA24000-memory.dmp	UPX
behavioral2/memory/4816-144-0x00007FF723540000-0x00007FF723894000-memory.dmp	UPX
behavioral2/memory/1656-145-0x00007FF705220000-0x00007FF705574000-memory.dmp	UPX
behavioral2/memory/4372-146-0x00007FF770EA0000-0x00007FF7711F4000-memory.dmp	UPX
behavioral2/memory/4828-147-0x00007FF70C470000-0x00007FF70C7C4000-memory.dmp	UPX
behavioral2/memory/2268-148-0x00007FF7C6DB0000-0x00007FF7C7104000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1448-0-0x00007FF6B7720000-0x00007FF6B7A74000-memory.dmp	xmrig
behavioral2/files/0x0008000000023245-4.dat	xmrig
behavioral2/memory/408-8-0x00007FF67D4D0000-0x00007FF67D824000-memory.dmp	xmrig
behavioral2/files/0x0007000000023246-11.dat	xmrig
behavioral2/memory/4560-13-0x00007FF7D0380000-0x00007FF7D06D4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023247-10.dat	xmrig
behavioral2/memory/3604-17-0x00007FF6B26D0000-0x00007FF6B2A24000-memory.dmp	xmrig
behavioral2/files/0x0008000000023243-22.dat	xmrig
behavioral2/memory/4392-26-0x00007FF60A160000-0x00007FF60A4B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023248-30.dat	xmrig
behavioral2/memory/1812-32-0x00007FF668060000-0x00007FF6683B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023249-36.dat	xmrig
behavioral2/memory/2872-38-0x00007FF7B22B0000-0x00007FF7B2604000-memory.dmp	xmrig
behavioral2/memory/2248-42-0x00007FF7C5B60000-0x00007FF7C5EB4000-memory.dmp	xmrig
behavioral2/files/0x000700000002324a-41.dat	xmrig
behavioral2/files/0x000700000002324c-46.dat	xmrig
behavioral2/memory/3200-51-0x00007FF6AB6D0000-0x00007FF6ABA24000-memory.dmp	xmrig
behavioral2/files/0x000700000002324e-55.dat	xmrig
behavioral2/files/0x000700000002324d-58.dat	xmrig
behavioral2/memory/4816-63-0x00007FF723540000-0x00007FF723894000-memory.dmp	xmrig
behavioral2/files/0x000700000002324f-65.dat	xmrig
behavioral2/files/0x0007000000023250-68.dat	xmrig
behavioral2/files/0x0007000000023251-75.dat	xmrig
behavioral2/memory/1448-74-0x00007FF6B7720000-0x00007FF6B7A74000-memory.dmp	xmrig
behavioral2/memory/2268-80-0x00007FF7C6DB0000-0x00007FF7C7104000-memory.dmp	xmrig
behavioral2/memory/4372-79-0x00007FF770EA0000-0x00007FF7711F4000-memory.dmp	xmrig
behavioral2/memory/4828-77-0x00007FF70C470000-0x00007FF70C7C4000-memory.dmp	xmrig
behavioral2/memory/1656-64-0x00007FF705220000-0x00007FF705574000-memory.dmp	xmrig
behavioral2/files/0x0007000000023252-84.dat	xmrig
behavioral2/memory/4560-86-0x00007FF7D0380000-0x00007FF7D06D4000-memory.dmp	xmrig
behavioral2/memory/3840-91-0x00007FF7C7960000-0x00007FF7C7CB4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023253-90.dat	xmrig
behavioral2/memory/2564-95-0x00007FF7E5A10000-0x00007FF7E5D64000-memory.dmp	xmrig
behavioral2/memory/3604-94-0x00007FF6B26D0000-0x00007FF6B2A24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023254-98.dat	xmrig
behavioral2/memory/4392-101-0x00007FF60A160000-0x00007FF60A4B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023255-106.dat	xmrig
behavioral2/memory/1308-104-0x00007FF6A18C0000-0x00007FF6A1C14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023256-110.dat	xmrig
behavioral2/files/0x0007000000023257-118.dat	xmrig
behavioral2/memory/3196-120-0x00007FF66AA70000-0x00007FF66ADC4000-memory.dmp	xmrig
behavioral2/memory/2872-123-0x00007FF7B22B0000-0x00007FF7B2604000-memory.dmp	xmrig
behavioral2/files/0x0007000000023258-122.dat	xmrig
behavioral2/files/0x0007000000023259-126.dat	xmrig
behavioral2/memory/1820-127-0x00007FF611DC0000-0x00007FF612114000-memory.dmp	xmrig
behavioral2/memory/1768-130-0x00007FF7F0A10000-0x00007FF7F0D64000-memory.dmp	xmrig
behavioral2/memory/2248-132-0x00007FF7C5B60000-0x00007FF7C5EB4000-memory.dmp	xmrig
behavioral2/memory/984-131-0x00007FF791B50000-0x00007FF791EA4000-memory.dmp	xmrig
behavioral2/memory/2616-133-0x00007FF7C94E0000-0x00007FF7C9834000-memory.dmp	xmrig
behavioral2/memory/3200-134-0x00007FF6AB6D0000-0x00007FF6ABA24000-memory.dmp	xmrig
behavioral2/memory/2268-135-0x00007FF7C6DB0000-0x00007FF7C7104000-memory.dmp	xmrig
behavioral2/memory/408-136-0x00007FF67D4D0000-0x00007FF67D824000-memory.dmp	xmrig
behavioral2/memory/4560-137-0x00007FF7D0380000-0x00007FF7D06D4000-memory.dmp	xmrig
behavioral2/memory/3604-138-0x00007FF6B26D0000-0x00007FF6B2A24000-memory.dmp	xmrig
behavioral2/memory/4392-139-0x00007FF60A160000-0x00007FF60A4B4000-memory.dmp	xmrig
behavioral2/memory/1812-140-0x00007FF668060000-0x00007FF6683B4000-memory.dmp	xmrig
behavioral2/memory/2872-141-0x00007FF7B22B0000-0x00007FF7B2604000-memory.dmp	xmrig
behavioral2/memory/2248-142-0x00007FF7C5B60000-0x00007FF7C5EB4000-memory.dmp	xmrig
behavioral2/memory/3200-143-0x00007FF6AB6D0000-0x00007FF6ABA24000-memory.dmp	xmrig
behavioral2/memory/4816-144-0x00007FF723540000-0x00007FF723894000-memory.dmp	xmrig
behavioral2/memory/1656-145-0x00007FF705220000-0x00007FF705574000-memory.dmp	xmrig
behavioral2/memory/4372-146-0x00007FF770EA0000-0x00007FF7711F4000-memory.dmp	xmrig
behavioral2/memory/4828-147-0x00007FF70C470000-0x00007FF70C7C4000-memory.dmp	xmrig
behavioral2/memory/2268-148-0x00007FF7C6DB0000-0x00007FF7C7104000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
408	DqTmWiG.exe
4560	JomNjvu.exe
3604	MRTHYrH.exe
4392	USopNvt.exe
1812	npEWNlC.exe
2872	hcAYaIb.exe
2248	SbKvRBk.exe
3200	bqNQDDg.exe
4816	CcVmSzt.exe
1656	gzRHnVh.exe
4828	tnNccwI.exe
4372	qbNNEBR.exe
2268	cpaPHDL.exe
3840	JbTvtJm.exe
2564	dCDScgo.exe
1308	Qlxkdbv.exe
3196	kWSEXTQ.exe
1820	PCOYfQR.exe
1768	jknXXea.exe
984	yzCRtqE.exe
2616	iIoIajS.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1448-0-0x00007FF6B7720000-0x00007FF6B7A74000-memory.dmp	upx
behavioral2/files/0x0008000000023245-4.dat	upx
behavioral2/memory/408-8-0x00007FF67D4D0000-0x00007FF67D824000-memory.dmp	upx
behavioral2/files/0x0007000000023246-11.dat	upx
behavioral2/memory/4560-13-0x00007FF7D0380000-0x00007FF7D06D4000-memory.dmp	upx
behavioral2/files/0x0007000000023247-10.dat	upx
behavioral2/memory/3604-17-0x00007FF6B26D0000-0x00007FF6B2A24000-memory.dmp	upx
behavioral2/files/0x0008000000023243-22.dat	upx
behavioral2/memory/4392-26-0x00007FF60A160000-0x00007FF60A4B4000-memory.dmp	upx
behavioral2/files/0x0007000000023248-30.dat	upx
behavioral2/memory/1812-32-0x00007FF668060000-0x00007FF6683B4000-memory.dmp	upx
behavioral2/files/0x0007000000023249-36.dat	upx
behavioral2/memory/2872-38-0x00007FF7B22B0000-0x00007FF7B2604000-memory.dmp	upx
behavioral2/memory/2248-42-0x00007FF7C5B60000-0x00007FF7C5EB4000-memory.dmp	upx
behavioral2/files/0x000700000002324a-41.dat	upx
behavioral2/files/0x000700000002324c-46.dat	upx
behavioral2/memory/3200-51-0x00007FF6AB6D0000-0x00007FF6ABA24000-memory.dmp	upx
behavioral2/files/0x000700000002324e-55.dat	upx
behavioral2/files/0x000700000002324d-58.dat	upx
behavioral2/memory/4816-63-0x00007FF723540000-0x00007FF723894000-memory.dmp	upx
behavioral2/files/0x000700000002324f-65.dat	upx
behavioral2/files/0x0007000000023250-68.dat	upx
behavioral2/files/0x0007000000023251-75.dat	upx
behavioral2/memory/1448-74-0x00007FF6B7720000-0x00007FF6B7A74000-memory.dmp	upx
behavioral2/memory/2268-80-0x00007FF7C6DB0000-0x00007FF7C7104000-memory.dmp	upx
behavioral2/memory/4372-79-0x00007FF770EA0000-0x00007FF7711F4000-memory.dmp	upx
behavioral2/memory/4828-77-0x00007FF70C470000-0x00007FF70C7C4000-memory.dmp	upx
behavioral2/memory/1656-64-0x00007FF705220000-0x00007FF705574000-memory.dmp	upx
behavioral2/files/0x0007000000023252-84.dat	upx
behavioral2/memory/4560-86-0x00007FF7D0380000-0x00007FF7D06D4000-memory.dmp	upx
behavioral2/memory/3840-91-0x00007FF7C7960000-0x00007FF7C7CB4000-memory.dmp	upx
behavioral2/files/0x0007000000023253-90.dat	upx
behavioral2/memory/2564-95-0x00007FF7E5A10000-0x00007FF7E5D64000-memory.dmp	upx
behavioral2/memory/3604-94-0x00007FF6B26D0000-0x00007FF6B2A24000-memory.dmp	upx
behavioral2/files/0x0007000000023254-98.dat	upx
behavioral2/memory/4392-101-0x00007FF60A160000-0x00007FF60A4B4000-memory.dmp	upx
behavioral2/files/0x0007000000023255-106.dat	upx
behavioral2/memory/1308-104-0x00007FF6A18C0000-0x00007FF6A1C14000-memory.dmp	upx
behavioral2/files/0x0007000000023256-110.dat	upx
behavioral2/files/0x0007000000023257-118.dat	upx
behavioral2/memory/3196-120-0x00007FF66AA70000-0x00007FF66ADC4000-memory.dmp	upx
behavioral2/memory/2872-123-0x00007FF7B22B0000-0x00007FF7B2604000-memory.dmp	upx
behavioral2/files/0x0007000000023258-122.dat	upx
behavioral2/files/0x0007000000023259-126.dat	upx
behavioral2/memory/1820-127-0x00007FF611DC0000-0x00007FF612114000-memory.dmp	upx
behavioral2/memory/1768-130-0x00007FF7F0A10000-0x00007FF7F0D64000-memory.dmp	upx
behavioral2/memory/2248-132-0x00007FF7C5B60000-0x00007FF7C5EB4000-memory.dmp	upx
behavioral2/memory/984-131-0x00007FF791B50000-0x00007FF791EA4000-memory.dmp	upx
behavioral2/memory/2616-133-0x00007FF7C94E0000-0x00007FF7C9834000-memory.dmp	upx
behavioral2/memory/3200-134-0x00007FF6AB6D0000-0x00007FF6ABA24000-memory.dmp	upx
behavioral2/memory/2268-135-0x00007FF7C6DB0000-0x00007FF7C7104000-memory.dmp	upx
behavioral2/memory/408-136-0x00007FF67D4D0000-0x00007FF67D824000-memory.dmp	upx
behavioral2/memory/4560-137-0x00007FF7D0380000-0x00007FF7D06D4000-memory.dmp	upx
behavioral2/memory/3604-138-0x00007FF6B26D0000-0x00007FF6B2A24000-memory.dmp	upx
behavioral2/memory/4392-139-0x00007FF60A160000-0x00007FF60A4B4000-memory.dmp	upx
behavioral2/memory/1812-140-0x00007FF668060000-0x00007FF6683B4000-memory.dmp	upx
behavioral2/memory/2872-141-0x00007FF7B22B0000-0x00007FF7B2604000-memory.dmp	upx
behavioral2/memory/2248-142-0x00007FF7C5B60000-0x00007FF7C5EB4000-memory.dmp	upx
behavioral2/memory/3200-143-0x00007FF6AB6D0000-0x00007FF6ABA24000-memory.dmp	upx
behavioral2/memory/4816-144-0x00007FF723540000-0x00007FF723894000-memory.dmp	upx
behavioral2/memory/1656-145-0x00007FF705220000-0x00007FF705574000-memory.dmp	upx
behavioral2/memory/4372-146-0x00007FF770EA0000-0x00007FF7711F4000-memory.dmp	upx
behavioral2/memory/4828-147-0x00007FF70C470000-0x00007FF70C7C4000-memory.dmp	upx
behavioral2/memory/2268-148-0x00007FF7C6DB0000-0x00007FF7C7104000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\MRTHYrH.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SbKvRBk.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CcVmSzt.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tnNccwI.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\Qlxkdbv.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jknXXea.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DqTmWiG.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JomNjvu.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gzRHnVh.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kWSEXTQ.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PCOYfQR.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yzCRtqE.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\npEWNlC.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hcAYaIb.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qbNNEBR.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\USopNvt.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bqNQDDg.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\cpaPHDL.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JbTvtJm.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dCDScgo.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iIoIajS.exe	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 408	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	92
PID 1448 wrote to memory of 408	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	92
PID 1448 wrote to memory of 4560	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	93
PID 1448 wrote to memory of 4560	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	93
PID 1448 wrote to memory of 3604	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	94
PID 1448 wrote to memory of 3604	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	94
PID 1448 wrote to memory of 4392	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	95
PID 1448 wrote to memory of 4392	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	95
PID 1448 wrote to memory of 1812	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	96
PID 1448 wrote to memory of 1812	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	96
PID 1448 wrote to memory of 2872	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	97
PID 1448 wrote to memory of 2872	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	97
PID 1448 wrote to memory of 2248	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	98
PID 1448 wrote to memory of 2248	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	98
PID 1448 wrote to memory of 3200	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	99
PID 1448 wrote to memory of 3200	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	99
PID 1448 wrote to memory of 1656	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	100
PID 1448 wrote to memory of 1656	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	100
PID 1448 wrote to memory of 4816	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	101
PID 1448 wrote to memory of 4816	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	101
PID 1448 wrote to memory of 4828	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	102
PID 1448 wrote to memory of 4828	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	102
PID 1448 wrote to memory of 4372	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	103
PID 1448 wrote to memory of 4372	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	103
PID 1448 wrote to memory of 2268	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	104
PID 1448 wrote to memory of 2268	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	104
PID 1448 wrote to memory of 3840	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	105
PID 1448 wrote to memory of 3840	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	105
PID 1448 wrote to memory of 2564	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	106
PID 1448 wrote to memory of 2564	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	106
PID 1448 wrote to memory of 1308	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	107
PID 1448 wrote to memory of 1308	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	107
PID 1448 wrote to memory of 3196	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	108
PID 1448 wrote to memory of 3196	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	108
PID 1448 wrote to memory of 1820	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	109
PID 1448 wrote to memory of 1820	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	109
PID 1448 wrote to memory of 1768	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	110
PID 1448 wrote to memory of 1768	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	110
PID 1448 wrote to memory of 984	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	111
PID 1448 wrote to memory of 984	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	111
PID 1448 wrote to memory of 2616	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	112
PID 1448 wrote to memory of 2616	1448	2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe	112

C:\Users\Admin\AppData\Local\Temp\2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_f2eaa60334818cbfb2bfe4bb4772ec4e_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\System\DqTmWiG.exe
  C:\Windows\System\DqTmWiG.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\JomNjvu.exe
  C:\Windows\System\JomNjvu.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\MRTHYrH.exe
  C:\Windows\System\MRTHYrH.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\USopNvt.exe
  C:\Windows\System\USopNvt.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\npEWNlC.exe
  C:\Windows\System\npEWNlC.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\hcAYaIb.exe
  C:\Windows\System\hcAYaIb.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\SbKvRBk.exe
  C:\Windows\System\SbKvRBk.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\bqNQDDg.exe
  C:\Windows\System\bqNQDDg.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\gzRHnVh.exe
  C:\Windows\System\gzRHnVh.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\CcVmSzt.exe
  C:\Windows\System\CcVmSzt.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\tnNccwI.exe
  C:\Windows\System\tnNccwI.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\qbNNEBR.exe
  C:\Windows\System\qbNNEBR.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\cpaPHDL.exe
  C:\Windows\System\cpaPHDL.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\JbTvtJm.exe
  C:\Windows\System\JbTvtJm.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\dCDScgo.exe
  C:\Windows\System\dCDScgo.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\Qlxkdbv.exe
  C:\Windows\System\Qlxkdbv.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\kWSEXTQ.exe
  C:\Windows\System\kWSEXTQ.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\PCOYfQR.exe
  C:\Windows\System\PCOYfQR.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\jknXXea.exe
  C:\Windows\System\jknXXea.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\yzCRtqE.exe
  C:\Windows\System\yzCRtqE.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\iIoIajS.exe
  C:\Windows\System\iIoIajS.exe
  2⤵
  - Executes dropped EXE
  PID:2616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3956 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:4256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CcVmSzt.exe

Path C:\Windows\System\CcVmSzt.exe
Size 5.9MB
SHA256 e616427d7fae1c49ff32ded2cdd1c25f823c0d88288a5715c92cc230c2b35d53
MD5 f12b993b85427c61a454f66b0c7b6ad9
SHA1 9d3c8ce51015a2772cc2eee449b03be92a5042ab
SHA512 285403dea133dbb8ba438a9db9f5402c89a57d7bf8cd6e758b1890516739b5876af3753dd59e254740dc3064f53f2e9303aa54780c1f505e0a485578c99f5683
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

DqTmWiG.exe

Path C:\Windows\System\DqTmWiG.exe
Size 5.9MB
SHA256 bc95d2c8c5a04201a2ca15f88ef297dc0d8f984218f733b00a1ddf05d60d7c28
MD5 85f349081b4b8ae4aedab0dd0ad4101a
SHA1 d276154ac0142fd329697ca045923fbefad52f0f
SHA512 acf26f1101604fb4ba9fba8e7da3ad7b5f853bccc21e4c042104decd30bd455e9addba338a856b504e77d78a8c53d1c580006d75c647a32a31fccc4091a7ffc9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

JbTvtJm.exe

Path C:\Windows\System\JbTvtJm.exe
Size 5.9MB
SHA256 bd7ccfe903ccfcedcc0189e7edc363d27813c692aa69a9f063b4389f80f8a856
MD5 d8d6ec737db2954fecb0b53f2275cc7f
SHA1 a406f7ea0611ecf1579a25ef15441e4edd3270e5
SHA512 e6962c904a869991f3dbecce673dc713f49ff862aa04478c8b506236740879bc90932cef63823a7965f1ff723faed845981433bccb95643c23ff0581516f716f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

JomNjvu.exe

Path C:\Windows\System\JomNjvu.exe
Size 5.9MB
SHA256 7573635cdde958e723cfc16b18c5407d748e9db300a9033b42f6f51422094234
MD5 02d2aba86dfbe71fcf0a3f0104db88ef
SHA1 a1282a4a18b8b470bbb74448c6b966ec1917090d
SHA512 b40e1073190890743e8fcfa7d48cb2f0d0b9c94980e4e806eba60c46f54d32c1832768032b640232bd874e8312984e88965ab5091536658ef546dd990990a197
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

MRTHYrH.exe

Path C:\Windows\System\MRTHYrH.exe
Size 5.9MB
SHA256 7124afa928302c369a677a9a93532879bbfa80f86fdc089235e55932844e8708
MD5 40686de7b099c918d3e0097d2feb13c3
SHA1 e91845c2b02666a96ff380bceddd5b00fd4912dc
SHA512 8d64bf8893188485bb7c2a5b4765bb4d567cf532fe17285a255c53c546d02c62a344540a1480436e96d2ef0074d0d05ff0767cd9ebb40e84c259124e918743cc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

PCOYfQR.exe

Path C:\Windows\System\PCOYfQR.exe
Size 5.9MB
SHA256 e227b2f9477c5a5432afcde13fc11ba6c0840badaf033b03d644f036c5e03e41
MD5 07a61903631e5b77f83e684ff5472e69
SHA1 4d666752e8f0890c3968ce7a5be18f75bc20d0e8
SHA512 f30cd82c46a8ab37cfe1d8697a4deada8895819c17543935a8ee366e5a7d310aaff946ec48ced5e27cac6e26b32c5b098916ccb5bdcb34e1a46b95b1971e417b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qlxkdbv.exe

Path C:\Windows\System\Qlxkdbv.exe
Size 5.9MB
SHA256 be24230212a55ac3f6ac0bb823c678cc52dd271e97ef46d06a1cc19f8bdabd08
MD5 8ae18cf941d97374c60a7404a55bbe23
SHA1 0b1064cc97074deb51049ba39c4880a8a30cc32a
SHA512 bab6d30e2d651929cc1d3ff73db553ce20d153ab342e52aedb720e06b6e75b351e1c2b8d595016e735ab26d27d745386ea58111b76a1ea6f66146a4af071bbb2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

SbKvRBk.exe

Path C:\Windows\System\SbKvRBk.exe
Size 5.9MB
SHA256 21d5e5b103babf086a89e2170e9f0e92ebe8a07e97d5c0fd1e0510db4f2ad03a
MD5 bbccf3053eb65c8d1189fb59d2358967
SHA1 eb9349c7b84f79e403b2f17b7b8974a192272512
SHA512 c604548d63f37b1eecaa8e54d8e2a14693c11fc531382500f5211cc7111ec06d7479016a3b0839ab38e5811f9edae6dd914dfcc1a81415fc9332740260937cf7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

USopNvt.exe

Path C:\Windows\System\USopNvt.exe
Size 5.9MB
SHA256 1fa970c071fbd3cd497badd432a1bed065379f9a3214c91736cc352912e99366
MD5 a24db9eb7d2a22fa6cbd0819f4aefe9f
SHA1 f273dbd345ddc89886e4603ba46596aeb09d78b0
SHA512 29b4cfe3cab7a7d9f80b7b8d89c885196d64ccd5c441acad80984c68cf70696939185613659e21723e3339ec1c1c9a53cae10682a3d8a0eef7cd4dc26c712581
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

bqNQDDg.exe

Path C:\Windows\System\bqNQDDg.exe
Size 5.9MB
SHA256 4f255248c34637c9bb4684a8e7b9cdd8ab32501c6f171264a2b9d89e3aac3ea7
MD5 5f330f4f23b63d31fb575278a73bed1c
SHA1 7c094ef802876729dff41c279f5a012d2ed6c76a
SHA512 2cd4535ad06e7ee1169553b747f2fa60c50a530510bb5b0af6e532bdcc7388339b8d0313b3e2fd4eb990e2cd4955fc62f8a69a2245cc6bcf9f5da6b6b74c434c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

cpaPHDL.exe

Path C:\Windows\System\cpaPHDL.exe
Size 5.9MB
SHA256 c9cd5ae08ced3abec35982aa2db88f78480f304fe412c94d16373f93a0cbe05c
MD5 f5fbcf10c8d96029ece1217b350a676d
SHA1 a462d5ba11905e03556831215cea80cacd22f883
SHA512 13eb1414ad7ab9ea4bfbd13795e4eb5a1930a4bb60ba9330616671841184932cde6e980fb7e3c1d99b307b1e53bdc1b3513a68627783ce60fe4e0f10a2bf1f40
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

dCDScgo.exe

Path C:\Windows\System\dCDScgo.exe
Size 5.9MB
SHA256 180e2e80f3ed074ec4cf44911918134a287f6812788ede128854761ab96db15e
MD5 8a9eb2f3f17b366aea89a33005eaa46e
SHA1 4f6521c73fd5454f690c904bc2c2d8a49b8ae02c
SHA512 219a3e42c5541fe8f767a5d6ebaccf07f540706c64d296338f6bae5109638e8345d0734f7307bde57dd4f87090c5db09c341fb9df282c0744de9f94cf3e2efad
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

gzRHnVh.exe

Path C:\Windows\System\gzRHnVh.exe
Size 5.9MB
SHA256 0bfe73cc5f47cc58b53885c29b6750034d6576223cbceda8ad9619fff8051b72
MD5 e04113a70a6cc483aae1c0733c8868cc
SHA1 82c8d97cac1f0bf41badbf94cc58bc44b8a38ad4
SHA512 82924d6adbecaf69e48254972f77083cf02496bdcaa85493c4777a372b5161f16cf368d8787a98420d7420bd63a0225985d400c7308178381993490d4aee59cb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:Q+856utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

hcAYaIb.exe

Path C:\Windows\System\hcAYaIb.exe
Size 5.9MB
SHA256 2227ce6bf70f100d5b4634b622a8124a8a444b4ba92bfb318536792cc6a70759
MD5 352ca538563bd0f9d507b8e0a4fe760a
SHA1 fad209c67909c389414f8f2e5bf441ce489eae84
SHA512 1edabbc7d2d55ccd6d774c02abc96c66f86f9c31ce0d3f25d2efd6278ca027452184a2c57071c0f6f2f90fe531beb1fa7f7bd0040512bd1f9b72b32abf9ddd93
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

iIoIajS.exe

Path C:\Windows\System\iIoIajS.exe
Size 5.9MB
SHA256 6381521ffdf0b8b97b3107fdba1621825999e62baa12e387e29ec1cf1aded4ac
MD5 ce0c79b0e8b6a8ede3b656fd95f17f18
SHA1 4643e36600cbf5d2729a705eec06e85b1eed278f
SHA512 95816341ceafd923c017ff43e0f75545a42239eb6fe83994207b883b8a4071a21041aaab397df6b3d45d11b64e0c66e04a0bbc85220571ac3eb17870e17214b0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

jknXXea.exe

Path C:\Windows\System\jknXXea.exe
Size 5.9MB
SHA256 7edefe60dc2688516844d9300628a78a686f5e2cdc645f2437b0aefa3de770d0
MD5 19d0fe0cf218b2ed0cddff8e69ccfa7e
SHA1 5a7923ed6bf9b3074a5d9a292decbf4c74d07b6f
SHA512 eee47e0491783fb770e4071dc96ac475b4649429448d265561787008e7ae65197a5903199e17984d0d6566402714febfc4fde994e8a69dfacb28354b52cb3a9c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

kWSEXTQ.exe

Path C:\Windows\System\kWSEXTQ.exe
Size 5.9MB
SHA256 f611c4e81048bf832a69dc0a26f147fb21be6a545d0b929a9107811a61c5fa59
MD5 168554add6d0bb89b6423767e168d537
SHA1 e77f9f2ce06e140325785c3831c38f3e8c769282
SHA512 135ab883e762e339fd048fd6a7bb412aacc072cb1492d0a6a53d23c1e126c7c1fbcab905d7ae1aaad422ecf6164acae964d5d85a17bc1a0ddd19f7770d2f3e01
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

npEWNlC.exe

Path C:\Windows\System\npEWNlC.exe
Size 5.9MB
SHA256 ebd05234a4631c0341f50c6d05641654173e9fd7b561b521f601b3e62daeb53d
MD5 d703d9dd5545a94d67a14df8765b08da
SHA1 66c33f230be163b2fac7d43471e40850a10e020d
SHA512 e8c5172dbfb08c980354859782694a9969e32689f5a1350c3dc2b91892913e914e5c74b7142799eb6ca0c039c8aa7e2c56d5c851a0a498f782f0a6930460ed55
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

qbNNEBR.exe

Path C:\Windows\System\qbNNEBR.exe
Size 5.9MB
SHA256 7341fdb631de3eae8ffbc4f0d4cf2567f8b33cd0bf6bf9e55ea8ed9c782682e9
MD5 67afb9d6174d125a874c4134f8cbf76a
SHA1 91169b7d8e836b48b24064bc15ef10b9050fdcd3
SHA512 acce00b2602cac98b5c3ba03bd945f2dd3f70502ae7c464047a54b425f59a2ae9df7e60cd032042607b0c2100bc1300aad230443f7d2bffe6df94affcffeef82
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

tnNccwI.exe

Path C:\Windows\System\tnNccwI.exe
Size 5.9MB
SHA256 85ab6c9a798a16d9d78a39a254e8d27c57540a5c1b1539c09cbe625cde764724
MD5 4d31d96594af7bcc4052b1b6e5df8d64
SHA1 15b0d9ac4d9ced8e136f27088a5af4d3f80cbaa2
SHA512 7fb5dd735977010bc2ae76ffbbbc738abfaea87a95474f45d74a40fb0cf980a5695c1d4c792708a5c15e8c1fbb4649d5c8b638f5c569e04af70781ad904d28c3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

yzCRtqE.exe

Path C:\Windows\System\yzCRtqE.exe
Size 5.9MB
SHA256 68f7a30529a51d8d52bc686f0cb5b1301e518eece84d02bfc2dea0723bb00650
MD5 aa020f732962df0a835b1c07f3f143ae
SHA1 bf00c5659f6d0e0ffa9e623884befc4a202eb5c4
SHA512 b7e26ee0a2a6a1e3af4db1622e2c5d807524e3069a1fef4e913e7695092a0f9e445ee11c54ee608ddcc5b8eb0bac2fac487d39800775e0086d001815fe9888c1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/408-136-0x00007FF67D4D0000-0x00007FF67D824000-memory.dmp

Download

memory/408-8-0x00007FF67D4D0000-0x00007FF67D824000-memory.dmp

Download

memory/984-131-0x00007FF791B50000-0x00007FF791EA4000-memory.dmp

Download

memory/984-155-0x00007FF791B50000-0x00007FF791EA4000-memory.dmp

Download

memory/1308-104-0x00007FF6A18C0000-0x00007FF6A1C14000-memory.dmp

Download

memory/1308-151-0x00007FF6A18C0000-0x00007FF6A1C14000-memory.dmp

Download

memory/1448-1-0x000001E5A7430000-0x000001E5A7440000-memory.dmp

Download

memory/1448-74-0x00007FF6B7720000-0x00007FF6B7A74000-memory.dmp

Download

memory/1448-0-0x00007FF6B7720000-0x00007FF6B7A74000-memory.dmp

Download

memory/1656-145-0x00007FF705220000-0x00007FF705574000-memory.dmp

Download

memory/1656-64-0x00007FF705220000-0x00007FF705574000-memory.dmp

Download

memory/1768-154-0x00007FF7F0A10000-0x00007FF7F0D64000-memory.dmp

Download

memory/1768-130-0x00007FF7F0A10000-0x00007FF7F0D64000-memory.dmp

Download

memory/1812-32-0x00007FF668060000-0x00007FF6683B4000-memory.dmp

Download

memory/1812-140-0x00007FF668060000-0x00007FF6683B4000-memory.dmp

Download

memory/1820-153-0x00007FF611DC0000-0x00007FF612114000-memory.dmp

Download

memory/1820-127-0x00007FF611DC0000-0x00007FF612114000-memory.dmp

Download

memory/2248-132-0x00007FF7C5B60000-0x00007FF7C5EB4000-memory.dmp

Download

memory/2248-42-0x00007FF7C5B60000-0x00007FF7C5EB4000-memory.dmp

Download

memory/2248-142-0x00007FF7C5B60000-0x00007FF7C5EB4000-memory.dmp

Download

memory/2268-135-0x00007FF7C6DB0000-0x00007FF7C7104000-memory.dmp

Download

memory/2268-80-0x00007FF7C6DB0000-0x00007FF7C7104000-memory.dmp

Download

memory/2268-148-0x00007FF7C6DB0000-0x00007FF7C7104000-memory.dmp

Download

memory/2564-95-0x00007FF7E5A10000-0x00007FF7E5D64000-memory.dmp

Download

memory/2564-150-0x00007FF7E5A10000-0x00007FF7E5D64000-memory.dmp

Download

memory/2616-133-0x00007FF7C94E0000-0x00007FF7C9834000-memory.dmp

Download

memory/2616-156-0x00007FF7C94E0000-0x00007FF7C9834000-memory.dmp

Download

memory/2872-123-0x00007FF7B22B0000-0x00007FF7B2604000-memory.dmp

Download

memory/2872-38-0x00007FF7B22B0000-0x00007FF7B2604000-memory.dmp

Download

memory/2872-141-0x00007FF7B22B0000-0x00007FF7B2604000-memory.dmp

Download

memory/3196-120-0x00007FF66AA70000-0x00007FF66ADC4000-memory.dmp

Download

memory/3196-152-0x00007FF66AA70000-0x00007FF66ADC4000-memory.dmp

Download

memory/3200-143-0x00007FF6AB6D0000-0x00007FF6ABA24000-memory.dmp

Download

memory/3200-134-0x00007FF6AB6D0000-0x00007FF6ABA24000-memory.dmp

Download

memory/3200-51-0x00007FF6AB6D0000-0x00007FF6ABA24000-memory.dmp

Download

memory/3604-138-0x00007FF6B26D0000-0x00007FF6B2A24000-memory.dmp

Download

memory/3604-94-0x00007FF6B26D0000-0x00007FF6B2A24000-memory.dmp

Download

memory/3604-17-0x00007FF6B26D0000-0x00007FF6B2A24000-memory.dmp

Download

memory/3840-91-0x00007FF7C7960000-0x00007FF7C7CB4000-memory.dmp

Download

memory/3840-149-0x00007FF7C7960000-0x00007FF7C7CB4000-memory.dmp

Download

memory/4372-146-0x00007FF770EA0000-0x00007FF7711F4000-memory.dmp

Download

memory/4372-79-0x00007FF770EA0000-0x00007FF7711F4000-memory.dmp

Download

memory/4392-101-0x00007FF60A160000-0x00007FF60A4B4000-memory.dmp

Download

memory/4392-26-0x00007FF60A160000-0x00007FF60A4B4000-memory.dmp

Download

memory/4392-139-0x00007FF60A160000-0x00007FF60A4B4000-memory.dmp

Download

memory/4560-13-0x00007FF7D0380000-0x00007FF7D06D4000-memory.dmp

Download

memory/4560-137-0x00007FF7D0380000-0x00007FF7D06D4000-memory.dmp

Download

memory/4560-86-0x00007FF7D0380000-0x00007FF7D06D4000-memory.dmp

Download

memory/4816-144-0x00007FF723540000-0x00007FF723894000-memory.dmp

Download

memory/4816-63-0x00007FF723540000-0x00007FF723894000-memory.dmp

Download

memory/4828-147-0x00007FF70C470000-0x00007FF70C7C4000-memory.dmp

Download

memory/4828-77-0x00007FF70C470000-0x00007FF70C7C4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads