cobaltstrike | b91999138cd3ffc2f0be3cffbc1e3ec03e753cbd4cf36ef8d8f3b590e3a69e67

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 20:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240531-y82desda49
SHA256 b91999138cd3ffc2f0be3cffbc1e3ec03e753cbd4cf36ef8d8f3b590e3a69e67
MD5 d0e80d1a3de846dfeba8e306117bbba1
SHA1 65cdd5fa52284c6ba3132cf792c88fa889941639
SHA512 a1628478c32e295a05c208ef87804a94182404f0b8fa73cf383460b102efd48d3d49f68bc154e745b4408a767a93eb11e8db52f5a4d7f2d12ef5021068440a38
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00090000000233c2-4.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ce-11.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233cf-10.dat	cobalt_reflective_dll
behavioral2/files/0x00090000000233c4-22.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d1-28.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d2-36.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d3-42.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d4-48.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d5-54.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d6-59.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d7-66.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d8-71.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233da-88.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d9-86.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233db-94.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233dc-100.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233dd-106.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233de-111.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e0-124.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e2-131.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233df-118.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233c2-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ce-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233cf-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00090000000233c4-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d1-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d2-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d3-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d4-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d5-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d6-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d7-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d8-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233da-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d9-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233db-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233dc-100.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233dd-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233de-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e0-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e2-131.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233df-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1624-0-0x00007FF6063C0000-0x00007FF606714000-memory.dmp	UPX
behavioral2/files/0x00090000000233c2-4.dat	UPX
behavioral2/memory/2948-8-0x00007FF765AD0000-0x00007FF765E24000-memory.dmp	UPX
behavioral2/files/0x00070000000233ce-11.dat	UPX
behavioral2/memory/5020-12-0x00007FF665C60000-0x00007FF665FB4000-memory.dmp	UPX
behavioral2/files/0x00070000000233cf-10.dat	UPX
behavioral2/memory/3492-20-0x00007FF7FF1E0000-0x00007FF7FF534000-memory.dmp	UPX
behavioral2/files/0x00090000000233c4-22.dat	UPX
behavioral2/memory/216-26-0x00007FF7EDE70000-0x00007FF7EE1C4000-memory.dmp	UPX
behavioral2/files/0x00070000000233d1-28.dat	UPX
behavioral2/files/0x00070000000233d2-36.dat	UPX
behavioral2/memory/2888-34-0x00007FF6230E0000-0x00007FF623434000-memory.dmp	UPX
behavioral2/files/0x00070000000233d3-42.dat	UPX
behavioral2/memory/808-40-0x00007FF6CDC90000-0x00007FF6CDFE4000-memory.dmp	UPX
behavioral2/files/0x00070000000233d4-48.dat	UPX
behavioral2/memory/1080-46-0x00007FF7A9990000-0x00007FF7A9CE4000-memory.dmp	UPX
behavioral2/files/0x00070000000233d5-54.dat	UPX
behavioral2/memory/3168-50-0x00007FF657760000-0x00007FF657AB4000-memory.dmp	UPX
behavioral2/memory/3680-56-0x00007FF6AC7B0000-0x00007FF6ACB04000-memory.dmp	UPX
behavioral2/files/0x00070000000233d6-59.dat	UPX
behavioral2/files/0x00070000000233d7-66.dat	UPX
behavioral2/files/0x00070000000233d8-71.dat	UPX
behavioral2/memory/2948-72-0x00007FF765AD0000-0x00007FF765E24000-memory.dmp	UPX
behavioral2/memory/5080-68-0x00007FF76F560000-0x00007FF76F8B4000-memory.dmp	UPX
behavioral2/memory/1624-62-0x00007FF6063C0000-0x00007FF606714000-memory.dmp	UPX
behavioral2/memory/3492-81-0x00007FF7FF1E0000-0x00007FF7FF534000-memory.dmp	UPX
behavioral2/memory/4900-85-0x00007FF7ED1A0000-0x00007FF7ED4F4000-memory.dmp	UPX
behavioral2/memory/3596-87-0x00007FF700F30000-0x00007FF701284000-memory.dmp	UPX
behavioral2/files/0x00070000000233da-88.dat	UPX
behavioral2/files/0x00070000000233d9-86.dat	UPX
behavioral2/memory/5020-79-0x00007FF665C60000-0x00007FF665FB4000-memory.dmp	UPX
behavioral2/memory/4480-77-0x00007FF770680000-0x00007FF7709D4000-memory.dmp	UPX
behavioral2/memory/844-75-0x00007FF61C200000-0x00007FF61C554000-memory.dmp	UPX
behavioral2/files/0x00070000000233db-94.dat	UPX
behavioral2/memory/1180-95-0x00007FF6A3360000-0x00007FF6A36B4000-memory.dmp	UPX
behavioral2/files/0x00070000000233dc-100.dat	UPX
behavioral2/files/0x00070000000233dd-106.dat	UPX
behavioral2/memory/1872-102-0x00007FF7930C0000-0x00007FF793414000-memory.dmp	UPX
behavioral2/files/0x00070000000233de-111.dat	UPX
behavioral2/memory/3680-120-0x00007FF6AC7B0000-0x00007FF6ACB04000-memory.dmp	UPX
behavioral2/files/0x00070000000233e0-124.dat	UPX
behavioral2/memory/4080-129-0x00007FF7B6B40000-0x00007FF7B6E94000-memory.dmp	UPX
behavioral2/files/0x00070000000233e2-131.dat	UPX
behavioral2/memory/1276-130-0x00007FF6938B0000-0x00007FF693C04000-memory.dmp	UPX
behavioral2/memory/3512-123-0x00007FF7C14A0000-0x00007FF7C17F4000-memory.dmp	UPX
behavioral2/files/0x00070000000233df-118.dat	UPX
behavioral2/memory/1424-112-0x00007FF621DA0000-0x00007FF6220F4000-memory.dmp	UPX
behavioral2/memory/3168-110-0x00007FF657760000-0x00007FF657AB4000-memory.dmp	UPX
behavioral2/memory/3760-133-0x00007FF78C8E0000-0x00007FF78CC34000-memory.dmp	UPX
behavioral2/memory/4900-134-0x00007FF7ED1A0000-0x00007FF7ED4F4000-memory.dmp	UPX
behavioral2/memory/3596-135-0x00007FF700F30000-0x00007FF701284000-memory.dmp	UPX
behavioral2/memory/1180-136-0x00007FF6A3360000-0x00007FF6A36B4000-memory.dmp	UPX
behavioral2/memory/1276-137-0x00007FF6938B0000-0x00007FF693C04000-memory.dmp	UPX
behavioral2/memory/2948-138-0x00007FF765AD0000-0x00007FF765E24000-memory.dmp	UPX
behavioral2/memory/5020-139-0x00007FF665C60000-0x00007FF665FB4000-memory.dmp	UPX
behavioral2/memory/3492-140-0x00007FF7FF1E0000-0x00007FF7FF534000-memory.dmp	UPX
behavioral2/memory/216-141-0x00007FF7EDE70000-0x00007FF7EE1C4000-memory.dmp	UPX
behavioral2/memory/2888-142-0x00007FF6230E0000-0x00007FF623434000-memory.dmp	UPX
behavioral2/memory/808-143-0x00007FF6CDC90000-0x00007FF6CDFE4000-memory.dmp	UPX
behavioral2/memory/1080-144-0x00007FF7A9990000-0x00007FF7A9CE4000-memory.dmp	UPX
behavioral2/memory/3168-145-0x00007FF657760000-0x00007FF657AB4000-memory.dmp	UPX
behavioral2/memory/3680-146-0x00007FF6AC7B0000-0x00007FF6ACB04000-memory.dmp	UPX
behavioral2/memory/5080-147-0x00007FF76F560000-0x00007FF76F8B4000-memory.dmp	UPX
behavioral2/memory/844-148-0x00007FF61C200000-0x00007FF61C554000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1624-0-0x00007FF6063C0000-0x00007FF606714000-memory.dmp	xmrig
behavioral2/files/0x00090000000233c2-4.dat	xmrig
behavioral2/memory/2948-8-0x00007FF765AD0000-0x00007FF765E24000-memory.dmp	xmrig
behavioral2/files/0x00070000000233ce-11.dat	xmrig
behavioral2/memory/5020-12-0x00007FF665C60000-0x00007FF665FB4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233cf-10.dat	xmrig
behavioral2/memory/3492-20-0x00007FF7FF1E0000-0x00007FF7FF534000-memory.dmp	xmrig
behavioral2/files/0x00090000000233c4-22.dat	xmrig
behavioral2/memory/216-26-0x00007FF7EDE70000-0x00007FF7EE1C4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d1-28.dat	xmrig
behavioral2/files/0x00070000000233d2-36.dat	xmrig
behavioral2/memory/2888-34-0x00007FF6230E0000-0x00007FF623434000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d3-42.dat	xmrig
behavioral2/memory/808-40-0x00007FF6CDC90000-0x00007FF6CDFE4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d4-48.dat	xmrig
behavioral2/memory/1080-46-0x00007FF7A9990000-0x00007FF7A9CE4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d5-54.dat	xmrig
behavioral2/memory/3168-50-0x00007FF657760000-0x00007FF657AB4000-memory.dmp	xmrig
behavioral2/memory/3680-56-0x00007FF6AC7B0000-0x00007FF6ACB04000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d6-59.dat	xmrig
behavioral2/files/0x00070000000233d7-66.dat	xmrig
behavioral2/files/0x00070000000233d8-71.dat	xmrig
behavioral2/memory/2948-72-0x00007FF765AD0000-0x00007FF765E24000-memory.dmp	xmrig
behavioral2/memory/5080-68-0x00007FF76F560000-0x00007FF76F8B4000-memory.dmp	xmrig
behavioral2/memory/1624-62-0x00007FF6063C0000-0x00007FF606714000-memory.dmp	xmrig
behavioral2/memory/3492-81-0x00007FF7FF1E0000-0x00007FF7FF534000-memory.dmp	xmrig
behavioral2/memory/4900-85-0x00007FF7ED1A0000-0x00007FF7ED4F4000-memory.dmp	xmrig
behavioral2/memory/3596-87-0x00007FF700F30000-0x00007FF701284000-memory.dmp	xmrig
behavioral2/files/0x00070000000233da-88.dat	xmrig
behavioral2/files/0x00070000000233d9-86.dat	xmrig
behavioral2/memory/5020-79-0x00007FF665C60000-0x00007FF665FB4000-memory.dmp	xmrig
behavioral2/memory/4480-77-0x00007FF770680000-0x00007FF7709D4000-memory.dmp	xmrig
behavioral2/memory/844-75-0x00007FF61C200000-0x00007FF61C554000-memory.dmp	xmrig
behavioral2/files/0x00070000000233db-94.dat	xmrig
behavioral2/memory/1180-95-0x00007FF6A3360000-0x00007FF6A36B4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233dc-100.dat	xmrig
behavioral2/files/0x00070000000233dd-106.dat	xmrig
behavioral2/memory/1872-102-0x00007FF7930C0000-0x00007FF793414000-memory.dmp	xmrig
behavioral2/files/0x00070000000233de-111.dat	xmrig
behavioral2/memory/3680-120-0x00007FF6AC7B0000-0x00007FF6ACB04000-memory.dmp	xmrig
behavioral2/files/0x00070000000233e0-124.dat	xmrig
behavioral2/memory/4080-129-0x00007FF7B6B40000-0x00007FF7B6E94000-memory.dmp	xmrig
behavioral2/files/0x00070000000233e2-131.dat	xmrig
behavioral2/memory/1276-130-0x00007FF6938B0000-0x00007FF693C04000-memory.dmp	xmrig
behavioral2/memory/3512-123-0x00007FF7C14A0000-0x00007FF7C17F4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233df-118.dat	xmrig
behavioral2/memory/1424-112-0x00007FF621DA0000-0x00007FF6220F4000-memory.dmp	xmrig
behavioral2/memory/3168-110-0x00007FF657760000-0x00007FF657AB4000-memory.dmp	xmrig
behavioral2/memory/3760-133-0x00007FF78C8E0000-0x00007FF78CC34000-memory.dmp	xmrig
behavioral2/memory/4900-134-0x00007FF7ED1A0000-0x00007FF7ED4F4000-memory.dmp	xmrig
behavioral2/memory/3596-135-0x00007FF700F30000-0x00007FF701284000-memory.dmp	xmrig
behavioral2/memory/1180-136-0x00007FF6A3360000-0x00007FF6A36B4000-memory.dmp	xmrig
behavioral2/memory/1276-137-0x00007FF6938B0000-0x00007FF693C04000-memory.dmp	xmrig
behavioral2/memory/2948-138-0x00007FF765AD0000-0x00007FF765E24000-memory.dmp	xmrig
behavioral2/memory/5020-139-0x00007FF665C60000-0x00007FF665FB4000-memory.dmp	xmrig
behavioral2/memory/3492-140-0x00007FF7FF1E0000-0x00007FF7FF534000-memory.dmp	xmrig
behavioral2/memory/216-141-0x00007FF7EDE70000-0x00007FF7EE1C4000-memory.dmp	xmrig
behavioral2/memory/2888-142-0x00007FF6230E0000-0x00007FF623434000-memory.dmp	xmrig
behavioral2/memory/808-143-0x00007FF6CDC90000-0x00007FF6CDFE4000-memory.dmp	xmrig
behavioral2/memory/1080-144-0x00007FF7A9990000-0x00007FF7A9CE4000-memory.dmp	xmrig
behavioral2/memory/3168-145-0x00007FF657760000-0x00007FF657AB4000-memory.dmp	xmrig
behavioral2/memory/3680-146-0x00007FF6AC7B0000-0x00007FF6ACB04000-memory.dmp	xmrig
behavioral2/memory/5080-147-0x00007FF76F560000-0x00007FF76F8B4000-memory.dmp	xmrig
behavioral2/memory/844-148-0x00007FF61C200000-0x00007FF61C554000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2948	XrGpkzS.exe
5020	biTZIfq.exe
3492	LsbwDrB.exe
216	kgWOEvz.exe
2888	pNvRkpa.exe
808	kmZbQdZ.exe
1080	LWlUQSm.exe
3168	DTcnDma.exe
3680	nAXVsbi.exe
5080	wvPXhQb.exe
844	foIAjUd.exe
4480	UMqNaQR.exe
4900	rCQrhkD.exe
3596	JzAXloc.exe
1180	UNmQcMq.exe
1872	XkvVGau.exe
1424	yzaQdKQ.exe
3512	vuSwRvd.exe
4080	OUvcRvr.exe
3760	NiGGyBY.exe
1276	XqEVTuD.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1624-0-0x00007FF6063C0000-0x00007FF606714000-memory.dmp	upx
behavioral2/files/0x00090000000233c2-4.dat	upx
behavioral2/memory/2948-8-0x00007FF765AD0000-0x00007FF765E24000-memory.dmp	upx
behavioral2/files/0x00070000000233ce-11.dat	upx
behavioral2/memory/5020-12-0x00007FF665C60000-0x00007FF665FB4000-memory.dmp	upx
behavioral2/files/0x00070000000233cf-10.dat	upx
behavioral2/memory/3492-20-0x00007FF7FF1E0000-0x00007FF7FF534000-memory.dmp	upx
behavioral2/files/0x00090000000233c4-22.dat	upx
behavioral2/memory/216-26-0x00007FF7EDE70000-0x00007FF7EE1C4000-memory.dmp	upx
behavioral2/files/0x00070000000233d1-28.dat	upx
behavioral2/files/0x00070000000233d2-36.dat	upx
behavioral2/memory/2888-34-0x00007FF6230E0000-0x00007FF623434000-memory.dmp	upx
behavioral2/files/0x00070000000233d3-42.dat	upx
behavioral2/memory/808-40-0x00007FF6CDC90000-0x00007FF6CDFE4000-memory.dmp	upx
behavioral2/files/0x00070000000233d4-48.dat	upx
behavioral2/memory/1080-46-0x00007FF7A9990000-0x00007FF7A9CE4000-memory.dmp	upx
behavioral2/files/0x00070000000233d5-54.dat	upx
behavioral2/memory/3168-50-0x00007FF657760000-0x00007FF657AB4000-memory.dmp	upx
behavioral2/memory/3680-56-0x00007FF6AC7B0000-0x00007FF6ACB04000-memory.dmp	upx
behavioral2/files/0x00070000000233d6-59.dat	upx
behavioral2/files/0x00070000000233d7-66.dat	upx
behavioral2/files/0x00070000000233d8-71.dat	upx
behavioral2/memory/2948-72-0x00007FF765AD0000-0x00007FF765E24000-memory.dmp	upx
behavioral2/memory/5080-68-0x00007FF76F560000-0x00007FF76F8B4000-memory.dmp	upx
behavioral2/memory/1624-62-0x00007FF6063C0000-0x00007FF606714000-memory.dmp	upx
behavioral2/memory/3492-81-0x00007FF7FF1E0000-0x00007FF7FF534000-memory.dmp	upx
behavioral2/memory/4900-85-0x00007FF7ED1A0000-0x00007FF7ED4F4000-memory.dmp	upx
behavioral2/memory/3596-87-0x00007FF700F30000-0x00007FF701284000-memory.dmp	upx
behavioral2/files/0x00070000000233da-88.dat	upx
behavioral2/files/0x00070000000233d9-86.dat	upx
behavioral2/memory/5020-79-0x00007FF665C60000-0x00007FF665FB4000-memory.dmp	upx
behavioral2/memory/4480-77-0x00007FF770680000-0x00007FF7709D4000-memory.dmp	upx
behavioral2/memory/844-75-0x00007FF61C200000-0x00007FF61C554000-memory.dmp	upx
behavioral2/files/0x00070000000233db-94.dat	upx
behavioral2/memory/1180-95-0x00007FF6A3360000-0x00007FF6A36B4000-memory.dmp	upx
behavioral2/files/0x00070000000233dc-100.dat	upx
behavioral2/files/0x00070000000233dd-106.dat	upx
behavioral2/memory/1872-102-0x00007FF7930C0000-0x00007FF793414000-memory.dmp	upx
behavioral2/files/0x00070000000233de-111.dat	upx
behavioral2/memory/3680-120-0x00007FF6AC7B0000-0x00007FF6ACB04000-memory.dmp	upx
behavioral2/files/0x00070000000233e0-124.dat	upx
behavioral2/memory/4080-129-0x00007FF7B6B40000-0x00007FF7B6E94000-memory.dmp	upx
behavioral2/files/0x00070000000233e2-131.dat	upx
behavioral2/memory/1276-130-0x00007FF6938B0000-0x00007FF693C04000-memory.dmp	upx
behavioral2/memory/3512-123-0x00007FF7C14A0000-0x00007FF7C17F4000-memory.dmp	upx
behavioral2/files/0x00070000000233df-118.dat	upx
behavioral2/memory/1424-112-0x00007FF621DA0000-0x00007FF6220F4000-memory.dmp	upx
behavioral2/memory/3168-110-0x00007FF657760000-0x00007FF657AB4000-memory.dmp	upx
behavioral2/memory/3760-133-0x00007FF78C8E0000-0x00007FF78CC34000-memory.dmp	upx
behavioral2/memory/4900-134-0x00007FF7ED1A0000-0x00007FF7ED4F4000-memory.dmp	upx
behavioral2/memory/3596-135-0x00007FF700F30000-0x00007FF701284000-memory.dmp	upx
behavioral2/memory/1180-136-0x00007FF6A3360000-0x00007FF6A36B4000-memory.dmp	upx
behavioral2/memory/1276-137-0x00007FF6938B0000-0x00007FF693C04000-memory.dmp	upx
behavioral2/memory/2948-138-0x00007FF765AD0000-0x00007FF765E24000-memory.dmp	upx
behavioral2/memory/5020-139-0x00007FF665C60000-0x00007FF665FB4000-memory.dmp	upx
behavioral2/memory/3492-140-0x00007FF7FF1E0000-0x00007FF7FF534000-memory.dmp	upx
behavioral2/memory/216-141-0x00007FF7EDE70000-0x00007FF7EE1C4000-memory.dmp	upx
behavioral2/memory/2888-142-0x00007FF6230E0000-0x00007FF623434000-memory.dmp	upx
behavioral2/memory/808-143-0x00007FF6CDC90000-0x00007FF6CDFE4000-memory.dmp	upx
behavioral2/memory/1080-144-0x00007FF7A9990000-0x00007FF7A9CE4000-memory.dmp	upx
behavioral2/memory/3168-145-0x00007FF657760000-0x00007FF657AB4000-memory.dmp	upx
behavioral2/memory/3680-146-0x00007FF6AC7B0000-0x00007FF6ACB04000-memory.dmp	upx
behavioral2/memory/5080-147-0x00007FF76F560000-0x00007FF76F8B4000-memory.dmp	upx
behavioral2/memory/844-148-0x00007FF61C200000-0x00007FF61C554000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\kmZbQdZ.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DTcnDma.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vuSwRvd.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OUvcRvr.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XrGpkzS.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LsbwDrB.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rCQrhkD.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\foIAjUd.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UMqNaQR.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nAXVsbi.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wvPXhQb.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XkvVGau.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\biTZIfq.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kgWOEvz.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JzAXloc.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UNmQcMq.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yzaQdKQ.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NiGGyBY.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XqEVTuD.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pNvRkpa.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LWlUQSm.exe	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2948	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	83
PID 1624 wrote to memory of 2948	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	83
PID 1624 wrote to memory of 5020	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	85
PID 1624 wrote to memory of 5020	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	85
PID 1624 wrote to memory of 3492	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	87
PID 1624 wrote to memory of 3492	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	87
PID 1624 wrote to memory of 216	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	88
PID 1624 wrote to memory of 216	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	88
PID 1624 wrote to memory of 2888	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	89
PID 1624 wrote to memory of 2888	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	89
PID 1624 wrote to memory of 808	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	91
PID 1624 wrote to memory of 808	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	91
PID 1624 wrote to memory of 1080	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	92
PID 1624 wrote to memory of 1080	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	92
PID 1624 wrote to memory of 3168	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	93
PID 1624 wrote to memory of 3168	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	93
PID 1624 wrote to memory of 3680	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	94
PID 1624 wrote to memory of 3680	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	94
PID 1624 wrote to memory of 5080	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	95
PID 1624 wrote to memory of 5080	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	95
PID 1624 wrote to memory of 844	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	97
PID 1624 wrote to memory of 844	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	97
PID 1624 wrote to memory of 4480	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	98
PID 1624 wrote to memory of 4480	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	98
PID 1624 wrote to memory of 4900	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	99
PID 1624 wrote to memory of 4900	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	99
PID 1624 wrote to memory of 3596	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	101
PID 1624 wrote to memory of 3596	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	101
PID 1624 wrote to memory of 1180	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	102
PID 1624 wrote to memory of 1180	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	102
PID 1624 wrote to memory of 1872	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	103
PID 1624 wrote to memory of 1872	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	103
PID 1624 wrote to memory of 1424	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	105
PID 1624 wrote to memory of 1424	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	105
PID 1624 wrote to memory of 3512	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	106
PID 1624 wrote to memory of 3512	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	106
PID 1624 wrote to memory of 4080	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	107
PID 1624 wrote to memory of 4080	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	107
PID 1624 wrote to memory of 3760	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	108
PID 1624 wrote to memory of 3760	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	108
PID 1624 wrote to memory of 1276	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	109
PID 1624 wrote to memory of 1276	1624	2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe	109

C:\Users\Admin\AppData\Local\Temp\2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_d0e80d1a3de846dfeba8e306117bbba1_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\System\XrGpkzS.exe
  C:\Windows\System\XrGpkzS.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\biTZIfq.exe
  C:\Windows\System\biTZIfq.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\LsbwDrB.exe
  C:\Windows\System\LsbwDrB.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\kgWOEvz.exe
  C:\Windows\System\kgWOEvz.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\pNvRkpa.exe
  C:\Windows\System\pNvRkpa.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\kmZbQdZ.exe
  C:\Windows\System\kmZbQdZ.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\LWlUQSm.exe
  C:\Windows\System\LWlUQSm.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\DTcnDma.exe
  C:\Windows\System\DTcnDma.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\nAXVsbi.exe
  C:\Windows\System\nAXVsbi.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\wvPXhQb.exe
  C:\Windows\System\wvPXhQb.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\foIAjUd.exe
  C:\Windows\System\foIAjUd.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\UMqNaQR.exe
  C:\Windows\System\UMqNaQR.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\rCQrhkD.exe
  C:\Windows\System\rCQrhkD.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\JzAXloc.exe
  C:\Windows\System\JzAXloc.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\UNmQcMq.exe
  C:\Windows\System\UNmQcMq.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\XkvVGau.exe
  C:\Windows\System\XkvVGau.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\yzaQdKQ.exe
  C:\Windows\System\yzaQdKQ.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\vuSwRvd.exe
  C:\Windows\System\vuSwRvd.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\OUvcRvr.exe
  C:\Windows\System\OUvcRvr.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\NiGGyBY.exe
  C:\Windows\System\NiGGyBY.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\XqEVTuD.exe
  C:\Windows\System\XqEVTuD.exe
  2⤵
  - Executes dropped EXE
  PID:1276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DTcnDma.exe

Path C:\Windows\System\DTcnDma.exe
Size 5.9MB
SHA256 f35b7f5be398f1d5d229df4758d0c35015969807d1bd62b44499d60edfdf9735
MD5 c1a08c171a9b50c6708c27821ed04b35
SHA1 34c9f11cb410688bb177baf7ed913b9ae8d994b0
SHA512 5721bb93e22779ab4e505e2b493fae4be5228f039adb141984dcdbe68fa3e415c4ea9fd12a70f2cf78945517055e5aecd62ef1221eee96d786789b19350bc59d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

JzAXloc.exe

Path C:\Windows\System\JzAXloc.exe
Size 5.9MB
SHA256 bf50694c1cbdf473b95d606e69874c864213f2eb5d22bef2be4d8c7c1c6e8fac
MD5 dcc2c8ab0ba2eab0e11fe0b46b5f335f
SHA1 15889cd1a6907baf63a93dd7c94d4c3e80473724
SHA512 f9583ab9ab4f7a0eddd071230d1bb7fa6bf8b24c0f585ab57d0860f09ca779eb7faf19bfc81f94ed57bd90bef6df42aeffe7c25f27a56987ab232ffecbb3b417
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

LWlUQSm.exe

Path C:\Windows\System\LWlUQSm.exe
Size 5.9MB
SHA256 780798fd278ed49993c81141b318171680c73db1f545d87120e948e8579671ad
MD5 ea209f141d653844dafd8771010ffc5d
SHA1 85c1ccde9571da5ee6caef3cbf6734e6669a9ed0
SHA512 23894c2104fe2489ff4a202160c95c2762fcfa7f41df841e6d8ff65d41404529167d862cfacab1623830c0b5e9aec1ef6477e849e91a7d99730c45d14c9e9da6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

LsbwDrB.exe

Path C:\Windows\System\LsbwDrB.exe
Size 5.9MB
SHA256 8ac39694c21799c925a08efd4d4075928f66c4321ba51cd4e6cb04460f789621
MD5 e05cba09092edeefd44006cf508d814a
SHA1 111a9b105455cf188f7daa0f8178f3571d1a700a
SHA512 e5df02df658751bb9bdf6b7bd599e70c8086ac71942c8bcaf09ca9b4521589d160a71e9ac115777a77975184cb262fa6f94497dff0d25ad1776820f2159f54ba
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

NiGGyBY.exe

Path C:\Windows\System\NiGGyBY.exe
Size 5.9MB
SHA256 4d5c3122e3133b437c4ba4be2d2dd100d788c0d05b2ec0f678bd5b306f9080ed
MD5 dcffd4131840235c385091a411ef9b47
SHA1 8549452e5456a374fe7cd7bf0ade338e776a8a95
SHA512 5c812130f377c394086290152a1e204c5707c1bed9f38aa41cc44f58a06f095412e600beda7927a442c513bb45267385e0a2a9c5820675fae781a5470113f8be
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

OUvcRvr.exe

Path C:\Windows\System\OUvcRvr.exe
Size 5.9MB
SHA256 e1e6370767850686d65fc0cbe657fb5dd8d356934b41b2f798d0dd62241fa3b1
MD5 41e00da7e62f958a6924f10c8cc31043
SHA1 b9ed589fd34c536bf4a74e9f3e84d7b7ba88a76d
SHA512 225cb81889ad471f7a52e630fe35cef3f859ed0c0d6d41c89260cb51abfceb4b16929ea4a38f4b22fc4e9160d6830cea6a007b9eeb6bc9ee57f166ef83e0cce3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

UMqNaQR.exe

Path C:\Windows\System\UMqNaQR.exe
Size 5.9MB
SHA256 e7ad5e9bd2c6fee040ab377f956d62815b3e338bf0e1a11d3287965dae4f0615
MD5 75f661728b463b0cd98f875e0aba61dd
SHA1 e42c3e1ca066e03c7e30ab03e2a55eeb4b4dac98
SHA512 a43fbd5c9c13bdfdc33d8c03bbb80577bf1a62a0e7e8b287e9c94e88619e18735868e71c6149e1d3f91b3dc290f15c29a14b0b433e1563bc04faf950718d0bcd
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

UNmQcMq.exe

Path C:\Windows\System\UNmQcMq.exe
Size 5.9MB
SHA256 29aef30b0ae231cb97f0053191830efd8573d3ed738409dc6bd6c37efede9d7b
MD5 2ab74f531c50c740648998cb00d86330
SHA1 1b7feed7ec0b94886ff81b10645b5296987c46f3
SHA512 989d5b6cf79f206c581dcb3fbe583825250fc4cdfef03e6051e031ebb0b88cb93a5980cb3f78c9f46cf1001b6c55c0f00a75122683dd81fa1d6b00a17b1c38a9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

XkvVGau.exe

Path C:\Windows\System\XkvVGau.exe
Size 5.9MB
SHA256 d2cd2cecd2edc5b6a4d64b386ff4f26209d4892abbde3e9d52aa68f4c3f657cf
MD5 7fe36223a28c02804e979a0ff6adf57c
SHA1 6ca25e3ee94840292cf6185a1a0d41659e97fc80
SHA512 b0980461fe15228f647b6c8337ada13dc87d4dcbd8b7816668cef5744866355ae01ffc6e927aa76b567cf2f6e43c1b74b65268f78b97890341bd6820ad2099a1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

XqEVTuD.exe

Path C:\Windows\System\XqEVTuD.exe
Size 5.9MB
SHA256 21cea4d16cfd40b02966cde2736a7d84c28e9ce58393897db36f83cc906a7e14
MD5 f1e53ca7241f19dfa8b4c70daa8a931c
SHA1 88e0c148a20975a958cc245d94fe72c00fafdbea
SHA512 a4762fb183ed8797ee9140113a0bb04875e14d4f784dfedcf58c4d4ae0e8a5cf40a1088edc0aa46c30046077476c3ba882785877a53e384ebd7e982d2120a0ab
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

XrGpkzS.exe

Path C:\Windows\System\XrGpkzS.exe
Size 5.9MB
SHA256 6c462c1e2b7b8b7f4369fbff709b4a8efee578d5cecaef94a68906f883d19f41
MD5 95ed6cf125bee7bf47a58697a7d8d66a
SHA1 ed6d43a3d6f9c95900c4ecf142670376fd7cf83c
SHA512 31f8be6d838fcb0e222b8f8a83cf22b595ad10333c23ac5238f0493d923217cc13f5b844a62d5adae2f2a962f51c30f9347369d79c282d25f9bced7620de0131
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

biTZIfq.exe

Path C:\Windows\System\biTZIfq.exe
Size 5.9MB
SHA256 ca9198b6deffc9f4921bfd9efc40d9adea0a9539d094b67c488fb1c5e797bf1c
MD5 740891fdf3450c6bfe8d33ab25ce49bd
SHA1 7f438604bc0b11d72d29eb810a01137bbe56300f
SHA512 693dbfe0d0d9cc69ec3eb7a7465bc460844549a795353a5717c9c9fe8e9592a3d9cf482a30accc261a33cac460899633703e5db5df168d25441a58afbbd67a2d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

foIAjUd.exe

Path C:\Windows\System\foIAjUd.exe
Size 5.9MB
SHA256 cc74191cdba1d1203a6de67dbe7a3f39c17aa9f0caba766a2271b5134d7cdbaa
MD5 82ac48377dec9c2d23d777b5a35628e1
SHA1 b7b3f253e47197f4c53dda4c6850c0c2ed365718
SHA512 5aed1e02dd31e336ace258326bb908f1a0550fcae1e6df99b23f93857d0527b998a33a05e651dd2fe887a546d68930d8dc5f35fd0bb3ffde64debf3865aac19a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

kgWOEvz.exe

Path C:\Windows\System\kgWOEvz.exe
Size 5.9MB
SHA256 9a8c057ed8552d5020e21547a2557c8522db9bed3949f7c1a8bfc0c328f478f3
MD5 b9de745d19ed4addc15b83777aef4c1e
SHA1 e33ef7ce516f468a54e18de52ad50fa2745d87a5
SHA512 34673d5a1b51abe15b3688177b0a39980863e8e4ebeac553aff576d4812c2d920ee3067ee3afe7e86274686fc411dc3c8464ae32f98bc1bffb4bd75920209359
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

kmZbQdZ.exe

Path C:\Windows\System\kmZbQdZ.exe
Size 5.9MB
SHA256 6d68654b606b24a908395c483d3b1989d72c198cacd29e1f3470d670927d8c11
MD5 e1ab2122b77af0e251eb88b9e14f7642
SHA1 86401585ea156fd3ec4ac6721a0ee6e5194d3a4f
SHA512 cf55dc2011277b7feb48765d0e13dc1470fd34000b008ecb916f6cf98a869e7da7acccb4fffa47ec20088981158429476a3a1012b8d213640b2fa63e5196727e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

nAXVsbi.exe

Path C:\Windows\System\nAXVsbi.exe
Size 5.9MB
SHA256 c8f24e937f3dbcab41c8d2a9acbbe57b8563525314c22de846d8f47107eedd97
MD5 dcd956e1f2c21470b7859bb7a149c276
SHA1 b2630ed10bf59df06be1258890b0ece35de7f4ae
SHA512 82a6ba0cdde55134c14c87817947e4ca782ee1850761b31cbed4ab69d5f5bcb75c5a2b90059d6a5c456a929bd0fe3bf22391e98d48c02ee66aecb5fa70195dca
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

pNvRkpa.exe

Path C:\Windows\System\pNvRkpa.exe
Size 5.9MB
SHA256 c87eee2d6b64051446b438da89287493ce423e96b892940c89e2c0ff0696eca7
MD5 7becae0f89c11c4f370d3b9567f6c58a
SHA1 0d539d4dafcccffb41250ec83c564c0fccf24803
SHA512 a2a41edaf73120cc656950b21845f47c8c576e11c3de783d157ee62ab5ff8a2c35b2865ed4ca018c754e784f28d6ae75a2a35de1498c275cbfb058dda609b482
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

rCQrhkD.exe

Path C:\Windows\System\rCQrhkD.exe
Size 5.9MB
SHA256 c4efc2a550f175d9cf0ab404d8ae876257f699929283c625b467defff3da0dd2
MD5 43850267deab112dd519786a7032f56c
SHA1 0e9272c834c616311c0f27fb9fb4e8d2a7e0d03f
SHA512 b55057bc4a054773bef02d0b1041ccd7379055f9ed6bc9cf7172e76d6e97d1cca4e1be6b2a1347ec8322f7fe88169ff6e44557a490e2a89e07175f45a8209061
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

vuSwRvd.exe

Path C:\Windows\System\vuSwRvd.exe
Size 5.9MB
SHA256 f6d7798c54f81119e89ec3ae6bc0fa02b063911c3646f990bcc37c7f1fea17db
MD5 d14c11a7fe55841dfee4bbd17dd089be
SHA1 5fbd520334161ccda38ad096741d5a2753ad290d
SHA512 b43d9e5c9e25fc6b545500a886f2aea92283d61bcc0a6aa2e8595a15ac249cc94f13f858186252c5a1287b9866399dba263f7801d2ff1df10ee35bce85bd07d7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

wvPXhQb.exe

Path C:\Windows\System\wvPXhQb.exe
Size 5.9MB
SHA256 318c025a2d92676a1fa603cae8d07b8e063d02dd7522b2566cfc6bbb1b2a226e
MD5 5470d6fb1b61605e4c92773bf47e63ad
SHA1 d2839d9836d1429d473c3cc789dc120329bc1484
SHA512 2e7148cf51bdcaf841c9e166fcfb96d000c59303b2eeba917fdc3eca894d74099d364f197ee17092b8d54fda08a4a2c3e443c5bd7f9a8f0504bdaf0daf69880b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

yzaQdKQ.exe

Path C:\Windows\System\yzaQdKQ.exe
Size 5.9MB
SHA256 5f0853d7f5f9660f50b24ae3d01ca2101fd7fc53eeb06813ce5979a4bb57c430
MD5 8a3a0a2ec5e633c1a01b0ddafc95b449
SHA1 5922817155d16240142969f3ae856480b4405689
SHA512 4b02b4dd7df265803709c491fc48aff77fdcfaa07b83bb0f35fc9303cb97067e422d20e42a4b65572b7288f5e35e48ff4e07e9f4900f0bf6abf1953495d2bdb1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/216-26-0x00007FF7EDE70000-0x00007FF7EE1C4000-memory.dmp

Download

memory/216-141-0x00007FF7EDE70000-0x00007FF7EE1C4000-memory.dmp

Download

memory/808-40-0x00007FF6CDC90000-0x00007FF6CDFE4000-memory.dmp

Download

memory/808-143-0x00007FF6CDC90000-0x00007FF6CDFE4000-memory.dmp

Download

memory/844-148-0x00007FF61C200000-0x00007FF61C554000-memory.dmp

Download

memory/844-75-0x00007FF61C200000-0x00007FF61C554000-memory.dmp

Download

memory/1080-144-0x00007FF7A9990000-0x00007FF7A9CE4000-memory.dmp

Download

memory/1080-46-0x00007FF7A9990000-0x00007FF7A9CE4000-memory.dmp

Download

memory/1180-95-0x00007FF6A3360000-0x00007FF6A36B4000-memory.dmp

Download

memory/1180-136-0x00007FF6A3360000-0x00007FF6A36B4000-memory.dmp

Download

memory/1180-152-0x00007FF6A3360000-0x00007FF6A36B4000-memory.dmp

Download

memory/1276-130-0x00007FF6938B0000-0x00007FF693C04000-memory.dmp

Download

memory/1276-137-0x00007FF6938B0000-0x00007FF693C04000-memory.dmp

Download

memory/1276-158-0x00007FF6938B0000-0x00007FF693C04000-memory.dmp

Download

memory/1424-112-0x00007FF621DA0000-0x00007FF6220F4000-memory.dmp

Download

memory/1424-154-0x00007FF621DA0000-0x00007FF6220F4000-memory.dmp

Download

memory/1624-0-0x00007FF6063C0000-0x00007FF606714000-memory.dmp

Download

memory/1624-62-0x00007FF6063C0000-0x00007FF606714000-memory.dmp

Download

memory/1624-1-0x0000021D6A740000-0x0000021D6A750000-memory.dmp

Download

memory/1872-153-0x00007FF7930C0000-0x00007FF793414000-memory.dmp

Download

memory/1872-102-0x00007FF7930C0000-0x00007FF793414000-memory.dmp

Download

memory/2888-142-0x00007FF6230E0000-0x00007FF623434000-memory.dmp

Download

memory/2888-34-0x00007FF6230E0000-0x00007FF623434000-memory.dmp

Download

memory/2948-138-0x00007FF765AD0000-0x00007FF765E24000-memory.dmp

Download

memory/2948-72-0x00007FF765AD0000-0x00007FF765E24000-memory.dmp

Download

memory/2948-8-0x00007FF765AD0000-0x00007FF765E24000-memory.dmp

Download

memory/3168-110-0x00007FF657760000-0x00007FF657AB4000-memory.dmp

Download

memory/3168-50-0x00007FF657760000-0x00007FF657AB4000-memory.dmp

Download

memory/3168-145-0x00007FF657760000-0x00007FF657AB4000-memory.dmp

Download

memory/3492-81-0x00007FF7FF1E0000-0x00007FF7FF534000-memory.dmp

Download

memory/3492-20-0x00007FF7FF1E0000-0x00007FF7FF534000-memory.dmp

Download

memory/3492-140-0x00007FF7FF1E0000-0x00007FF7FF534000-memory.dmp

Download

memory/3512-123-0x00007FF7C14A0000-0x00007FF7C17F4000-memory.dmp

Download

memory/3512-155-0x00007FF7C14A0000-0x00007FF7C17F4000-memory.dmp

Download

memory/3596-135-0x00007FF700F30000-0x00007FF701284000-memory.dmp

Download

memory/3596-151-0x00007FF700F30000-0x00007FF701284000-memory.dmp

Download

memory/3596-87-0x00007FF700F30000-0x00007FF701284000-memory.dmp

Download

memory/3680-146-0x00007FF6AC7B0000-0x00007FF6ACB04000-memory.dmp

Download

memory/3680-120-0x00007FF6AC7B0000-0x00007FF6ACB04000-memory.dmp

Download

memory/3680-56-0x00007FF6AC7B0000-0x00007FF6ACB04000-memory.dmp

Download

memory/3760-157-0x00007FF78C8E0000-0x00007FF78CC34000-memory.dmp

Download

memory/3760-133-0x00007FF78C8E0000-0x00007FF78CC34000-memory.dmp

Download

memory/4080-156-0x00007FF7B6B40000-0x00007FF7B6E94000-memory.dmp

Download

memory/4080-129-0x00007FF7B6B40000-0x00007FF7B6E94000-memory.dmp

Download

memory/4480-77-0x00007FF770680000-0x00007FF7709D4000-memory.dmp

Download

memory/4480-149-0x00007FF770680000-0x00007FF7709D4000-memory.dmp

Download

memory/4900-150-0x00007FF7ED1A0000-0x00007FF7ED4F4000-memory.dmp

Download

memory/4900-85-0x00007FF7ED1A0000-0x00007FF7ED4F4000-memory.dmp

Download

memory/4900-134-0x00007FF7ED1A0000-0x00007FF7ED4F4000-memory.dmp

Download

memory/5020-12-0x00007FF665C60000-0x00007FF665FB4000-memory.dmp

Download

memory/5020-139-0x00007FF665C60000-0x00007FF665FB4000-memory.dmp

Download

memory/5020-79-0x00007FF665C60000-0x00007FF665FB4000-memory.dmp

Download

memory/5080-147-0x00007FF76F560000-0x00007FF76F8B4000-memory.dmp

Download

memory/5080-68-0x00007FF76F560000-0x00007FF76F8B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads