cobaltstrike | 3838b4b1f192ca58fab79211267cc2ff8adc19e4f3cb9c6302411fc31b36e81e

Analysis

max time kernel
142s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 19:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240531-yb2ypabe79
SHA256 3838b4b1f192ca58fab79211267cc2ff8adc19e4f3cb9c6302411fc31b36e81e
MD5 8cff0ef27147f93ad8f3e609624fc04c
SHA1 180c0617e4f4d607e2e63a97a73901b60f9c7610
SHA512 6047ecceeab9366a55cb0841b798118d74410532f08a09eff673abeb16fa91d63abb74ddb7617bc585b003f4f510f23074144513ecf32eac1b1f25e3ded0e324
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000800000002326a-4.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002326d-11.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002326e-10.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023272-22.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023273-29.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023274-34.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023275-42.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023276-46.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023277-52.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023278-60.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023279-68.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002327a-72.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002327b-78.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002327c-82.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002327d-87.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002327e-93.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002327f-97.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023280-103.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023281-112.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023282-121.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023283-126.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000800000002326a-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002326d-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002326e-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023272-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023273-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023274-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023275-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023276-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023277-52.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023278-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023279-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002327a-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002327b-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002327c-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002327d-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002327e-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002327f-97.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023280-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023281-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023282-121.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023283-126.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4896-0-0x00007FF759EB0000-0x00007FF75A204000-memory.dmp	UPX
behavioral2/files/0x000800000002326a-4.dat	UPX
behavioral2/memory/4204-7-0x00007FF6A8460000-0x00007FF6A87B4000-memory.dmp	UPX
behavioral2/files/0x000800000002326d-11.dat	UPX
behavioral2/memory/4400-14-0x00007FF62F8B0000-0x00007FF62FC04000-memory.dmp	UPX
behavioral2/files/0x000800000002326e-10.dat	UPX
behavioral2/memory/3496-20-0x00007FF7BB110000-0x00007FF7BB464000-memory.dmp	UPX
behavioral2/files/0x0008000000023272-22.dat	UPX
behavioral2/memory/3312-26-0x00007FF71C2A0000-0x00007FF71C5F4000-memory.dmp	UPX
behavioral2/files/0x0007000000023273-29.dat	UPX
behavioral2/memory/4168-30-0x00007FF6C13D0000-0x00007FF6C1724000-memory.dmp	UPX
behavioral2/files/0x0007000000023274-34.dat	UPX
behavioral2/memory/1284-38-0x00007FF74DAD0000-0x00007FF74DE24000-memory.dmp	UPX
behavioral2/files/0x0007000000023275-42.dat	UPX
behavioral2/memory/4848-44-0x00007FF6297C0000-0x00007FF629B14000-memory.dmp	UPX
behavioral2/files/0x0007000000023276-46.dat	UPX
behavioral2/memory/1504-50-0x00007FF79D210000-0x00007FF79D564000-memory.dmp	UPX
behavioral2/files/0x0007000000023277-52.dat	UPX
behavioral2/files/0x0007000000023278-60.dat	UPX
behavioral2/memory/796-56-0x00007FF654E60000-0x00007FF6551B4000-memory.dmp	UPX
behavioral2/memory/4896-62-0x00007FF759EB0000-0x00007FF75A204000-memory.dmp	UPX
behavioral2/memory/4204-67-0x00007FF6A8460000-0x00007FF6A87B4000-memory.dmp	UPX
behavioral2/files/0x0007000000023279-68.dat	UPX
behavioral2/memory/1772-69-0x00007FF6C4180000-0x00007FF6C44D4000-memory.dmp	UPX
behavioral2/memory/3484-66-0x00007FF75AAC0000-0x00007FF75AE14000-memory.dmp	UPX
behavioral2/files/0x000700000002327a-72.dat	UPX
behavioral2/files/0x000700000002327b-78.dat	UPX
behavioral2/files/0x000700000002327c-82.dat	UPX
behavioral2/files/0x000700000002327d-87.dat	UPX
behavioral2/files/0x000700000002327e-93.dat	UPX
behavioral2/files/0x000700000002327f-97.dat	UPX
behavioral2/files/0x0007000000023280-103.dat	UPX
behavioral2/memory/3804-111-0x00007FF7C7BF0000-0x00007FF7C7F44000-memory.dmp	UPX
behavioral2/memory/4000-115-0x00007FF70F130000-0x00007FF70F484000-memory.dmp	UPX
behavioral2/memory/3872-117-0x00007FF73D410000-0x00007FF73D764000-memory.dmp	UPX
behavioral2/memory/3480-118-0x00007FF73B860000-0x00007FF73BBB4000-memory.dmp	UPX
behavioral2/memory/3624-116-0x00007FF71A690000-0x00007FF71A9E4000-memory.dmp	UPX
behavioral2/memory/1456-114-0x00007FF762920000-0x00007FF762C74000-memory.dmp	UPX
behavioral2/files/0x0007000000023281-112.dat	UPX
behavioral2/files/0x0007000000023282-121.dat	UPX
behavioral2/files/0x0007000000023283-126.dat	UPX
behavioral2/memory/3784-110-0x00007FF768CB0000-0x00007FF769004000-memory.dmp	UPX
behavioral2/memory/844-106-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp	UPX
behavioral2/memory/4560-128-0x00007FF72FF00000-0x00007FF730254000-memory.dmp	UPX
behavioral2/memory/4576-129-0x00007FF697C20000-0x00007FF697F74000-memory.dmp	UPX
behavioral2/memory/4168-130-0x00007FF6C13D0000-0x00007FF6C1724000-memory.dmp	UPX
behavioral2/memory/4848-131-0x00007FF6297C0000-0x00007FF629B14000-memory.dmp	UPX
behavioral2/memory/1504-132-0x00007FF79D210000-0x00007FF79D564000-memory.dmp	UPX
behavioral2/memory/1772-133-0x00007FF6C4180000-0x00007FF6C44D4000-memory.dmp	UPX
behavioral2/memory/4400-135-0x00007FF62F8B0000-0x00007FF62FC04000-memory.dmp	UPX
behavioral2/memory/4204-134-0x00007FF6A8460000-0x00007FF6A87B4000-memory.dmp	UPX
behavioral2/memory/3496-136-0x00007FF7BB110000-0x00007FF7BB464000-memory.dmp	UPX
behavioral2/memory/3312-137-0x00007FF71C2A0000-0x00007FF71C5F4000-memory.dmp	UPX
behavioral2/memory/4168-138-0x00007FF6C13D0000-0x00007FF6C1724000-memory.dmp	UPX
behavioral2/memory/1284-139-0x00007FF74DAD0000-0x00007FF74DE24000-memory.dmp	UPX
behavioral2/memory/4848-140-0x00007FF6297C0000-0x00007FF629B14000-memory.dmp	UPX
behavioral2/memory/1504-141-0x00007FF79D210000-0x00007FF79D564000-memory.dmp	UPX
behavioral2/memory/796-142-0x00007FF654E60000-0x00007FF6551B4000-memory.dmp	UPX
behavioral2/memory/3484-143-0x00007FF75AAC0000-0x00007FF75AE14000-memory.dmp	UPX
behavioral2/memory/844-144-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp	UPX
behavioral2/memory/3784-145-0x00007FF768CB0000-0x00007FF769004000-memory.dmp	UPX
behavioral2/memory/3804-146-0x00007FF7C7BF0000-0x00007FF7C7F44000-memory.dmp	UPX
behavioral2/memory/1456-147-0x00007FF762920000-0x00007FF762C74000-memory.dmp	UPX
behavioral2/memory/4000-148-0x00007FF70F130000-0x00007FF70F484000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4896-0-0x00007FF759EB0000-0x00007FF75A204000-memory.dmp	xmrig
behavioral2/files/0x000800000002326a-4.dat	xmrig
behavioral2/memory/4204-7-0x00007FF6A8460000-0x00007FF6A87B4000-memory.dmp	xmrig
behavioral2/files/0x000800000002326d-11.dat	xmrig
behavioral2/memory/4400-14-0x00007FF62F8B0000-0x00007FF62FC04000-memory.dmp	xmrig
behavioral2/files/0x000800000002326e-10.dat	xmrig
behavioral2/memory/3496-20-0x00007FF7BB110000-0x00007FF7BB464000-memory.dmp	xmrig
behavioral2/files/0x0008000000023272-22.dat	xmrig
behavioral2/memory/3312-26-0x00007FF71C2A0000-0x00007FF71C5F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023273-29.dat	xmrig
behavioral2/memory/4168-30-0x00007FF6C13D0000-0x00007FF6C1724000-memory.dmp	xmrig
behavioral2/files/0x0007000000023274-34.dat	xmrig
behavioral2/memory/1284-38-0x00007FF74DAD0000-0x00007FF74DE24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023275-42.dat	xmrig
behavioral2/memory/4848-44-0x00007FF6297C0000-0x00007FF629B14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023276-46.dat	xmrig
behavioral2/memory/1504-50-0x00007FF79D210000-0x00007FF79D564000-memory.dmp	xmrig
behavioral2/files/0x0007000000023277-52.dat	xmrig
behavioral2/files/0x0007000000023278-60.dat	xmrig
behavioral2/memory/796-56-0x00007FF654E60000-0x00007FF6551B4000-memory.dmp	xmrig
behavioral2/memory/4896-62-0x00007FF759EB0000-0x00007FF75A204000-memory.dmp	xmrig
behavioral2/memory/4204-67-0x00007FF6A8460000-0x00007FF6A87B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023279-68.dat	xmrig
behavioral2/memory/1772-69-0x00007FF6C4180000-0x00007FF6C44D4000-memory.dmp	xmrig
behavioral2/memory/3484-66-0x00007FF75AAC0000-0x00007FF75AE14000-memory.dmp	xmrig
behavioral2/files/0x000700000002327a-72.dat	xmrig
behavioral2/files/0x000700000002327b-78.dat	xmrig
behavioral2/files/0x000700000002327c-82.dat	xmrig
behavioral2/files/0x000700000002327d-87.dat	xmrig
behavioral2/files/0x000700000002327e-93.dat	xmrig
behavioral2/files/0x000700000002327f-97.dat	xmrig
behavioral2/files/0x0007000000023280-103.dat	xmrig
behavioral2/memory/3804-111-0x00007FF7C7BF0000-0x00007FF7C7F44000-memory.dmp	xmrig
behavioral2/memory/4000-115-0x00007FF70F130000-0x00007FF70F484000-memory.dmp	xmrig
behavioral2/memory/3872-117-0x00007FF73D410000-0x00007FF73D764000-memory.dmp	xmrig
behavioral2/memory/3480-118-0x00007FF73B860000-0x00007FF73BBB4000-memory.dmp	xmrig
behavioral2/memory/3624-116-0x00007FF71A690000-0x00007FF71A9E4000-memory.dmp	xmrig
behavioral2/memory/1456-114-0x00007FF762920000-0x00007FF762C74000-memory.dmp	xmrig
behavioral2/files/0x0007000000023281-112.dat	xmrig
behavioral2/files/0x0007000000023282-121.dat	xmrig
behavioral2/files/0x0007000000023283-126.dat	xmrig
behavioral2/memory/3784-110-0x00007FF768CB0000-0x00007FF769004000-memory.dmp	xmrig
behavioral2/memory/844-106-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp	xmrig
behavioral2/memory/4560-128-0x00007FF72FF00000-0x00007FF730254000-memory.dmp	xmrig
behavioral2/memory/4576-129-0x00007FF697C20000-0x00007FF697F74000-memory.dmp	xmrig
behavioral2/memory/4168-130-0x00007FF6C13D0000-0x00007FF6C1724000-memory.dmp	xmrig
behavioral2/memory/4848-131-0x00007FF6297C0000-0x00007FF629B14000-memory.dmp	xmrig
behavioral2/memory/1504-132-0x00007FF79D210000-0x00007FF79D564000-memory.dmp	xmrig
behavioral2/memory/1772-133-0x00007FF6C4180000-0x00007FF6C44D4000-memory.dmp	xmrig
behavioral2/memory/4400-135-0x00007FF62F8B0000-0x00007FF62FC04000-memory.dmp	xmrig
behavioral2/memory/4204-134-0x00007FF6A8460000-0x00007FF6A87B4000-memory.dmp	xmrig
behavioral2/memory/3496-136-0x00007FF7BB110000-0x00007FF7BB464000-memory.dmp	xmrig
behavioral2/memory/3312-137-0x00007FF71C2A0000-0x00007FF71C5F4000-memory.dmp	xmrig
behavioral2/memory/4168-138-0x00007FF6C13D0000-0x00007FF6C1724000-memory.dmp	xmrig
behavioral2/memory/1284-139-0x00007FF74DAD0000-0x00007FF74DE24000-memory.dmp	xmrig
behavioral2/memory/4848-140-0x00007FF6297C0000-0x00007FF629B14000-memory.dmp	xmrig
behavioral2/memory/1504-141-0x00007FF79D210000-0x00007FF79D564000-memory.dmp	xmrig
behavioral2/memory/796-142-0x00007FF654E60000-0x00007FF6551B4000-memory.dmp	xmrig
behavioral2/memory/3484-143-0x00007FF75AAC0000-0x00007FF75AE14000-memory.dmp	xmrig
behavioral2/memory/844-144-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp	xmrig
behavioral2/memory/3784-145-0x00007FF768CB0000-0x00007FF769004000-memory.dmp	xmrig
behavioral2/memory/3804-146-0x00007FF7C7BF0000-0x00007FF7C7F44000-memory.dmp	xmrig
behavioral2/memory/1456-147-0x00007FF762920000-0x00007FF762C74000-memory.dmp	xmrig
behavioral2/memory/4000-148-0x00007FF70F130000-0x00007FF70F484000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4204	wIJIrQg.exe
4400	XBlWuYg.exe
3496	KWSFCmY.exe
3312	CpTzhFV.exe
4168	mzuJtYK.exe
1284	APzMBCc.exe
4848	RTLQGPr.exe
1504	QcAqoaa.exe
796	ZEStXmE.exe
3484	UVuPIVc.exe
1772	kVXvzpw.exe
844	SxbgNmV.exe
3784	jcegJhM.exe
3804	AdapZDy.exe
1456	GDDQDRo.exe
4000	TLdtTeM.exe
3624	JaZFsmm.exe
3872	eGbkvDZ.exe
3480	GKQUYPP.exe
4560	DMMhLdI.exe
4576	ljqzGHP.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4896-0-0x00007FF759EB0000-0x00007FF75A204000-memory.dmp	upx
behavioral2/files/0x000800000002326a-4.dat	upx
behavioral2/memory/4204-7-0x00007FF6A8460000-0x00007FF6A87B4000-memory.dmp	upx
behavioral2/files/0x000800000002326d-11.dat	upx
behavioral2/memory/4400-14-0x00007FF62F8B0000-0x00007FF62FC04000-memory.dmp	upx
behavioral2/files/0x000800000002326e-10.dat	upx
behavioral2/memory/3496-20-0x00007FF7BB110000-0x00007FF7BB464000-memory.dmp	upx
behavioral2/files/0x0008000000023272-22.dat	upx
behavioral2/memory/3312-26-0x00007FF71C2A0000-0x00007FF71C5F4000-memory.dmp	upx
behavioral2/files/0x0007000000023273-29.dat	upx
behavioral2/memory/4168-30-0x00007FF6C13D0000-0x00007FF6C1724000-memory.dmp	upx
behavioral2/files/0x0007000000023274-34.dat	upx
behavioral2/memory/1284-38-0x00007FF74DAD0000-0x00007FF74DE24000-memory.dmp	upx
behavioral2/files/0x0007000000023275-42.dat	upx
behavioral2/memory/4848-44-0x00007FF6297C0000-0x00007FF629B14000-memory.dmp	upx
behavioral2/files/0x0007000000023276-46.dat	upx
behavioral2/memory/1504-50-0x00007FF79D210000-0x00007FF79D564000-memory.dmp	upx
behavioral2/files/0x0007000000023277-52.dat	upx
behavioral2/files/0x0007000000023278-60.dat	upx
behavioral2/memory/796-56-0x00007FF654E60000-0x00007FF6551B4000-memory.dmp	upx
behavioral2/memory/4896-62-0x00007FF759EB0000-0x00007FF75A204000-memory.dmp	upx
behavioral2/memory/4204-67-0x00007FF6A8460000-0x00007FF6A87B4000-memory.dmp	upx
behavioral2/files/0x0007000000023279-68.dat	upx
behavioral2/memory/1772-69-0x00007FF6C4180000-0x00007FF6C44D4000-memory.dmp	upx
behavioral2/memory/3484-66-0x00007FF75AAC0000-0x00007FF75AE14000-memory.dmp	upx
behavioral2/files/0x000700000002327a-72.dat	upx
behavioral2/files/0x000700000002327b-78.dat	upx
behavioral2/files/0x000700000002327c-82.dat	upx
behavioral2/files/0x000700000002327d-87.dat	upx
behavioral2/files/0x000700000002327e-93.dat	upx
behavioral2/files/0x000700000002327f-97.dat	upx
behavioral2/files/0x0007000000023280-103.dat	upx
behavioral2/memory/3804-111-0x00007FF7C7BF0000-0x00007FF7C7F44000-memory.dmp	upx
behavioral2/memory/4000-115-0x00007FF70F130000-0x00007FF70F484000-memory.dmp	upx
behavioral2/memory/3872-117-0x00007FF73D410000-0x00007FF73D764000-memory.dmp	upx
behavioral2/memory/3480-118-0x00007FF73B860000-0x00007FF73BBB4000-memory.dmp	upx
behavioral2/memory/3624-116-0x00007FF71A690000-0x00007FF71A9E4000-memory.dmp	upx
behavioral2/memory/1456-114-0x00007FF762920000-0x00007FF762C74000-memory.dmp	upx
behavioral2/files/0x0007000000023281-112.dat	upx
behavioral2/files/0x0007000000023282-121.dat	upx
behavioral2/files/0x0007000000023283-126.dat	upx
behavioral2/memory/3784-110-0x00007FF768CB0000-0x00007FF769004000-memory.dmp	upx
behavioral2/memory/844-106-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp	upx
behavioral2/memory/4560-128-0x00007FF72FF00000-0x00007FF730254000-memory.dmp	upx
behavioral2/memory/4576-129-0x00007FF697C20000-0x00007FF697F74000-memory.dmp	upx
behavioral2/memory/4168-130-0x00007FF6C13D0000-0x00007FF6C1724000-memory.dmp	upx
behavioral2/memory/4848-131-0x00007FF6297C0000-0x00007FF629B14000-memory.dmp	upx
behavioral2/memory/1504-132-0x00007FF79D210000-0x00007FF79D564000-memory.dmp	upx
behavioral2/memory/1772-133-0x00007FF6C4180000-0x00007FF6C44D4000-memory.dmp	upx
behavioral2/memory/4400-135-0x00007FF62F8B0000-0x00007FF62FC04000-memory.dmp	upx
behavioral2/memory/4204-134-0x00007FF6A8460000-0x00007FF6A87B4000-memory.dmp	upx
behavioral2/memory/3496-136-0x00007FF7BB110000-0x00007FF7BB464000-memory.dmp	upx
behavioral2/memory/3312-137-0x00007FF71C2A0000-0x00007FF71C5F4000-memory.dmp	upx
behavioral2/memory/4168-138-0x00007FF6C13D0000-0x00007FF6C1724000-memory.dmp	upx
behavioral2/memory/1284-139-0x00007FF74DAD0000-0x00007FF74DE24000-memory.dmp	upx
behavioral2/memory/4848-140-0x00007FF6297C0000-0x00007FF629B14000-memory.dmp	upx
behavioral2/memory/1504-141-0x00007FF79D210000-0x00007FF79D564000-memory.dmp	upx
behavioral2/memory/796-142-0x00007FF654E60000-0x00007FF6551B4000-memory.dmp	upx
behavioral2/memory/3484-143-0x00007FF75AAC0000-0x00007FF75AE14000-memory.dmp	upx
behavioral2/memory/844-144-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp	upx
behavioral2/memory/3784-145-0x00007FF768CB0000-0x00007FF769004000-memory.dmp	upx
behavioral2/memory/3804-146-0x00007FF7C7BF0000-0x00007FF7C7F44000-memory.dmp	upx
behavioral2/memory/1456-147-0x00007FF762920000-0x00007FF762C74000-memory.dmp	upx
behavioral2/memory/4000-148-0x00007FF70F130000-0x00007FF70F484000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\KWSFCmY.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\APzMBCc.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QcAqoaa.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GDDQDRo.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TLdtTeM.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wIJIrQg.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CpTzhFV.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mzuJtYK.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RTLQGPr.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZEStXmE.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eGbkvDZ.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GKQUYPP.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XBlWuYg.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kVXvzpw.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jcegJhM.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ljqzGHP.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UVuPIVc.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AdapZDy.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JaZFsmm.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DMMhLdI.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SxbgNmV.exe	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4204	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	92
PID 4896 wrote to memory of 4204	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	92
PID 4896 wrote to memory of 4400	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	93
PID 4896 wrote to memory of 4400	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	93
PID 4896 wrote to memory of 3496	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	94
PID 4896 wrote to memory of 3496	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	94
PID 4896 wrote to memory of 3312	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	95
PID 4896 wrote to memory of 3312	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	95
PID 4896 wrote to memory of 4168	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	96
PID 4896 wrote to memory of 4168	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	96
PID 4896 wrote to memory of 1284	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	97
PID 4896 wrote to memory of 1284	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	97
PID 4896 wrote to memory of 4848	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	98
PID 4896 wrote to memory of 4848	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	98
PID 4896 wrote to memory of 1504	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	99
PID 4896 wrote to memory of 1504	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	99
PID 4896 wrote to memory of 796	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	100
PID 4896 wrote to memory of 796	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	100
PID 4896 wrote to memory of 3484	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	101
PID 4896 wrote to memory of 3484	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	101
PID 4896 wrote to memory of 1772	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	102
PID 4896 wrote to memory of 1772	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	102
PID 4896 wrote to memory of 844	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	103
PID 4896 wrote to memory of 844	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	103
PID 4896 wrote to memory of 3784	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	104
PID 4896 wrote to memory of 3784	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	104
PID 4896 wrote to memory of 3804	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	105
PID 4896 wrote to memory of 3804	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	105
PID 4896 wrote to memory of 1456	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	106
PID 4896 wrote to memory of 1456	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	106
PID 4896 wrote to memory of 4000	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	107
PID 4896 wrote to memory of 4000	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	107
PID 4896 wrote to memory of 3624	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	108
PID 4896 wrote to memory of 3624	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	108
PID 4896 wrote to memory of 3872	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	109
PID 4896 wrote to memory of 3872	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	109
PID 4896 wrote to memory of 3480	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	110
PID 4896 wrote to memory of 3480	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	110
PID 4896 wrote to memory of 4560	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	111
PID 4896 wrote to memory of 4560	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	111
PID 4896 wrote to memory of 4576	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	112
PID 4896 wrote to memory of 4576	4896	2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe	112

C:\Users\Admin\AppData\Local\Temp\2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_8cff0ef27147f93ad8f3e609624fc04c_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\System\wIJIrQg.exe
  C:\Windows\System\wIJIrQg.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\XBlWuYg.exe
  C:\Windows\System\XBlWuYg.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\KWSFCmY.exe
  C:\Windows\System\KWSFCmY.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\CpTzhFV.exe
  C:\Windows\System\CpTzhFV.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\mzuJtYK.exe
  C:\Windows\System\mzuJtYK.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\APzMBCc.exe
  C:\Windows\System\APzMBCc.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\RTLQGPr.exe
  C:\Windows\System\RTLQGPr.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\QcAqoaa.exe
  C:\Windows\System\QcAqoaa.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\ZEStXmE.exe
  C:\Windows\System\ZEStXmE.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\UVuPIVc.exe
  C:\Windows\System\UVuPIVc.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\kVXvzpw.exe
  C:\Windows\System\kVXvzpw.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\SxbgNmV.exe
  C:\Windows\System\SxbgNmV.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\jcegJhM.exe
  C:\Windows\System\jcegJhM.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\AdapZDy.exe
  C:\Windows\System\AdapZDy.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\GDDQDRo.exe
  C:\Windows\System\GDDQDRo.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\TLdtTeM.exe
  C:\Windows\System\TLdtTeM.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\JaZFsmm.exe
  C:\Windows\System\JaZFsmm.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\eGbkvDZ.exe
  C:\Windows\System\eGbkvDZ.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\GKQUYPP.exe
  C:\Windows\System\GKQUYPP.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\DMMhLdI.exe
  C:\Windows\System\DMMhLdI.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\ljqzGHP.exe
  C:\Windows\System\ljqzGHP.exe
  2⤵
  - Executes dropped EXE
  PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3704 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

APzMBCc.exe

Path C:\Windows\System\APzMBCc.exe
Size 5.9MB
SHA256 c65d3a1b6a020ed7e08176a99bce4057eb17e0cddb0f55026d7c2540ddb5a678
MD5 f10154059464fe61bcf1e45a9f0abe64
SHA1 499eace9169e425bb4603d0266ec97dba0739ebd
SHA512 14e3c74c642f321228bbe16bfe9dbdbcc9d2e9a2004388f1531ccad27e62a3c7009bb5d098e47a54cc8cad3b2a7f7ff42561970baf139a9221ecff74ca060e5b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

AdapZDy.exe

Path C:\Windows\System\AdapZDy.exe
Size 5.9MB
SHA256 bff65507e056c88f52a4696841716ada562f8e0860435a7a055b84c477646a6e
MD5 748527ecae7735cc7a81118926f68f8e
SHA1 75771c9f30c21e3d7fde43d6e60a9831d384caba
SHA512 ac5d260f320825b354bee36926ce1872a990659bd51fc61da949cb00cc6bc803f5836313e5a02b1f59a8bfbd0b3e6b44f2b231cf3bfd1056fe45eb6f640d4c57
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

CpTzhFV.exe

Path C:\Windows\System\CpTzhFV.exe
Size 5.9MB
SHA256 54d5ce27f605e8ace2e4415a6491346b5fe47788f58475d10b7ab5d80e9f0747
MD5 cd7f14e02aed25b4f04d4baec47e0939
SHA1 63fbc0810545ef5fe4c6420312a40ecd7fb9bd7a
SHA512 2f39aa88c32fb0cc1ff4e3894a27ecf9e9baeccd6a17431ab34650aefd76b5eb4f55c0252e6a8c16f5835fa99ce95a040ff8b5bf5643399bf376c0c4328bff39
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:Q+856utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

DMMhLdI.exe

Path C:\Windows\System\DMMhLdI.exe
Size 5.9MB
SHA256 6fe5ce99915108771849785386eba791e0860e190e9b89fdbadd6f10fab8762c
MD5 15eda19a36fed84deaef1c40aa0e1526
SHA1 af5b8033fa7cca0f4b1268a7f776e8fc784ee3c5
SHA512 f3b7468512340c3a90e75ed4d2310f26b6725634117bb99c749c61f6b57bf12109af8a3dca97fbdb3026518810359baa0e9626694a51129d9ee5227067aca5a3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

GDDQDRo.exe

Path C:\Windows\System\GDDQDRo.exe
Size 5.9MB
SHA256 3cf03bfc625e74b0549191640a9eab1ce6a305c0f89d7aa2ee3f2f1e2f27988c
MD5 bd27fd982be55ec21767bb6d95ce837a
SHA1 c9ce2b93db8413fe91335e40c654527eccfa5b9d
SHA512 85ecc26611061e3b928ba1c56b3d50ade3f7299d541524f920471beec8ab455d09df36a4b60fa7bb5747a74a272280b61229d5b7f4d5a1208a5292b064ba6f8b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

GKQUYPP.exe

Path C:\Windows\System\GKQUYPP.exe
Size 5.9MB
SHA256 e0bafd0317b538589ac68bb98664183c91a2c98bfa2b3fb0e81e69f43bbd8be7
MD5 6c9ccab2d50bd9e53a77fc867c396892
SHA1 c4656fbca455af6fc90ff9f18240d75523c701b0
SHA512 3852470f94883b2e5917538b54ba29bf4bde40829d425ca4b7da1416afbacec3f40c2ab290ee7b259b8f134621426700df0f1d20386ae43566eea5d8c52f89d0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

JaZFsmm.exe

Path C:\Windows\System\JaZFsmm.exe
Size 5.9MB
SHA256 65f544b8a8689fbe1ece23c84f3701cdf15d891b8286cdd0206d34fb76631e74
MD5 69d719957bf4653efbb72515f0afc762
SHA1 d1bde6477f79b87c356d727a4e14fd5170e24ad7
SHA512 54eacd8dd8de8d8cde31d520f438415f7d2e96595af8794a969f67ca22ce6faf21a56c805a76ff1fecbb5d8f6d33f6b5a52a3e070022de5850efb8ee3dda346d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

KWSFCmY.exe

Path C:\Windows\System\KWSFCmY.exe
Size 5.9MB
SHA256 7ea609b4ebebb3bbbac96449e368785f3093706a357bbf3260b230d467077e66
MD5 ab7dd3927efad2fc5c507e2abd0f2079
SHA1 58f42141f6c41b3629d1a2b58ec5fba058c47ab9
SHA512 5902c2cf5b78f3c78a00a8bc3a9fa7300c44c9084a85bcf2ad5424af188870ff9926beb14b12d77bf639ac5d7b4131c709e0dac385847f5d669bb5dd5101fa95
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

QcAqoaa.exe

Path C:\Windows\System\QcAqoaa.exe
Size 5.9MB
SHA256 a4d5361c221eb07696bcd482f163dfacb57e5e57cc4e7f98e5d73a28d31a0bac
MD5 c01267f7af75139bc1f725802627baf8
SHA1 9f229b9088d1d99aedd4b624150cfd6e11bd2f56
SHA512 ec8d648744f40ecccf8d43d5c7e30519b6b596cc4d19aeacd1b115039bf44cf1c36de7b9383e20256fbcc5452029e16b7ec8169b35c5c91ef24f082a2a2f2d32
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

RTLQGPr.exe

Path C:\Windows\System\RTLQGPr.exe
Size 5.9MB
SHA256 197f05179b86c03d74c0c7ed1d790bf9d9da09a2eca0b5789e67a7505b8ca65d
MD5 1522c6563f2a3f387e008e2a8fe6118d
SHA1 39972fa4df2bdf1cfa804ed4b2f2fc1c6d2c55f3
SHA512 680be7726493ac1b0dd36486ddcd62494cbe52b3f08ab31fd81c0c57aa0ff99d8e56d194c48b502669050753aa99a0c157f817e22d0636fc94a3cc58af926cec
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

SxbgNmV.exe

Path C:\Windows\System\SxbgNmV.exe
Size 5.9MB
SHA256 5b50f1dc6e1309e23bc51c258566a65672f4bb6f8fb55efd5941bdb4eb0f241b
MD5 17aa28e7ef5408d88eef8b6c5b8c405c
SHA1 83fefad4c069f191b1945cf5a41d81adf963015a
SHA512 6bf6ec8fbbdddd521c59eb6f4f5c8e0d32cabcc4db3a733d7919154851e33faca87e16c2ff50ce17291f4897233d743141f87b88c6d9e9985e21e409f3b998c6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

TLdtTeM.exe

Path C:\Windows\System\TLdtTeM.exe
Size 5.9MB
SHA256 3e44f8f5d4281abbb6a14501aa39fc17a0259b69ac495a2c59058cb18535805e
MD5 5ced1cb97e10050f2bb8c0538a3ab124
SHA1 bc499e74e1ce186fb8d1e63a4ffb53f6a1d39cdc
SHA512 f29d0a0472126613aba56b543b883a6f4b2b32e6924e8c7e65a751249b93f49f728d81dd82a61c179a3caf793caed7525843ad6683fdce9a5db697d03864cfa5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

UVuPIVc.exe

Path C:\Windows\System\UVuPIVc.exe
Size 5.9MB
SHA256 576572c2c0c3a2a01e5f813a138c0a3338f19982f0c6af74bc090c2e9a45f86b
MD5 faada38a5145fa86ad6ebbd4171e19e8
SHA1 5d750057da4a72b702e698ed47cc53e33119355e
SHA512 f640b2fc507cce2b9d788cae5c56077f8447e214cfcf28517eb52a534d4b8c2121a51013b9fc0eea55c6105a10e16147ea5329af0b39d90da9d653c9b65cb7cf
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

XBlWuYg.exe

Path C:\Windows\System\XBlWuYg.exe
Size 5.9MB
SHA256 346cd074edea2361ef83b2ec17bd17e7efb00c4fa114987661083a037745cbda
MD5 d20e1b4e18499849005dfb931b63c72c
SHA1 d7878b2297f70362d6d8b963ccf3d66f938f94d5
SHA512 2e6aee7b61a7272497a0cc376337d40c0826f1e0db39d95fefa4c977620288b9074fcff70d8765fda9db33721de91d6f78450598e40be171a80949648c153995
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZEStXmE.exe

Path C:\Windows\System\ZEStXmE.exe
Size 5.9MB
SHA256 3d483a0674df64d11f78c27c0ce5e019053f6810f69e513422cfc5e9fa63d794
MD5 1e20726c90ef744befb47306d2143736
SHA1 592c9b7e550dfa833d6734793f6329ad2c0271cc
SHA512 d9c5b208f69a91e9fa2cd12fb9221790f06d37b246c4a7647ed8f504d468bb7f4e6bd78ffc4cc1800bd1b460e019eedc3c625547b89908fc3d947a7ec9323b30
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

eGbkvDZ.exe

Path C:\Windows\System\eGbkvDZ.exe
Size 5.9MB
SHA256 13cf4e626b1871910ecace47878c61dfe78a142345d3380f9dbbfcf554272698
MD5 088370eca94ac8533bf695a02300f69f
SHA1 df4e9db7fc3f8fde7e9d41f938e4a6df5d10a431
SHA512 a5bd1d59dbfd73d2ec6d67da2ee10e1ed5e94cb8d9e745d92d92d71c0e7534c946f7ee7a8ded0737b37ecf35ce5a723e57f30c6e7d82f6b73131e3a8f08ddc85
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

jcegJhM.exe

Path C:\Windows\System\jcegJhM.exe
Size 5.9MB
SHA256 8b6024dacf7dc40d21cf7ddaa3e6f07a1904058d44a889e0611f26ff4067d7d0
MD5 28046fb2f0c66789eb32023d963c9132
SHA1 a9cc3e1910907e1d32200f1018dde0796cf7d065
SHA512 af9efce9ed2eebe82495ab3844e01bd08e5929cb69eaba7eab85b33b10e5bc32b784576827214ab5730944504ff0c6ccf29f4b9afcf84aab441d05866c2d9a6c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

kVXvzpw.exe

Path C:\Windows\System\kVXvzpw.exe
Size 5.9MB
SHA256 e8394474b386953899b6cf474ce6cc7bece78a3e5b03c806da292f447d4dffe3
MD5 e1c158af6784a476977f83d36816401d
SHA1 62986f13a13b1139aa4189c3f0601d4976d15761
SHA512 81e1d984264d4c57acba8d49eed63f094d3e49f8efba1a2579e3f175ccd47dbd4de038079301316bcc7308d0990d1e001aa03300e698da7bb54b12bba8976dd8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

ljqzGHP.exe

Path C:\Windows\System\ljqzGHP.exe
Size 5.9MB
SHA256 75ea04c6b79b2172e311e7b574d05832a4fb3c5485dcaceb8448986d5d722556
MD5 72d8a44bda3b28934f7805586eb3984f
SHA1 14cc2661d8eb0592efa0f43ff370f2945283943f
SHA512 96f09a4055a54fa4f16ef5d5ebe04eb44e4f6e5318886e3ebfa501967f33bcb9821cd6e24bb191bc1877ca6e698289e6bf0c60ed659aa070fe70d93d4a8a8e6b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

mzuJtYK.exe

Path C:\Windows\System\mzuJtYK.exe
Size 5.9MB
SHA256 a7b0e4c954ee546f60b1ea7259606c9e60b09cd9086c9c3b1e9dd454fac5c5a1
MD5 a709468ca48c40af459348405123fb14
SHA1 6d503b163bd61cb6e518559b709b906019fddd43
SHA512 46ed2f8f9a77a6ab408fa7e54551260f3e7de0eee0424da70e5f0f93ab6d0f86a0e38aec00482901d95a2a17a6d1024ac4140710fe874209da91a26e7387b4e0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

wIJIrQg.exe

Path C:\Windows\System\wIJIrQg.exe
Size 5.9MB
SHA256 efc046f756857c7c96c820e08f8eec7c0672a4015da956dbdda7012fbd5ef3b6
MD5 e6da68ba6c748b28ada02a11be4c6843
SHA1 d464b06880cf728b86589b252ba8397be1774669
SHA512 15719205b16822144cb83eb117bbdee4179a27b85205c8d9f8b03f410556b3c397addc2fb047dd01e3baf18caccfb16db416689dfaca28fa71b0c2977d37b9fe
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/796-142-0x00007FF654E60000-0x00007FF6551B4000-memory.dmp

Download

memory/796-56-0x00007FF654E60000-0x00007FF6551B4000-memory.dmp

Download

memory/844-144-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp

Download

memory/844-106-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp

Download

memory/1284-38-0x00007FF74DAD0000-0x00007FF74DE24000-memory.dmp

Download

memory/1284-139-0x00007FF74DAD0000-0x00007FF74DE24000-memory.dmp

Download

memory/1456-114-0x00007FF762920000-0x00007FF762C74000-memory.dmp

Download

memory/1456-147-0x00007FF762920000-0x00007FF762C74000-memory.dmp

Download

memory/1504-50-0x00007FF79D210000-0x00007FF79D564000-memory.dmp

Download

memory/1504-141-0x00007FF79D210000-0x00007FF79D564000-memory.dmp

Download

memory/1504-132-0x00007FF79D210000-0x00007FF79D564000-memory.dmp

Download

memory/1772-69-0x00007FF6C4180000-0x00007FF6C44D4000-memory.dmp

Download

memory/1772-133-0x00007FF6C4180000-0x00007FF6C44D4000-memory.dmp

Download

memory/1772-150-0x00007FF6C4180000-0x00007FF6C44D4000-memory.dmp

Download

memory/3312-26-0x00007FF71C2A0000-0x00007FF71C5F4000-memory.dmp

Download

memory/3312-137-0x00007FF71C2A0000-0x00007FF71C5F4000-memory.dmp

Download

memory/3480-118-0x00007FF73B860000-0x00007FF73BBB4000-memory.dmp

Download

memory/3480-152-0x00007FF73B860000-0x00007FF73BBB4000-memory.dmp

Download

memory/3484-143-0x00007FF75AAC0000-0x00007FF75AE14000-memory.dmp

Download

memory/3484-66-0x00007FF75AAC0000-0x00007FF75AE14000-memory.dmp

Download

memory/3496-136-0x00007FF7BB110000-0x00007FF7BB464000-memory.dmp

Download

memory/3496-20-0x00007FF7BB110000-0x00007FF7BB464000-memory.dmp

Download

memory/3624-116-0x00007FF71A690000-0x00007FF71A9E4000-memory.dmp

Download

memory/3624-149-0x00007FF71A690000-0x00007FF71A9E4000-memory.dmp

Download

memory/3784-145-0x00007FF768CB0000-0x00007FF769004000-memory.dmp

Download

memory/3784-110-0x00007FF768CB0000-0x00007FF769004000-memory.dmp

Download

memory/3804-111-0x00007FF7C7BF0000-0x00007FF7C7F44000-memory.dmp

Download

memory/3804-146-0x00007FF7C7BF0000-0x00007FF7C7F44000-memory.dmp

Download

memory/3872-117-0x00007FF73D410000-0x00007FF73D764000-memory.dmp

Download

memory/3872-151-0x00007FF73D410000-0x00007FF73D764000-memory.dmp

Download

memory/4000-115-0x00007FF70F130000-0x00007FF70F484000-memory.dmp

Download

memory/4000-148-0x00007FF70F130000-0x00007FF70F484000-memory.dmp

Download

memory/4168-130-0x00007FF6C13D0000-0x00007FF6C1724000-memory.dmp

Download

memory/4168-138-0x00007FF6C13D0000-0x00007FF6C1724000-memory.dmp

Download

memory/4168-30-0x00007FF6C13D0000-0x00007FF6C1724000-memory.dmp

Download

memory/4204-134-0x00007FF6A8460000-0x00007FF6A87B4000-memory.dmp

Download

memory/4204-7-0x00007FF6A8460000-0x00007FF6A87B4000-memory.dmp

Download

memory/4204-67-0x00007FF6A8460000-0x00007FF6A87B4000-memory.dmp

Download

memory/4400-14-0x00007FF62F8B0000-0x00007FF62FC04000-memory.dmp

Download

memory/4400-135-0x00007FF62F8B0000-0x00007FF62FC04000-memory.dmp

Download

memory/4560-128-0x00007FF72FF00000-0x00007FF730254000-memory.dmp

Download

memory/4560-153-0x00007FF72FF00000-0x00007FF730254000-memory.dmp

Download

memory/4576-129-0x00007FF697C20000-0x00007FF697F74000-memory.dmp

Download

memory/4576-154-0x00007FF697C20000-0x00007FF697F74000-memory.dmp

Download

memory/4848-44-0x00007FF6297C0000-0x00007FF629B14000-memory.dmp

Download

memory/4848-140-0x00007FF6297C0000-0x00007FF629B14000-memory.dmp

Download

memory/4848-131-0x00007FF6297C0000-0x00007FF629B14000-memory.dmp

Download

memory/4896-0-0x00007FF759EB0000-0x00007FF75A204000-memory.dmp

Download

memory/4896-62-0x00007FF759EB0000-0x00007FF75A204000-memory.dmp

Download

memory/4896-1-0x000002CEAEBE0000-0x000002CEAEBF0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads