cobaltstrike | 0a453ba7845d8991a2487b9017690e4ebc4431349fc9bc21ea1b680d63a3607c

Analysis

max time kernel
138s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240531-yn4ytabc6s
SHA256 0a453ba7845d8991a2487b9017690e4ebc4431349fc9bc21ea1b680d63a3607c
MD5 a4fdbb0032babf8c9a7c9c5c1633ac9a
SHA1 7ce2426e324ae87cd1c29125b9a27e12e8c61264
SHA512 6e0dca9da3c3da44604213f0f47f86d268a969612fa6e0a8f4a398457c78b3e5b64af176a51234ff8e4d025311980ba01208b91b3cffa03ee557fbc47f3a6d7d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023437-5.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343b-10.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343c-12.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343d-22.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343e-29.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343f-34.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023438-42.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023440-44.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023441-48.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023442-60.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023443-65.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023444-73.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023445-78.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023446-87.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023447-91.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023449-106.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023448-104.dat	cobalt_reflective_dll
behavioral2/files/0x00090000000226f2-118.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344a-116.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023425-124.dat	cobalt_reflective_dll
behavioral2/files/0x000a00000002342f-128.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023437-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343b-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343c-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343d-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343e-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343f-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023438-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023440-44.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023441-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023442-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023443-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023444-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023445-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023446-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023447-91.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023449-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023448-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00090000000226f2-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344a-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a000000023425-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a00000002342f-128.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2028-0-0x00007FF6D0DC0000-0x00007FF6D1114000-memory.dmp	UPX
behavioral2/files/0x0008000000023437-5.dat	UPX
behavioral2/memory/2488-8-0x00007FF780B60000-0x00007FF780EB4000-memory.dmp	UPX
behavioral2/files/0x000700000002343b-10.dat	UPX
behavioral2/files/0x000700000002343c-12.dat	UPX
behavioral2/files/0x000700000002343d-22.dat	UPX
behavioral2/files/0x000700000002343e-29.dat	UPX
behavioral2/memory/3628-24-0x00007FF6A6C00000-0x00007FF6A6F54000-memory.dmp	UPX
behavioral2/memory/4448-23-0x00007FF73A1B0000-0x00007FF73A504000-memory.dmp	UPX
behavioral2/memory/3476-18-0x00007FF6A1AD0000-0x00007FF6A1E24000-memory.dmp	UPX
behavioral2/memory/2956-32-0x00007FF6D1370000-0x00007FF6D16C4000-memory.dmp	UPX
behavioral2/files/0x000700000002343f-34.dat	UPX
behavioral2/memory/4548-37-0x00007FF7202B0000-0x00007FF720604000-memory.dmp	UPX
behavioral2/files/0x0008000000023438-42.dat	UPX
behavioral2/files/0x0007000000023440-44.dat	UPX
behavioral2/memory/1792-43-0x00007FF637BC0000-0x00007FF637F14000-memory.dmp	UPX
behavioral2/files/0x0007000000023441-48.dat	UPX
behavioral2/files/0x0007000000023442-60.dat	UPX
behavioral2/memory/2028-63-0x00007FF6D0DC0000-0x00007FF6D1114000-memory.dmp	UPX
behavioral2/files/0x0007000000023443-65.dat	UPX
behavioral2/memory/2292-64-0x00007FF6B7F00000-0x00007FF6B8254000-memory.dmp	UPX
behavioral2/memory/2396-52-0x00007FF7A0C90000-0x00007FF7A0FE4000-memory.dmp	UPX
behavioral2/memory/4744-49-0x00007FF67E7D0000-0x00007FF67EB24000-memory.dmp	UPX
behavioral2/memory/4168-70-0x00007FF69EEC0000-0x00007FF69F214000-memory.dmp	UPX
behavioral2/files/0x0007000000023444-73.dat	UPX
behavioral2/files/0x0007000000023445-78.dat	UPX
behavioral2/memory/2156-80-0x00007FF60FD10000-0x00007FF610064000-memory.dmp	UPX
behavioral2/files/0x0007000000023446-87.dat	UPX
behavioral2/files/0x0007000000023447-91.dat	UPX
behavioral2/memory/428-98-0x00007FF6092C0000-0x00007FF609614000-memory.dmp	UPX
behavioral2/memory/2352-100-0x00007FF747A70000-0x00007FF747DC4000-memory.dmp	UPX
behavioral2/files/0x0007000000023449-106.dat	UPX
behavioral2/files/0x0007000000023448-104.dat	UPX
behavioral2/memory/2900-101-0x00007FF7328B0000-0x00007FF732C04000-memory.dmp	UPX
behavioral2/memory/440-99-0x00007FF602860000-0x00007FF602BB4000-memory.dmp	UPX
behavioral2/memory/3512-83-0x00007FF698520000-0x00007FF698874000-memory.dmp	UPX
behavioral2/memory/4448-79-0x00007FF73A1B0000-0x00007FF73A504000-memory.dmp	UPX
behavioral2/memory/2488-69-0x00007FF780B60000-0x00007FF780EB4000-memory.dmp	UPX
behavioral2/files/0x00090000000226f2-118.dat	UPX
behavioral2/files/0x000700000002344a-116.dat	UPX
behavioral2/memory/3712-122-0x00007FF77AC30000-0x00007FF77AF84000-memory.dmp	UPX
behavioral2/files/0x000a000000023425-124.dat	UPX
behavioral2/memory/4548-130-0x00007FF7202B0000-0x00007FF720604000-memory.dmp	UPX
behavioral2/files/0x000a00000002342f-128.dat	UPX
behavioral2/memory/3076-131-0x00007FF774750000-0x00007FF774AA4000-memory.dmp	UPX
behavioral2/memory/4744-134-0x00007FF67E7D0000-0x00007FF67EB24000-memory.dmp	UPX
behavioral2/memory/4164-132-0x00007FF7921E0000-0x00007FF792534000-memory.dmp	UPX
behavioral2/memory/4112-114-0x00007FF70D320000-0x00007FF70D674000-memory.dmp	UPX
behavioral2/memory/3628-111-0x00007FF6A6C00000-0x00007FF6A6F54000-memory.dmp	UPX
behavioral2/memory/1792-133-0x00007FF637BC0000-0x00007FF637F14000-memory.dmp	UPX
behavioral2/memory/2396-135-0x00007FF7A0C90000-0x00007FF7A0FE4000-memory.dmp	UPX
behavioral2/memory/3512-136-0x00007FF698520000-0x00007FF698874000-memory.dmp	UPX
behavioral2/memory/2900-139-0x00007FF7328B0000-0x00007FF732C04000-memory.dmp	UPX
behavioral2/memory/2352-138-0x00007FF747A70000-0x00007FF747DC4000-memory.dmp	UPX
behavioral2/memory/440-137-0x00007FF602860000-0x00007FF602BB4000-memory.dmp	UPX
behavioral2/memory/4112-140-0x00007FF70D320000-0x00007FF70D674000-memory.dmp	UPX
behavioral2/memory/2488-141-0x00007FF780B60000-0x00007FF780EB4000-memory.dmp	UPX
behavioral2/memory/3476-142-0x00007FF6A1AD0000-0x00007FF6A1E24000-memory.dmp	UPX
behavioral2/memory/4448-143-0x00007FF73A1B0000-0x00007FF73A504000-memory.dmp	UPX
behavioral2/memory/3628-144-0x00007FF6A6C00000-0x00007FF6A6F54000-memory.dmp	UPX
behavioral2/memory/2956-145-0x00007FF6D1370000-0x00007FF6D16C4000-memory.dmp	UPX
behavioral2/memory/4548-146-0x00007FF7202B0000-0x00007FF720604000-memory.dmp	UPX
behavioral2/memory/1792-147-0x00007FF637BC0000-0x00007FF637F14000-memory.dmp	UPX
behavioral2/memory/2396-148-0x00007FF7A0C90000-0x00007FF7A0FE4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2028-0-0x00007FF6D0DC0000-0x00007FF6D1114000-memory.dmp	xmrig
behavioral2/files/0x0008000000023437-5.dat	xmrig
behavioral2/memory/2488-8-0x00007FF780B60000-0x00007FF780EB4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343b-10.dat	xmrig
behavioral2/files/0x000700000002343c-12.dat	xmrig
behavioral2/files/0x000700000002343d-22.dat	xmrig
behavioral2/files/0x000700000002343e-29.dat	xmrig
behavioral2/memory/3628-24-0x00007FF6A6C00000-0x00007FF6A6F54000-memory.dmp	xmrig
behavioral2/memory/4448-23-0x00007FF73A1B0000-0x00007FF73A504000-memory.dmp	xmrig
behavioral2/memory/3476-18-0x00007FF6A1AD0000-0x00007FF6A1E24000-memory.dmp	xmrig
behavioral2/memory/2956-32-0x00007FF6D1370000-0x00007FF6D16C4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343f-34.dat	xmrig
behavioral2/memory/4548-37-0x00007FF7202B0000-0x00007FF720604000-memory.dmp	xmrig
behavioral2/files/0x0008000000023438-42.dat	xmrig
behavioral2/files/0x0007000000023440-44.dat	xmrig
behavioral2/memory/1792-43-0x00007FF637BC0000-0x00007FF637F14000-memory.dmp	xmrig
behavioral2/files/0x0007000000023441-48.dat	xmrig
behavioral2/files/0x0007000000023442-60.dat	xmrig
behavioral2/memory/2028-63-0x00007FF6D0DC0000-0x00007FF6D1114000-memory.dmp	xmrig
behavioral2/files/0x0007000000023443-65.dat	xmrig
behavioral2/memory/2292-64-0x00007FF6B7F00000-0x00007FF6B8254000-memory.dmp	xmrig
behavioral2/memory/2396-52-0x00007FF7A0C90000-0x00007FF7A0FE4000-memory.dmp	xmrig
behavioral2/memory/4744-49-0x00007FF67E7D0000-0x00007FF67EB24000-memory.dmp	xmrig
behavioral2/memory/4168-70-0x00007FF69EEC0000-0x00007FF69F214000-memory.dmp	xmrig
behavioral2/files/0x0007000000023444-73.dat	xmrig
behavioral2/files/0x0007000000023445-78.dat	xmrig
behavioral2/memory/2156-80-0x00007FF60FD10000-0x00007FF610064000-memory.dmp	xmrig
behavioral2/files/0x0007000000023446-87.dat	xmrig
behavioral2/files/0x0007000000023447-91.dat	xmrig
behavioral2/memory/428-98-0x00007FF6092C0000-0x00007FF609614000-memory.dmp	xmrig
behavioral2/memory/2352-100-0x00007FF747A70000-0x00007FF747DC4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023449-106.dat	xmrig
behavioral2/files/0x0007000000023448-104.dat	xmrig
behavioral2/memory/2900-101-0x00007FF7328B0000-0x00007FF732C04000-memory.dmp	xmrig
behavioral2/memory/440-99-0x00007FF602860000-0x00007FF602BB4000-memory.dmp	xmrig
behavioral2/memory/3512-83-0x00007FF698520000-0x00007FF698874000-memory.dmp	xmrig
behavioral2/memory/4448-79-0x00007FF73A1B0000-0x00007FF73A504000-memory.dmp	xmrig
behavioral2/memory/2488-69-0x00007FF780B60000-0x00007FF780EB4000-memory.dmp	xmrig
behavioral2/files/0x00090000000226f2-118.dat	xmrig
behavioral2/files/0x000700000002344a-116.dat	xmrig
behavioral2/memory/3712-122-0x00007FF77AC30000-0x00007FF77AF84000-memory.dmp	xmrig
behavioral2/files/0x000a000000023425-124.dat	xmrig
behavioral2/memory/4548-130-0x00007FF7202B0000-0x00007FF720604000-memory.dmp	xmrig
behavioral2/files/0x000a00000002342f-128.dat	xmrig
behavioral2/memory/3076-131-0x00007FF774750000-0x00007FF774AA4000-memory.dmp	xmrig
behavioral2/memory/4744-134-0x00007FF67E7D0000-0x00007FF67EB24000-memory.dmp	xmrig
behavioral2/memory/4164-132-0x00007FF7921E0000-0x00007FF792534000-memory.dmp	xmrig
behavioral2/memory/4112-114-0x00007FF70D320000-0x00007FF70D674000-memory.dmp	xmrig
behavioral2/memory/3628-111-0x00007FF6A6C00000-0x00007FF6A6F54000-memory.dmp	xmrig
behavioral2/memory/1792-133-0x00007FF637BC0000-0x00007FF637F14000-memory.dmp	xmrig
behavioral2/memory/2396-135-0x00007FF7A0C90000-0x00007FF7A0FE4000-memory.dmp	xmrig
behavioral2/memory/3512-136-0x00007FF698520000-0x00007FF698874000-memory.dmp	xmrig
behavioral2/memory/2900-139-0x00007FF7328B0000-0x00007FF732C04000-memory.dmp	xmrig
behavioral2/memory/2352-138-0x00007FF747A70000-0x00007FF747DC4000-memory.dmp	xmrig
behavioral2/memory/440-137-0x00007FF602860000-0x00007FF602BB4000-memory.dmp	xmrig
behavioral2/memory/4112-140-0x00007FF70D320000-0x00007FF70D674000-memory.dmp	xmrig
behavioral2/memory/2488-141-0x00007FF780B60000-0x00007FF780EB4000-memory.dmp	xmrig
behavioral2/memory/3476-142-0x00007FF6A1AD0000-0x00007FF6A1E24000-memory.dmp	xmrig
behavioral2/memory/4448-143-0x00007FF73A1B0000-0x00007FF73A504000-memory.dmp	xmrig
behavioral2/memory/3628-144-0x00007FF6A6C00000-0x00007FF6A6F54000-memory.dmp	xmrig
behavioral2/memory/2956-145-0x00007FF6D1370000-0x00007FF6D16C4000-memory.dmp	xmrig
behavioral2/memory/4548-146-0x00007FF7202B0000-0x00007FF720604000-memory.dmp	xmrig
behavioral2/memory/1792-147-0x00007FF637BC0000-0x00007FF637F14000-memory.dmp	xmrig
behavioral2/memory/2396-148-0x00007FF7A0C90000-0x00007FF7A0FE4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2488	kldElow.exe
3476	KOlwMhv.exe
4448	bowLxBU.exe
3628	BuQKqUf.exe
2956	qXirzKA.exe
4548	DPtNuoH.exe
1792	RBezWgq.exe
4744	rlIUugX.exe
2396	QwwlJoW.exe
2292	YPxhIeV.exe
4168	teXkZoC.exe
2156	aFLJmJr.exe
3512	EnNejOD.exe
428	UnbnpNc.exe
440	wVwriOf.exe
2352	GaZbKVT.exe
2900	kFzPKRJ.exe
4112	GnAISoZ.exe
3712	bvqhsuP.exe
3076	mcJmjLi.exe
4164	oGRRgTo.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2028-0-0x00007FF6D0DC0000-0x00007FF6D1114000-memory.dmp	upx
behavioral2/files/0x0008000000023437-5.dat	upx
behavioral2/memory/2488-8-0x00007FF780B60000-0x00007FF780EB4000-memory.dmp	upx
behavioral2/files/0x000700000002343b-10.dat	upx
behavioral2/files/0x000700000002343c-12.dat	upx
behavioral2/files/0x000700000002343d-22.dat	upx
behavioral2/files/0x000700000002343e-29.dat	upx
behavioral2/memory/3628-24-0x00007FF6A6C00000-0x00007FF6A6F54000-memory.dmp	upx
behavioral2/memory/4448-23-0x00007FF73A1B0000-0x00007FF73A504000-memory.dmp	upx
behavioral2/memory/3476-18-0x00007FF6A1AD0000-0x00007FF6A1E24000-memory.dmp	upx
behavioral2/memory/2956-32-0x00007FF6D1370000-0x00007FF6D16C4000-memory.dmp	upx
behavioral2/files/0x000700000002343f-34.dat	upx
behavioral2/memory/4548-37-0x00007FF7202B0000-0x00007FF720604000-memory.dmp	upx
behavioral2/files/0x0008000000023438-42.dat	upx
behavioral2/files/0x0007000000023440-44.dat	upx
behavioral2/memory/1792-43-0x00007FF637BC0000-0x00007FF637F14000-memory.dmp	upx
behavioral2/files/0x0007000000023441-48.dat	upx
behavioral2/files/0x0007000000023442-60.dat	upx
behavioral2/memory/2028-63-0x00007FF6D0DC0000-0x00007FF6D1114000-memory.dmp	upx
behavioral2/files/0x0007000000023443-65.dat	upx
behavioral2/memory/2292-64-0x00007FF6B7F00000-0x00007FF6B8254000-memory.dmp	upx
behavioral2/memory/2396-52-0x00007FF7A0C90000-0x00007FF7A0FE4000-memory.dmp	upx
behavioral2/memory/4744-49-0x00007FF67E7D0000-0x00007FF67EB24000-memory.dmp	upx
behavioral2/memory/4168-70-0x00007FF69EEC0000-0x00007FF69F214000-memory.dmp	upx
behavioral2/files/0x0007000000023444-73.dat	upx
behavioral2/files/0x0007000000023445-78.dat	upx
behavioral2/memory/2156-80-0x00007FF60FD10000-0x00007FF610064000-memory.dmp	upx
behavioral2/files/0x0007000000023446-87.dat	upx
behavioral2/files/0x0007000000023447-91.dat	upx
behavioral2/memory/428-98-0x00007FF6092C0000-0x00007FF609614000-memory.dmp	upx
behavioral2/memory/2352-100-0x00007FF747A70000-0x00007FF747DC4000-memory.dmp	upx
behavioral2/files/0x0007000000023449-106.dat	upx
behavioral2/files/0x0007000000023448-104.dat	upx
behavioral2/memory/2900-101-0x00007FF7328B0000-0x00007FF732C04000-memory.dmp	upx
behavioral2/memory/440-99-0x00007FF602860000-0x00007FF602BB4000-memory.dmp	upx
behavioral2/memory/3512-83-0x00007FF698520000-0x00007FF698874000-memory.dmp	upx
behavioral2/memory/4448-79-0x00007FF73A1B0000-0x00007FF73A504000-memory.dmp	upx
behavioral2/memory/2488-69-0x00007FF780B60000-0x00007FF780EB4000-memory.dmp	upx
behavioral2/files/0x00090000000226f2-118.dat	upx
behavioral2/files/0x000700000002344a-116.dat	upx
behavioral2/memory/3712-122-0x00007FF77AC30000-0x00007FF77AF84000-memory.dmp	upx
behavioral2/files/0x000a000000023425-124.dat	upx
behavioral2/memory/4548-130-0x00007FF7202B0000-0x00007FF720604000-memory.dmp	upx
behavioral2/files/0x000a00000002342f-128.dat	upx
behavioral2/memory/3076-131-0x00007FF774750000-0x00007FF774AA4000-memory.dmp	upx
behavioral2/memory/4744-134-0x00007FF67E7D0000-0x00007FF67EB24000-memory.dmp	upx
behavioral2/memory/4164-132-0x00007FF7921E0000-0x00007FF792534000-memory.dmp	upx
behavioral2/memory/4112-114-0x00007FF70D320000-0x00007FF70D674000-memory.dmp	upx
behavioral2/memory/3628-111-0x00007FF6A6C00000-0x00007FF6A6F54000-memory.dmp	upx
behavioral2/memory/1792-133-0x00007FF637BC0000-0x00007FF637F14000-memory.dmp	upx
behavioral2/memory/2396-135-0x00007FF7A0C90000-0x00007FF7A0FE4000-memory.dmp	upx
behavioral2/memory/3512-136-0x00007FF698520000-0x00007FF698874000-memory.dmp	upx
behavioral2/memory/2900-139-0x00007FF7328B0000-0x00007FF732C04000-memory.dmp	upx
behavioral2/memory/2352-138-0x00007FF747A70000-0x00007FF747DC4000-memory.dmp	upx
behavioral2/memory/440-137-0x00007FF602860000-0x00007FF602BB4000-memory.dmp	upx
behavioral2/memory/4112-140-0x00007FF70D320000-0x00007FF70D674000-memory.dmp	upx
behavioral2/memory/2488-141-0x00007FF780B60000-0x00007FF780EB4000-memory.dmp	upx
behavioral2/memory/3476-142-0x00007FF6A1AD0000-0x00007FF6A1E24000-memory.dmp	upx
behavioral2/memory/4448-143-0x00007FF73A1B0000-0x00007FF73A504000-memory.dmp	upx
behavioral2/memory/3628-144-0x00007FF6A6C00000-0x00007FF6A6F54000-memory.dmp	upx
behavioral2/memory/2956-145-0x00007FF6D1370000-0x00007FF6D16C4000-memory.dmp	upx
behavioral2/memory/4548-146-0x00007FF7202B0000-0x00007FF720604000-memory.dmp	upx
behavioral2/memory/1792-147-0x00007FF637BC0000-0x00007FF637F14000-memory.dmp	upx
behavioral2/memory/2396-148-0x00007FF7A0C90000-0x00007FF7A0FE4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\KOlwMhv.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QwwlJoW.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aFLJmJr.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wVwriOf.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GaZbKVT.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kldElow.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bowLxBU.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DPtNuoH.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YPxhIeV.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\teXkZoC.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mcJmjLi.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oGRRgTo.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qXirzKA.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rlIUugX.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EnNejOD.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GnAISoZ.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BuQKqUf.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RBezWgq.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UnbnpNc.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kFzPKRJ.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bvqhsuP.exe	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2488	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	83
PID 2028 wrote to memory of 2488	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	83
PID 2028 wrote to memory of 3476	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	85
PID 2028 wrote to memory of 3476	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	85
PID 2028 wrote to memory of 4448	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	86
PID 2028 wrote to memory of 4448	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	86
PID 2028 wrote to memory of 3628	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	87
PID 2028 wrote to memory of 3628	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	87
PID 2028 wrote to memory of 2956	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	88
PID 2028 wrote to memory of 2956	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	88
PID 2028 wrote to memory of 4548	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	90
PID 2028 wrote to memory of 4548	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	90
PID 2028 wrote to memory of 4744	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	91
PID 2028 wrote to memory of 4744	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	91
PID 2028 wrote to memory of 1792	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	92
PID 2028 wrote to memory of 1792	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	92
PID 2028 wrote to memory of 2396	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	93
PID 2028 wrote to memory of 2396	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	93
PID 2028 wrote to memory of 2292	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	94
PID 2028 wrote to memory of 2292	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	94
PID 2028 wrote to memory of 4168	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	95
PID 2028 wrote to memory of 4168	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	95
PID 2028 wrote to memory of 2156	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	96
PID 2028 wrote to memory of 2156	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	96
PID 2028 wrote to memory of 3512	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	97
PID 2028 wrote to memory of 3512	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	97
PID 2028 wrote to memory of 428	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	98
PID 2028 wrote to memory of 428	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	98
PID 2028 wrote to memory of 440	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	99
PID 2028 wrote to memory of 440	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	99
PID 2028 wrote to memory of 2352	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	100
PID 2028 wrote to memory of 2352	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	100
PID 2028 wrote to memory of 2900	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	101
PID 2028 wrote to memory of 2900	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	101
PID 2028 wrote to memory of 4112	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	102
PID 2028 wrote to memory of 4112	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	102
PID 2028 wrote to memory of 3712	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	103
PID 2028 wrote to memory of 3712	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	103
PID 2028 wrote to memory of 3076	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	104
PID 2028 wrote to memory of 3076	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	104
PID 2028 wrote to memory of 4164	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	105
PID 2028 wrote to memory of 4164	2028	2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe	105

C:\Users\Admin\AppData\Local\Temp\2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_a4fdbb0032babf8c9a7c9c5c1633ac9a_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\System\kldElow.exe
  C:\Windows\System\kldElow.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\KOlwMhv.exe
  C:\Windows\System\KOlwMhv.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\bowLxBU.exe
  C:\Windows\System\bowLxBU.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\BuQKqUf.exe
  C:\Windows\System\BuQKqUf.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\qXirzKA.exe
  C:\Windows\System\qXirzKA.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\DPtNuoH.exe
  C:\Windows\System\DPtNuoH.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\rlIUugX.exe
  C:\Windows\System\rlIUugX.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\RBezWgq.exe
  C:\Windows\System\RBezWgq.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\QwwlJoW.exe
  C:\Windows\System\QwwlJoW.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\YPxhIeV.exe
  C:\Windows\System\YPxhIeV.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\teXkZoC.exe
  C:\Windows\System\teXkZoC.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\aFLJmJr.exe
  C:\Windows\System\aFLJmJr.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\EnNejOD.exe
  C:\Windows\System\EnNejOD.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\UnbnpNc.exe
  C:\Windows\System\UnbnpNc.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\wVwriOf.exe
  C:\Windows\System\wVwriOf.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\GaZbKVT.exe
  C:\Windows\System\GaZbKVT.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\kFzPKRJ.exe
  C:\Windows\System\kFzPKRJ.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\GnAISoZ.exe
  C:\Windows\System\GnAISoZ.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\bvqhsuP.exe
  C:\Windows\System\bvqhsuP.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\mcJmjLi.exe
  C:\Windows\System\mcJmjLi.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\oGRRgTo.exe
  C:\Windows\System\oGRRgTo.exe
  2⤵
  - Executes dropped EXE
  PID:4164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BuQKqUf.exe

Path C:\Windows\System\BuQKqUf.exe
Size 5.9MB
SHA256 6c2504b4ca67f64c64d2e206298b03c432b7e37949d05cd2015bef332e172c2f
MD5 8b2f8562d789148a35eb3eaa96e8e5c1
SHA1 39c481f202def1554af455738bff9c395f856ded
SHA512 0838fc6b1ac1961b6eb02789ce76b758ba749ec681331c29653d5fd44078c1bd49f52a3ffd8aaced0146589a20b4d809387a25299deed51e1ac877375a61c017
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

DPtNuoH.exe

Path C:\Windows\System\DPtNuoH.exe
Size 5.9MB
SHA256 c0d28bb96e97696754b77f9e91406dc045606f5960cfca1d63f875490a5d3719
MD5 5b47e647a87e7dadb9b32b2e3e3a181e
SHA1 a80ddf2950c921b579c4b40c61f18d037ad0ac54
SHA512 8d7b4e180c49be98f93cf283ea446c86bfa3894a0a2ffe6b0ec39f0317513037e1da91f6a66d07a0a4ca18a1655c06eae8180af0b2c0a0a64db75e8c6c3e29b5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

EnNejOD.exe

Path C:\Windows\System\EnNejOD.exe
Size 5.9MB
SHA256 bb5499f8bcf5b4c058d23c4ea9fbcdcd6d186f5819ca3f6328201e95ea39f0e0
MD5 15eb5165b7f1d473f6a05feb7379397e
SHA1 c73bf6c5aeb6863c00b00785e7c936bb0d4415e4
SHA512 2aa671b2cfbb675c2d78a90b4c55eeca5cbc2647df6dfe2073efacbbd176927b56691a351c304ac095d6b5bfbc460a8820408723481ead572d80f184db331821
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

GaZbKVT.exe

Path C:\Windows\System\GaZbKVT.exe
Size 5.9MB
SHA256 e94212631fb1cb5b61e2209e6e4296582ae06be13c1a89bbbed120666d460d24
MD5 47f8572bc9f67c193a58b7a542cc1377
SHA1 9b0099b861cce94e1291726d547558faafbdf9d9
SHA512 bca2f8a4ae671ca529c17a9c826f83690513ab025e85c9947129f0b3afa8dd4d98d6dd9677ef87a9425e724685403f5226ce99ed7f1215e78d93e62946ff1aa3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

GnAISoZ.exe

Path C:\Windows\System\GnAISoZ.exe
Size 5.9MB
SHA256 b215954d54c62fb9ef124de90f1765173c935df3eb15fcd7e29c1d2be486a9a6
MD5 e1ea280e1ac8ac9faf5aaaa7b1c6eeb4
SHA1 e9846618d2ecbea2d3eac51ab83167990431de21
SHA512 39a2e306d993cc4dd54fc5324ff3f7cb47b9a46ba8c9a8a9d9d5775e3ea9b58e09e4391a3c2005140504a9b7e6fa25775a4fcaa64b9b713049abc6f991d407e4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

KOlwMhv.exe

Path C:\Windows\System\KOlwMhv.exe
Size 5.9MB
SHA256 f95ba44c4f9815901acdc441eee6f2ef5521d6accc6610ce22327a111eb49105
MD5 c68c59443512c9af2e8c8f2b86e8ca57
SHA1 bf9e8f4e08374190b0826216b9fed3723a6bfa32
SHA512 4f2eaab8d99af8b6bb07f8d84bd078f69b05dce63b6ff0640124989a235c625a6a96112434b7eba8093b173a5c9caf7fd3a1f8fb04bd49f36381818de9a9927e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

QwwlJoW.exe

Path C:\Windows\System\QwwlJoW.exe
Size 5.9MB
SHA256 02ae051b4664799d11e9d478d59ec60547495897d96ecfe3ffa1012224fad23e
MD5 863e0640de14a430549f2fe870b3badf
SHA1 40022b49927c635d8b12f28bfd54378da3b8f8cb
SHA512 db0e84dcae269821bf156962d7443f9f32e1c6baffc03433ab18657d77389fd15042dc52220d89eb7982228e6f4277d5037b7ac373dce38add3d685721c60cf1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

RBezWgq.exe

Path C:\Windows\System\RBezWgq.exe
Size 5.9MB
SHA256 52f085ba04ea233f7e02707a7a6c6eaebb20e775a11bf327ffb51bcf9ef6c995
MD5 e5313c6fe21c176fec955085fa2de106
SHA1 04547ade650f8bf6f9cc4e9a95618c1682865f61
SHA512 5c1cf17ee5d7c5c394c7952223ff89af8d52e36fa92855ad9a10415a7b21efef840f1a559641bee0f04523b0928348b91a8dc068fbac341aa02b0027029ac583
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:Q+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnbnpNc.exe

Path C:\Windows\System\UnbnpNc.exe
Size 5.9MB
SHA256 2e8c95d2c2019448ca4896fe939e4a3150b1e7fb6a0e2d7af288708b502dfec3
MD5 976f7c7e40cf96aa7539ace46851832d
SHA1 8600f3a5c71f854e5fadae345c0374c74156a947
SHA512 ec2d03ec5060a03cb17b220599c87727754f1b562cca2585d3754301c2e86dec2e24d995f1683bad4b842c37d063ca93e74ecff3e0d75df54e9e150cc6736218
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

YPxhIeV.exe

Path C:\Windows\System\YPxhIeV.exe
Size 5.9MB
SHA256 aae0490a7c57ad9c3bc573b44dcaadf5c4eb00a9f7b42bfe3f1bb348d5694785
MD5 516ed17e837f97a2773d4bb5b3901fe9
SHA1 dac3f1b80a532e57ea0e47e5927cbfe4c834cab1
SHA512 eb14eb604446c9c1536e19b2f82009ce348bfeb0fdcc22bb5f5960ee29b74629aa3f2f8333f27a3f6ed4f66e2cbb2411ac4ff3a314997a6a8c5c6315aeaf70d3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

aFLJmJr.exe

Path C:\Windows\System\aFLJmJr.exe
Size 5.9MB
SHA256 7556c4b0258e832eb9274b4b460779fe9f7a97b72d00aacdfffc94a774bc427a
MD5 2942e23270477cb57d9a8c1b5c930983
SHA1 cc97b7074b31daa2e57a48106f7c2e8c4e94a07e
SHA512 b188293b5eb1de21b75f98858cc851a59f45e3d7c25415845af3e61ff216136c49efbb199822cc51f725fb5432ccdc53ecfb26d573d238db870261d19e823f9c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

bowLxBU.exe

Path C:\Windows\System\bowLxBU.exe
Size 5.9MB
SHA256 b9c9da6c0cc673a10201d707e6b5d994a88f405e4af35323f7aac083c9c55241
MD5 0821412d12293c4ff0c488f95ad368e4
SHA1 26b83fff0a47b8a050bf35cc5eff869390ca5543
SHA512 cc008c16134639aa9673c0dff4887fa92277597564b8801f2721b227deae95640b680ad9cf1c9e56a0f3542746e73c21c4d67483d40dc97301abc32cd8acbd15
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

bvqhsuP.exe

Path C:\Windows\System\bvqhsuP.exe
Size 5.9MB
SHA256 f3603c06d803b38887d6b6cac3b26de72ee0e0de5a403ce5a7adb638c1a52829
MD5 d8578338c045a917d8a9dfdfab9544cf
SHA1 71fd69cd99bd2b0ba619893abe16919a200a374f
SHA512 736ac4e028c605aa72f71fe2cd6a39bd0fc722b66e90e2622ecd394993fed044b73710002e9313d46cdcd1f709272442948c4f526df5916003a77445e124f7cc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

kFzPKRJ.exe

Path C:\Windows\System\kFzPKRJ.exe
Size 5.9MB
SHA256 83b14363cdf5249972d86ee2374a8c642310e9fca401a28099acfbe0d46e6def
MD5 bb78de89a67fcca1949546ff4e42073b
SHA1 8e758260717a4478d8a5f04f004776b502df2c97
SHA512 2f75a48e7abf910308a379981436e9de85603c0c68c1a8788936b9d5653e180afaba4ff0f360aa335c39971109dd233634da8408b780ae69795a27e70fdab8bf
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

kldElow.exe

Path C:\Windows\System\kldElow.exe
Size 5.9MB
SHA256 0e7f5180e90fbc5731d69961a84458326aacdc7752106f4f5a03637a6df21d25
MD5 01c2b14fcb94395a182878dad466caac
SHA1 f37b0c2bf60dfe9a44eea8076316c79e4f81c34d
SHA512 e36ebed172f485dcd6ebc79fce29d7ddcfad41afa0601b1c923ae5fcd7648877f7be9093c0289cf492f10ec83ee40ccb0502cffe2b6f4fec876a99f3438cc607
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

mcJmjLi.exe

Path C:\Windows\System\mcJmjLi.exe
Size 5.9MB
SHA256 3c8dffd0c4012c64295f6de1bb9769ff225af44eae9a2f80b283e4617f4c806d
MD5 62e8ac9dd0d1939999e62f46c2e07b24
SHA1 d1f7eefc8f385809bb6e08a051197f430c227cd8
SHA512 10ee7685bfb5dda9ba2793cf87a20a4ceae1ff4339fb1d0a710a5837792f12326be4b7b4c9b6dff564b61d75ff956c9cfa50f8cf595971a3325cee82bef7ed8b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

oGRRgTo.exe

Path C:\Windows\System\oGRRgTo.exe
Size 5.9MB
SHA256 4686c25cb6563288bb3462ee42628dc29b34e2b067ef216a531d2e7d38c60d6d
MD5 3fa74564c3dfd7aad9e697ef514c0230
SHA1 344f509714cf3fe93139e01e6ed6f4c620729ed0
SHA512 bdc5c16fb02a2de83b5ee2f75f11bf410858cf2b5bb20b5833261c8db8498910a3300303e28cf2acb39f242ee61dd0936149ad26619eaf737f39e5230285c177
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

qXirzKA.exe

Path C:\Windows\System\qXirzKA.exe
Size 5.9MB
SHA256 96820b97a811af6851dcec48e760616b0f973eda693fd65358cd8abbc4453ad2
MD5 81c975c2b81f3ca7432bb687f80aa800
SHA1 990ca2833d96682d065778db68477114e127dd9e
SHA512 4e969728f3dbfa8f77b7ac600c4cae1f6d5efe97603fb38ab3366be5ee6843ab51b339ef5964ed19f67d605a09e0ea23870b37aff07de3dd5b1abf1d827685a8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

rlIUugX.exe

Path C:\Windows\System\rlIUugX.exe
Size 5.9MB
SHA256 a9fa3c211d0abbf11a78af6e9503c38178adcabcd4ba0c799a64d5516b2d08e8
MD5 3ec5f111293816206391ba92dda366c5
SHA1 63eae611de3c3f64eeb045267d5b30003078ede0
SHA512 76f42b7e3d380dc1b37eb06d48e86139d471b90085c0f1981be160d0ec62462029eb79a9fccac97538463c4b2237f8bc20210859f478d07f34204048edff8ba6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

teXkZoC.exe

Path C:\Windows\System\teXkZoC.exe
Size 5.9MB
SHA256 d3dcfd3abbe21cc7f7cfa8672aae3d3f6aa440bd1a773392f46dba06434019cc
MD5 58046537978b08aa611ccafc94d2e5c2
SHA1 e69a52fab337e343b6d6f54e85fb67cb6a7ef436
SHA512 12c424d98a943b0aeca02a1fee42a0f111b77eea82321f75bbfb9a64f4f3bc0b689f709d57dafecfba447c425de4e08c8cd6cd90c60b3d3962a455c62216a71b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:Q+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

wVwriOf.exe

Path C:\Windows\System\wVwriOf.exe
Size 5.9MB
SHA256 c60ba3b01d9cef32f420f06dc37b661c35565a033d7e5323f38e833859bd7ab1
MD5 c2ac9fb13b6a97d9e4a7a735da1abfdd
SHA1 a7dc826f900ff8465ee8620336218f1f0e6c5e3f
SHA512 600a067280169bf42820e25f462dffedc2aae8bd32a80ccc83940c412fc2d31416de7f35f10b65a3da8665a3f1d5c7fb001bc052f6cd346be068634df1136945
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/428-98-0x00007FF6092C0000-0x00007FF609614000-memory.dmp

Download

memory/428-154-0x00007FF6092C0000-0x00007FF609614000-memory.dmp

Download

memory/440-137-0x00007FF602860000-0x00007FF602BB4000-memory.dmp

Download

memory/440-156-0x00007FF602860000-0x00007FF602BB4000-memory.dmp

Download

memory/440-99-0x00007FF602860000-0x00007FF602BB4000-memory.dmp

Download

memory/1792-147-0x00007FF637BC0000-0x00007FF637F14000-memory.dmp

Download

memory/1792-43-0x00007FF637BC0000-0x00007FF637F14000-memory.dmp

Download

memory/1792-133-0x00007FF637BC0000-0x00007FF637F14000-memory.dmp

Download

memory/2028-1-0x00000216666E0000-0x00000216666F0000-memory.dmp

Download

memory/2028-63-0x00007FF6D0DC0000-0x00007FF6D1114000-memory.dmp

Download

memory/2028-0-0x00007FF6D0DC0000-0x00007FF6D1114000-memory.dmp

Download

memory/2156-80-0x00007FF60FD10000-0x00007FF610064000-memory.dmp

Download

memory/2156-152-0x00007FF60FD10000-0x00007FF610064000-memory.dmp

Download

memory/2292-150-0x00007FF6B7F00000-0x00007FF6B8254000-memory.dmp

Download

memory/2292-64-0x00007FF6B7F00000-0x00007FF6B8254000-memory.dmp

Download

memory/2352-138-0x00007FF747A70000-0x00007FF747DC4000-memory.dmp

Download

memory/2352-100-0x00007FF747A70000-0x00007FF747DC4000-memory.dmp

Download

memory/2352-155-0x00007FF747A70000-0x00007FF747DC4000-memory.dmp

Download

memory/2396-135-0x00007FF7A0C90000-0x00007FF7A0FE4000-memory.dmp

Download

memory/2396-148-0x00007FF7A0C90000-0x00007FF7A0FE4000-memory.dmp

Download

memory/2396-52-0x00007FF7A0C90000-0x00007FF7A0FE4000-memory.dmp

Download

memory/2488-69-0x00007FF780B60000-0x00007FF780EB4000-memory.dmp

Download

memory/2488-141-0x00007FF780B60000-0x00007FF780EB4000-memory.dmp

Download

memory/2488-8-0x00007FF780B60000-0x00007FF780EB4000-memory.dmp

Download

memory/2900-101-0x00007FF7328B0000-0x00007FF732C04000-memory.dmp

Download

memory/2900-157-0x00007FF7328B0000-0x00007FF732C04000-memory.dmp

Download

memory/2900-139-0x00007FF7328B0000-0x00007FF732C04000-memory.dmp

Download

memory/2956-32-0x00007FF6D1370000-0x00007FF6D16C4000-memory.dmp

Download

memory/2956-145-0x00007FF6D1370000-0x00007FF6D16C4000-memory.dmp

Download

memory/3076-131-0x00007FF774750000-0x00007FF774AA4000-memory.dmp

Download

memory/3076-160-0x00007FF774750000-0x00007FF774AA4000-memory.dmp

Download

memory/3476-18-0x00007FF6A1AD0000-0x00007FF6A1E24000-memory.dmp

Download

memory/3476-142-0x00007FF6A1AD0000-0x00007FF6A1E24000-memory.dmp

Download

memory/3512-153-0x00007FF698520000-0x00007FF698874000-memory.dmp

Download

memory/3512-136-0x00007FF698520000-0x00007FF698874000-memory.dmp

Download

memory/3512-83-0x00007FF698520000-0x00007FF698874000-memory.dmp

Download

memory/3628-111-0x00007FF6A6C00000-0x00007FF6A6F54000-memory.dmp

Download

memory/3628-144-0x00007FF6A6C00000-0x00007FF6A6F54000-memory.dmp

Download

memory/3628-24-0x00007FF6A6C00000-0x00007FF6A6F54000-memory.dmp

Download

memory/3712-159-0x00007FF77AC30000-0x00007FF77AF84000-memory.dmp

Download

memory/3712-122-0x00007FF77AC30000-0x00007FF77AF84000-memory.dmp

Download

memory/4112-140-0x00007FF70D320000-0x00007FF70D674000-memory.dmp

Download

memory/4112-158-0x00007FF70D320000-0x00007FF70D674000-memory.dmp

Download

memory/4112-114-0x00007FF70D320000-0x00007FF70D674000-memory.dmp

Download

memory/4164-132-0x00007FF7921E0000-0x00007FF792534000-memory.dmp

Download

memory/4164-161-0x00007FF7921E0000-0x00007FF792534000-memory.dmp

Download

memory/4168-151-0x00007FF69EEC0000-0x00007FF69F214000-memory.dmp

Download

memory/4168-70-0x00007FF69EEC0000-0x00007FF69F214000-memory.dmp

Download

memory/4448-23-0x00007FF73A1B0000-0x00007FF73A504000-memory.dmp

Download

memory/4448-143-0x00007FF73A1B0000-0x00007FF73A504000-memory.dmp

Download

memory/4448-79-0x00007FF73A1B0000-0x00007FF73A504000-memory.dmp

Download

memory/4548-130-0x00007FF7202B0000-0x00007FF720604000-memory.dmp

Download

memory/4548-37-0x00007FF7202B0000-0x00007FF720604000-memory.dmp

Download

memory/4548-146-0x00007FF7202B0000-0x00007FF720604000-memory.dmp

Download

memory/4744-149-0x00007FF67E7D0000-0x00007FF67EB24000-memory.dmp

Download

memory/4744-49-0x00007FF67E7D0000-0x00007FF67EB24000-memory.dmp

Download

memory/4744-134-0x00007FF67E7D0000-0x00007FF67EB24000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads