cobaltstrike | f3ab8598832259532a48345e9e310900ee8fa14f4742faad75098b81ef2db705

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-1evpwsgc75
SHA256 f3ab8598832259532a48345e9e310900ee8fa14f4742faad75098b81ef2db705
MD5 8bdd7efaaabf950092bc32ee90d8c2b3
SHA1 e4f534470b34a5f6159526f494603c043b4b7f56
SHA512 ea23103a3ae879cdf7b806ed63758405c53c0f44978a01f8377c1e2ab4a9a6d4206197f8658339ae939f3277c810c1cd7b25f91b0aa9ba571a42a80118e4f57d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023269-4.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002326e-12.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326f-11.dat	cobalt_reflective_dll
behavioral2/files/0x000e000000023240-23.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023271-29.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023272-34.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023274-41.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023275-48.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023276-53.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023277-60.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023278-64.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023279-71.dat	cobalt_reflective_dll
behavioral2/files/0x000200000001e32b-79.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002327b-86.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002327c-92.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002327d-100.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002327e-104.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002327f-108.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023280-114.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023281-123.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023282-122.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023269-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002326e-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326f-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000e000000023240-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023271-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023272-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023274-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023275-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023276-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023277-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023278-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023279-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000200000001e32b-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002327b-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002327c-92.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002327d-100.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002327e-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002327f-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023280-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023281-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023282-122.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4832-0-0x00007FF7D21D0000-0x00007FF7D2524000-memory.dmp	UPX
behavioral2/files/0x0008000000023269-4.dat	UPX
behavioral2/memory/4480-8-0x00007FF64C2D0000-0x00007FF64C624000-memory.dmp	UPX
behavioral2/files/0x000800000002326e-12.dat	UPX
behavioral2/memory/2600-14-0x00007FF65B710000-0x00007FF65BA64000-memory.dmp	UPX
behavioral2/files/0x000700000002326f-11.dat	UPX
behavioral2/memory/2180-20-0x00007FF74C7E0000-0x00007FF74CB34000-memory.dmp	UPX
behavioral2/files/0x000e000000023240-23.dat	UPX
behavioral2/memory/3132-25-0x00007FF737990000-0x00007FF737CE4000-memory.dmp	UPX
behavioral2/files/0x0007000000023271-29.dat	UPX
behavioral2/memory/2684-32-0x00007FF658590000-0x00007FF6588E4000-memory.dmp	UPX
behavioral2/files/0x0007000000023272-34.dat	UPX
behavioral2/memory/3664-38-0x00007FF74E270000-0x00007FF74E5C4000-memory.dmp	UPX
behavioral2/files/0x0007000000023274-41.dat	UPX
behavioral2/files/0x0007000000023275-48.dat	UPX
behavioral2/memory/2108-46-0x00007FF729CA0000-0x00007FF729FF4000-memory.dmp	UPX
behavioral2/files/0x0007000000023276-53.dat	UPX
behavioral2/memory/4396-55-0x00007FF67C2C0000-0x00007FF67C614000-memory.dmp	UPX
behavioral2/memory/3216-58-0x00007FF7558D0000-0x00007FF755C24000-memory.dmp	UPX
behavioral2/files/0x0007000000023277-60.dat	UPX
behavioral2/files/0x0007000000023278-64.dat	UPX
behavioral2/memory/948-66-0x00007FF7221E0000-0x00007FF722534000-memory.dmp	UPX
behavioral2/memory/4492-69-0x00007FF758A30000-0x00007FF758D84000-memory.dmp	UPX
behavioral2/memory/4832-63-0x00007FF7D21D0000-0x00007FF7D2524000-memory.dmp	UPX
behavioral2/files/0x0007000000023279-71.dat	UPX
behavioral2/memory/2600-75-0x00007FF65B710000-0x00007FF65BA64000-memory.dmp	UPX
behavioral2/memory/1900-76-0x00007FF732390000-0x00007FF7326E4000-memory.dmp	UPX
behavioral2/files/0x000200000001e32b-79.dat	UPX
behavioral2/memory/2180-81-0x00007FF74C7E0000-0x00007FF74CB34000-memory.dmp	UPX
behavioral2/memory/2252-83-0x00007FF754EE0000-0x00007FF755234000-memory.dmp	UPX
behavioral2/files/0x000700000002327b-86.dat	UPX
behavioral2/files/0x000700000002327c-92.dat	UPX
behavioral2/memory/4040-93-0x00007FF635350000-0x00007FF6356A4000-memory.dmp	UPX
behavioral2/memory/3664-96-0x00007FF74E270000-0x00007FF74E5C4000-memory.dmp	UPX
behavioral2/files/0x000700000002327d-100.dat	UPX
behavioral2/memory/2352-99-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp	UPX
behavioral2/files/0x000700000002327e-104.dat	UPX
behavioral2/files/0x000700000002327f-108.dat	UPX
behavioral2/files/0x0007000000023280-114.dat	UPX
behavioral2/files/0x0007000000023281-123.dat	UPX
behavioral2/files/0x0007000000023282-122.dat	UPX
behavioral2/memory/3132-87-0x00007FF737990000-0x00007FF737CE4000-memory.dmp	UPX
behavioral2/memory/4904-125-0x00007FF639230000-0x00007FF639584000-memory.dmp	UPX
behavioral2/memory/3260-128-0x00007FF777EB0000-0x00007FF778204000-memory.dmp	UPX
behavioral2/memory/2524-130-0x00007FF6E32A0000-0x00007FF6E35F4000-memory.dmp	UPX
behavioral2/memory/2340-129-0x00007FF70FD10000-0x00007FF710064000-memory.dmp	UPX
behavioral2/memory/3248-131-0x00007FF6DF830000-0x00007FF6DFB84000-memory.dmp	UPX
behavioral2/memory/4572-132-0x00007FF6CD700000-0x00007FF6CDA54000-memory.dmp	UPX
behavioral2/memory/4492-133-0x00007FF758A30000-0x00007FF758D84000-memory.dmp	UPX
behavioral2/memory/4040-134-0x00007FF635350000-0x00007FF6356A4000-memory.dmp	UPX
behavioral2/memory/4480-135-0x00007FF64C2D0000-0x00007FF64C624000-memory.dmp	UPX
behavioral2/memory/2600-136-0x00007FF65B710000-0x00007FF65BA64000-memory.dmp	UPX
behavioral2/memory/2180-137-0x00007FF74C7E0000-0x00007FF74CB34000-memory.dmp	UPX
behavioral2/memory/3132-138-0x00007FF737990000-0x00007FF737CE4000-memory.dmp	UPX
behavioral2/memory/2684-139-0x00007FF658590000-0x00007FF6588E4000-memory.dmp	UPX
behavioral2/memory/3664-140-0x00007FF74E270000-0x00007FF74E5C4000-memory.dmp	UPX
behavioral2/memory/2352-141-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp	UPX
behavioral2/memory/2108-142-0x00007FF729CA0000-0x00007FF729FF4000-memory.dmp	UPX
behavioral2/memory/4396-143-0x00007FF67C2C0000-0x00007FF67C614000-memory.dmp	UPX
behavioral2/memory/3216-144-0x00007FF7558D0000-0x00007FF755C24000-memory.dmp	UPX
behavioral2/memory/948-145-0x00007FF7221E0000-0x00007FF722534000-memory.dmp	UPX
behavioral2/memory/4492-146-0x00007FF758A30000-0x00007FF758D84000-memory.dmp	UPX
behavioral2/memory/1900-147-0x00007FF732390000-0x00007FF7326E4000-memory.dmp	UPX
behavioral2/memory/2252-148-0x00007FF754EE0000-0x00007FF755234000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4832-0-0x00007FF7D21D0000-0x00007FF7D2524000-memory.dmp	xmrig
behavioral2/files/0x0008000000023269-4.dat	xmrig
behavioral2/memory/4480-8-0x00007FF64C2D0000-0x00007FF64C624000-memory.dmp	xmrig
behavioral2/files/0x000800000002326e-12.dat	xmrig
behavioral2/memory/2600-14-0x00007FF65B710000-0x00007FF65BA64000-memory.dmp	xmrig
behavioral2/files/0x000700000002326f-11.dat	xmrig
behavioral2/memory/2180-20-0x00007FF74C7E0000-0x00007FF74CB34000-memory.dmp	xmrig
behavioral2/files/0x000e000000023240-23.dat	xmrig
behavioral2/memory/3132-25-0x00007FF737990000-0x00007FF737CE4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023271-29.dat	xmrig
behavioral2/memory/2684-32-0x00007FF658590000-0x00007FF6588E4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023272-34.dat	xmrig
behavioral2/memory/3664-38-0x00007FF74E270000-0x00007FF74E5C4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023274-41.dat	xmrig
behavioral2/files/0x0007000000023275-48.dat	xmrig
behavioral2/memory/2108-46-0x00007FF729CA0000-0x00007FF729FF4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023276-53.dat	xmrig
behavioral2/memory/4396-55-0x00007FF67C2C0000-0x00007FF67C614000-memory.dmp	xmrig
behavioral2/memory/3216-58-0x00007FF7558D0000-0x00007FF755C24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023277-60.dat	xmrig
behavioral2/files/0x0007000000023278-64.dat	xmrig
behavioral2/memory/948-66-0x00007FF7221E0000-0x00007FF722534000-memory.dmp	xmrig
behavioral2/memory/4492-69-0x00007FF758A30000-0x00007FF758D84000-memory.dmp	xmrig
behavioral2/memory/4832-63-0x00007FF7D21D0000-0x00007FF7D2524000-memory.dmp	xmrig
behavioral2/files/0x0007000000023279-71.dat	xmrig
behavioral2/memory/2600-75-0x00007FF65B710000-0x00007FF65BA64000-memory.dmp	xmrig
behavioral2/memory/1900-76-0x00007FF732390000-0x00007FF7326E4000-memory.dmp	xmrig
behavioral2/files/0x000200000001e32b-79.dat	xmrig
behavioral2/memory/2180-81-0x00007FF74C7E0000-0x00007FF74CB34000-memory.dmp	xmrig
behavioral2/memory/2252-83-0x00007FF754EE0000-0x00007FF755234000-memory.dmp	xmrig
behavioral2/files/0x000700000002327b-86.dat	xmrig
behavioral2/files/0x000700000002327c-92.dat	xmrig
behavioral2/memory/4040-93-0x00007FF635350000-0x00007FF6356A4000-memory.dmp	xmrig
behavioral2/memory/3664-96-0x00007FF74E270000-0x00007FF74E5C4000-memory.dmp	xmrig
behavioral2/files/0x000700000002327d-100.dat	xmrig
behavioral2/memory/2352-99-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp	xmrig
behavioral2/files/0x000700000002327e-104.dat	xmrig
behavioral2/files/0x000700000002327f-108.dat	xmrig
behavioral2/files/0x0007000000023280-114.dat	xmrig
behavioral2/files/0x0007000000023281-123.dat	xmrig
behavioral2/files/0x0007000000023282-122.dat	xmrig
behavioral2/memory/3132-87-0x00007FF737990000-0x00007FF737CE4000-memory.dmp	xmrig
behavioral2/memory/4904-125-0x00007FF639230000-0x00007FF639584000-memory.dmp	xmrig
behavioral2/memory/3260-128-0x00007FF777EB0000-0x00007FF778204000-memory.dmp	xmrig
behavioral2/memory/2524-130-0x00007FF6E32A0000-0x00007FF6E35F4000-memory.dmp	xmrig
behavioral2/memory/2340-129-0x00007FF70FD10000-0x00007FF710064000-memory.dmp	xmrig
behavioral2/memory/3248-131-0x00007FF6DF830000-0x00007FF6DFB84000-memory.dmp	xmrig
behavioral2/memory/4572-132-0x00007FF6CD700000-0x00007FF6CDA54000-memory.dmp	xmrig
behavioral2/memory/4492-133-0x00007FF758A30000-0x00007FF758D84000-memory.dmp	xmrig
behavioral2/memory/4040-134-0x00007FF635350000-0x00007FF6356A4000-memory.dmp	xmrig
behavioral2/memory/4480-135-0x00007FF64C2D0000-0x00007FF64C624000-memory.dmp	xmrig
behavioral2/memory/2600-136-0x00007FF65B710000-0x00007FF65BA64000-memory.dmp	xmrig
behavioral2/memory/2180-137-0x00007FF74C7E0000-0x00007FF74CB34000-memory.dmp	xmrig
behavioral2/memory/3132-138-0x00007FF737990000-0x00007FF737CE4000-memory.dmp	xmrig
behavioral2/memory/2684-139-0x00007FF658590000-0x00007FF6588E4000-memory.dmp	xmrig
behavioral2/memory/3664-140-0x00007FF74E270000-0x00007FF74E5C4000-memory.dmp	xmrig
behavioral2/memory/2352-141-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp	xmrig
behavioral2/memory/2108-142-0x00007FF729CA0000-0x00007FF729FF4000-memory.dmp	xmrig
behavioral2/memory/4396-143-0x00007FF67C2C0000-0x00007FF67C614000-memory.dmp	xmrig
behavioral2/memory/3216-144-0x00007FF7558D0000-0x00007FF755C24000-memory.dmp	xmrig
behavioral2/memory/948-145-0x00007FF7221E0000-0x00007FF722534000-memory.dmp	xmrig
behavioral2/memory/4492-146-0x00007FF758A30000-0x00007FF758D84000-memory.dmp	xmrig
behavioral2/memory/1900-147-0x00007FF732390000-0x00007FF7326E4000-memory.dmp	xmrig
behavioral2/memory/2252-148-0x00007FF754EE0000-0x00007FF755234000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4480	XVipaxA.exe
2600	BtYFqyO.exe
2180	ewwYHLQ.exe
3132	yYWzavP.exe
2684	wcYZpKH.exe
3664	SsLpqhi.exe
2108	TzXDBxJ.exe
4396	fUbKPPN.exe
3216	pGVnvDG.exe
948	QhXIWrz.exe
4492	jnDBytx.exe
1900	Slhkgiz.exe
2252	rxKGhTP.exe
4040	EhqttgR.exe
2352	rxpErUp.exe
4904	CHARGft.exe
3260	wFRyvdq.exe
2340	mnJHQuW.exe
2524	njpTRYK.exe
4572	rmYByLv.exe
3248	jzPIyIb.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4832-0-0x00007FF7D21D0000-0x00007FF7D2524000-memory.dmp	upx
behavioral2/files/0x0008000000023269-4.dat	upx
behavioral2/memory/4480-8-0x00007FF64C2D0000-0x00007FF64C624000-memory.dmp	upx
behavioral2/files/0x000800000002326e-12.dat	upx
behavioral2/memory/2600-14-0x00007FF65B710000-0x00007FF65BA64000-memory.dmp	upx
behavioral2/files/0x000700000002326f-11.dat	upx
behavioral2/memory/2180-20-0x00007FF74C7E0000-0x00007FF74CB34000-memory.dmp	upx
behavioral2/files/0x000e000000023240-23.dat	upx
behavioral2/memory/3132-25-0x00007FF737990000-0x00007FF737CE4000-memory.dmp	upx
behavioral2/files/0x0007000000023271-29.dat	upx
behavioral2/memory/2684-32-0x00007FF658590000-0x00007FF6588E4000-memory.dmp	upx
behavioral2/files/0x0007000000023272-34.dat	upx
behavioral2/memory/3664-38-0x00007FF74E270000-0x00007FF74E5C4000-memory.dmp	upx
behavioral2/files/0x0007000000023274-41.dat	upx
behavioral2/files/0x0007000000023275-48.dat	upx
behavioral2/memory/2108-46-0x00007FF729CA0000-0x00007FF729FF4000-memory.dmp	upx
behavioral2/files/0x0007000000023276-53.dat	upx
behavioral2/memory/4396-55-0x00007FF67C2C0000-0x00007FF67C614000-memory.dmp	upx
behavioral2/memory/3216-58-0x00007FF7558D0000-0x00007FF755C24000-memory.dmp	upx
behavioral2/files/0x0007000000023277-60.dat	upx
behavioral2/files/0x0007000000023278-64.dat	upx
behavioral2/memory/948-66-0x00007FF7221E0000-0x00007FF722534000-memory.dmp	upx
behavioral2/memory/4492-69-0x00007FF758A30000-0x00007FF758D84000-memory.dmp	upx
behavioral2/memory/4832-63-0x00007FF7D21D0000-0x00007FF7D2524000-memory.dmp	upx
behavioral2/files/0x0007000000023279-71.dat	upx
behavioral2/memory/2600-75-0x00007FF65B710000-0x00007FF65BA64000-memory.dmp	upx
behavioral2/memory/1900-76-0x00007FF732390000-0x00007FF7326E4000-memory.dmp	upx
behavioral2/files/0x000200000001e32b-79.dat	upx
behavioral2/memory/2180-81-0x00007FF74C7E0000-0x00007FF74CB34000-memory.dmp	upx
behavioral2/memory/2252-83-0x00007FF754EE0000-0x00007FF755234000-memory.dmp	upx
behavioral2/files/0x000700000002327b-86.dat	upx
behavioral2/files/0x000700000002327c-92.dat	upx
behavioral2/memory/4040-93-0x00007FF635350000-0x00007FF6356A4000-memory.dmp	upx
behavioral2/memory/3664-96-0x00007FF74E270000-0x00007FF74E5C4000-memory.dmp	upx
behavioral2/files/0x000700000002327d-100.dat	upx
behavioral2/memory/2352-99-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp	upx
behavioral2/files/0x000700000002327e-104.dat	upx
behavioral2/files/0x000700000002327f-108.dat	upx
behavioral2/files/0x0007000000023280-114.dat	upx
behavioral2/files/0x0007000000023281-123.dat	upx
behavioral2/files/0x0007000000023282-122.dat	upx
behavioral2/memory/3132-87-0x00007FF737990000-0x00007FF737CE4000-memory.dmp	upx
behavioral2/memory/4904-125-0x00007FF639230000-0x00007FF639584000-memory.dmp	upx
behavioral2/memory/3260-128-0x00007FF777EB0000-0x00007FF778204000-memory.dmp	upx
behavioral2/memory/2524-130-0x00007FF6E32A0000-0x00007FF6E35F4000-memory.dmp	upx
behavioral2/memory/2340-129-0x00007FF70FD10000-0x00007FF710064000-memory.dmp	upx
behavioral2/memory/3248-131-0x00007FF6DF830000-0x00007FF6DFB84000-memory.dmp	upx
behavioral2/memory/4572-132-0x00007FF6CD700000-0x00007FF6CDA54000-memory.dmp	upx
behavioral2/memory/4492-133-0x00007FF758A30000-0x00007FF758D84000-memory.dmp	upx
behavioral2/memory/4040-134-0x00007FF635350000-0x00007FF6356A4000-memory.dmp	upx
behavioral2/memory/4480-135-0x00007FF64C2D0000-0x00007FF64C624000-memory.dmp	upx
behavioral2/memory/2600-136-0x00007FF65B710000-0x00007FF65BA64000-memory.dmp	upx
behavioral2/memory/2180-137-0x00007FF74C7E0000-0x00007FF74CB34000-memory.dmp	upx
behavioral2/memory/3132-138-0x00007FF737990000-0x00007FF737CE4000-memory.dmp	upx
behavioral2/memory/2684-139-0x00007FF658590000-0x00007FF6588E4000-memory.dmp	upx
behavioral2/memory/3664-140-0x00007FF74E270000-0x00007FF74E5C4000-memory.dmp	upx
behavioral2/memory/2352-141-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp	upx
behavioral2/memory/2108-142-0x00007FF729CA0000-0x00007FF729FF4000-memory.dmp	upx
behavioral2/memory/4396-143-0x00007FF67C2C0000-0x00007FF67C614000-memory.dmp	upx
behavioral2/memory/3216-144-0x00007FF7558D0000-0x00007FF755C24000-memory.dmp	upx
behavioral2/memory/948-145-0x00007FF7221E0000-0x00007FF722534000-memory.dmp	upx
behavioral2/memory/4492-146-0x00007FF758A30000-0x00007FF758D84000-memory.dmp	upx
behavioral2/memory/1900-147-0x00007FF732390000-0x00007FF7326E4000-memory.dmp	upx
behavioral2/memory/2252-148-0x00007FF754EE0000-0x00007FF755234000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\fUbKPPN.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QhXIWrz.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\Slhkgiz.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mnJHQuW.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BtYFqyO.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ewwYHLQ.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rxpErUp.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CHARGft.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\njpTRYK.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XVipaxA.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wcYZpKH.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SsLpqhi.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TzXDBxJ.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jnDBytx.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yYWzavP.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\pGVnvDG.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rxKGhTP.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EhqttgR.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wFRyvdq.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jzPIyIb.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rmYByLv.exe	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4480	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	92
PID 4832 wrote to memory of 4480	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	92
PID 4832 wrote to memory of 2600	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	93
PID 4832 wrote to memory of 2600	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	93
PID 4832 wrote to memory of 2180	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	94
PID 4832 wrote to memory of 2180	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	94
PID 4832 wrote to memory of 3132	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	95
PID 4832 wrote to memory of 3132	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	95
PID 4832 wrote to memory of 2684	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	96
PID 4832 wrote to memory of 2684	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	96
PID 4832 wrote to memory of 3664	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	97
PID 4832 wrote to memory of 3664	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	97
PID 4832 wrote to memory of 2108	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	98
PID 4832 wrote to memory of 2108	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	98
PID 4832 wrote to memory of 4396	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	99
PID 4832 wrote to memory of 4396	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	99
PID 4832 wrote to memory of 3216	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	100
PID 4832 wrote to memory of 3216	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	100
PID 4832 wrote to memory of 948	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	101
PID 4832 wrote to memory of 948	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	101
PID 4832 wrote to memory of 4492	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	102
PID 4832 wrote to memory of 4492	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	102
PID 4832 wrote to memory of 1900	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	103
PID 4832 wrote to memory of 1900	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	103
PID 4832 wrote to memory of 2252	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	104
PID 4832 wrote to memory of 2252	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	104
PID 4832 wrote to memory of 4040	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	105
PID 4832 wrote to memory of 4040	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	105
PID 4832 wrote to memory of 2352	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	108
PID 4832 wrote to memory of 2352	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	108
PID 4832 wrote to memory of 4904	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	109
PID 4832 wrote to memory of 4904	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	109
PID 4832 wrote to memory of 3260	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	110
PID 4832 wrote to memory of 3260	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	110
PID 4832 wrote to memory of 2340	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	111
PID 4832 wrote to memory of 2340	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	111
PID 4832 wrote to memory of 2524	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	112
PID 4832 wrote to memory of 2524	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	112
PID 4832 wrote to memory of 3248	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	113
PID 4832 wrote to memory of 3248	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	113
PID 4832 wrote to memory of 4572	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	114
PID 4832 wrote to memory of 4572	4832	2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe	114

C:\Users\Admin\AppData\Local\Temp\2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_8bdd7efaaabf950092bc32ee90d8c2b3_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\System\XVipaxA.exe
  C:\Windows\System\XVipaxA.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\BtYFqyO.exe
  C:\Windows\System\BtYFqyO.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\ewwYHLQ.exe
  C:\Windows\System\ewwYHLQ.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\yYWzavP.exe
  C:\Windows\System\yYWzavP.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\wcYZpKH.exe
  C:\Windows\System\wcYZpKH.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\SsLpqhi.exe
  C:\Windows\System\SsLpqhi.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\TzXDBxJ.exe
  C:\Windows\System\TzXDBxJ.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\fUbKPPN.exe
  C:\Windows\System\fUbKPPN.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\pGVnvDG.exe
  C:\Windows\System\pGVnvDG.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\QhXIWrz.exe
  C:\Windows\System\QhXIWrz.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\jnDBytx.exe
  C:\Windows\System\jnDBytx.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\Slhkgiz.exe
  C:\Windows\System\Slhkgiz.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\rxKGhTP.exe
  C:\Windows\System\rxKGhTP.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\EhqttgR.exe
  C:\Windows\System\EhqttgR.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\rxpErUp.exe
  C:\Windows\System\rxpErUp.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\CHARGft.exe
  C:\Windows\System\CHARGft.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\wFRyvdq.exe
  C:\Windows\System\wFRyvdq.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\mnJHQuW.exe
  C:\Windows\System\mnJHQuW.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\njpTRYK.exe
  C:\Windows\System\njpTRYK.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\jzPIyIb.exe
  C:\Windows\System\jzPIyIb.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\rmYByLv.exe
  C:\Windows\System\rmYByLv.exe
  2⤵
  - Executes dropped EXE
  PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4100 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:2908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BtYFqyO.exe

Path C:\Windows\System\BtYFqyO.exe
Size 5.9MB
SHA256 402f781c153df3bdcfdcdea5359ea7b54aa6b34cd62a7953302e539ce51d25b3
MD5 8edd432a260a9f00b4330de0e973c616
SHA1 03a1916566a81ee9b6f3ceb606c52d22757514d3
SHA512 7d52427ada50f67a19b14b29d980d9462ea525495f475e59cd4caa4a21028ec56089f01aa54ba5f77059fdea41863b2c38548a73740132d5d6bb277fc0377ca9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

CHARGft.exe

Path C:\Windows\System\CHARGft.exe
Size 5.9MB
SHA256 d1de64c4bb1fd7ccc60707858ffc6aa10d9a7a301ff6b728cd1b66593e246655
MD5 7b529418a98159d34939c92238293fec
SHA1 d819cb6e85fee0f59e4f086a3e8967b44cc9646f
SHA512 a14a3f794f3ed978ce6da1069f7f96d6f6ac81700205f2402fa1467cb9e6e6addbf11259615c176232d1097de7de259328d51ec7cabfd85f6477dab06113c5b2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

EhqttgR.exe

Path C:\Windows\System\EhqttgR.exe
Size 5.9MB
SHA256 f7c7b259ea3f00ac4d500c030d641c20c5a297c2745bff3144a09076ca228264
MD5 639b07c853123376854e64fb0e8f1dc9
SHA1 600cdd901b26316921fa98a53ca3db152b04e230
SHA512 141dfc72f601180ff7361ee6665a35cdff6691b8e65c8e6e0256bee32be98c27509e797f8ad14f56ee44e013aea14b54f0a0ebfc848fa9868af0e3ead5362642
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

QhXIWrz.exe

Path C:\Windows\System\QhXIWrz.exe
Size 5.9MB
SHA256 75067ecb6f71d711a9f3eef1cd7a126e2e6f266cdc01b77bbb9cbed2d15c07f8
MD5 f997642aa64d766dcff40fe3defedf63
SHA1 f7b11974d09cf4f491316cbc10c93f170e8cebe4
SHA512 4b50ec62aa18e16222bd401ecaa34bb9c2661e7a237c4092d83f08da481cd88696b6251c9487e0ab75a56f33911742cb5fb22d10d57f8f446b0a2d52398d0df8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Slhkgiz.exe

Path C:\Windows\System\Slhkgiz.exe
Size 5.9MB
SHA256 20f128eeb947cea6192bcbd2b8b8d8085a3867b06ef38103c576f8e4f8f02878
MD5 6d7b7fcc69844bac236fedc71f3bbac4
SHA1 5e993e3842e72083891d6ab9f0efc6d997d99034
SHA512 dd4f82504a61429d219717c246ce8682fe2f90112fb32a767f4470c8a8173b4edabdf434b89043fe88bc53f388ac4122035174c1f96c08faf9d58765e28097ea
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

SsLpqhi.exe

Path C:\Windows\System\SsLpqhi.exe
Size 5.9MB
SHA256 b5577df9d3f27866cbc0155a71730eb9dbdb33e60d992434fd2ade9542dea2b9
MD5 781fbfcae5d3cdb57ea4dc0e599c56b4
SHA1 d81dde7385f270e01461842df5d4fcc682aced23
SHA512 9ccfcbff53e870197cb102fc5f73262782bdd3f46eb88c4abe2bc21c766e19ead924a5eddd3eff2a85eaf80a2a7e246f4ff48748607c346c54da0d19d6281a7f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

TzXDBxJ.exe

Path C:\Windows\System\TzXDBxJ.exe
Size 5.9MB
SHA256 74cb19cbfc7ac70ae07278614de5da3be5af55466298bd0f9f90a34338d8e349
MD5 797c3780fdc9030f22165b25f024921b
SHA1 2f729381eebf3dd32b2b388e2b16f6b23cea09d0
SHA512 075c6ce34f0ee06ab877ab761b791aaf7324211785d60853c1db312901799a6194d7902139f25fbf993c63afd9bf2ab79409ee68f1d074c2ffe35c0e9c42e200
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

XVipaxA.exe

Path C:\Windows\System\XVipaxA.exe
Size 5.9MB
SHA256 20cad935a5c3aa454902b52bf7ffde62f5cd8fecf2373a633c254819db354e8f
MD5 0416f0cf5a5885e8bc05601cd0cf5dd9
SHA1 46f407ca409f7c48ba2962fbfc9c5c861bac2f61
SHA512 6f7954023bb982ab247bbeea8f397d1d847d3cf1d54cad0713c2c02f62f6e0f40ef0a3d1fb255c43193efc97fd539f94988c9a0ca22c4c9d4bcb82f8b9276600
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

ewwYHLQ.exe

Path C:\Windows\System\ewwYHLQ.exe
Size 5.9MB
SHA256 3796f081febcfba56b9fa8b7b43f8e63247e132bf1f213674d8fc9bbbc184a7d
MD5 00e4330e4b24233979e1a9664f33b47e
SHA1 3dfb5c1426c82da711b5aeb8266cca57ad6bea93
SHA512 c9cc85f237459b6c5cef0c3df5b4b608ad968a843f57191f528eaaa8023ccb735f9bf643de3ed50ba58ef20762d59bfd71fc8e3a708cb64fb1bafc891d4f46ce
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

fUbKPPN.exe

Path C:\Windows\System\fUbKPPN.exe
Size 5.9MB
SHA256 28faa743818978a6d87c75cfa0dca0aa2f16a182e7a8419f9244cc2016e06749
MD5 91a5ecb664fab0d38311ca4d39bf8b31
SHA1 fdf5ce698df5b13c54b82edaba779337a2238363
SHA512 77cbf13d2aadee11716917c9c73c0f2026fc490ac4d34a1a9b07950472e18a3e9ef62540cca2653f9360f5bc259df09a339a123552bcea23ebd4cfb9fa3fabcd
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

jnDBytx.exe

Path C:\Windows\System\jnDBytx.exe
Size 5.9MB
SHA256 c6255ef648b817461d41d9cf96f0d9427f7c223d904d86fd99d17a6b3f66b3cc
MD5 d4546e99049009800c01e52c1333dbf6
SHA1 9ed0fb5b3f5f8ba2881e2ea0c2d0ff0e8907cbde
SHA512 3cc7c7feb4691f2b32a3e735b34a38c9546789b5793a11fdb66a05e95c18c4b677b50e82ebcd1d7a0886c6e1df36604c12e2b11373e6601d0d25548e80181007
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

jzPIyIb.exe

Path C:\Windows\System\jzPIyIb.exe
Size 5.9MB
SHA256 c60732ecf627be3c5f8917b62f5ca8672d4509adb2b6c5c04f26db4420864c5b
MD5 d93b7fa8934b12d7de5dad1711a299a3
SHA1 63064f13b547af371201e4ba7c248c1c2c7c26b1
SHA512 ecf01bd1817208e9d6430d9d1bdd048a338e760ea92a050690c3139a8f1c78871d83a4e8d2c191323f74bf6b4d9fcacdf3e71ccfed24ef4769690f5e101995a9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

mnJHQuW.exe

Path C:\Windows\System\mnJHQuW.exe
Size 5.9MB
SHA256 274190b8481bd0b61946c695f23b27ed7c6c06cda657abac8f61ce31809ef67a
MD5 9cf8541519bf765d4c45183df68d2aa8
SHA1 b18692f73587b2d0c1aecdb5bb3ff62d72dcc6cb
SHA512 67afb1bf92bc7120ad63454753e41b1f7413609fe2960be3adb43f42236998f94b7470b447737b919a2fa39e7fdf3b979ada107ffb6bf1f659526497e2845a7f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:Q+856utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

njpTRYK.exe

Path C:\Windows\System\njpTRYK.exe
Size 5.9MB
SHA256 c6d27cec42e51eec19178978c23290dcfb2455d5eae37a9e8f103c8a00bf8406
MD5 35703b053bf5511325e90cecd801854e
SHA1 f93697c6b45a5535f95e047c2e314e9b841fa808
SHA512 80e836699066a856d734417d7949b89c5361163d3365b6a51fd72511587ea3044d4970141af2135f07439c806ba782d7dd59f5c07eba67d1c26900ef49033368
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

pGVnvDG.exe

Path C:\Windows\System\pGVnvDG.exe
Size 5.9MB
SHA256 7f12410cd412794c96f7c0c727c2cbaad07f5773908d868f3c5034ceb27e0bc0
MD5 1d57b89246dbcf6fa3784ab77485359d
SHA1 f7c11663b8e01d5c36f47399c74368e919a300a9
SHA512 db7ed696dda130fc2da30421427497f551810301195f88e82f6ab3e922dc95cfda528bcdfdb4677ca4b80fb0e7240250ff6e624f97e2dad51caf084f93849fc3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

rmYByLv.exe

Path C:\Windows\System\rmYByLv.exe
Size 5.9MB
SHA256 a34aee372a9f4fa89766ba819cb1314cba03057f82f39f06bade2cb5647b771a
MD5 75a71186d37dfc25fc521c5dff040e0b
SHA1 87b3c703c63643d18e5e4eccca5bbab9b5da6d95
SHA512 f811fba89799ba7c9f277a2e7d01b1da82b7f2daab18f3b91db19329cf408e8f8b438a2b3471eaf4cce7d249b468ab1a9238bd8e92e719d99d9d1c532b2d9b14
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

rxKGhTP.exe

Path C:\Windows\System\rxKGhTP.exe
Size 5.9MB
SHA256 195e343563072b95496af886f9f1776c38daf03d22bc9f46e010672fb5da494b
MD5 72360a213ddbf891f958fb0c03a2908d
SHA1 578338295b47563eddd5087224aaaf53e9b22e79
SHA512 c452d968cf298b005f2df69a6fdaf1d2ea85b2da592819989aaccfc17db15ba8c913e69fc1055865e319aba9a0c13047493d27c6bb6bae486b16b42c520551f7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

rxpErUp.exe

Path C:\Windows\System\rxpErUp.exe
Size 5.9MB
SHA256 f9dd515a59b8a069f004d9f5cf15659b1476855ae482730db2e27edf549c6fd2
MD5 3316f4e71922608945eeed1bb92c3613
SHA1 9b3653c74bb89c1f603d9e326b7d900221362bc6
SHA512 254391659283dc6d807b6e6ded93805278ce6cb2e3d5e86e0d113a801219457b352ca9deee8180dfb303c985df002fabd3bf488d343a0d8ea1becf0d4849473d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

wFRyvdq.exe

Path C:\Windows\System\wFRyvdq.exe
Size 5.9MB
SHA256 8f541aeb96f847fc85804a09bf132aa41c6178efe70411d7bebec12b133544da
MD5 7dc8161f209007a4c8b1a548a14ef73a
SHA1 b3d3e4b6ef7c9b392e7aaf162bd8634861a42eb3
SHA512 0d2d0fa4a1cfb97946f5b935b095a581fc3638e3e5f3bc3004628c4a1ae55cc2de4d168eb495819388b9d939b1c1f66dbad3d95d042468fcdcee032ec9bb27c9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

wcYZpKH.exe

Path C:\Windows\System\wcYZpKH.exe
Size 5.9MB
SHA256 6877344fb0daec91d69b43324660d7b0acc18de133441a95072786530efaf494
MD5 ff93bde45db9ed9355ae5fe87fdd546a
SHA1 f2fb400147182089197e8f3552afec1988837d2c
SHA512 ffb632161986acec76e5400c6ad9892ce4d71192b4cd4787dc54cbf94ce23a05125464420ab9d9c107d702664b4a6b547ba4504921cf6fd373d69d4d8aae3d36
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

yYWzavP.exe

Path C:\Windows\System\yYWzavP.exe
Size 5.9MB
SHA256 46da39f0937a918780cde2c2250cb290a8c49314c937b705caf42dfa72ae6051
MD5 227aae0d27704e9ea9f3cfb7fd13e3fe
SHA1 58ba547790f9365e89dbe2ef2988cf3bba71edde
SHA512 7369fc7b3000606d035a23143eed0a7db8db457740417bbc44f90642cadf8ee64fbcdc0f44e5e50f40ddf9b8c35df93e876344a4f8d937e8db2c83a513390c23
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/948-145-0x00007FF7221E0000-0x00007FF722534000-memory.dmp

Download

memory/948-66-0x00007FF7221E0000-0x00007FF722534000-memory.dmp

Download

memory/1900-76-0x00007FF732390000-0x00007FF7326E4000-memory.dmp

Download

memory/1900-147-0x00007FF732390000-0x00007FF7326E4000-memory.dmp

Download

memory/2108-142-0x00007FF729CA0000-0x00007FF729FF4000-memory.dmp

Download

memory/2108-46-0x00007FF729CA0000-0x00007FF729FF4000-memory.dmp

Download

memory/2180-20-0x00007FF74C7E0000-0x00007FF74CB34000-memory.dmp

Download

memory/2180-137-0x00007FF74C7E0000-0x00007FF74CB34000-memory.dmp

Download

memory/2180-81-0x00007FF74C7E0000-0x00007FF74CB34000-memory.dmp

Download

memory/2252-83-0x00007FF754EE0000-0x00007FF755234000-memory.dmp

Download

memory/2252-148-0x00007FF754EE0000-0x00007FF755234000-memory.dmp

Download

memory/2340-129-0x00007FF70FD10000-0x00007FF710064000-memory.dmp

Download

memory/2340-152-0x00007FF70FD10000-0x00007FF710064000-memory.dmp

Download

memory/2352-150-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp

Download

memory/2352-99-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp

Download

memory/2352-141-0x00007FF6E6790000-0x00007FF6E6AE4000-memory.dmp

Download

memory/2524-130-0x00007FF6E32A0000-0x00007FF6E35F4000-memory.dmp

Download

memory/2524-153-0x00007FF6E32A0000-0x00007FF6E35F4000-memory.dmp

Download

memory/2600-136-0x00007FF65B710000-0x00007FF65BA64000-memory.dmp

Download

memory/2600-75-0x00007FF65B710000-0x00007FF65BA64000-memory.dmp

Download

memory/2600-14-0x00007FF65B710000-0x00007FF65BA64000-memory.dmp

Download

memory/2684-139-0x00007FF658590000-0x00007FF6588E4000-memory.dmp

Download

memory/2684-32-0x00007FF658590000-0x00007FF6588E4000-memory.dmp

Download

memory/3132-87-0x00007FF737990000-0x00007FF737CE4000-memory.dmp

Download

memory/3132-25-0x00007FF737990000-0x00007FF737CE4000-memory.dmp

Download

memory/3132-138-0x00007FF737990000-0x00007FF737CE4000-memory.dmp

Download

memory/3216-144-0x00007FF7558D0000-0x00007FF755C24000-memory.dmp

Download

memory/3216-58-0x00007FF7558D0000-0x00007FF755C24000-memory.dmp

Download

memory/3248-131-0x00007FF6DF830000-0x00007FF6DFB84000-memory.dmp

Download

memory/3248-156-0x00007FF6DF830000-0x00007FF6DFB84000-memory.dmp

Download

memory/3260-128-0x00007FF777EB0000-0x00007FF778204000-memory.dmp

Download

memory/3260-151-0x00007FF777EB0000-0x00007FF778204000-memory.dmp

Download

memory/3664-96-0x00007FF74E270000-0x00007FF74E5C4000-memory.dmp

Download

memory/3664-38-0x00007FF74E270000-0x00007FF74E5C4000-memory.dmp

Download

memory/3664-140-0x00007FF74E270000-0x00007FF74E5C4000-memory.dmp

Download

memory/4040-134-0x00007FF635350000-0x00007FF6356A4000-memory.dmp

Download

memory/4040-93-0x00007FF635350000-0x00007FF6356A4000-memory.dmp

Download

memory/4040-149-0x00007FF635350000-0x00007FF6356A4000-memory.dmp

Download

memory/4396-55-0x00007FF67C2C0000-0x00007FF67C614000-memory.dmp

Download

memory/4396-143-0x00007FF67C2C0000-0x00007FF67C614000-memory.dmp

Download

memory/4480-8-0x00007FF64C2D0000-0x00007FF64C624000-memory.dmp

Download

memory/4480-135-0x00007FF64C2D0000-0x00007FF64C624000-memory.dmp

Download

memory/4492-69-0x00007FF758A30000-0x00007FF758D84000-memory.dmp

Download

memory/4492-146-0x00007FF758A30000-0x00007FF758D84000-memory.dmp

Download

memory/4492-133-0x00007FF758A30000-0x00007FF758D84000-memory.dmp

Download

memory/4572-132-0x00007FF6CD700000-0x00007FF6CDA54000-memory.dmp

Download

memory/4572-155-0x00007FF6CD700000-0x00007FF6CDA54000-memory.dmp

Download

memory/4832-1-0x0000027899550000-0x0000027899560000-memory.dmp

Download

memory/4832-63-0x00007FF7D21D0000-0x00007FF7D2524000-memory.dmp

Download

memory/4832-0-0x00007FF7D21D0000-0x00007FF7D2524000-memory.dmp

Download

memory/4904-154-0x00007FF639230000-0x00007FF639584000-memory.dmp

Download

memory/4904-125-0x00007FF639230000-0x00007FF639584000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads