cobaltstrike | d120fda7cefed613ff54b2bff62c12099228937381fc027a3716189c0d959137

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-1fqsbsgc89
SHA256 d120fda7cefed613ff54b2bff62c12099228937381fc027a3716189c0d959137
MD5 91c26f084ffa7e869bebaee95cb3abcb
SHA1 f3f15a30a708e516decf0b8a8daccc5379769431
SHA512 6b998d0b88d0990aa438c788ebb9904c5bee9be52590005bc7b05af8efe32d60926d0b850f3a288501416e8be778afd3de490b7d7b04a2331b22ad7623f00e6e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000f000000023253-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023264-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023265-10.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023261-24.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023266-28.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023268-35.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023269-41.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326a-46.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326b-52.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326c-57.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326d-62.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326e-67.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023270-76.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023272-87.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023273-92.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023274-97.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023275-102.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023276-106.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023277-111.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023271-82.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326f-72.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000f000000023253-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023264-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023265-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023261-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023266-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023268-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023269-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326a-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326b-52.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326c-57.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326d-62.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326e-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023270-76.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023272-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023273-92.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023274-97.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023275-102.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023276-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023277-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023271-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326f-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3696-0-0x00007FF760E70000-0x00007FF7611C4000-memory.dmp	UPX
behavioral2/files/0x000f000000023253-4.dat	UPX
behavioral2/memory/1724-8-0x00007FF663760000-0x00007FF663AB4000-memory.dmp	UPX
behavioral2/files/0x0007000000023264-11.dat	UPX
behavioral2/files/0x0007000000023265-10.dat	UPX
behavioral2/memory/1896-20-0x00007FF7E85F0000-0x00007FF7E8944000-memory.dmp	UPX
behavioral2/memory/5016-16-0x00007FF748E80000-0x00007FF7491D4000-memory.dmp	UPX
behavioral2/files/0x0008000000023261-24.dat	UPX
behavioral2/memory/780-26-0x00007FF76E290000-0x00007FF76E5E4000-memory.dmp	UPX
behavioral2/files/0x0007000000023266-28.dat	UPX
behavioral2/memory/2036-32-0x00007FF6954F0000-0x00007FF695844000-memory.dmp	UPX
behavioral2/files/0x0007000000023268-35.dat	UPX
behavioral2/memory/2636-38-0x00007FF69CF10000-0x00007FF69D264000-memory.dmp	UPX
behavioral2/files/0x0007000000023269-41.dat	UPX
behavioral2/files/0x000700000002326a-46.dat	UPX
behavioral2/files/0x000700000002326b-52.dat	UPX
behavioral2/files/0x000700000002326c-57.dat	UPX
behavioral2/files/0x000700000002326d-62.dat	UPX
behavioral2/files/0x000700000002326e-67.dat	UPX
behavioral2/files/0x0007000000023270-76.dat	UPX
behavioral2/files/0x0007000000023272-87.dat	UPX
behavioral2/files/0x0007000000023273-92.dat	UPX
behavioral2/files/0x0007000000023274-97.dat	UPX
behavioral2/files/0x0007000000023275-102.dat	UPX
behavioral2/files/0x0007000000023276-106.dat	UPX
behavioral2/files/0x0007000000023277-111.dat	UPX
behavioral2/files/0x0007000000023271-82.dat	UPX
behavioral2/files/0x000700000002326f-72.dat	UPX
behavioral2/memory/872-113-0x00007FF70A700000-0x00007FF70AA54000-memory.dmp	UPX
behavioral2/memory/1484-114-0x00007FF745FD0000-0x00007FF746324000-memory.dmp	UPX
behavioral2/memory/4964-115-0x00007FF7C2010000-0x00007FF7C2364000-memory.dmp	UPX
behavioral2/memory/3308-116-0x00007FF60EA30000-0x00007FF60ED84000-memory.dmp	UPX
behavioral2/memory/4332-118-0x00007FF70F180000-0x00007FF70F4D4000-memory.dmp	UPX
behavioral2/memory/4904-117-0x00007FF7B39F0000-0x00007FF7B3D44000-memory.dmp	UPX
behavioral2/memory/4136-119-0x00007FF7A25E0000-0x00007FF7A2934000-memory.dmp	UPX
behavioral2/memory/2412-120-0x00007FF7802F0000-0x00007FF780644000-memory.dmp	UPX
behavioral2/memory/3204-121-0x00007FF761650000-0x00007FF7619A4000-memory.dmp	UPX
behavioral2/memory/4632-123-0x00007FF66B810000-0x00007FF66BB64000-memory.dmp	UPX
behavioral2/memory/3108-124-0x00007FF7B6710000-0x00007FF7B6A64000-memory.dmp	UPX
behavioral2/memory/2956-125-0x00007FF7B4940000-0x00007FF7B4C94000-memory.dmp	UPX
behavioral2/memory/3804-126-0x00007FF730E20000-0x00007FF731174000-memory.dmp	UPX
behavioral2/memory/3776-127-0x00007FF6C4DB0000-0x00007FF6C5104000-memory.dmp	UPX
behavioral2/memory/908-122-0x00007FF79DFB0000-0x00007FF79E304000-memory.dmp	UPX
behavioral2/memory/3696-128-0x00007FF760E70000-0x00007FF7611C4000-memory.dmp	UPX
behavioral2/memory/1724-129-0x00007FF663760000-0x00007FF663AB4000-memory.dmp	UPX
behavioral2/memory/5016-130-0x00007FF748E80000-0x00007FF7491D4000-memory.dmp	UPX
behavioral2/memory/1896-131-0x00007FF7E85F0000-0x00007FF7E8944000-memory.dmp	UPX
behavioral2/memory/1724-132-0x00007FF663760000-0x00007FF663AB4000-memory.dmp	UPX
behavioral2/memory/2636-133-0x00007FF69CF10000-0x00007FF69D264000-memory.dmp	UPX
behavioral2/memory/5016-134-0x00007FF748E80000-0x00007FF7491D4000-memory.dmp	UPX
behavioral2/memory/1896-135-0x00007FF7E85F0000-0x00007FF7E8944000-memory.dmp	UPX
behavioral2/memory/780-136-0x00007FF76E290000-0x00007FF76E5E4000-memory.dmp	UPX
behavioral2/memory/2036-137-0x00007FF6954F0000-0x00007FF695844000-memory.dmp	UPX
behavioral2/memory/2636-138-0x00007FF69CF10000-0x00007FF69D264000-memory.dmp	UPX
behavioral2/memory/872-139-0x00007FF70A700000-0x00007FF70AA54000-memory.dmp	UPX
behavioral2/memory/1484-140-0x00007FF745FD0000-0x00007FF746324000-memory.dmp	UPX
behavioral2/memory/3308-142-0x00007FF60EA30000-0x00007FF60ED84000-memory.dmp	UPX
behavioral2/memory/4964-141-0x00007FF7C2010000-0x00007FF7C2364000-memory.dmp	UPX
behavioral2/memory/4136-143-0x00007FF7A25E0000-0x00007FF7A2934000-memory.dmp	UPX
behavioral2/memory/4332-144-0x00007FF70F180000-0x00007FF70F4D4000-memory.dmp	UPX
behavioral2/memory/3204-145-0x00007FF761650000-0x00007FF7619A4000-memory.dmp	UPX
behavioral2/memory/4904-147-0x00007FF7B39F0000-0x00007FF7B3D44000-memory.dmp	UPX
behavioral2/memory/908-148-0x00007FF79DFB0000-0x00007FF79E304000-memory.dmp	UPX
behavioral2/memory/2412-146-0x00007FF7802F0000-0x00007FF780644000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3696-0-0x00007FF760E70000-0x00007FF7611C4000-memory.dmp	xmrig
behavioral2/files/0x000f000000023253-4.dat	xmrig
behavioral2/memory/1724-8-0x00007FF663760000-0x00007FF663AB4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023264-11.dat	xmrig
behavioral2/files/0x0007000000023265-10.dat	xmrig
behavioral2/memory/1896-20-0x00007FF7E85F0000-0x00007FF7E8944000-memory.dmp	xmrig
behavioral2/memory/5016-16-0x00007FF748E80000-0x00007FF7491D4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023261-24.dat	xmrig
behavioral2/memory/780-26-0x00007FF76E290000-0x00007FF76E5E4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023266-28.dat	xmrig
behavioral2/memory/2036-32-0x00007FF6954F0000-0x00007FF695844000-memory.dmp	xmrig
behavioral2/files/0x0007000000023268-35.dat	xmrig
behavioral2/memory/2636-38-0x00007FF69CF10000-0x00007FF69D264000-memory.dmp	xmrig
behavioral2/files/0x0007000000023269-41.dat	xmrig
behavioral2/files/0x000700000002326a-46.dat	xmrig
behavioral2/files/0x000700000002326b-52.dat	xmrig
behavioral2/files/0x000700000002326c-57.dat	xmrig
behavioral2/files/0x000700000002326d-62.dat	xmrig
behavioral2/files/0x000700000002326e-67.dat	xmrig
behavioral2/files/0x0007000000023270-76.dat	xmrig
behavioral2/files/0x0007000000023272-87.dat	xmrig
behavioral2/files/0x0007000000023273-92.dat	xmrig
behavioral2/files/0x0007000000023274-97.dat	xmrig
behavioral2/files/0x0007000000023275-102.dat	xmrig
behavioral2/files/0x0007000000023276-106.dat	xmrig
behavioral2/files/0x0007000000023277-111.dat	xmrig
behavioral2/files/0x0007000000023271-82.dat	xmrig
behavioral2/files/0x000700000002326f-72.dat	xmrig
behavioral2/memory/872-113-0x00007FF70A700000-0x00007FF70AA54000-memory.dmp	xmrig
behavioral2/memory/1484-114-0x00007FF745FD0000-0x00007FF746324000-memory.dmp	xmrig
behavioral2/memory/4964-115-0x00007FF7C2010000-0x00007FF7C2364000-memory.dmp	xmrig
behavioral2/memory/3308-116-0x00007FF60EA30000-0x00007FF60ED84000-memory.dmp	xmrig
behavioral2/memory/4332-118-0x00007FF70F180000-0x00007FF70F4D4000-memory.dmp	xmrig
behavioral2/memory/4904-117-0x00007FF7B39F0000-0x00007FF7B3D44000-memory.dmp	xmrig
behavioral2/memory/4136-119-0x00007FF7A25E0000-0x00007FF7A2934000-memory.dmp	xmrig
behavioral2/memory/2412-120-0x00007FF7802F0000-0x00007FF780644000-memory.dmp	xmrig
behavioral2/memory/3204-121-0x00007FF761650000-0x00007FF7619A4000-memory.dmp	xmrig
behavioral2/memory/4632-123-0x00007FF66B810000-0x00007FF66BB64000-memory.dmp	xmrig
behavioral2/memory/3108-124-0x00007FF7B6710000-0x00007FF7B6A64000-memory.dmp	xmrig
behavioral2/memory/2956-125-0x00007FF7B4940000-0x00007FF7B4C94000-memory.dmp	xmrig
behavioral2/memory/3804-126-0x00007FF730E20000-0x00007FF731174000-memory.dmp	xmrig
behavioral2/memory/3776-127-0x00007FF6C4DB0000-0x00007FF6C5104000-memory.dmp	xmrig
behavioral2/memory/908-122-0x00007FF79DFB0000-0x00007FF79E304000-memory.dmp	xmrig
behavioral2/memory/3696-128-0x00007FF760E70000-0x00007FF7611C4000-memory.dmp	xmrig
behavioral2/memory/1724-129-0x00007FF663760000-0x00007FF663AB4000-memory.dmp	xmrig
behavioral2/memory/5016-130-0x00007FF748E80000-0x00007FF7491D4000-memory.dmp	xmrig
behavioral2/memory/1896-131-0x00007FF7E85F0000-0x00007FF7E8944000-memory.dmp	xmrig
behavioral2/memory/1724-132-0x00007FF663760000-0x00007FF663AB4000-memory.dmp	xmrig
behavioral2/memory/2636-133-0x00007FF69CF10000-0x00007FF69D264000-memory.dmp	xmrig
behavioral2/memory/5016-134-0x00007FF748E80000-0x00007FF7491D4000-memory.dmp	xmrig
behavioral2/memory/1896-135-0x00007FF7E85F0000-0x00007FF7E8944000-memory.dmp	xmrig
behavioral2/memory/780-136-0x00007FF76E290000-0x00007FF76E5E4000-memory.dmp	xmrig
behavioral2/memory/2036-137-0x00007FF6954F0000-0x00007FF695844000-memory.dmp	xmrig
behavioral2/memory/2636-138-0x00007FF69CF10000-0x00007FF69D264000-memory.dmp	xmrig
behavioral2/memory/872-139-0x00007FF70A700000-0x00007FF70AA54000-memory.dmp	xmrig
behavioral2/memory/1484-140-0x00007FF745FD0000-0x00007FF746324000-memory.dmp	xmrig
behavioral2/memory/3308-142-0x00007FF60EA30000-0x00007FF60ED84000-memory.dmp	xmrig
behavioral2/memory/4964-141-0x00007FF7C2010000-0x00007FF7C2364000-memory.dmp	xmrig
behavioral2/memory/4136-143-0x00007FF7A25E0000-0x00007FF7A2934000-memory.dmp	xmrig
behavioral2/memory/4332-144-0x00007FF70F180000-0x00007FF70F4D4000-memory.dmp	xmrig
behavioral2/memory/3204-145-0x00007FF761650000-0x00007FF7619A4000-memory.dmp	xmrig
behavioral2/memory/4904-147-0x00007FF7B39F0000-0x00007FF7B3D44000-memory.dmp	xmrig
behavioral2/memory/908-148-0x00007FF79DFB0000-0x00007FF79E304000-memory.dmp	xmrig
behavioral2/memory/2412-146-0x00007FF7802F0000-0x00007FF780644000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1724	MKquvdO.exe
5016	VKDaHAf.exe
1896	nwUnLyn.exe
780	lUcwWnZ.exe
2036	mZkmRLZ.exe
2636	MeHcWOJ.exe
872	hgwXnRW.exe
1484	yISWftk.exe
4964	hhnzVdL.exe
3308	wootkch.exe
4904	msSIrlk.exe
4332	oCnIOPz.exe
4136	ILnILzY.exe
2412	EKOCIVV.exe
3204	bhjWMIp.exe
908	fTExZmq.exe
4632	RunipkX.exe
3108	tvwitHp.exe
2956	zGPKWbr.exe
3804	NLgZFnd.exe
3776	iyfPHlA.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3696-0-0x00007FF760E70000-0x00007FF7611C4000-memory.dmp	upx
behavioral2/files/0x000f000000023253-4.dat	upx
behavioral2/memory/1724-8-0x00007FF663760000-0x00007FF663AB4000-memory.dmp	upx
behavioral2/files/0x0007000000023264-11.dat	upx
behavioral2/files/0x0007000000023265-10.dat	upx
behavioral2/memory/1896-20-0x00007FF7E85F0000-0x00007FF7E8944000-memory.dmp	upx
behavioral2/memory/5016-16-0x00007FF748E80000-0x00007FF7491D4000-memory.dmp	upx
behavioral2/files/0x0008000000023261-24.dat	upx
behavioral2/memory/780-26-0x00007FF76E290000-0x00007FF76E5E4000-memory.dmp	upx
behavioral2/files/0x0007000000023266-28.dat	upx
behavioral2/memory/2036-32-0x00007FF6954F0000-0x00007FF695844000-memory.dmp	upx
behavioral2/files/0x0007000000023268-35.dat	upx
behavioral2/memory/2636-38-0x00007FF69CF10000-0x00007FF69D264000-memory.dmp	upx
behavioral2/files/0x0007000000023269-41.dat	upx
behavioral2/files/0x000700000002326a-46.dat	upx
behavioral2/files/0x000700000002326b-52.dat	upx
behavioral2/files/0x000700000002326c-57.dat	upx
behavioral2/files/0x000700000002326d-62.dat	upx
behavioral2/files/0x000700000002326e-67.dat	upx
behavioral2/files/0x0007000000023270-76.dat	upx
behavioral2/files/0x0007000000023272-87.dat	upx
behavioral2/files/0x0007000000023273-92.dat	upx
behavioral2/files/0x0007000000023274-97.dat	upx
behavioral2/files/0x0007000000023275-102.dat	upx
behavioral2/files/0x0007000000023276-106.dat	upx
behavioral2/files/0x0007000000023277-111.dat	upx
behavioral2/files/0x0007000000023271-82.dat	upx
behavioral2/files/0x000700000002326f-72.dat	upx
behavioral2/memory/872-113-0x00007FF70A700000-0x00007FF70AA54000-memory.dmp	upx
behavioral2/memory/1484-114-0x00007FF745FD0000-0x00007FF746324000-memory.dmp	upx
behavioral2/memory/4964-115-0x00007FF7C2010000-0x00007FF7C2364000-memory.dmp	upx
behavioral2/memory/3308-116-0x00007FF60EA30000-0x00007FF60ED84000-memory.dmp	upx
behavioral2/memory/4332-118-0x00007FF70F180000-0x00007FF70F4D4000-memory.dmp	upx
behavioral2/memory/4904-117-0x00007FF7B39F0000-0x00007FF7B3D44000-memory.dmp	upx
behavioral2/memory/4136-119-0x00007FF7A25E0000-0x00007FF7A2934000-memory.dmp	upx
behavioral2/memory/2412-120-0x00007FF7802F0000-0x00007FF780644000-memory.dmp	upx
behavioral2/memory/3204-121-0x00007FF761650000-0x00007FF7619A4000-memory.dmp	upx
behavioral2/memory/4632-123-0x00007FF66B810000-0x00007FF66BB64000-memory.dmp	upx
behavioral2/memory/3108-124-0x00007FF7B6710000-0x00007FF7B6A64000-memory.dmp	upx
behavioral2/memory/2956-125-0x00007FF7B4940000-0x00007FF7B4C94000-memory.dmp	upx
behavioral2/memory/3804-126-0x00007FF730E20000-0x00007FF731174000-memory.dmp	upx
behavioral2/memory/3776-127-0x00007FF6C4DB0000-0x00007FF6C5104000-memory.dmp	upx
behavioral2/memory/908-122-0x00007FF79DFB0000-0x00007FF79E304000-memory.dmp	upx
behavioral2/memory/3696-128-0x00007FF760E70000-0x00007FF7611C4000-memory.dmp	upx
behavioral2/memory/1724-129-0x00007FF663760000-0x00007FF663AB4000-memory.dmp	upx
behavioral2/memory/5016-130-0x00007FF748E80000-0x00007FF7491D4000-memory.dmp	upx
behavioral2/memory/1896-131-0x00007FF7E85F0000-0x00007FF7E8944000-memory.dmp	upx
behavioral2/memory/1724-132-0x00007FF663760000-0x00007FF663AB4000-memory.dmp	upx
behavioral2/memory/2636-133-0x00007FF69CF10000-0x00007FF69D264000-memory.dmp	upx
behavioral2/memory/5016-134-0x00007FF748E80000-0x00007FF7491D4000-memory.dmp	upx
behavioral2/memory/1896-135-0x00007FF7E85F0000-0x00007FF7E8944000-memory.dmp	upx
behavioral2/memory/780-136-0x00007FF76E290000-0x00007FF76E5E4000-memory.dmp	upx
behavioral2/memory/2036-137-0x00007FF6954F0000-0x00007FF695844000-memory.dmp	upx
behavioral2/memory/2636-138-0x00007FF69CF10000-0x00007FF69D264000-memory.dmp	upx
behavioral2/memory/872-139-0x00007FF70A700000-0x00007FF70AA54000-memory.dmp	upx
behavioral2/memory/1484-140-0x00007FF745FD0000-0x00007FF746324000-memory.dmp	upx
behavioral2/memory/3308-142-0x00007FF60EA30000-0x00007FF60ED84000-memory.dmp	upx
behavioral2/memory/4964-141-0x00007FF7C2010000-0x00007FF7C2364000-memory.dmp	upx
behavioral2/memory/4136-143-0x00007FF7A25E0000-0x00007FF7A2934000-memory.dmp	upx
behavioral2/memory/4332-144-0x00007FF70F180000-0x00007FF70F4D4000-memory.dmp	upx
behavioral2/memory/3204-145-0x00007FF761650000-0x00007FF7619A4000-memory.dmp	upx
behavioral2/memory/4904-147-0x00007FF7B39F0000-0x00007FF7B3D44000-memory.dmp	upx
behavioral2/memory/908-148-0x00007FF79DFB0000-0x00007FF79E304000-memory.dmp	upx
behavioral2/memory/2412-146-0x00007FF7802F0000-0x00007FF780644000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\VKDaHAf.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lUcwWnZ.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wootkch.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RunipkX.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nwUnLyn.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hhnzVdL.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EKOCIVV.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fTExZmq.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iyfPHlA.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MKquvdO.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hgwXnRW.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yISWftk.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oCnIOPz.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NLgZFnd.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mZkmRLZ.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MeHcWOJ.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\msSIrlk.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ILnILzY.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bhjWMIp.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tvwitHp.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zGPKWbr.exe	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 1724	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	91
PID 3696 wrote to memory of 1724	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	91
PID 3696 wrote to memory of 5016	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	92
PID 3696 wrote to memory of 5016	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	92
PID 3696 wrote to memory of 1896	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	93
PID 3696 wrote to memory of 1896	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	93
PID 3696 wrote to memory of 780	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	94
PID 3696 wrote to memory of 780	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	94
PID 3696 wrote to memory of 2036	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	95
PID 3696 wrote to memory of 2036	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	95
PID 3696 wrote to memory of 2636	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	96
PID 3696 wrote to memory of 2636	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	96
PID 3696 wrote to memory of 872	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	97
PID 3696 wrote to memory of 872	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	97
PID 3696 wrote to memory of 1484	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	98
PID 3696 wrote to memory of 1484	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	98
PID 3696 wrote to memory of 4964	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	99
PID 3696 wrote to memory of 4964	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	99
PID 3696 wrote to memory of 3308	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	100
PID 3696 wrote to memory of 3308	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	100
PID 3696 wrote to memory of 4904	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	101
PID 3696 wrote to memory of 4904	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	101
PID 3696 wrote to memory of 4332	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	102
PID 3696 wrote to memory of 4332	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	102
PID 3696 wrote to memory of 4136	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	103
PID 3696 wrote to memory of 4136	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	103
PID 3696 wrote to memory of 2412	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	104
PID 3696 wrote to memory of 2412	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	104
PID 3696 wrote to memory of 3204	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	105
PID 3696 wrote to memory of 3204	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	105
PID 3696 wrote to memory of 908	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	106
PID 3696 wrote to memory of 908	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	106
PID 3696 wrote to memory of 4632	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	107
PID 3696 wrote to memory of 4632	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	107
PID 3696 wrote to memory of 3108	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	108
PID 3696 wrote to memory of 3108	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	108
PID 3696 wrote to memory of 2956	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	109
PID 3696 wrote to memory of 2956	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	109
PID 3696 wrote to memory of 3804	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	110
PID 3696 wrote to memory of 3804	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	110
PID 3696 wrote to memory of 3776	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	111
PID 3696 wrote to memory of 3776	3696	2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe	111

C:\Users\Admin\AppData\Local\Temp\2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_91c26f084ffa7e869bebaee95cb3abcb_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\System\MKquvdO.exe
  C:\Windows\System\MKquvdO.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\VKDaHAf.exe
  C:\Windows\System\VKDaHAf.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\nwUnLyn.exe
  C:\Windows\System\nwUnLyn.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\lUcwWnZ.exe
  C:\Windows\System\lUcwWnZ.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\mZkmRLZ.exe
  C:\Windows\System\mZkmRLZ.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\MeHcWOJ.exe
  C:\Windows\System\MeHcWOJ.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\hgwXnRW.exe
  C:\Windows\System\hgwXnRW.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\yISWftk.exe
  C:\Windows\System\yISWftk.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\hhnzVdL.exe
  C:\Windows\System\hhnzVdL.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\wootkch.exe
  C:\Windows\System\wootkch.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\msSIrlk.exe
  C:\Windows\System\msSIrlk.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\oCnIOPz.exe
  C:\Windows\System\oCnIOPz.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\ILnILzY.exe
  C:\Windows\System\ILnILzY.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\EKOCIVV.exe
  C:\Windows\System\EKOCIVV.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\bhjWMIp.exe
  C:\Windows\System\bhjWMIp.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\fTExZmq.exe
  C:\Windows\System\fTExZmq.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\RunipkX.exe
  C:\Windows\System\RunipkX.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\tvwitHp.exe
  C:\Windows\System\tvwitHp.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\zGPKWbr.exe
  C:\Windows\System\zGPKWbr.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\NLgZFnd.exe
  C:\Windows\System\NLgZFnd.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\iyfPHlA.exe
  C:\Windows\System\iyfPHlA.exe
  2⤵
  - Executes dropped EXE
  PID:3776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:1520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

EKOCIVV.exe

Path C:\Windows\System\EKOCIVV.exe
Size 5.9MB
SHA256 d0f31473a4444865a126356b76815978891f7fc0a3bbb88279232b336352be15
MD5 6da577f0f9d785039028c689a0fb05db
SHA1 7746d535e4e7ee6d7c9b0aa950bf2b1d59b57f53
SHA512 6492f2c80c876c96c75f335d0cdf941ea011b0d901983935b8ff578ba1aacdc34f4772767aa4f7e0cc271cb10e2c786f2975e88c7e77e00b659ac03d6a705ccc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

ILnILzY.exe

Path C:\Windows\System\ILnILzY.exe
Size 5.9MB
SHA256 c7b51f959a799fbacda13068ace76849097ce4ce4ff64c689d26aa69e0077d9a
MD5 677bf69eba1391c95fb07b50a01b1102
SHA1 2eb7c0a4cb8310931b31f6a91de0d1eb0ffc55b7
SHA512 b9366c0173f3e35404c3af6b3286d185a222a836a45a028c9661197d8a765002ed5a03c28c842393970a0f9dffa18e807d5e5d0f03ea80d3eb5010f4704b65be
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

MKquvdO.exe

Path C:\Windows\System\MKquvdO.exe
Size 5.9MB
SHA256 382a9417ee841a97022d52a599e653f8d207dc1b5a03319daaf24134ae648614
MD5 6561bce1f104a01c7676596ee9685c2b
SHA1 cf021be11df4a2ec4362135eccf03e9b73925545
SHA512 70c0661d119cad9b457bc6ff23499cd268f8cbb5aa127f0ec882dfce31d7a04f956a2186cc9f470b9abb7bea627f1dea12b76e0935c6678f68746b282ddebe90
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

MeHcWOJ.exe

Path C:\Windows\System\MeHcWOJ.exe
Size 5.9MB
SHA256 1b188bf499b685c9f14c338db8e003b6dee3fd9d81f096a81940582d285e218a
MD5 987360a3e1db29175943c5060679e706
SHA1 9b736c9130d57be112affc4740bca5031a440766
SHA512 9873a2d1e22e32d712a74e48bd4060ad4f39119d2677203d87d05b40b93ca32a1d5481ef84039de36af220c0b00fc657e916774f99913dc2c4324969506d8f42
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

NLgZFnd.exe

Path C:\Windows\System\NLgZFnd.exe
Size 5.9MB
SHA256 b0f9c698d0c9e96c4c1ba2b86a378deb5b79b81d5c708f26fb1be9ecd70dd22e
MD5 820155aff35e25f9004f4e251125b176
SHA1 f2f6d84b212eab6fbf3eab10a90b5914b1b7e943
SHA512 673ce56f08452f479eec6f7d6d790d2b8adba64feaef0e4da1b28139924feed35f91d50cbe6d10f0f5ce83216917348ecef619e20e864b1216f3d50aa14bdc1a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

RunipkX.exe

Path C:\Windows\System\RunipkX.exe
Size 5.9MB
SHA256 67d896ee136a0ca138a969eca0fc984f8269c426262604f705ace8d4db50e438
MD5 b7bddae17bdb7c7a0072d882bcafdf52
SHA1 eb8a9db1c797be5d0630155d4682a816cd8cb67e
SHA512 eea2252919478da0f8a1426fd74be2acf32ffbd05cd13a6e003c2dc2b630cb488769b247f4074dd8615feed8db96631fae12e604fba1ca4d4b47f2addfc0412b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

VKDaHAf.exe

Path C:\Windows\System\VKDaHAf.exe
Size 5.9MB
SHA256 04de976d743b5364e0d70954be77c6330070f3b59b03fa74d3af96f388269500
MD5 7970c273da75c0a304deaacccbfef5f3
SHA1 5fd9a31992f09b07c456f408b8f7855142430b81
SHA512 1cef0e761bd6171a578084679432446921820298b2e3d793123169b7664d01f10d5ea5c18593bca262f9d2c7b63987d5912132bcbf42cf370a017a4287766f04
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

bhjWMIp.exe

Path C:\Windows\System\bhjWMIp.exe
Size 5.9MB
SHA256 2e400ce12ecb3ae9e8585c1e07c10e8504f71ddebf83b27813aa5a86e49ff367
MD5 7858216a6f5cedb9cc7f203500c4f69f
SHA1 97eef2a1c6360da5f2b96f3c007a6134478a41a5
SHA512 52cca21ff0bae7eda124dde16599575f7d64ec5f6008abc68283830e01b647107399af805f02e82890b28003dba2c4900d580b6819de32341bb2cc01ef79dc04
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

fTExZmq.exe

Path C:\Windows\System\fTExZmq.exe
Size 5.9MB
SHA256 e32a37cfa50a4a2c2c2c99625944a2be4579b19339eb336add2f832e1a0307d2
MD5 8f90b8f9e055321ecfc015c0f36ff49b
SHA1 a0705632144fac3ca75539717e4da8609bcb0fbc
SHA512 29caf7ea2e8ea5ee2a64eef96fac602857bd1a38d66ed9d679fc7f06485cd423d89974db1f3ebfea313d311cab88a71c4e41fa5bd2d603e1c592d3b2fa1cfd75
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

hgwXnRW.exe

Path C:\Windows\System\hgwXnRW.exe
Size 5.9MB
SHA256 f261a5d0dd9d9f553c6eb206817ba15d4f339b898539d636281004c8c07e5bc4
MD5 aa2dac6c220b9e94e198f2f007f46332
SHA1 7aca2565a5c7e998e786c3470ce11e0fafc46218
SHA512 23d4049e207f4ab4b794a859e3332eb8bb3d2f3624a8d2db4ca35cc0131b1cddc91f166b27e2f1b2e2667247f8f4408e5fa51ea3ef0c39f8e5e50c2818c49d39
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:Q+856utgpPF8u/7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

hhnzVdL.exe

Path C:\Windows\System\hhnzVdL.exe
Size 5.9MB
SHA256 c0d7c9f157edee922b1dd9d607b51fd7482be29c4989cf6e6fdf480a9242e21c
MD5 2a8c0ea02815cf50c7920e6f80dc9026
SHA1 c267eb1eb3b334204797ae85c7942ff75cfd86e5
SHA512 ffb57adf2b9cbadb35dae36bee3f5e14cf87be1d0f5081c846978774727045f27e4a27b27933d702e31dca13e56958196196975c0cfd0df19034dbcf6db546f7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

iyfPHlA.exe

Path C:\Windows\System\iyfPHlA.exe
Size 5.9MB
SHA256 c5c32a310cbfb3549dd9d495abaf55a43e4e1a6d7baa7797fd44523bb18f920e
MD5 2f45f34872aebb94160f0438088b38ff
SHA1 7afe1cd97a5752c1029fcc36787493376ce8376f
SHA512 d0d541fc5db321e0be1424e9a1fe38ee22ac9553b0c40a69063bb6e95115ce35137dbf43816f94d69644553948e96ff4e75c79e754995d20a4f3625ff6c228eb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

lUcwWnZ.exe

Path C:\Windows\System\lUcwWnZ.exe
Size 5.9MB
SHA256 66979469958dc24bc92172bcc160a9fd71373d043bd4f5654996e3a106b62ae3
MD5 61ed2ad29afa48fbab4bda7170cafe85
SHA1 7c90ab6818b68a358f2451c4bb13a42af58fa3e3
SHA512 68a63b16ff91a1d73ec87f3dbb2270e214d792232b7a6928f29b184d667123156e012cbf620146f99db6828765c7fb7afa867c2142bb939e4d2c3be29e8d1dc9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

mZkmRLZ.exe

Path C:\Windows\System\mZkmRLZ.exe
Size 5.9MB
SHA256 b23243577ab691801862d5cdd30a8886473c5c351cc75cd223acbde9ebefac77
MD5 430ffb48159462097eb5b3beca6601b6
SHA1 fdbc5f544f467ceaf1ef8ff008134978e94f0c60
SHA512 229662281b5d2a4741ab036b9604632d313a378de4511d10f3469f2906a3a305d64d37e39b0595cad9fe340702c2364313777f91c93f5d4167359eff1cffe3cd
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

msSIrlk.exe

Path C:\Windows\System\msSIrlk.exe
Size 5.9MB
SHA256 de6b9f1473743579ada879970197f451213774cbb59d6cb1441e3b394b5837e9
MD5 a526c1e11f680bb6268ea4bc50d2b27c
SHA1 ab652c6d7aa4fbc33ec3673791bb42c3ba0b012b
SHA512 0b0a8fdc93989839f2d88e2bc9fd4d56bb74c1154437c6d58ddd523591c1e0aeefa71557c57fe18c57c366d16e0767bc815df06ff4ab5f7b4bb2fbedba0ac4c7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

nwUnLyn.exe

Path C:\Windows\System\nwUnLyn.exe
Size 5.9MB
SHA256 dd30d922e281dfe914f93a0cb880e22716b1e24326c3fb145ac5b893022a6a0b
MD5 004acb0ad5278ac8c6f51119601632b9
SHA1 f939aff38db96c3a26caf24bb5ddd7399fc1e3b9
SHA512 1491dd6cecede240475ad247030ceefe4453d406dda0dc0303491644501005176ff6dc71c69e19d162e9e39e95d81b89ac16ba3131d133dbc81600b6509d8ed1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

oCnIOPz.exe

Path C:\Windows\System\oCnIOPz.exe
Size 5.9MB
SHA256 841015bd893a4e736f0958a4cb96cc94923d42b9394b14159a5e389c29c5bf95
MD5 42c6f64faba5e8edb09e7dad9547520c
SHA1 159b9b96ceece843ea0ec2ff280a72ef767ebc97
SHA512 593f49def3aa8409aeb083c39e5ab29433104e07d84aba3e2bccdcf6030cf4eb01f0cf634cdb7efcababc29373b1e813cc3ecd747dd661bebfa62430504cb9ac
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

tvwitHp.exe

Path C:\Windows\System\tvwitHp.exe
Size 5.9MB
SHA256 9e7565848724dde69e86998081db96a8a8920e6678c37efcbf24b8ff332d8d57
MD5 e4e67bcfb976507d7e4a8667be60f467
SHA1 46cf2979ee40faabb682585a170f2e45c930b8a0
SHA512 dc26074afdc743706c05f37c2d240bae43b688b006bdbedfefd51cd877baee25be90a17a829ad1593572c3f4b026251b0e67f3d59525fa6758c1019dec84f34b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

wootkch.exe

Path C:\Windows\System\wootkch.exe
Size 5.9MB
SHA256 8e936c2c8bb31983c7677ae717c52e3c114de0648ab71e238d0329deafa839a1
MD5 7b20866becd979926eb17705535b6b82
SHA1 c402c4610a20edfba7fa64abd71cd901406b385e
SHA512 09bf07e3a1a087369735ead45ec696934b5155b3ef8e6f5717eb06a8c4eef6252e04278461482b7ec63e828c09a522ca56ae484f368283c0ade80e02dd79a6a2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

yISWftk.exe

Path C:\Windows\System\yISWftk.exe
Size 5.9MB
SHA256 e3d94924bd4ab5dea3881ff1c1b8d06ae7bc707ee2dbfdf30ec3d2650a9792b3
MD5 1982dccbf95e5ac1b84b5f8a4fb6a8bf
SHA1 bb21a39bb66f76f4516cb5f6149f65f78fe24757
SHA512 9883386b0e727c2ff091f61a4bf1c4a64db9298d2ab5339325a495f2bcdb61f88bf860e3fa02c79dffb3e06774128e504c05e760b09564379f8682710bcdf277
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

zGPKWbr.exe

Path C:\Windows\System\zGPKWbr.exe
Size 5.9MB
SHA256 d03b82b9effbde1c5d6cd3c7b2983e4b5fd43788352ae91e7f4439701bdfce34
MD5 022aae964c18d52503975d6651b393e2
SHA1 36c9a6af45899e14f475144d46965b66acfefb83
SHA512 022a7c3910512b6e7120086c80ab12986977f15c7f9415cf707a6d19ee167f01109c40bb4f27676aa131e107f9f8cd2d49f0d72e23c6ceabe97c0aaafa1d7c25
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/780-136-0x00007FF76E290000-0x00007FF76E5E4000-memory.dmp

Download

memory/780-26-0x00007FF76E290000-0x00007FF76E5E4000-memory.dmp

Download

memory/872-113-0x00007FF70A700000-0x00007FF70AA54000-memory.dmp

Download

memory/872-139-0x00007FF70A700000-0x00007FF70AA54000-memory.dmp

Download

memory/908-122-0x00007FF79DFB0000-0x00007FF79E304000-memory.dmp

Download

memory/908-148-0x00007FF79DFB0000-0x00007FF79E304000-memory.dmp

Download

memory/1484-140-0x00007FF745FD0000-0x00007FF746324000-memory.dmp

Download

memory/1484-114-0x00007FF745FD0000-0x00007FF746324000-memory.dmp

Download

memory/1724-8-0x00007FF663760000-0x00007FF663AB4000-memory.dmp

Download

memory/1724-132-0x00007FF663760000-0x00007FF663AB4000-memory.dmp

Download

memory/1724-129-0x00007FF663760000-0x00007FF663AB4000-memory.dmp

Download

memory/1896-135-0x00007FF7E85F0000-0x00007FF7E8944000-memory.dmp

Download

memory/1896-20-0x00007FF7E85F0000-0x00007FF7E8944000-memory.dmp

Download

memory/1896-131-0x00007FF7E85F0000-0x00007FF7E8944000-memory.dmp

Download

memory/2036-32-0x00007FF6954F0000-0x00007FF695844000-memory.dmp

Download

memory/2036-137-0x00007FF6954F0000-0x00007FF695844000-memory.dmp

Download

memory/2412-120-0x00007FF7802F0000-0x00007FF780644000-memory.dmp

Download

memory/2412-146-0x00007FF7802F0000-0x00007FF780644000-memory.dmp

Download

memory/2636-38-0x00007FF69CF10000-0x00007FF69D264000-memory.dmp

Download

memory/2636-138-0x00007FF69CF10000-0x00007FF69D264000-memory.dmp

Download

memory/2636-133-0x00007FF69CF10000-0x00007FF69D264000-memory.dmp

Download

memory/2956-125-0x00007FF7B4940000-0x00007FF7B4C94000-memory.dmp

Download

memory/2956-151-0x00007FF7B4940000-0x00007FF7B4C94000-memory.dmp

Download

memory/3108-124-0x00007FF7B6710000-0x00007FF7B6A64000-memory.dmp

Download

memory/3108-150-0x00007FF7B6710000-0x00007FF7B6A64000-memory.dmp

Download

memory/3204-121-0x00007FF761650000-0x00007FF7619A4000-memory.dmp

Download

memory/3204-145-0x00007FF761650000-0x00007FF7619A4000-memory.dmp

Download

memory/3308-142-0x00007FF60EA30000-0x00007FF60ED84000-memory.dmp

Download

memory/3308-116-0x00007FF60EA30000-0x00007FF60ED84000-memory.dmp

Download

memory/3696-128-0x00007FF760E70000-0x00007FF7611C4000-memory.dmp

Download

memory/3696-0-0x00007FF760E70000-0x00007FF7611C4000-memory.dmp

Download

memory/3696-1-0x000001F725BB0000-0x000001F725BC0000-memory.dmp

Download

memory/3776-127-0x00007FF6C4DB0000-0x00007FF6C5104000-memory.dmp

Download

memory/3776-153-0x00007FF6C4DB0000-0x00007FF6C5104000-memory.dmp

Download

memory/3804-126-0x00007FF730E20000-0x00007FF731174000-memory.dmp

Download

memory/3804-152-0x00007FF730E20000-0x00007FF731174000-memory.dmp

Download

memory/4136-119-0x00007FF7A25E0000-0x00007FF7A2934000-memory.dmp

Download

memory/4136-143-0x00007FF7A25E0000-0x00007FF7A2934000-memory.dmp

Download

memory/4332-144-0x00007FF70F180000-0x00007FF70F4D4000-memory.dmp

Download

memory/4332-118-0x00007FF70F180000-0x00007FF70F4D4000-memory.dmp

Download

memory/4632-149-0x00007FF66B810000-0x00007FF66BB64000-memory.dmp

Download

memory/4632-123-0x00007FF66B810000-0x00007FF66BB64000-memory.dmp

Download

memory/4904-147-0x00007FF7B39F0000-0x00007FF7B3D44000-memory.dmp

Download

memory/4904-117-0x00007FF7B39F0000-0x00007FF7B3D44000-memory.dmp

Download

memory/4964-141-0x00007FF7C2010000-0x00007FF7C2364000-memory.dmp

Download

memory/4964-115-0x00007FF7C2010000-0x00007FF7C2364000-memory.dmp

Download

memory/5016-134-0x00007FF748E80000-0x00007FF7491D4000-memory.dmp

Download

memory/5016-130-0x00007FF748E80000-0x00007FF7491D4000-memory.dmp

Download

memory/5016-16-0x00007FF748E80000-0x00007FF7491D4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads