cobaltstrike | f477bc330e6eef864b116f37b57c66113eb1fd8ccadc031b9d1e66359ab56051

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-ada1zsbc47
SHA256 f477bc330e6eef864b116f37b57c66113eb1fd8ccadc031b9d1e66359ab56051
MD5 b5f28fc41f0f7c5d7d717b4812375447
SHA1 01525a8f1a29c4c09794b9130c9249682f22211c
SHA512 c32d3e19ae62eda9db4b9978c2ffd38aab1acffec4532d6eb0e9f2dddf30f2f27c59dea166476381923fcac573234781fa2a7f27db17c55b04ff984cf18a0c88
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00090000000233ed-4.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f1-10.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f2-12.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000233ee-24.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f5-36.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f6-43.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f9-53.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fb-66.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fc-73.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fe-80.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ff-88.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023400-94.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023401-104.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023403-109.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023402-119.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023404-121.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fd-86.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233fa-64.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f8-56.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f7-47.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233f4-30.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233ed-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f1-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f2-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00080000000233ee-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f5-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f6-43.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f9-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fb-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fc-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fe-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ff-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023400-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023401-104.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023403-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023402-119.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023404-121.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fd-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233fa-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f8-56.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f7-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233f4-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3180-0-0x00007FF6C3710000-0x00007FF6C3A64000-memory.dmp	UPX
behavioral2/files/0x00090000000233ed-4.dat	UPX
behavioral2/memory/4988-8-0x00007FF619C40000-0x00007FF619F94000-memory.dmp	UPX
behavioral2/files/0x00070000000233f1-10.dat	UPX
behavioral2/memory/5044-14-0x00007FF775B40000-0x00007FF775E94000-memory.dmp	UPX
behavioral2/files/0x00070000000233f2-12.dat	UPX
behavioral2/files/0x00080000000233ee-24.dat	UPX
behavioral2/files/0x00070000000233f5-36.dat	UPX
behavioral2/files/0x00070000000233f6-43.dat	UPX
behavioral2/files/0x00070000000233f9-53.dat	UPX
behavioral2/memory/3736-61-0x00007FF7C3360000-0x00007FF7C36B4000-memory.dmp	UPX
behavioral2/files/0x00070000000233fb-66.dat	UPX
behavioral2/files/0x00070000000233fc-73.dat	UPX
behavioral2/files/0x00070000000233fe-80.dat	UPX
behavioral2/files/0x00070000000233ff-88.dat	UPX
behavioral2/files/0x0007000000023400-94.dat	UPX
behavioral2/files/0x0007000000023401-104.dat	UPX
behavioral2/files/0x0007000000023403-109.dat	UPX
behavioral2/files/0x0007000000023402-119.dat	UPX
behavioral2/memory/4404-127-0x00007FF6855D0000-0x00007FF685924000-memory.dmp	UPX
behavioral2/memory/3408-126-0x00007FF7B5C10000-0x00007FF7B5F64000-memory.dmp	UPX
behavioral2/memory/1692-125-0x00007FF7165A0000-0x00007FF7168F4000-memory.dmp	UPX
behavioral2/memory/524-124-0x00007FF6AD030000-0x00007FF6AD384000-memory.dmp	UPX
behavioral2/memory/552-123-0x00007FF735020000-0x00007FF735374000-memory.dmp	UPX
behavioral2/files/0x0007000000023404-121.dat	UPX
behavioral2/memory/4472-118-0x00007FF7CD7B0000-0x00007FF7CDB04000-memory.dmp	UPX
behavioral2/memory/4960-115-0x00007FF702FF0000-0x00007FF703344000-memory.dmp	UPX
behavioral2/memory/5096-106-0x00007FF7452D0000-0x00007FF745624000-memory.dmp	UPX
behavioral2/memory/1824-100-0x00007FF735EF0000-0x00007FF736244000-memory.dmp	UPX
behavioral2/memory/2628-91-0x00007FF744C10000-0x00007FF744F64000-memory.dmp	UPX
behavioral2/files/0x00070000000233fd-86.dat	UPX
behavioral2/memory/2020-83-0x00007FF6F4020000-0x00007FF6F4374000-memory.dmp	UPX
behavioral2/memory/1164-77-0x00007FF6A62D0000-0x00007FF6A6624000-memory.dmp	UPX
behavioral2/memory/3116-71-0x00007FF7C90D0000-0x00007FF7C9424000-memory.dmp	UPX
behavioral2/memory/3720-70-0x00007FF7D26D0000-0x00007FF7D2A24000-memory.dmp	UPX
behavioral2/memory/1984-68-0x00007FF790BD0000-0x00007FF790F24000-memory.dmp	UPX
behavioral2/files/0x00070000000233fa-64.dat	UPX
behavioral2/files/0x00070000000233f8-56.dat	UPX
behavioral2/files/0x00070000000233f7-47.dat	UPX
behavioral2/memory/3312-38-0x00007FF731820000-0x00007FF731B74000-memory.dmp	UPX
behavioral2/files/0x00070000000233f4-30.dat	UPX
behavioral2/memory/1676-27-0x00007FF61AA00000-0x00007FF61AD54000-memory.dmp	UPX
behavioral2/memory/64-21-0x00007FF74F670000-0x00007FF74F9C4000-memory.dmp	UPX
behavioral2/memory/3180-128-0x00007FF6C3710000-0x00007FF6C3A64000-memory.dmp	UPX
behavioral2/memory/4988-129-0x00007FF619C40000-0x00007FF619F94000-memory.dmp	UPX
behavioral2/memory/4960-130-0x00007FF702FF0000-0x00007FF703344000-memory.dmp	UPX
behavioral2/memory/4988-131-0x00007FF619C40000-0x00007FF619F94000-memory.dmp	UPX
behavioral2/memory/5044-132-0x00007FF775B40000-0x00007FF775E94000-memory.dmp	UPX
behavioral2/memory/64-133-0x00007FF74F670000-0x00007FF74F9C4000-memory.dmp	UPX
behavioral2/memory/1676-134-0x00007FF61AA00000-0x00007FF61AD54000-memory.dmp	UPX
behavioral2/memory/3312-135-0x00007FF731820000-0x00007FF731B74000-memory.dmp	UPX
behavioral2/memory/2020-136-0x00007FF6F4020000-0x00007FF6F4374000-memory.dmp	UPX
behavioral2/memory/3736-137-0x00007FF7C3360000-0x00007FF7C36B4000-memory.dmp	UPX
behavioral2/memory/1984-138-0x00007FF790BD0000-0x00007FF790F24000-memory.dmp	UPX
behavioral2/memory/3720-139-0x00007FF7D26D0000-0x00007FF7D2A24000-memory.dmp	UPX
behavioral2/memory/3116-142-0x00007FF7C90D0000-0x00007FF7C9424000-memory.dmp	UPX
behavioral2/memory/2628-141-0x00007FF744C10000-0x00007FF744F64000-memory.dmp	UPX
behavioral2/memory/1164-140-0x00007FF6A62D0000-0x00007FF6A6624000-memory.dmp	UPX
behavioral2/memory/1824-143-0x00007FF735EF0000-0x00007FF736244000-memory.dmp	UPX
behavioral2/memory/4472-144-0x00007FF7CD7B0000-0x00007FF7CDB04000-memory.dmp	UPX
behavioral2/memory/5096-145-0x00007FF7452D0000-0x00007FF745624000-memory.dmp	UPX
behavioral2/memory/524-150-0x00007FF6AD030000-0x00007FF6AD384000-memory.dmp	UPX
behavioral2/memory/1692-149-0x00007FF7165A0000-0x00007FF7168F4000-memory.dmp	UPX
behavioral2/memory/4960-148-0x00007FF702FF0000-0x00007FF703344000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3180-0-0x00007FF6C3710000-0x00007FF6C3A64000-memory.dmp	xmrig
behavioral2/files/0x00090000000233ed-4.dat	xmrig
behavioral2/memory/4988-8-0x00007FF619C40000-0x00007FF619F94000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f1-10.dat	xmrig
behavioral2/memory/5044-14-0x00007FF775B40000-0x00007FF775E94000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f2-12.dat	xmrig
behavioral2/files/0x00080000000233ee-24.dat	xmrig
behavioral2/files/0x00070000000233f5-36.dat	xmrig
behavioral2/files/0x00070000000233f6-43.dat	xmrig
behavioral2/files/0x00070000000233f9-53.dat	xmrig
behavioral2/memory/3736-61-0x00007FF7C3360000-0x00007FF7C36B4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fb-66.dat	xmrig
behavioral2/files/0x00070000000233fc-73.dat	xmrig
behavioral2/files/0x00070000000233fe-80.dat	xmrig
behavioral2/files/0x00070000000233ff-88.dat	xmrig
behavioral2/files/0x0007000000023400-94.dat	xmrig
behavioral2/files/0x0007000000023401-104.dat	xmrig
behavioral2/files/0x0007000000023403-109.dat	xmrig
behavioral2/files/0x0007000000023402-119.dat	xmrig
behavioral2/memory/4404-127-0x00007FF6855D0000-0x00007FF685924000-memory.dmp	xmrig
behavioral2/memory/3408-126-0x00007FF7B5C10000-0x00007FF7B5F64000-memory.dmp	xmrig
behavioral2/memory/1692-125-0x00007FF7165A0000-0x00007FF7168F4000-memory.dmp	xmrig
behavioral2/memory/524-124-0x00007FF6AD030000-0x00007FF6AD384000-memory.dmp	xmrig
behavioral2/memory/552-123-0x00007FF735020000-0x00007FF735374000-memory.dmp	xmrig
behavioral2/files/0x0007000000023404-121.dat	xmrig
behavioral2/memory/4472-118-0x00007FF7CD7B0000-0x00007FF7CDB04000-memory.dmp	xmrig
behavioral2/memory/4960-115-0x00007FF702FF0000-0x00007FF703344000-memory.dmp	xmrig
behavioral2/memory/5096-106-0x00007FF7452D0000-0x00007FF745624000-memory.dmp	xmrig
behavioral2/memory/1824-100-0x00007FF735EF0000-0x00007FF736244000-memory.dmp	xmrig
behavioral2/memory/2628-91-0x00007FF744C10000-0x00007FF744F64000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fd-86.dat	xmrig
behavioral2/memory/2020-83-0x00007FF6F4020000-0x00007FF6F4374000-memory.dmp	xmrig
behavioral2/memory/1164-77-0x00007FF6A62D0000-0x00007FF6A6624000-memory.dmp	xmrig
behavioral2/memory/3116-71-0x00007FF7C90D0000-0x00007FF7C9424000-memory.dmp	xmrig
behavioral2/memory/3720-70-0x00007FF7D26D0000-0x00007FF7D2A24000-memory.dmp	xmrig
behavioral2/memory/1984-68-0x00007FF790BD0000-0x00007FF790F24000-memory.dmp	xmrig
behavioral2/files/0x00070000000233fa-64.dat	xmrig
behavioral2/files/0x00070000000233f8-56.dat	xmrig
behavioral2/files/0x00070000000233f7-47.dat	xmrig
behavioral2/memory/3312-38-0x00007FF731820000-0x00007FF731B74000-memory.dmp	xmrig
behavioral2/files/0x00070000000233f4-30.dat	xmrig
behavioral2/memory/1676-27-0x00007FF61AA00000-0x00007FF61AD54000-memory.dmp	xmrig
behavioral2/memory/64-21-0x00007FF74F670000-0x00007FF74F9C4000-memory.dmp	xmrig
behavioral2/memory/3180-128-0x00007FF6C3710000-0x00007FF6C3A64000-memory.dmp	xmrig
behavioral2/memory/4988-129-0x00007FF619C40000-0x00007FF619F94000-memory.dmp	xmrig
behavioral2/memory/4960-130-0x00007FF702FF0000-0x00007FF703344000-memory.dmp	xmrig
behavioral2/memory/4988-131-0x00007FF619C40000-0x00007FF619F94000-memory.dmp	xmrig
behavioral2/memory/5044-132-0x00007FF775B40000-0x00007FF775E94000-memory.dmp	xmrig
behavioral2/memory/64-133-0x00007FF74F670000-0x00007FF74F9C4000-memory.dmp	xmrig
behavioral2/memory/1676-134-0x00007FF61AA00000-0x00007FF61AD54000-memory.dmp	xmrig
behavioral2/memory/3312-135-0x00007FF731820000-0x00007FF731B74000-memory.dmp	xmrig
behavioral2/memory/2020-136-0x00007FF6F4020000-0x00007FF6F4374000-memory.dmp	xmrig
behavioral2/memory/3736-137-0x00007FF7C3360000-0x00007FF7C36B4000-memory.dmp	xmrig
behavioral2/memory/1984-138-0x00007FF790BD0000-0x00007FF790F24000-memory.dmp	xmrig
behavioral2/memory/3720-139-0x00007FF7D26D0000-0x00007FF7D2A24000-memory.dmp	xmrig
behavioral2/memory/3116-142-0x00007FF7C90D0000-0x00007FF7C9424000-memory.dmp	xmrig
behavioral2/memory/2628-141-0x00007FF744C10000-0x00007FF744F64000-memory.dmp	xmrig
behavioral2/memory/1164-140-0x00007FF6A62D0000-0x00007FF6A6624000-memory.dmp	xmrig
behavioral2/memory/1824-143-0x00007FF735EF0000-0x00007FF736244000-memory.dmp	xmrig
behavioral2/memory/4472-144-0x00007FF7CD7B0000-0x00007FF7CDB04000-memory.dmp	xmrig
behavioral2/memory/5096-145-0x00007FF7452D0000-0x00007FF745624000-memory.dmp	xmrig
behavioral2/memory/524-150-0x00007FF6AD030000-0x00007FF6AD384000-memory.dmp	xmrig
behavioral2/memory/1692-149-0x00007FF7165A0000-0x00007FF7168F4000-memory.dmp	xmrig
behavioral2/memory/4960-148-0x00007FF702FF0000-0x00007FF703344000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4988	WuRvxlO.exe
5044	eUvynKD.exe
64	YuljGBr.exe
1676	ZBrlEcz.exe
3312	arXLxKw.exe
2020	tPhhxmt.exe
3736	wTOlfFK.exe
1984	jERLLNQ.exe
3720	PCmTpth.exe
3116	acFHjxK.exe
2628	OKIgRXU.exe
1164	uoAgwUf.exe
1824	drEmFLp.exe
4472	qvgncwR.exe
5096	wyoWWrZ.exe
552	JLwnVhq.exe
524	dVXPuqF.exe
1692	MagQTxU.exe
4960	EzHLHoZ.exe
3408	vgKYOOU.exe
4404	VKwooDM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3180-0-0x00007FF6C3710000-0x00007FF6C3A64000-memory.dmp	upx
behavioral2/files/0x00090000000233ed-4.dat	upx
behavioral2/memory/4988-8-0x00007FF619C40000-0x00007FF619F94000-memory.dmp	upx
behavioral2/files/0x00070000000233f1-10.dat	upx
behavioral2/memory/5044-14-0x00007FF775B40000-0x00007FF775E94000-memory.dmp	upx
behavioral2/files/0x00070000000233f2-12.dat	upx
behavioral2/files/0x00080000000233ee-24.dat	upx
behavioral2/files/0x00070000000233f5-36.dat	upx
behavioral2/files/0x00070000000233f6-43.dat	upx
behavioral2/files/0x00070000000233f9-53.dat	upx
behavioral2/memory/3736-61-0x00007FF7C3360000-0x00007FF7C36B4000-memory.dmp	upx
behavioral2/files/0x00070000000233fb-66.dat	upx
behavioral2/files/0x00070000000233fc-73.dat	upx
behavioral2/files/0x00070000000233fe-80.dat	upx
behavioral2/files/0x00070000000233ff-88.dat	upx
behavioral2/files/0x0007000000023400-94.dat	upx
behavioral2/files/0x0007000000023401-104.dat	upx
behavioral2/files/0x0007000000023403-109.dat	upx
behavioral2/files/0x0007000000023402-119.dat	upx
behavioral2/memory/4404-127-0x00007FF6855D0000-0x00007FF685924000-memory.dmp	upx
behavioral2/memory/3408-126-0x00007FF7B5C10000-0x00007FF7B5F64000-memory.dmp	upx
behavioral2/memory/1692-125-0x00007FF7165A0000-0x00007FF7168F4000-memory.dmp	upx
behavioral2/memory/524-124-0x00007FF6AD030000-0x00007FF6AD384000-memory.dmp	upx
behavioral2/memory/552-123-0x00007FF735020000-0x00007FF735374000-memory.dmp	upx
behavioral2/files/0x0007000000023404-121.dat	upx
behavioral2/memory/4472-118-0x00007FF7CD7B0000-0x00007FF7CDB04000-memory.dmp	upx
behavioral2/memory/4960-115-0x00007FF702FF0000-0x00007FF703344000-memory.dmp	upx
behavioral2/memory/5096-106-0x00007FF7452D0000-0x00007FF745624000-memory.dmp	upx
behavioral2/memory/1824-100-0x00007FF735EF0000-0x00007FF736244000-memory.dmp	upx
behavioral2/memory/2628-91-0x00007FF744C10000-0x00007FF744F64000-memory.dmp	upx
behavioral2/files/0x00070000000233fd-86.dat	upx
behavioral2/memory/2020-83-0x00007FF6F4020000-0x00007FF6F4374000-memory.dmp	upx
behavioral2/memory/1164-77-0x00007FF6A62D0000-0x00007FF6A6624000-memory.dmp	upx
behavioral2/memory/3116-71-0x00007FF7C90D0000-0x00007FF7C9424000-memory.dmp	upx
behavioral2/memory/3720-70-0x00007FF7D26D0000-0x00007FF7D2A24000-memory.dmp	upx
behavioral2/memory/1984-68-0x00007FF790BD0000-0x00007FF790F24000-memory.dmp	upx
behavioral2/files/0x00070000000233fa-64.dat	upx
behavioral2/files/0x00070000000233f8-56.dat	upx
behavioral2/files/0x00070000000233f7-47.dat	upx
behavioral2/memory/3312-38-0x00007FF731820000-0x00007FF731B74000-memory.dmp	upx
behavioral2/files/0x00070000000233f4-30.dat	upx
behavioral2/memory/1676-27-0x00007FF61AA00000-0x00007FF61AD54000-memory.dmp	upx
behavioral2/memory/64-21-0x00007FF74F670000-0x00007FF74F9C4000-memory.dmp	upx
behavioral2/memory/3180-128-0x00007FF6C3710000-0x00007FF6C3A64000-memory.dmp	upx
behavioral2/memory/4988-129-0x00007FF619C40000-0x00007FF619F94000-memory.dmp	upx
behavioral2/memory/4960-130-0x00007FF702FF0000-0x00007FF703344000-memory.dmp	upx
behavioral2/memory/4988-131-0x00007FF619C40000-0x00007FF619F94000-memory.dmp	upx
behavioral2/memory/5044-132-0x00007FF775B40000-0x00007FF775E94000-memory.dmp	upx
behavioral2/memory/64-133-0x00007FF74F670000-0x00007FF74F9C4000-memory.dmp	upx
behavioral2/memory/1676-134-0x00007FF61AA00000-0x00007FF61AD54000-memory.dmp	upx
behavioral2/memory/3312-135-0x00007FF731820000-0x00007FF731B74000-memory.dmp	upx
behavioral2/memory/2020-136-0x00007FF6F4020000-0x00007FF6F4374000-memory.dmp	upx
behavioral2/memory/3736-137-0x00007FF7C3360000-0x00007FF7C36B4000-memory.dmp	upx
behavioral2/memory/1984-138-0x00007FF790BD0000-0x00007FF790F24000-memory.dmp	upx
behavioral2/memory/3720-139-0x00007FF7D26D0000-0x00007FF7D2A24000-memory.dmp	upx
behavioral2/memory/3116-142-0x00007FF7C90D0000-0x00007FF7C9424000-memory.dmp	upx
behavioral2/memory/2628-141-0x00007FF744C10000-0x00007FF744F64000-memory.dmp	upx
behavioral2/memory/1164-140-0x00007FF6A62D0000-0x00007FF6A6624000-memory.dmp	upx
behavioral2/memory/1824-143-0x00007FF735EF0000-0x00007FF736244000-memory.dmp	upx
behavioral2/memory/4472-144-0x00007FF7CD7B0000-0x00007FF7CDB04000-memory.dmp	upx
behavioral2/memory/5096-145-0x00007FF7452D0000-0x00007FF745624000-memory.dmp	upx
behavioral2/memory/524-150-0x00007FF6AD030000-0x00007FF6AD384000-memory.dmp	upx
behavioral2/memory/1692-149-0x00007FF7165A0000-0x00007FF7168F4000-memory.dmp	upx
behavioral2/memory/4960-148-0x00007FF702FF0000-0x00007FF703344000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\acFHjxK.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uoAgwUf.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\drEmFLp.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dVXPuqF.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eUvynKD.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PCmTpth.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OKIgRXU.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wyoWWrZ.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wTOlfFK.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EzHLHoZ.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vgKYOOU.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YuljGBr.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZBrlEcz.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\arXLxKw.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jERLLNQ.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MagQTxU.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VKwooDM.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WuRvxlO.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tPhhxmt.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qvgncwR.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JLwnVhq.exe	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 4988	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	83
PID 3180 wrote to memory of 4988	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	83
PID 3180 wrote to memory of 5044	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	84
PID 3180 wrote to memory of 5044	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	84
PID 3180 wrote to memory of 64	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	85
PID 3180 wrote to memory of 64	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	85
PID 3180 wrote to memory of 1676	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	86
PID 3180 wrote to memory of 1676	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	86
PID 3180 wrote to memory of 3312	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	87
PID 3180 wrote to memory of 3312	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	87
PID 3180 wrote to memory of 2020	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	88
PID 3180 wrote to memory of 2020	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	88
PID 3180 wrote to memory of 1984	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	89
PID 3180 wrote to memory of 1984	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	89
PID 3180 wrote to memory of 3736	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	90
PID 3180 wrote to memory of 3736	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	90
PID 3180 wrote to memory of 3720	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	91
PID 3180 wrote to memory of 3720	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	91
PID 3180 wrote to memory of 3116	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	92
PID 3180 wrote to memory of 3116	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	92
PID 3180 wrote to memory of 2628	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	93
PID 3180 wrote to memory of 2628	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	93
PID 3180 wrote to memory of 1164	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	94
PID 3180 wrote to memory of 1164	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	94
PID 3180 wrote to memory of 1824	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	95
PID 3180 wrote to memory of 1824	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	95
PID 3180 wrote to memory of 4472	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	96
PID 3180 wrote to memory of 4472	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	96
PID 3180 wrote to memory of 5096	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	97
PID 3180 wrote to memory of 5096	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	97
PID 3180 wrote to memory of 552	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	98
PID 3180 wrote to memory of 552	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	98
PID 3180 wrote to memory of 524	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	99
PID 3180 wrote to memory of 524	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	99
PID 3180 wrote to memory of 1692	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	100
PID 3180 wrote to memory of 1692	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	100
PID 3180 wrote to memory of 4960	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	101
PID 3180 wrote to memory of 4960	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	101
PID 3180 wrote to memory of 3408	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	102
PID 3180 wrote to memory of 3408	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	102
PID 3180 wrote to memory of 4404	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	103
PID 3180 wrote to memory of 4404	3180	2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe	103

C:\Users\Admin\AppData\Local\Temp\2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-31_b5f28fc41f0f7c5d7d717b4812375447_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\System\WuRvxlO.exe
  C:\Windows\System\WuRvxlO.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\eUvynKD.exe
  C:\Windows\System\eUvynKD.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\YuljGBr.exe
  C:\Windows\System\YuljGBr.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\ZBrlEcz.exe
  C:\Windows\System\ZBrlEcz.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\arXLxKw.exe
  C:\Windows\System\arXLxKw.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\tPhhxmt.exe
  C:\Windows\System\tPhhxmt.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\jERLLNQ.exe
  C:\Windows\System\jERLLNQ.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\wTOlfFK.exe
  C:\Windows\System\wTOlfFK.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\PCmTpth.exe
  C:\Windows\System\PCmTpth.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\acFHjxK.exe
  C:\Windows\System\acFHjxK.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\OKIgRXU.exe
  C:\Windows\System\OKIgRXU.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\uoAgwUf.exe
  C:\Windows\System\uoAgwUf.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\drEmFLp.exe
  C:\Windows\System\drEmFLp.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\qvgncwR.exe
  C:\Windows\System\qvgncwR.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\wyoWWrZ.exe
  C:\Windows\System\wyoWWrZ.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\JLwnVhq.exe
  C:\Windows\System\JLwnVhq.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\dVXPuqF.exe
  C:\Windows\System\dVXPuqF.exe
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Windows\System\MagQTxU.exe
  C:\Windows\System\MagQTxU.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\EzHLHoZ.exe
  C:\Windows\System\EzHLHoZ.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\vgKYOOU.exe
  C:\Windows\System\vgKYOOU.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\VKwooDM.exe
  C:\Windows\System\VKwooDM.exe
  2⤵
  - Executes dropped EXE
  PID:4404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

EzHLHoZ.exe

Path C:\Windows\System\EzHLHoZ.exe
Size 5.9MB
SHA256 d0dadc3007d7ccb03d4940ea095376860db1400c2ed477fb66194b833d874322
MD5 41894896da58c4d02a18b0b656a2f219
SHA1 dfc661f77487b0118074333f6d0119933576b173
SHA512 354ff361e4d24c1a09cfff15facc952265b73f9ac1167e09c213748f7342ac648f44a82d0a22416ec32a36afc8780832fcbf8dce286ebf0de0ddd82b9c2e79ac
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

JLwnVhq.exe

Path C:\Windows\System\JLwnVhq.exe
Size 5.9MB
SHA256 dbd4b7cf780ae5a588093980d15a4fdd8ed9b73bea211e599fdfe11aebcaf6fd
MD5 9f0050c5fabbe6a05d0eb87ec16871cb
SHA1 206397ee3f58758b6fe98c825541d68382301651
SHA512 c64b810e386c7846cb195397fa9e9f2c8b67d38b2bf48a97a1099da94478bda4cffffbda5d6981000f390b4c64134827bdbc0a3436dda86df3f65ef777544c1e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

MagQTxU.exe

Path C:\Windows\System\MagQTxU.exe
Size 5.9MB
SHA256 d866abd77ddbb5b8a9ec0439cde8173ff151c700f0fe774ee362ddb88c01aa9d
MD5 72e70fc053750605fa550b7d2f35e03d
SHA1 208db7ef846b5682692e20939a90bb0bf4017e18
SHA512 a2e0e30c24c9f21bef2db57f70f7e1d0ec86fa70fdcedb4ae7cd4a33f90e9e947229a15237af92eca636e7b9ec819e1577198a1ea36085e01034f2506ca27501
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

OKIgRXU.exe

Path C:\Windows\System\OKIgRXU.exe
Size 5.9MB
SHA256 16088271900502fa5a823e00f07fff4e6bcbf4f55a610ff51a9db349ccf562f5
MD5 d87439065b06a2fb895a97f36898ec49
SHA1 12acc95795e3f3b3b44a466a1297b33ed2627aad
SHA512 53bb604add263e82bf04010623ce23e846b6a307b80cc05e7b43d24dd734e0e2b063e7b86bcc70e8d374100d4a49e7d12fc1f1544add24344d9446b6bd3a05b5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

PCmTpth.exe

Path C:\Windows\System\PCmTpth.exe
Size 5.9MB
SHA256 a3a650b446717012bc2ee4922b8cdf37fd92ebbf467a64ef91b675a13dd5a96c
MD5 f21223601e2b65246a8272362bab46e0
SHA1 19a5b7677174dda99026c61b1c8249cd97a4c5f3
SHA512 3da16527664caf3978537491ae45c4eff314f37d0cf922f46adbdc5da9016f59d52cd46f02a2007ad532f30c59ebf94c779734b79fde8ed672255ab37957f147
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

VKwooDM.exe

Path C:\Windows\System\VKwooDM.exe
Size 5.9MB
SHA256 3b076cdc5933aa45649429e91765106e127781d2073089d9e7ce15d5afc54be7
MD5 8cee6155959b01f04e63580ba8a37d06
SHA1 0cf05caa28812cf4967929a1ba0693d5494762e5
SHA512 068849e62dfb4c3fb7e139413c299489e1634ce4e52ebb39740cbccbaaeb438223a3f7a36e5a7d15fbd853b62023b9026beaea1802f661e0897dc3a5e7fd6d6e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

WuRvxlO.exe

Path C:\Windows\System\WuRvxlO.exe
Size 5.9MB
SHA256 ead94631d56adcfa68f08c53d16524e08968ca1ad252c51c8a05cc8e49249f0a
MD5 f733d8dbd3050a94509a087742c6a78e
SHA1 5894bee03a3e3e5ad475968de536105f1e490e1f
SHA512 97e9da16a9d321d11f25e0082bf206641a879ed4ffe4005f2612821020412e028d9e671cad4df4ce9e1432f48a118f49955fe717d037dc1be1d28e8a30daf633
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

YuljGBr.exe

Path C:\Windows\System\YuljGBr.exe
Size 5.9MB
SHA256 e7e7bbc91e721d09bbad260308af3d38baea763093c6f696eaef9844961a8161
MD5 86986cd6653abd84fc41e081d736533b
SHA1 769b28ddbd5ebdf5a3ca5b86bfc25b00c37ebdff
SHA512 80c4a01fe9eed51ea321d2ec69b829bb8ae9c2a1187a6d4c5faf63b88fd54ca13ef5112bc35331dcfc4292a4d7497a3c3651289cc85b6c3a26a7218540a379bc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZBrlEcz.exe

Path C:\Windows\System\ZBrlEcz.exe
Size 5.9MB
SHA256 2efcf58c044250a8b755bd2f230a5e58cf0dd1bbd1c9f0cd3548630608a433e7
MD5 010ae29d0648ebb5d8d42fd0fc87060e
SHA1 c22e00ea45d3c733c12e821fa6d1f21f184022a7
SHA512 6944623182371bff11a50806b5d9d6ffd7756f94c368b2eb33b4fa94d1cc19e22816c148920ee2ffb4f88c7f8b4f869645677180f1c617c999ab1f909b3104d8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

acFHjxK.exe

Path C:\Windows\System\acFHjxK.exe
Size 5.9MB
SHA256 d6fa201b776be7c57ed901f437a2fc37570c77275dea4bc08d3ba58646b6fb32
MD5 be4bb410a36c01e6f44d98cc9d78ae62
SHA1 c1db05bde531f767bee67345658be9b8238ccfb3
SHA512 b95afc5dc7b8573418ea378ce1c26ed37f0645c5a5b14611eb2453adbbaf3f5f34f838a66bba7da9663a638e57ffdef7b3c3ebe8f6798670edddadce94bfbb60
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

arXLxKw.exe

Path C:\Windows\System\arXLxKw.exe
Size 5.9MB
SHA256 d7f68cc2d4cbfd42fa37bf656c4eaa4de231fca904cb6d40716b8a2fad2187a5
MD5 b4fac760d38e5b72ff0de494435439c9
SHA1 540fe4f355f1b8f4b0e4c6894583599460b9cf5d
SHA512 7238f606c1942d4617e06ee4dae186575903440777b00c9d86f9a08d18b7c852193c99dab6bcc813149da3fabca31da6444c68749282f104f579ca7886beb581
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

dVXPuqF.exe

Path C:\Windows\System\dVXPuqF.exe
Size 5.9MB
SHA256 73ecc9d9d4f63e8ca53c8a56f82476c70c4b4ef5f725ed35c9a310a310fa76fb
MD5 4a637ef02f26c22bb305a46d7d49228d
SHA1 841ff172d61bf729626380b66331e27657e38ff5
SHA512 d62f258c2e8b936869bdec54fc17ebee1e82ffa508176b531061c7f556540b516a7587d60fe694a077df048f5964d23c381f19be4ac268f6433937d5875420f5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

drEmFLp.exe

Path C:\Windows\System\drEmFLp.exe
Size 5.9MB
SHA256 3a633a005115c3a88a566d44621a296e49aadc8a9c68f89f786be811437b3032
MD5 7b076c5ed82074cbb6fb1436c1da37da
SHA1 de0f8d7213455a772e478dcaef64fbea4f76738d
SHA512 bf94f153f0bf35144fe0f67ca8f948132e682d80acf9ad08b5015007cfac89d01746830d93cd580fc8976896015fdaad10b9cc3d3f0c60da51edfe067b95c592
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

eUvynKD.exe

Path C:\Windows\System\eUvynKD.exe
Size 5.9MB
SHA256 be6b5d27613234451241b8890f910108e1034cd529810355f2492cb10d5fc8d6
MD5 449dcb735d324f228dfa5a656404801a
SHA1 1e3c5bf9fe6598122e30858cc4e4da6e4273e990
SHA512 78788ec71b01aaf394ca11182502e1459a07d67a5ac09ebb92cd4e7f64bfa919459b713e6f1b6172e9c7089eeed5ebd7c87b7a0312b26cde226aa606c5d506f8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

jERLLNQ.exe

Path C:\Windows\System\jERLLNQ.exe
Size 5.9MB
SHA256 8dfcef8055dc935f25f9cffca3b6557ecb4f6d222518be3af5134a152132eb00
MD5 dfbdbbbf6dbdafb39dd7cc66005292c9
SHA1 2420129544de6cb5f26af984e73224286af65745
SHA512 235a47470388beb1371553f47aaec410e2006b617d7a35fe8eb3b33ddd614d627af7c779359e262f63f10de5cf0debf31d2104f1a9e888fb2aa21b5fc94c4b8e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

qvgncwR.exe

Path C:\Windows\System\qvgncwR.exe
Size 5.9MB
SHA256 fc7e95872e6a01445520d37663f2551af30dd507535efa793ac7bdc4b55c5712
MD5 c7014f8d71f2149d4465ebad43e58ea4
SHA1 d3e943101b81dd45d69494282edd557c21b88a01
SHA512 3dba2b0fa9ec39930ea182d5b03964a823f4f117788a87b5220f7a23dd3806a7e9110bf7eadfc2adb6f2ea5eb7e57c4ebf6d87c04f6e232051c62f5fb92e148f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

tPhhxmt.exe

Path C:\Windows\System\tPhhxmt.exe
Size 5.9MB
SHA256 6231dc0a863eb8b209b81772c4c836c5f565b1be741364e81e3be8ab59d4b6b9
MD5 21e105d5ec5a2be4ba4e020ccd9a98a9
SHA1 1f0f325c30254fdafacc17884f620e9fac2d2f07
SHA512 e33c3cbcf26e1daa9b46954fb23bab347a791483d50bf9049b7e98d1fc64e75b78514d6ef05b3feb469e6cf44182be039b363f5992423e1edc04de30087379cb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

uoAgwUf.exe

Path C:\Windows\System\uoAgwUf.exe
Size 5.9MB
SHA256 b3bcb49a6475d392791460345840b1eacaa417c9e5b34fecb5158386923e8496
MD5 c1d7e0ccef2fb488a7e05c366f521f09
SHA1 f1352f7ac957a2f5f10fa982de60d7aaacb08a4e
SHA512 27dcbe82366f987ac3bd6ab75cb99cfa121a087daed81b810a61cffe2d90565619e6e1cb83a3a1908e147afe7272e8393914e7251a338fe8bf31327fede0a1bd
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

vgKYOOU.exe

Path C:\Windows\System\vgKYOOU.exe
Size 5.9MB
SHA256 789b908143956493f9d9445340548132aacfe35cd38c97f91d2baa5e8914b1a7
MD5 46db46bf1d3b80c27fd2996c4e498d27
SHA1 2d9523641f1fa04934ae56244414366c4acf54d1
SHA512 423f26e2f93766b67ccb33fd84abdc63174c894ed3031357c774f7d870790b9309722973518a1a879d3dfb1243165cb872e4b87d881ec8cee474337aa2f7a9a2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

wTOlfFK.exe

Path C:\Windows\System\wTOlfFK.exe
Size 5.9MB
SHA256 cf8b2712ac64cda7e7d9d56664008ce013090eebab421ca9adc914987fa7f4d3
MD5 da756abc58d65da4bd40663e1dcac6b3
SHA1 1410bc101ed59af93cebb34899a0b5575a53eb9f
SHA512 89cbc24855b08e52a956b03a60c25fa1b54eccca91575bee8a0d65f6743c8a333f8f6599b61a9689daaef4bdf7782eea29eb878937f78f7c508fc4fabee70d0c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

wyoWWrZ.exe

Path C:\Windows\System\wyoWWrZ.exe
Size 5.9MB
SHA256 61e8092c95217f80629cf84cfd08a5c1ef089dcc3a727336bd9709dd58a2c8df
MD5 438804ad638bc4f446f9017c3d1d2141
SHA1 90d5628ad3dbbb6ecd8a8c3f37e9f5b8dc87e4e5
SHA512 025454af4fb7276bb0b6fea72c1856663008a3ea8085dfa74e588aae03be9b437b12af9ed415b12c819ce5984dbb3e4c534693344215609a321914f36597dd93
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/64-21-0x00007FF74F670000-0x00007FF74F9C4000-memory.dmp

Download

memory/64-133-0x00007FF74F670000-0x00007FF74F9C4000-memory.dmp

Download

memory/524-124-0x00007FF6AD030000-0x00007FF6AD384000-memory.dmp

Download

memory/524-150-0x00007FF6AD030000-0x00007FF6AD384000-memory.dmp

Download

memory/552-123-0x00007FF735020000-0x00007FF735374000-memory.dmp

Download

memory/552-146-0x00007FF735020000-0x00007FF735374000-memory.dmp

Download

memory/1164-140-0x00007FF6A62D0000-0x00007FF6A6624000-memory.dmp

Download

memory/1164-77-0x00007FF6A62D0000-0x00007FF6A6624000-memory.dmp

Download

memory/1676-27-0x00007FF61AA00000-0x00007FF61AD54000-memory.dmp

Download

memory/1676-134-0x00007FF61AA00000-0x00007FF61AD54000-memory.dmp

Download

memory/1692-149-0x00007FF7165A0000-0x00007FF7168F4000-memory.dmp

Download

memory/1692-125-0x00007FF7165A0000-0x00007FF7168F4000-memory.dmp

Download

memory/1824-100-0x00007FF735EF0000-0x00007FF736244000-memory.dmp

Download

memory/1824-143-0x00007FF735EF0000-0x00007FF736244000-memory.dmp

Download

memory/1984-138-0x00007FF790BD0000-0x00007FF790F24000-memory.dmp

Download

memory/1984-68-0x00007FF790BD0000-0x00007FF790F24000-memory.dmp

Download

memory/2020-136-0x00007FF6F4020000-0x00007FF6F4374000-memory.dmp

Download

memory/2020-83-0x00007FF6F4020000-0x00007FF6F4374000-memory.dmp

Download

memory/2628-141-0x00007FF744C10000-0x00007FF744F64000-memory.dmp

Download

memory/2628-91-0x00007FF744C10000-0x00007FF744F64000-memory.dmp

Download

memory/3116-71-0x00007FF7C90D0000-0x00007FF7C9424000-memory.dmp

Download

memory/3116-142-0x00007FF7C90D0000-0x00007FF7C9424000-memory.dmp

Download

memory/3180-128-0x00007FF6C3710000-0x00007FF6C3A64000-memory.dmp

Download

memory/3180-1-0x000001E4DB380000-0x000001E4DB390000-memory.dmp

Download

memory/3180-0-0x00007FF6C3710000-0x00007FF6C3A64000-memory.dmp

Download

memory/3312-38-0x00007FF731820000-0x00007FF731B74000-memory.dmp

Download

memory/3312-135-0x00007FF731820000-0x00007FF731B74000-memory.dmp

Download

memory/3408-151-0x00007FF7B5C10000-0x00007FF7B5F64000-memory.dmp

Download

memory/3408-126-0x00007FF7B5C10000-0x00007FF7B5F64000-memory.dmp

Download

memory/3720-70-0x00007FF7D26D0000-0x00007FF7D2A24000-memory.dmp

Download

memory/3720-139-0x00007FF7D26D0000-0x00007FF7D2A24000-memory.dmp

Download

memory/3736-61-0x00007FF7C3360000-0x00007FF7C36B4000-memory.dmp

Download

memory/3736-137-0x00007FF7C3360000-0x00007FF7C36B4000-memory.dmp

Download

memory/4404-127-0x00007FF6855D0000-0x00007FF685924000-memory.dmp

Download

memory/4404-147-0x00007FF6855D0000-0x00007FF685924000-memory.dmp

Download

memory/4472-118-0x00007FF7CD7B0000-0x00007FF7CDB04000-memory.dmp

Download

memory/4472-144-0x00007FF7CD7B0000-0x00007FF7CDB04000-memory.dmp

Download

memory/4960-148-0x00007FF702FF0000-0x00007FF703344000-memory.dmp

Download

memory/4960-115-0x00007FF702FF0000-0x00007FF703344000-memory.dmp

Download

memory/4960-130-0x00007FF702FF0000-0x00007FF703344000-memory.dmp

Download

memory/4988-131-0x00007FF619C40000-0x00007FF619F94000-memory.dmp

Download

memory/4988-129-0x00007FF619C40000-0x00007FF619F94000-memory.dmp

Download

memory/4988-8-0x00007FF619C40000-0x00007FF619F94000-memory.dmp

Download

memory/5044-132-0x00007FF775B40000-0x00007FF775E94000-memory.dmp

Download

memory/5044-14-0x00007FF775B40000-0x00007FF775E94000-memory.dmp

Download

memory/5096-145-0x00007FF7452D0000-0x00007FF745624000-memory.dmp

Download

memory/5096-106-0x00007FF7452D0000-0x00007FF745624000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads