cobaltstrike | c7f9817a07be5bf309084f6cd2704c5564e1f927ea87afbf741298e4af4a1d84

Analysis

max time kernel
138s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
Size 6.0MB
Sample240601-awhtjsbc4v
SHA256 c7f9817a07be5bf309084f6cd2704c5564e1f927ea87afbf741298e4af4a1d84
MD5 2f3f05a922703504474d9c9623bf74b7
SHA1 d792460943d2fdcdb0a4a9f4b2059e7f30d91552
SHA512 10b2821edcb4e1ec4f19d43e0f4ec4010203ebe514b123edffd8dcd008e75eec8e321e546bce0edaee945f62e0db3f0bd8ad10d02b7bd62ae4635a70c63979c3
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:T+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0007000000023297-5.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002342f-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023433-18.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023434-23.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023435-29.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023430-33.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023436-41.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023439-59.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343a-63.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343c-71.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343f-93.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023442-112.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023444-118.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023443-115.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023441-109.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023440-101.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343e-91.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343d-87.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343b-73.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023438-54.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023437-50.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023297-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002342f-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023433-18.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023434-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023435-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023430-33.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023436-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023439-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343a-63.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343c-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343f-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023442-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023444-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023443-115.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023441-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023440-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343e-91.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343d-87.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343b-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023438-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023437-50.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2720-0-0x00007FF626550000-0x00007FF6268A4000-memory.dmp	UPX
behavioral2/files/0x0007000000023297-5.dat	UPX
behavioral2/memory/3048-7-0x00007FF6BE790000-0x00007FF6BEAE4000-memory.dmp	UPX
behavioral2/files/0x000800000002342f-11.dat	UPX
behavioral2/memory/3480-14-0x00007FF639A90000-0x00007FF639DE4000-memory.dmp	UPX
behavioral2/files/0x0007000000023433-18.dat	UPX
behavioral2/files/0x0007000000023434-23.dat	UPX
behavioral2/memory/1040-24-0x00007FF7FCCD0000-0x00007FF7FD024000-memory.dmp	UPX
behavioral2/memory/2592-22-0x00007FF63CE30000-0x00007FF63D184000-memory.dmp	UPX
behavioral2/files/0x0007000000023435-29.dat	UPX
behavioral2/files/0x0008000000023430-33.dat	UPX
behavioral2/files/0x0007000000023436-41.dat	UPX
behavioral2/memory/1460-47-0x00007FF6946F0000-0x00007FF694A44000-memory.dmp	UPX
behavioral2/files/0x0007000000023439-59.dat	UPX
behavioral2/files/0x000700000002343a-63.dat	UPX
behavioral2/files/0x000700000002343c-71.dat	UPX
behavioral2/memory/5064-75-0x00007FF7345F0000-0x00007FF734944000-memory.dmp	UPX
behavioral2/files/0x000700000002343f-93.dat	UPX
behavioral2/files/0x0007000000023442-112.dat	UPX
behavioral2/files/0x0007000000023444-118.dat	UPX
behavioral2/files/0x0007000000023443-115.dat	UPX
behavioral2/files/0x0007000000023441-109.dat	UPX
behavioral2/files/0x0007000000023440-101.dat	UPX
behavioral2/files/0x000700000002343e-91.dat	UPX
behavioral2/files/0x000700000002343d-87.dat	UPX
behavioral2/memory/4048-80-0x00007FF701910000-0x00007FF701C64000-memory.dmp	UPX
behavioral2/memory/1696-79-0x00007FF722340000-0x00007FF722694000-memory.dmp	UPX
behavioral2/memory/5108-78-0x00007FF651A90000-0x00007FF651DE4000-memory.dmp	UPX
behavioral2/files/0x000700000002343b-73.dat	UPX
behavioral2/memory/4468-72-0x00007FF69F380000-0x00007FF69F6D4000-memory.dmp	UPX
behavioral2/files/0x0007000000023438-54.dat	UPX
behavioral2/files/0x0007000000023437-50.dat	UPX
behavioral2/memory/828-48-0x00007FF725E90000-0x00007FF7261E4000-memory.dmp	UPX
behavioral2/memory/3052-43-0x00007FF6E3380000-0x00007FF6E36D4000-memory.dmp	UPX
behavioral2/memory/3268-31-0x00007FF610040000-0x00007FF610394000-memory.dmp	UPX
behavioral2/memory/4748-120-0x00007FF6A4F50000-0x00007FF6A52A4000-memory.dmp	UPX
behavioral2/memory/3472-122-0x00007FF7E5760000-0x00007FF7E5AB4000-memory.dmp	UPX
behavioral2/memory/4928-121-0x00007FF6C3350000-0x00007FF6C36A4000-memory.dmp	UPX
behavioral2/memory/5036-124-0x00007FF669EE0000-0x00007FF66A234000-memory.dmp	UPX
behavioral2/memory/2212-125-0x00007FF6FC660000-0x00007FF6FC9B4000-memory.dmp	UPX
behavioral2/memory/3544-123-0x00007FF622900000-0x00007FF622C54000-memory.dmp	UPX
behavioral2/memory/4888-126-0x00007FF7A3EE0000-0x00007FF7A4234000-memory.dmp	UPX
behavioral2/memory/4076-127-0x00007FF73A0D0000-0x00007FF73A424000-memory.dmp	UPX
behavioral2/memory/2720-128-0x00007FF626550000-0x00007FF6268A4000-memory.dmp	UPX
behavioral2/memory/3048-129-0x00007FF6BE790000-0x00007FF6BEAE4000-memory.dmp	UPX
behavioral2/memory/3480-130-0x00007FF639A90000-0x00007FF639DE4000-memory.dmp	UPX
behavioral2/memory/1040-131-0x00007FF7FCCD0000-0x00007FF7FD024000-memory.dmp	UPX
behavioral2/memory/3268-132-0x00007FF610040000-0x00007FF610394000-memory.dmp	UPX
behavioral2/memory/828-133-0x00007FF725E90000-0x00007FF7261E4000-memory.dmp	UPX
behavioral2/memory/3048-134-0x00007FF6BE790000-0x00007FF6BEAE4000-memory.dmp	UPX
behavioral2/memory/3480-135-0x00007FF639A90000-0x00007FF639DE4000-memory.dmp	UPX
behavioral2/memory/2592-136-0x00007FF63CE30000-0x00007FF63D184000-memory.dmp	UPX
behavioral2/memory/1040-137-0x00007FF7FCCD0000-0x00007FF7FD024000-memory.dmp	UPX
behavioral2/memory/3052-138-0x00007FF6E3380000-0x00007FF6E36D4000-memory.dmp	UPX
behavioral2/memory/3268-139-0x00007FF610040000-0x00007FF610394000-memory.dmp	UPX
behavioral2/memory/1460-140-0x00007FF6946F0000-0x00007FF694A44000-memory.dmp	UPX
behavioral2/memory/828-141-0x00007FF725E90000-0x00007FF7261E4000-memory.dmp	UPX
behavioral2/memory/4468-142-0x00007FF69F380000-0x00007FF69F6D4000-memory.dmp	UPX
behavioral2/memory/5064-143-0x00007FF7345F0000-0x00007FF734944000-memory.dmp	UPX
behavioral2/memory/5108-144-0x00007FF651A90000-0x00007FF651DE4000-memory.dmp	UPX
behavioral2/memory/1696-145-0x00007FF722340000-0x00007FF722694000-memory.dmp	UPX
behavioral2/memory/4048-146-0x00007FF701910000-0x00007FF701C64000-memory.dmp	UPX
behavioral2/memory/4748-147-0x00007FF6A4F50000-0x00007FF6A52A4000-memory.dmp	UPX
behavioral2/memory/4928-148-0x00007FF6C3350000-0x00007FF6C36A4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2720-0-0x00007FF626550000-0x00007FF6268A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023297-5.dat	xmrig
behavioral2/memory/3048-7-0x00007FF6BE790000-0x00007FF6BEAE4000-memory.dmp	xmrig
behavioral2/files/0x000800000002342f-11.dat	xmrig
behavioral2/memory/3480-14-0x00007FF639A90000-0x00007FF639DE4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023433-18.dat	xmrig
behavioral2/files/0x0007000000023434-23.dat	xmrig
behavioral2/memory/1040-24-0x00007FF7FCCD0000-0x00007FF7FD024000-memory.dmp	xmrig
behavioral2/memory/2592-22-0x00007FF63CE30000-0x00007FF63D184000-memory.dmp	xmrig
behavioral2/files/0x0007000000023435-29.dat	xmrig
behavioral2/files/0x0008000000023430-33.dat	xmrig
behavioral2/files/0x0007000000023436-41.dat	xmrig
behavioral2/memory/1460-47-0x00007FF6946F0000-0x00007FF694A44000-memory.dmp	xmrig
behavioral2/files/0x0007000000023439-59.dat	xmrig
behavioral2/files/0x000700000002343a-63.dat	xmrig
behavioral2/files/0x000700000002343c-71.dat	xmrig
behavioral2/memory/5064-75-0x00007FF7345F0000-0x00007FF734944000-memory.dmp	xmrig
behavioral2/files/0x000700000002343f-93.dat	xmrig
behavioral2/files/0x0007000000023442-112.dat	xmrig
behavioral2/files/0x0007000000023444-118.dat	xmrig
behavioral2/files/0x0007000000023443-115.dat	xmrig
behavioral2/files/0x0007000000023441-109.dat	xmrig
behavioral2/files/0x0007000000023440-101.dat	xmrig
behavioral2/files/0x000700000002343e-91.dat	xmrig
behavioral2/files/0x000700000002343d-87.dat	xmrig
behavioral2/memory/4048-80-0x00007FF701910000-0x00007FF701C64000-memory.dmp	xmrig
behavioral2/memory/1696-79-0x00007FF722340000-0x00007FF722694000-memory.dmp	xmrig
behavioral2/memory/5108-78-0x00007FF651A90000-0x00007FF651DE4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343b-73.dat	xmrig
behavioral2/memory/4468-72-0x00007FF69F380000-0x00007FF69F6D4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023438-54.dat	xmrig
behavioral2/files/0x0007000000023437-50.dat	xmrig
behavioral2/memory/828-48-0x00007FF725E90000-0x00007FF7261E4000-memory.dmp	xmrig
behavioral2/memory/3052-43-0x00007FF6E3380000-0x00007FF6E36D4000-memory.dmp	xmrig
behavioral2/memory/3268-31-0x00007FF610040000-0x00007FF610394000-memory.dmp	xmrig
behavioral2/memory/4748-120-0x00007FF6A4F50000-0x00007FF6A52A4000-memory.dmp	xmrig
behavioral2/memory/3472-122-0x00007FF7E5760000-0x00007FF7E5AB4000-memory.dmp	xmrig
behavioral2/memory/4928-121-0x00007FF6C3350000-0x00007FF6C36A4000-memory.dmp	xmrig
behavioral2/memory/5036-124-0x00007FF669EE0000-0x00007FF66A234000-memory.dmp	xmrig
behavioral2/memory/2212-125-0x00007FF6FC660000-0x00007FF6FC9B4000-memory.dmp	xmrig
behavioral2/memory/3544-123-0x00007FF622900000-0x00007FF622C54000-memory.dmp	xmrig
behavioral2/memory/4888-126-0x00007FF7A3EE0000-0x00007FF7A4234000-memory.dmp	xmrig
behavioral2/memory/4076-127-0x00007FF73A0D0000-0x00007FF73A424000-memory.dmp	xmrig
behavioral2/memory/2720-128-0x00007FF626550000-0x00007FF6268A4000-memory.dmp	xmrig
behavioral2/memory/3048-129-0x00007FF6BE790000-0x00007FF6BEAE4000-memory.dmp	xmrig
behavioral2/memory/3480-130-0x00007FF639A90000-0x00007FF639DE4000-memory.dmp	xmrig
behavioral2/memory/1040-131-0x00007FF7FCCD0000-0x00007FF7FD024000-memory.dmp	xmrig
behavioral2/memory/3268-132-0x00007FF610040000-0x00007FF610394000-memory.dmp	xmrig
behavioral2/memory/828-133-0x00007FF725E90000-0x00007FF7261E4000-memory.dmp	xmrig
behavioral2/memory/3048-134-0x00007FF6BE790000-0x00007FF6BEAE4000-memory.dmp	xmrig
behavioral2/memory/3480-135-0x00007FF639A90000-0x00007FF639DE4000-memory.dmp	xmrig
behavioral2/memory/2592-136-0x00007FF63CE30000-0x00007FF63D184000-memory.dmp	xmrig
behavioral2/memory/1040-137-0x00007FF7FCCD0000-0x00007FF7FD024000-memory.dmp	xmrig
behavioral2/memory/3052-138-0x00007FF6E3380000-0x00007FF6E36D4000-memory.dmp	xmrig
behavioral2/memory/3268-139-0x00007FF610040000-0x00007FF610394000-memory.dmp	xmrig
behavioral2/memory/1460-140-0x00007FF6946F0000-0x00007FF694A44000-memory.dmp	xmrig
behavioral2/memory/828-141-0x00007FF725E90000-0x00007FF7261E4000-memory.dmp	xmrig
behavioral2/memory/4468-142-0x00007FF69F380000-0x00007FF69F6D4000-memory.dmp	xmrig
behavioral2/memory/5064-143-0x00007FF7345F0000-0x00007FF734944000-memory.dmp	xmrig
behavioral2/memory/5108-144-0x00007FF651A90000-0x00007FF651DE4000-memory.dmp	xmrig
behavioral2/memory/1696-145-0x00007FF722340000-0x00007FF722694000-memory.dmp	xmrig
behavioral2/memory/4048-146-0x00007FF701910000-0x00007FF701C64000-memory.dmp	xmrig
behavioral2/memory/4748-147-0x00007FF6A4F50000-0x00007FF6A52A4000-memory.dmp	xmrig
behavioral2/memory/4928-148-0x00007FF6C3350000-0x00007FF6C36A4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3048	MxMnMkd.exe
3480	hQGCgWK.exe
2592	ELEumah.exe
1040	RJdUaAr.exe
3268	PeRMTfR.exe
3052	ZrXDeda.exe
1460	OBMGifP.exe
828	bBbeTMe.exe
4468	YQMiycg.exe
5064	gRqaLDl.exe
5108	aMGpopW.exe
1696	falZAkK.exe
4048	uKlQOeS.exe
4748	tklzRsk.exe
4928	bsUXYey.exe
3472	IeSKwia.exe
3544	nQzPIqA.exe
5036	rhDYGuW.exe
2212	wGymNer.exe
4888	ttRxALo.exe
4076	JCdFTUu.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2720-0-0x00007FF626550000-0x00007FF6268A4000-memory.dmp	upx
behavioral2/files/0x0007000000023297-5.dat	upx
behavioral2/memory/3048-7-0x00007FF6BE790000-0x00007FF6BEAE4000-memory.dmp	upx
behavioral2/files/0x000800000002342f-11.dat	upx
behavioral2/memory/3480-14-0x00007FF639A90000-0x00007FF639DE4000-memory.dmp	upx
behavioral2/files/0x0007000000023433-18.dat	upx
behavioral2/files/0x0007000000023434-23.dat	upx
behavioral2/memory/1040-24-0x00007FF7FCCD0000-0x00007FF7FD024000-memory.dmp	upx
behavioral2/memory/2592-22-0x00007FF63CE30000-0x00007FF63D184000-memory.dmp	upx
behavioral2/files/0x0007000000023435-29.dat	upx
behavioral2/files/0x0008000000023430-33.dat	upx
behavioral2/files/0x0007000000023436-41.dat	upx
behavioral2/memory/1460-47-0x00007FF6946F0000-0x00007FF694A44000-memory.dmp	upx
behavioral2/files/0x0007000000023439-59.dat	upx
behavioral2/files/0x000700000002343a-63.dat	upx
behavioral2/files/0x000700000002343c-71.dat	upx
behavioral2/memory/5064-75-0x00007FF7345F0000-0x00007FF734944000-memory.dmp	upx
behavioral2/files/0x000700000002343f-93.dat	upx
behavioral2/files/0x0007000000023442-112.dat	upx
behavioral2/files/0x0007000000023444-118.dat	upx
behavioral2/files/0x0007000000023443-115.dat	upx
behavioral2/files/0x0007000000023441-109.dat	upx
behavioral2/files/0x0007000000023440-101.dat	upx
behavioral2/files/0x000700000002343e-91.dat	upx
behavioral2/files/0x000700000002343d-87.dat	upx
behavioral2/memory/4048-80-0x00007FF701910000-0x00007FF701C64000-memory.dmp	upx
behavioral2/memory/1696-79-0x00007FF722340000-0x00007FF722694000-memory.dmp	upx
behavioral2/memory/5108-78-0x00007FF651A90000-0x00007FF651DE4000-memory.dmp	upx
behavioral2/files/0x000700000002343b-73.dat	upx
behavioral2/memory/4468-72-0x00007FF69F380000-0x00007FF69F6D4000-memory.dmp	upx
behavioral2/files/0x0007000000023438-54.dat	upx
behavioral2/files/0x0007000000023437-50.dat	upx
behavioral2/memory/828-48-0x00007FF725E90000-0x00007FF7261E4000-memory.dmp	upx
behavioral2/memory/3052-43-0x00007FF6E3380000-0x00007FF6E36D4000-memory.dmp	upx
behavioral2/memory/3268-31-0x00007FF610040000-0x00007FF610394000-memory.dmp	upx
behavioral2/memory/4748-120-0x00007FF6A4F50000-0x00007FF6A52A4000-memory.dmp	upx
behavioral2/memory/3472-122-0x00007FF7E5760000-0x00007FF7E5AB4000-memory.dmp	upx
behavioral2/memory/4928-121-0x00007FF6C3350000-0x00007FF6C36A4000-memory.dmp	upx
behavioral2/memory/5036-124-0x00007FF669EE0000-0x00007FF66A234000-memory.dmp	upx
behavioral2/memory/2212-125-0x00007FF6FC660000-0x00007FF6FC9B4000-memory.dmp	upx
behavioral2/memory/3544-123-0x00007FF622900000-0x00007FF622C54000-memory.dmp	upx
behavioral2/memory/4888-126-0x00007FF7A3EE0000-0x00007FF7A4234000-memory.dmp	upx
behavioral2/memory/4076-127-0x00007FF73A0D0000-0x00007FF73A424000-memory.dmp	upx
behavioral2/memory/2720-128-0x00007FF626550000-0x00007FF6268A4000-memory.dmp	upx
behavioral2/memory/3048-129-0x00007FF6BE790000-0x00007FF6BEAE4000-memory.dmp	upx
behavioral2/memory/3480-130-0x00007FF639A90000-0x00007FF639DE4000-memory.dmp	upx
behavioral2/memory/1040-131-0x00007FF7FCCD0000-0x00007FF7FD024000-memory.dmp	upx
behavioral2/memory/3268-132-0x00007FF610040000-0x00007FF610394000-memory.dmp	upx
behavioral2/memory/828-133-0x00007FF725E90000-0x00007FF7261E4000-memory.dmp	upx
behavioral2/memory/3048-134-0x00007FF6BE790000-0x00007FF6BEAE4000-memory.dmp	upx
behavioral2/memory/3480-135-0x00007FF639A90000-0x00007FF639DE4000-memory.dmp	upx
behavioral2/memory/2592-136-0x00007FF63CE30000-0x00007FF63D184000-memory.dmp	upx
behavioral2/memory/1040-137-0x00007FF7FCCD0000-0x00007FF7FD024000-memory.dmp	upx
behavioral2/memory/3052-138-0x00007FF6E3380000-0x00007FF6E36D4000-memory.dmp	upx
behavioral2/memory/3268-139-0x00007FF610040000-0x00007FF610394000-memory.dmp	upx
behavioral2/memory/1460-140-0x00007FF6946F0000-0x00007FF694A44000-memory.dmp	upx
behavioral2/memory/828-141-0x00007FF725E90000-0x00007FF7261E4000-memory.dmp	upx
behavioral2/memory/4468-142-0x00007FF69F380000-0x00007FF69F6D4000-memory.dmp	upx
behavioral2/memory/5064-143-0x00007FF7345F0000-0x00007FF734944000-memory.dmp	upx
behavioral2/memory/5108-144-0x00007FF651A90000-0x00007FF651DE4000-memory.dmp	upx
behavioral2/memory/1696-145-0x00007FF722340000-0x00007FF722694000-memory.dmp	upx
behavioral2/memory/4048-146-0x00007FF701910000-0x00007FF701C64000-memory.dmp	upx
behavioral2/memory/4748-147-0x00007FF6A4F50000-0x00007FF6A52A4000-memory.dmp	upx
behavioral2/memory/4928-148-0x00007FF6C3350000-0x00007FF6C36A4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\PeRMTfR.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ttRxALo.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YQMiycg.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gRqaLDl.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\falZAkK.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IeSKwia.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nQzPIqA.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uKlQOeS.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bsUXYey.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JCdFTUu.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hQGCgWK.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ELEumah.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RJdUaAr.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bBbeTMe.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aMGpopW.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wGymNer.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MxMnMkd.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZrXDeda.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OBMGifP.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tklzRsk.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rhDYGuW.exe	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 3048	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	82
PID 2720 wrote to memory of 3048	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	82
PID 2720 wrote to memory of 3480	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	83
PID 2720 wrote to memory of 3480	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	83
PID 2720 wrote to memory of 2592	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	84
PID 2720 wrote to memory of 2592	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	84
PID 2720 wrote to memory of 1040	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	85
PID 2720 wrote to memory of 1040	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	85
PID 2720 wrote to memory of 3268	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	86
PID 2720 wrote to memory of 3268	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	86
PID 2720 wrote to memory of 3052	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	91
PID 2720 wrote to memory of 3052	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	91
PID 2720 wrote to memory of 1460	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	92
PID 2720 wrote to memory of 1460	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	92
PID 2720 wrote to memory of 828	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	93
PID 2720 wrote to memory of 828	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	93
PID 2720 wrote to memory of 4468	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	94
PID 2720 wrote to memory of 4468	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	94
PID 2720 wrote to memory of 5064	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	95
PID 2720 wrote to memory of 5064	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	95
PID 2720 wrote to memory of 5108	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	96
PID 2720 wrote to memory of 5108	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	96
PID 2720 wrote to memory of 1696	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	97
PID 2720 wrote to memory of 1696	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	97
PID 2720 wrote to memory of 4048	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	98
PID 2720 wrote to memory of 4048	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	98
PID 2720 wrote to memory of 4748	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	99
PID 2720 wrote to memory of 4748	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	99
PID 2720 wrote to memory of 4928	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	100
PID 2720 wrote to memory of 4928	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	100
PID 2720 wrote to memory of 3472	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	101
PID 2720 wrote to memory of 3472	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	101
PID 2720 wrote to memory of 3544	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	102
PID 2720 wrote to memory of 3544	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	102
PID 2720 wrote to memory of 5036	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	103
PID 2720 wrote to memory of 5036	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	103
PID 2720 wrote to memory of 2212	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	104
PID 2720 wrote to memory of 2212	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	104
PID 2720 wrote to memory of 4888	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	105
PID 2720 wrote to memory of 4888	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	105
PID 2720 wrote to memory of 4076	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	106
PID 2720 wrote to memory of 4076	2720	2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe	106

C:\Users\Admin\AppData\Local\Temp\2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_2f3f05a922703504474d9c9623bf74b7_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\System\MxMnMkd.exe
  C:\Windows\System\MxMnMkd.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\hQGCgWK.exe
  C:\Windows\System\hQGCgWK.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\ELEumah.exe
  C:\Windows\System\ELEumah.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\RJdUaAr.exe
  C:\Windows\System\RJdUaAr.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\PeRMTfR.exe
  C:\Windows\System\PeRMTfR.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\ZrXDeda.exe
  C:\Windows\System\ZrXDeda.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\OBMGifP.exe
  C:\Windows\System\OBMGifP.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\bBbeTMe.exe
  C:\Windows\System\bBbeTMe.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\YQMiycg.exe
  C:\Windows\System\YQMiycg.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\gRqaLDl.exe
  C:\Windows\System\gRqaLDl.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\aMGpopW.exe
  C:\Windows\System\aMGpopW.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\falZAkK.exe
  C:\Windows\System\falZAkK.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\uKlQOeS.exe
  C:\Windows\System\uKlQOeS.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\tklzRsk.exe
  C:\Windows\System\tklzRsk.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\bsUXYey.exe
  C:\Windows\System\bsUXYey.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\IeSKwia.exe
  C:\Windows\System\IeSKwia.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\nQzPIqA.exe
  C:\Windows\System\nQzPIqA.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\rhDYGuW.exe
  C:\Windows\System\rhDYGuW.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\wGymNer.exe
  C:\Windows\System\wGymNer.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\ttRxALo.exe
  C:\Windows\System\ttRxALo.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\JCdFTUu.exe
  C:\Windows\System\JCdFTUu.exe
  2⤵
  - Executes dropped EXE
  PID:4076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ELEumah.exe

Path C:\Windows\System\ELEumah.exe
Size 6.0MB
SHA256 4c243f98c7bd75808ad3710f7720a8971ff0e9e4508f64eb7cef1982cd5584bd
MD5 44f76c6f86cfb0ac855a2733fa098a7f
SHA1 33c17a2a791582272bbd673333ff05636173c1bf
SHA512 1bec2fd0b763e93a5cf1cd266dc62a9b67a7fcd0110fa1d7d80c5ac35434e33ab777d2947f8185e3612c6dd65d6f77292c37e5f1abc33d5d38f2a64670422f68
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:T+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

IeSKwia.exe

Path C:\Windows\System\IeSKwia.exe
Size 6.0MB
SHA256 8c44c8390ab1a905e593c841ebe1278ff71a2f3e5c678b5efde9980f281cac17
MD5 59695fcda41cccec8f234442fd88aa4d
SHA1 03b280e55dca39ad3fe90a0ac78572846c1ba951
SHA512 0af1dfc8021f96ae57544bab333c07c095126cf3c076950c079634cdd39f023597646fc8b95d49e2d815f1062a804deb5276cf6fd3e7a0dc901f3e0a2ad8ca06
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:T+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

JCdFTUu.exe

Path C:\Windows\System\JCdFTUu.exe
Size 6.0MB
SHA256 efe3114007136142ad9fea90fa796392001a9eb7c058d785a4ac912919fa11d5
MD5 bace3866ec155abed5077ad4f79c5002
SHA1 119da7dae18e6858d6ae38bc252eb5520434cc02
SHA512 380aca86370fbb01820cd682bc1f4c45c2f281799a780ef24e37bffea917a7be56224402d4b04705b66f80d785e445fc81248fc76168e1311a20e1ece553adc8
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:T+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

MxMnMkd.exe

Path C:\Windows\System\MxMnMkd.exe
Size 6.0MB
SHA256 aeb6886cde43946b4252e0d03b106f2b07e8505a7e919e9951c0d90df91af95b
MD5 e51c1f7602cd4f8138284d8ce27ece40
SHA1 f3a8c50eefa634e5dfdaa39a5cfd985f4ae02e77
SHA512 b56bfc97bc923401b1f35731c3819f9930a3a99a4b3638bd2f58e72fa63220cdebeb9e12b8a33cc854346e88e6034485811009a4d52e0b0f4c68e4b0c8c7803e
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:T+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

OBMGifP.exe

Path C:\Windows\System\OBMGifP.exe
Size 6.0MB
SHA256 c2b40434192ab38b8c17afbb4b7d7e8c55035c2a2ce0bb7bd7ed56f8de54a588
MD5 97bed9808781c87c0126f7f556fbfc22
SHA1 bb7ec2d86e70a67877a3df434b9bf72215fb45c3
SHA512 c651d964264e148f141b21d661c7dc75689874e786e493faabca41ffbc00b9441db5bfce53b3def323e70f8a7284d67b456caa29a7eb54f457d7c8ebf40dce46
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:T+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

PeRMTfR.exe

Path C:\Windows\System\PeRMTfR.exe
Size 6.0MB
SHA256 454b8322ef07e14e57f6311795117d1e685baac76a42156b169285a3904e38a6
MD5 e9e53ae8877635d8e1041ed7a3e1d334
SHA1 6c8ffd7f2f6c492efe19893206be4f530301d2c1
SHA512 a94ba96b24e777f5e19b8accdf4abc31d89f927b38eac4f6e639bd2369f5d3cf0550e10f8a65fc20a7eb20110cd09f7c10e846c3da108b2dda8244e4a45c43ba
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:T+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

RJdUaAr.exe

Path C:\Windows\System\RJdUaAr.exe
Size 6.0MB
SHA256 711e439f966860ca56163ed84ea50a76a834ed90ab4e5bb5fa2fa8b33bf43c83
MD5 193d1819287cb2df8f86b5a88b3ac258
SHA1 226508f0af65a7ea9b652d5dfed9ee6a8351631d
SHA512 38d37ed5b2a69354b8393aaea76689841b8ee39725f1450ede873ff7b0e544dce3fb628518780f89e0365b2dd2a8884ffdee2c4b88e62d59b5c8f4b67822f35a
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:T+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

YQMiycg.exe

Path C:\Windows\System\YQMiycg.exe
Size 6.0MB
SHA256 c78d90b54143077e5554ab01248f4747eb1f8c09a1b0dcf7f264e1b774d39062
MD5 102c970e52e5e276b235cb8f31c07987
SHA1 b1911d932c3afb90e8b40f7234b33fbf445eeae2
SHA512 c3ed0bff7040f60b98d3a679e8e1539de71569ce5bbe54e5139f041a2a1d4f21a5f70a70b21b64c61cc070617f313f0034c599cd90c7bca800ac6033b69f4418
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:T+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZrXDeda.exe

Path C:\Windows\System\ZrXDeda.exe
Size 6.0MB
SHA256 b2220ab0db2ca5c8f0a2beab049aeff2b15f8385dce51a111bc9f3d0fff03910
MD5 47a43b001f305ec13f90627fa0ae0f90
SHA1 f7373e3e2c3b7fa488eca9893b5baf840416f951
SHA512 06183ce0dcb183ea22905d845b4efc23a70605f121c97701cc92e0252144b89513fd95d06c08112c5291b43c76cc688ce5bc97b31d4e609e731b593ee371d977
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:T+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

aMGpopW.exe

Path C:\Windows\System\aMGpopW.exe
Size 6.0MB
SHA256 3395bb15aacccbb9e08b5350dba9ebc34f2dd113c782c5d6d9c126126e7ee0dc
MD5 36800d103bd490197653af58a1f1df6c
SHA1 bbd280f54b7bb5595344c16dd626b20395fd2c7c
SHA512 d8d04717d87e92417c5a7fd6b449c62d26f93086b2ce85713342f9b657ee009ce7fc8e3b1a2c6fe9c5c59e7a6bdcda9a58e3194eac3d6597e76bcec9332454c2
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:T+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

bBbeTMe.exe

Path C:\Windows\System\bBbeTMe.exe
Size 6.0MB
SHA256 f37be5d4ae9d8275e0b902d16f0c581e55208b9ed2af070d6766c9547ff09389
MD5 490af6a6583b8f863b5f60abeba39f7f
SHA1 58222ae5563945f3ea795b9564b7a1ad6a9e686c
SHA512 9dc24aca0fdc70eb4b8108b7fa9b8c3f8da5f2c7d659e8e32f0a72327a798bd915bbf71b5fe8f6ef4371ddeb08e4d3b015e073d3b5990860a9ecc656d8e40606
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:T+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

bsUXYey.exe

Path C:\Windows\System\bsUXYey.exe
Size 6.0MB
SHA256 a0c9ace358166fb697724fd636fe640a2958f43b485c9366a10acf9b88dd62da
MD5 3677208bdf51189d7221e7ef48e33bbe
SHA1 4669a560c53de92e23256584fec6e32d9648c585
SHA512 b2abcdd4c752bc86e5c61be4a43d0be0487e99e22fd1261f40568ad0663b2197d225ac6aa2d116967cd3ee629808839ebf7c96cc1738cef421cbe1fb0dc3ac79
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:T+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

falZAkK.exe

Path C:\Windows\System\falZAkK.exe
Size 6.0MB
SHA256 ead5aa7d4d7c9cfbb8ba672a37924328d8a22ee2bd024f6ee3c026b1c059304e
MD5 8f4ad9c64522a94bd4d7637657ddf53b
SHA1 4af1e5f5ccdc2a9a692aecddf5b3575f21460973
SHA512 5e412c3cb54898dd7772151865bfe08cc805930383d4decef76a5a9df1f02747537ec1c389d0203bdda89fcebfc6e4536aaea3ecb6f7c9f5e9dfb4af4c839b56
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:T+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

gRqaLDl.exe

Path C:\Windows\System\gRqaLDl.exe
Size 6.0MB
SHA256 c87c91b23f9f28d7fc0e28353ba5605cdd35b1976422d1de791a9e02690caa81
MD5 6cbe5398ca6e8fe48150c86f72969d4a
SHA1 6fa99b3085cee8b86ec42ad57002a7a82b9656bc
SHA512 8a71deb44f4e0e52b1b6766405adcfc2c0f7db61c4bde24177cb48b510d6b7aa25a90ac752113346ecf7ce8ead004a9706283b789070b955424519607093e3db
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:T+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

hQGCgWK.exe

Path C:\Windows\System\hQGCgWK.exe
Size 6.0MB
SHA256 62e823eba6c803242bb21082b0d298bc7bbbb24a524400bbed5ae5215062facc
MD5 80cc0586d42dee5c150d84d6be9e2e15
SHA1 bb193abf320449000ff0c8aacbb85db4586c707f
SHA512 8ce490ebdb0faf9b3a7705d9aee7b8a0be3a79be332b1375c4493cb99faa0a26a7d42d0ba7782cae396adcaad739b5be4cabec15ec82d4db9fd0f9522962d4f6
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:T+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

nQzPIqA.exe

Path C:\Windows\System\nQzPIqA.exe
Size 6.0MB
SHA256 511b03e6690c210e17ea258d6921ae78bed4f0b798159e853b902fd85cee62c7
MD5 67cfd0eab4f669aaad85a64fbb970c51
SHA1 7f460392fd2477957426ebef714cede4c1116a7d
SHA512 c6e7e0335615b8d169092535453906233343a3d0660aab8f5b91afeef4e93d113262c25bffb7f179fb881d1a450ea11dbc36b81a82d699b4d96c34d1ead3f35a
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:T+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

rhDYGuW.exe

Path C:\Windows\System\rhDYGuW.exe
Size 6.0MB
SHA256 b5501cad731980f1be60211697df43e1d6a671b731afae1c12dbdbd59f44cc74
MD5 8b931546ea21a11db1291b5b91c1a714
SHA1 e5d3147cdf711971ebfeb370f0f8898f1a43d73b
SHA512 db2b97a71c2b454f3deef7c0bdb2c04586199e1874b961ac1e1ca20c63fca0fde5d96f22f3ada2e36be8738e8e98acb95b69456011ca4d23683951b9b222c64c
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:T+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

tklzRsk.exe

Path C:\Windows\System\tklzRsk.exe
Size 6.0MB
SHA256 b6a51b5afd495e14c133677728a7da5a27b7c583ded8963ce1354b2ce6b3237e
MD5 77dea11faade6994d388a245215969f8
SHA1 2eda401266b705589f1763c42f1b5c71469b25c4
SHA512 921770e760f4ebea6a1f5f166c1f0d99abf39e042607ec47fa3a63d3b2121f62a0414d3de384299b0b449b1efb0232ed68ee1e13d0d602e0523c9a562c05c933
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:T+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

ttRxALo.exe

Path C:\Windows\System\ttRxALo.exe
Size 6.0MB
SHA256 3d5acf340648e67c7d8997ff93d0c5171d746142798bf6eefbe104a784fba43f
MD5 26643ff96735857bdbb799790102fc6a
SHA1 b0bb85c37d5a3be50393045eacbd5bea5ff5054d
SHA512 e18682ff7e2c8bb30fd46decf3048eee0197a4d93f5b14793d8846b6823c5c2e58df90a652ce1954836fb81a9ad7a70b5beff9f74e3311bf39a84df53d4eb49c
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:T+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

uKlQOeS.exe

Path C:\Windows\System\uKlQOeS.exe
Size 6.0MB
SHA256 95941287055834986072ec863898b0e17797cf9f81e413b431b784f4d97c360e
MD5 f00b056b1c8005a5698468c907b86da1
SHA1 23715e4f8d351356a3607d5bf890854a45fa77f3
SHA512 910cd2f9ddeb1d9e5896804c3ba1720a59c534ff28f75fd2c072b706a5f89e6b1e1cbcf41cc719a4651cc29c872e9fcb66ecaef883b1a69871732d9731fa832f
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:T+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

wGymNer.exe

Path C:\Windows\System\wGymNer.exe
Size 6.0MB
SHA256 a09c1980237d93c46e2292f0cd67569eb08cd085c0a7d324a2dd52f397e5faa5
MD5 c9765e2899d0ab19a5faeec7f1d2fe6f
SHA1 2833bb547d13846152f780b2a29b71aeeb43a348
SHA512 2ae66b9096b8b2b6e6f8379cb099bc9f49c83e02bb678f377f84d9fe40dfa119479d95495c7e70560bf794304e383c882198c4c06e1cdc23cb4127d686e00e75
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:T+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/828-48-0x00007FF725E90000-0x00007FF7261E4000-memory.dmp

Download

memory/828-141-0x00007FF725E90000-0x00007FF7261E4000-memory.dmp

Download

memory/828-133-0x00007FF725E90000-0x00007FF7261E4000-memory.dmp

Download

memory/1040-24-0x00007FF7FCCD0000-0x00007FF7FD024000-memory.dmp

Download

memory/1040-131-0x00007FF7FCCD0000-0x00007FF7FD024000-memory.dmp

Download

memory/1040-137-0x00007FF7FCCD0000-0x00007FF7FD024000-memory.dmp

Download

memory/1460-47-0x00007FF6946F0000-0x00007FF694A44000-memory.dmp

Download

memory/1460-140-0x00007FF6946F0000-0x00007FF694A44000-memory.dmp

Download

memory/1696-79-0x00007FF722340000-0x00007FF722694000-memory.dmp

Download

memory/1696-145-0x00007FF722340000-0x00007FF722694000-memory.dmp

Download

memory/2212-125-0x00007FF6FC660000-0x00007FF6FC9B4000-memory.dmp

Download

memory/2212-152-0x00007FF6FC660000-0x00007FF6FC9B4000-memory.dmp

Download

memory/2592-136-0x00007FF63CE30000-0x00007FF63D184000-memory.dmp

Download

memory/2592-22-0x00007FF63CE30000-0x00007FF63D184000-memory.dmp

Download

memory/2720-0-0x00007FF626550000-0x00007FF6268A4000-memory.dmp

Download

memory/2720-1-0x000001EADF530000-0x000001EADF540000-memory.dmp

Download

memory/2720-128-0x00007FF626550000-0x00007FF6268A4000-memory.dmp

Download

memory/3048-134-0x00007FF6BE790000-0x00007FF6BEAE4000-memory.dmp

Download

memory/3048-129-0x00007FF6BE790000-0x00007FF6BEAE4000-memory.dmp

Download

memory/3048-7-0x00007FF6BE790000-0x00007FF6BEAE4000-memory.dmp

Download

memory/3052-138-0x00007FF6E3380000-0x00007FF6E36D4000-memory.dmp

Download

memory/3052-43-0x00007FF6E3380000-0x00007FF6E36D4000-memory.dmp

Download

memory/3268-31-0x00007FF610040000-0x00007FF610394000-memory.dmp

Download

memory/3268-139-0x00007FF610040000-0x00007FF610394000-memory.dmp

Download

memory/3268-132-0x00007FF610040000-0x00007FF610394000-memory.dmp

Download

memory/3472-122-0x00007FF7E5760000-0x00007FF7E5AB4000-memory.dmp

Download

memory/3472-149-0x00007FF7E5760000-0x00007FF7E5AB4000-memory.dmp

Download

memory/3480-135-0x00007FF639A90000-0x00007FF639DE4000-memory.dmp

Download

memory/3480-130-0x00007FF639A90000-0x00007FF639DE4000-memory.dmp

Download

memory/3480-14-0x00007FF639A90000-0x00007FF639DE4000-memory.dmp

Download

memory/3544-150-0x00007FF622900000-0x00007FF622C54000-memory.dmp

Download

memory/3544-123-0x00007FF622900000-0x00007FF622C54000-memory.dmp

Download

memory/4048-80-0x00007FF701910000-0x00007FF701C64000-memory.dmp

Download

memory/4048-146-0x00007FF701910000-0x00007FF701C64000-memory.dmp

Download

memory/4076-153-0x00007FF73A0D0000-0x00007FF73A424000-memory.dmp

Download

memory/4076-127-0x00007FF73A0D0000-0x00007FF73A424000-memory.dmp

Download

memory/4468-72-0x00007FF69F380000-0x00007FF69F6D4000-memory.dmp

Download

memory/4468-142-0x00007FF69F380000-0x00007FF69F6D4000-memory.dmp

Download

memory/4748-120-0x00007FF6A4F50000-0x00007FF6A52A4000-memory.dmp

Download

memory/4748-147-0x00007FF6A4F50000-0x00007FF6A52A4000-memory.dmp

Download

memory/4888-126-0x00007FF7A3EE0000-0x00007FF7A4234000-memory.dmp

Download

memory/4888-154-0x00007FF7A3EE0000-0x00007FF7A4234000-memory.dmp

Download

memory/4928-148-0x00007FF6C3350000-0x00007FF6C36A4000-memory.dmp

Download

memory/4928-121-0x00007FF6C3350000-0x00007FF6C36A4000-memory.dmp

Download

memory/5036-124-0x00007FF669EE0000-0x00007FF66A234000-memory.dmp

Download

memory/5036-151-0x00007FF669EE0000-0x00007FF66A234000-memory.dmp

Download

memory/5064-143-0x00007FF7345F0000-0x00007FF734944000-memory.dmp

Download

memory/5064-75-0x00007FF7345F0000-0x00007FF734944000-memory.dmp

Download

memory/5108-144-0x00007FF651A90000-0x00007FF651DE4000-memory.dmp

Download

memory/5108-78-0x00007FF651A90000-0x00007FF651DE4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads