cobaltstrike | 3c03c8d5dd4d8ee05f058b795c25c706444eac15fb4e2e444580fe3abe3d544a

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
Size 6.0MB
Sample240601-b58l1aeb95
SHA256 3c03c8d5dd4d8ee05f058b795c25c706444eac15fb4e2e444580fe3abe3d544a
MD5 3e77bd42bd11dc83991453c84c2f5087
SHA1 92e8db6ca462cab363cf7f911f5b108f47019320
SHA512 ad4b473d129e2bc3ca08b387a0aae8090d5e69de47862743701646b26f65e58685f39e9967b2a44a58d4e616668b6f0cb5de65d9f7bbd4becaa56c80fb4076a0
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:T+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023488-7.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002348d-10.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002348e-24.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002348f-30.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023491-43.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023490-39.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023492-46.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023405-54.dat	cobalt_reflective_dll
behavioral2/files/0x0004000000022a49-64.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023404-71.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023489-80.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023495-106.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023497-114.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023499-121.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002349a-125.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023498-117.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023496-110.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023494-91.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023493-89.dat	cobalt_reflective_dll
behavioral2/files/0x000b000000023406-59.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002348c-12.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023488-7.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002348d-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002348e-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002348f-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023491-43.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023490-39.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023492-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a000000023405-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0004000000022a49-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a000000023404-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023489-80.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023495-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023497-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023499-121.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002349a-125.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023498-117.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023496-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023494-91.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023493-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b000000023406-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002348c-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4992-0-0x00007FF704450000-0x00007FF7047A4000-memory.dmp	UPX
behavioral2/files/0x0008000000023488-7.dat	UPX
behavioral2/memory/5044-6-0x00007FF7F87E0000-0x00007FF7F8B34000-memory.dmp	UPX
behavioral2/files/0x000700000002348d-10.dat	UPX
behavioral2/memory/2872-19-0x00007FF6FD8C0000-0x00007FF6FDC14000-memory.dmp	UPX
behavioral2/files/0x000700000002348e-24.dat	UPX
behavioral2/files/0x000700000002348f-30.dat	UPX
behavioral2/files/0x0007000000023491-43.dat	UPX
behavioral2/memory/1368-42-0x00007FF73EEF0000-0x00007FF73F244000-memory.dmp	UPX
behavioral2/memory/2824-40-0x00007FF7ACFA0000-0x00007FF7AD2F4000-memory.dmp	UPX
behavioral2/files/0x0007000000023490-39.dat	UPX
behavioral2/memory/2228-34-0x00007FF6D0AB0000-0x00007FF6D0E04000-memory.dmp	UPX
behavioral2/memory/928-26-0x00007FF75C920000-0x00007FF75CC74000-memory.dmp	UPX
behavioral2/memory/1236-14-0x00007FF77D980000-0x00007FF77DCD4000-memory.dmp	UPX
behavioral2/files/0x0007000000023492-46.dat	UPX
behavioral2/files/0x000a000000023405-54.dat	UPX
behavioral2/memory/988-51-0x00007FF60A820000-0x00007FF60AB74000-memory.dmp	UPX
behavioral2/files/0x0004000000022a49-64.dat	UPX
behavioral2/files/0x000a000000023404-71.dat	UPX
behavioral2/memory/768-74-0x00007FF7348E0000-0x00007FF734C34000-memory.dmp	UPX
behavioral2/files/0x0008000000023489-80.dat	UPX
behavioral2/memory/2872-95-0x00007FF6FD8C0000-0x00007FF6FDC14000-memory.dmp	UPX
behavioral2/memory/1732-98-0x00007FF6739A0000-0x00007FF673CF4000-memory.dmp	UPX
behavioral2/memory/1508-99-0x00007FF62F9A0000-0x00007FF62FCF4000-memory.dmp	UPX
behavioral2/files/0x0007000000023495-106.dat	UPX
behavioral2/files/0x0007000000023497-114.dat	UPX
behavioral2/files/0x0007000000023499-121.dat	UPX
behavioral2/files/0x000700000002349a-125.dat	UPX
behavioral2/files/0x0007000000023498-117.dat	UPX
behavioral2/files/0x0007000000023496-110.dat	UPX
behavioral2/memory/4492-102-0x00007FF747F30000-0x00007FF748284000-memory.dmp	UPX
behavioral2/memory/3056-96-0x00007FF7F0A50000-0x00007FF7F0DA4000-memory.dmp	UPX
behavioral2/files/0x0007000000023494-91.dat	UPX
behavioral2/files/0x0007000000023493-89.dat	UPX
behavioral2/memory/1236-77-0x00007FF77D980000-0x00007FF77DCD4000-memory.dmp	UPX
behavioral2/memory/5044-73-0x00007FF7F87E0000-0x00007FF7F8B34000-memory.dmp	UPX
behavioral2/memory/3240-72-0x00007FF77FF50000-0x00007FF7802A4000-memory.dmp	UPX
behavioral2/memory/5084-66-0x00007FF72E520000-0x00007FF72E874000-memory.dmp	UPX
behavioral2/memory/4992-65-0x00007FF704450000-0x00007FF7047A4000-memory.dmp	UPX
behavioral2/memory/4964-61-0x00007FF743040000-0x00007FF743394000-memory.dmp	UPX
behavioral2/files/0x000b000000023406-59.dat	UPX
behavioral2/files/0x000700000002348c-12.dat	UPX
behavioral2/memory/928-127-0x00007FF75C920000-0x00007FF75CC74000-memory.dmp	UPX
behavioral2/memory/1556-129-0x00007FF77F500000-0x00007FF77F854000-memory.dmp	UPX
behavioral2/memory/2568-132-0x00007FF745A50000-0x00007FF745DA4000-memory.dmp	UPX
behavioral2/memory/3324-131-0x00007FF6BFB70000-0x00007FF6BFEC4000-memory.dmp	UPX
behavioral2/memory/4880-130-0x00007FF739BD0000-0x00007FF739F24000-memory.dmp	UPX
behavioral2/memory/4616-128-0x00007FF73C270000-0x00007FF73C5C4000-memory.dmp	UPX
behavioral2/memory/2824-133-0x00007FF7ACFA0000-0x00007FF7AD2F4000-memory.dmp	UPX
behavioral2/memory/1368-134-0x00007FF73EEF0000-0x00007FF73F244000-memory.dmp	UPX
behavioral2/memory/3240-135-0x00007FF77FF50000-0x00007FF7802A4000-memory.dmp	UPX
behavioral2/memory/768-136-0x00007FF7348E0000-0x00007FF734C34000-memory.dmp	UPX
behavioral2/memory/4492-137-0x00007FF747F30000-0x00007FF748284000-memory.dmp	UPX
behavioral2/memory/5044-138-0x00007FF7F87E0000-0x00007FF7F8B34000-memory.dmp	UPX
behavioral2/memory/1236-139-0x00007FF77D980000-0x00007FF77DCD4000-memory.dmp	UPX
behavioral2/memory/2872-140-0x00007FF6FD8C0000-0x00007FF6FDC14000-memory.dmp	UPX
behavioral2/memory/928-141-0x00007FF75C920000-0x00007FF75CC74000-memory.dmp	UPX
behavioral2/memory/2228-142-0x00007FF6D0AB0000-0x00007FF6D0E04000-memory.dmp	UPX
behavioral2/memory/1368-144-0x00007FF73EEF0000-0x00007FF73F244000-memory.dmp	UPX
behavioral2/memory/2824-143-0x00007FF7ACFA0000-0x00007FF7AD2F4000-memory.dmp	UPX
behavioral2/memory/988-145-0x00007FF60A820000-0x00007FF60AB74000-memory.dmp	UPX
behavioral2/memory/4964-146-0x00007FF743040000-0x00007FF743394000-memory.dmp	UPX
behavioral2/memory/5084-147-0x00007FF72E520000-0x00007FF72E874000-memory.dmp	UPX
behavioral2/memory/3240-148-0x00007FF77FF50000-0x00007FF7802A4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4992-0-0x00007FF704450000-0x00007FF7047A4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023488-7.dat	xmrig
behavioral2/memory/5044-6-0x00007FF7F87E0000-0x00007FF7F8B34000-memory.dmp	xmrig
behavioral2/files/0x000700000002348d-10.dat	xmrig
behavioral2/memory/2872-19-0x00007FF6FD8C0000-0x00007FF6FDC14000-memory.dmp	xmrig
behavioral2/files/0x000700000002348e-24.dat	xmrig
behavioral2/files/0x000700000002348f-30.dat	xmrig
behavioral2/files/0x0007000000023491-43.dat	xmrig
behavioral2/memory/1368-42-0x00007FF73EEF0000-0x00007FF73F244000-memory.dmp	xmrig
behavioral2/memory/2824-40-0x00007FF7ACFA0000-0x00007FF7AD2F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023490-39.dat	xmrig
behavioral2/memory/2228-34-0x00007FF6D0AB0000-0x00007FF6D0E04000-memory.dmp	xmrig
behavioral2/memory/928-26-0x00007FF75C920000-0x00007FF75CC74000-memory.dmp	xmrig
behavioral2/memory/1236-14-0x00007FF77D980000-0x00007FF77DCD4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023492-46.dat	xmrig
behavioral2/files/0x000a000000023405-54.dat	xmrig
behavioral2/memory/988-51-0x00007FF60A820000-0x00007FF60AB74000-memory.dmp	xmrig
behavioral2/files/0x0004000000022a49-64.dat	xmrig
behavioral2/files/0x000a000000023404-71.dat	xmrig
behavioral2/memory/768-74-0x00007FF7348E0000-0x00007FF734C34000-memory.dmp	xmrig
behavioral2/files/0x0008000000023489-80.dat	xmrig
behavioral2/memory/2872-95-0x00007FF6FD8C0000-0x00007FF6FDC14000-memory.dmp	xmrig
behavioral2/memory/1732-98-0x00007FF6739A0000-0x00007FF673CF4000-memory.dmp	xmrig
behavioral2/memory/1508-99-0x00007FF62F9A0000-0x00007FF62FCF4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023495-106.dat	xmrig
behavioral2/files/0x0007000000023497-114.dat	xmrig
behavioral2/files/0x0007000000023499-121.dat	xmrig
behavioral2/files/0x000700000002349a-125.dat	xmrig
behavioral2/files/0x0007000000023498-117.dat	xmrig
behavioral2/files/0x0007000000023496-110.dat	xmrig
behavioral2/memory/4492-102-0x00007FF747F30000-0x00007FF748284000-memory.dmp	xmrig
behavioral2/memory/3056-96-0x00007FF7F0A50000-0x00007FF7F0DA4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023494-91.dat	xmrig
behavioral2/files/0x0007000000023493-89.dat	xmrig
behavioral2/memory/1236-77-0x00007FF77D980000-0x00007FF77DCD4000-memory.dmp	xmrig
behavioral2/memory/5044-73-0x00007FF7F87E0000-0x00007FF7F8B34000-memory.dmp	xmrig
behavioral2/memory/3240-72-0x00007FF77FF50000-0x00007FF7802A4000-memory.dmp	xmrig
behavioral2/memory/5084-66-0x00007FF72E520000-0x00007FF72E874000-memory.dmp	xmrig
behavioral2/memory/4992-65-0x00007FF704450000-0x00007FF7047A4000-memory.dmp	xmrig
behavioral2/memory/4964-61-0x00007FF743040000-0x00007FF743394000-memory.dmp	xmrig
behavioral2/files/0x000b000000023406-59.dat	xmrig
behavioral2/files/0x000700000002348c-12.dat	xmrig
behavioral2/memory/928-127-0x00007FF75C920000-0x00007FF75CC74000-memory.dmp	xmrig
behavioral2/memory/1556-129-0x00007FF77F500000-0x00007FF77F854000-memory.dmp	xmrig
behavioral2/memory/2568-132-0x00007FF745A50000-0x00007FF745DA4000-memory.dmp	xmrig
behavioral2/memory/3324-131-0x00007FF6BFB70000-0x00007FF6BFEC4000-memory.dmp	xmrig
behavioral2/memory/4880-130-0x00007FF739BD0000-0x00007FF739F24000-memory.dmp	xmrig
behavioral2/memory/4616-128-0x00007FF73C270000-0x00007FF73C5C4000-memory.dmp	xmrig
behavioral2/memory/2824-133-0x00007FF7ACFA0000-0x00007FF7AD2F4000-memory.dmp	xmrig
behavioral2/memory/1368-134-0x00007FF73EEF0000-0x00007FF73F244000-memory.dmp	xmrig
behavioral2/memory/3240-135-0x00007FF77FF50000-0x00007FF7802A4000-memory.dmp	xmrig
behavioral2/memory/768-136-0x00007FF7348E0000-0x00007FF734C34000-memory.dmp	xmrig
behavioral2/memory/4492-137-0x00007FF747F30000-0x00007FF748284000-memory.dmp	xmrig
behavioral2/memory/5044-138-0x00007FF7F87E0000-0x00007FF7F8B34000-memory.dmp	xmrig
behavioral2/memory/1236-139-0x00007FF77D980000-0x00007FF77DCD4000-memory.dmp	xmrig
behavioral2/memory/2872-140-0x00007FF6FD8C0000-0x00007FF6FDC14000-memory.dmp	xmrig
behavioral2/memory/928-141-0x00007FF75C920000-0x00007FF75CC74000-memory.dmp	xmrig
behavioral2/memory/2228-142-0x00007FF6D0AB0000-0x00007FF6D0E04000-memory.dmp	xmrig
behavioral2/memory/1368-144-0x00007FF73EEF0000-0x00007FF73F244000-memory.dmp	xmrig
behavioral2/memory/2824-143-0x00007FF7ACFA0000-0x00007FF7AD2F4000-memory.dmp	xmrig
behavioral2/memory/988-145-0x00007FF60A820000-0x00007FF60AB74000-memory.dmp	xmrig
behavioral2/memory/4964-146-0x00007FF743040000-0x00007FF743394000-memory.dmp	xmrig
behavioral2/memory/5084-147-0x00007FF72E520000-0x00007FF72E874000-memory.dmp	xmrig
behavioral2/memory/3240-148-0x00007FF77FF50000-0x00007FF7802A4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
5044	UwUdlBL.exe
1236	oUOnFiU.exe
2872	OzNXdlD.exe
928	PoDKeZH.exe
2228	yADZsVp.exe
2824	aZXQUHB.exe
1368	AwEBgDH.exe
988	BbzUVFV.exe
4964	PcYteHi.exe
5084	GJgAZUi.exe
3240	baosKaz.exe
768	nbNDogY.exe
3056	VfmTyJR.exe
1732	KdpiYGC.exe
1508	PbUuXKP.exe
4492	wOHyIYL.exe
4616	xKmvrWa.exe
1556	MYeVjDY.exe
4880	aTQrcNK.exe
3324	phUQgvv.exe
2568	bvndusq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4992-0-0x00007FF704450000-0x00007FF7047A4000-memory.dmp	upx
behavioral2/files/0x0008000000023488-7.dat	upx
behavioral2/memory/5044-6-0x00007FF7F87E0000-0x00007FF7F8B34000-memory.dmp	upx
behavioral2/files/0x000700000002348d-10.dat	upx
behavioral2/memory/2872-19-0x00007FF6FD8C0000-0x00007FF6FDC14000-memory.dmp	upx
behavioral2/files/0x000700000002348e-24.dat	upx
behavioral2/files/0x000700000002348f-30.dat	upx
behavioral2/files/0x0007000000023491-43.dat	upx
behavioral2/memory/1368-42-0x00007FF73EEF0000-0x00007FF73F244000-memory.dmp	upx
behavioral2/memory/2824-40-0x00007FF7ACFA0000-0x00007FF7AD2F4000-memory.dmp	upx
behavioral2/files/0x0007000000023490-39.dat	upx
behavioral2/memory/2228-34-0x00007FF6D0AB0000-0x00007FF6D0E04000-memory.dmp	upx
behavioral2/memory/928-26-0x00007FF75C920000-0x00007FF75CC74000-memory.dmp	upx
behavioral2/memory/1236-14-0x00007FF77D980000-0x00007FF77DCD4000-memory.dmp	upx
behavioral2/files/0x0007000000023492-46.dat	upx
behavioral2/files/0x000a000000023405-54.dat	upx
behavioral2/memory/988-51-0x00007FF60A820000-0x00007FF60AB74000-memory.dmp	upx
behavioral2/files/0x0004000000022a49-64.dat	upx
behavioral2/files/0x000a000000023404-71.dat	upx
behavioral2/memory/768-74-0x00007FF7348E0000-0x00007FF734C34000-memory.dmp	upx
behavioral2/files/0x0008000000023489-80.dat	upx
behavioral2/memory/2872-95-0x00007FF6FD8C0000-0x00007FF6FDC14000-memory.dmp	upx
behavioral2/memory/1732-98-0x00007FF6739A0000-0x00007FF673CF4000-memory.dmp	upx
behavioral2/memory/1508-99-0x00007FF62F9A0000-0x00007FF62FCF4000-memory.dmp	upx
behavioral2/files/0x0007000000023495-106.dat	upx
behavioral2/files/0x0007000000023497-114.dat	upx
behavioral2/files/0x0007000000023499-121.dat	upx
behavioral2/files/0x000700000002349a-125.dat	upx
behavioral2/files/0x0007000000023498-117.dat	upx
behavioral2/files/0x0007000000023496-110.dat	upx
behavioral2/memory/4492-102-0x00007FF747F30000-0x00007FF748284000-memory.dmp	upx
behavioral2/memory/3056-96-0x00007FF7F0A50000-0x00007FF7F0DA4000-memory.dmp	upx
behavioral2/files/0x0007000000023494-91.dat	upx
behavioral2/files/0x0007000000023493-89.dat	upx
behavioral2/memory/1236-77-0x00007FF77D980000-0x00007FF77DCD4000-memory.dmp	upx
behavioral2/memory/5044-73-0x00007FF7F87E0000-0x00007FF7F8B34000-memory.dmp	upx
behavioral2/memory/3240-72-0x00007FF77FF50000-0x00007FF7802A4000-memory.dmp	upx
behavioral2/memory/5084-66-0x00007FF72E520000-0x00007FF72E874000-memory.dmp	upx
behavioral2/memory/4992-65-0x00007FF704450000-0x00007FF7047A4000-memory.dmp	upx
behavioral2/memory/4964-61-0x00007FF743040000-0x00007FF743394000-memory.dmp	upx
behavioral2/files/0x000b000000023406-59.dat	upx
behavioral2/files/0x000700000002348c-12.dat	upx
behavioral2/memory/928-127-0x00007FF75C920000-0x00007FF75CC74000-memory.dmp	upx
behavioral2/memory/1556-129-0x00007FF77F500000-0x00007FF77F854000-memory.dmp	upx
behavioral2/memory/2568-132-0x00007FF745A50000-0x00007FF745DA4000-memory.dmp	upx
behavioral2/memory/3324-131-0x00007FF6BFB70000-0x00007FF6BFEC4000-memory.dmp	upx
behavioral2/memory/4880-130-0x00007FF739BD0000-0x00007FF739F24000-memory.dmp	upx
behavioral2/memory/4616-128-0x00007FF73C270000-0x00007FF73C5C4000-memory.dmp	upx
behavioral2/memory/2824-133-0x00007FF7ACFA0000-0x00007FF7AD2F4000-memory.dmp	upx
behavioral2/memory/1368-134-0x00007FF73EEF0000-0x00007FF73F244000-memory.dmp	upx
behavioral2/memory/3240-135-0x00007FF77FF50000-0x00007FF7802A4000-memory.dmp	upx
behavioral2/memory/768-136-0x00007FF7348E0000-0x00007FF734C34000-memory.dmp	upx
behavioral2/memory/4492-137-0x00007FF747F30000-0x00007FF748284000-memory.dmp	upx
behavioral2/memory/5044-138-0x00007FF7F87E0000-0x00007FF7F8B34000-memory.dmp	upx
behavioral2/memory/1236-139-0x00007FF77D980000-0x00007FF77DCD4000-memory.dmp	upx
behavioral2/memory/2872-140-0x00007FF6FD8C0000-0x00007FF6FDC14000-memory.dmp	upx
behavioral2/memory/928-141-0x00007FF75C920000-0x00007FF75CC74000-memory.dmp	upx
behavioral2/memory/2228-142-0x00007FF6D0AB0000-0x00007FF6D0E04000-memory.dmp	upx
behavioral2/memory/1368-144-0x00007FF73EEF0000-0x00007FF73F244000-memory.dmp	upx
behavioral2/memory/2824-143-0x00007FF7ACFA0000-0x00007FF7AD2F4000-memory.dmp	upx
behavioral2/memory/988-145-0x00007FF60A820000-0x00007FF60AB74000-memory.dmp	upx
behavioral2/memory/4964-146-0x00007FF743040000-0x00007FF743394000-memory.dmp	upx
behavioral2/memory/5084-147-0x00007FF72E520000-0x00007FF72E874000-memory.dmp	upx
behavioral2/memory/3240-148-0x00007FF77FF50000-0x00007FF7802A4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\UwUdlBL.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oUOnFiU.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nbNDogY.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xKmvrWa.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bvndusq.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AwEBgDH.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BbzUVFV.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PcYteHi.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wOHyIYL.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MYeVjDY.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OzNXdlD.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aZXQUHB.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KdpiYGC.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\aTQrcNK.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PoDKeZH.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\yADZsVp.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GJgAZUi.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\baosKaz.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VfmTyJR.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PbUuXKP.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\phUQgvv.exe	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 5044	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	83
PID 4992 wrote to memory of 5044	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	83
PID 4992 wrote to memory of 1236	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	84
PID 4992 wrote to memory of 1236	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	84
PID 4992 wrote to memory of 2872	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	86
PID 4992 wrote to memory of 2872	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	86
PID 4992 wrote to memory of 928	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	87
PID 4992 wrote to memory of 928	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	87
PID 4992 wrote to memory of 2228	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	88
PID 4992 wrote to memory of 2228	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	88
PID 4992 wrote to memory of 2824	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	89
PID 4992 wrote to memory of 2824	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	89
PID 4992 wrote to memory of 1368	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	90
PID 4992 wrote to memory of 1368	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	90
PID 4992 wrote to memory of 988	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	91
PID 4992 wrote to memory of 988	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	91
PID 4992 wrote to memory of 4964	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	94
PID 4992 wrote to memory of 4964	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	94
PID 4992 wrote to memory of 5084	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	95
PID 4992 wrote to memory of 5084	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	95
PID 4992 wrote to memory of 3240	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	96
PID 4992 wrote to memory of 3240	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	96
PID 4992 wrote to memory of 768	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	97
PID 4992 wrote to memory of 768	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	97
PID 4992 wrote to memory of 3056	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	98
PID 4992 wrote to memory of 3056	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	98
PID 4992 wrote to memory of 1732	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	99
PID 4992 wrote to memory of 1732	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	99
PID 4992 wrote to memory of 1508	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	100
PID 4992 wrote to memory of 1508	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	100
PID 4992 wrote to memory of 4492	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	101
PID 4992 wrote to memory of 4492	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	101
PID 4992 wrote to memory of 4616	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	102
PID 4992 wrote to memory of 4616	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	102
PID 4992 wrote to memory of 1556	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	103
PID 4992 wrote to memory of 1556	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	103
PID 4992 wrote to memory of 4880	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	104
PID 4992 wrote to memory of 4880	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	104
PID 4992 wrote to memory of 3324	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	105
PID 4992 wrote to memory of 3324	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	105
PID 4992 wrote to memory of 2568	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	106
PID 4992 wrote to memory of 2568	4992	2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe	106

C:\Users\Admin\AppData\Local\Temp\2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_3e77bd42bd11dc83991453c84c2f5087_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\System\UwUdlBL.exe
  C:\Windows\System\UwUdlBL.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\oUOnFiU.exe
  C:\Windows\System\oUOnFiU.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\OzNXdlD.exe
  C:\Windows\System\OzNXdlD.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\PoDKeZH.exe
  C:\Windows\System\PoDKeZH.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\yADZsVp.exe
  C:\Windows\System\yADZsVp.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\aZXQUHB.exe
  C:\Windows\System\aZXQUHB.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\AwEBgDH.exe
  C:\Windows\System\AwEBgDH.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\BbzUVFV.exe
  C:\Windows\System\BbzUVFV.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\PcYteHi.exe
  C:\Windows\System\PcYteHi.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\GJgAZUi.exe
  C:\Windows\System\GJgAZUi.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\baosKaz.exe
  C:\Windows\System\baosKaz.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\nbNDogY.exe
  C:\Windows\System\nbNDogY.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\VfmTyJR.exe
  C:\Windows\System\VfmTyJR.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\KdpiYGC.exe
  C:\Windows\System\KdpiYGC.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\PbUuXKP.exe
  C:\Windows\System\PbUuXKP.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\wOHyIYL.exe
  C:\Windows\System\wOHyIYL.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\xKmvrWa.exe
  C:\Windows\System\xKmvrWa.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\MYeVjDY.exe
  C:\Windows\System\MYeVjDY.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\aTQrcNK.exe
  C:\Windows\System\aTQrcNK.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\phUQgvv.exe
  C:\Windows\System\phUQgvv.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\bvndusq.exe
  C:\Windows\System\bvndusq.exe
  2⤵
  - Executes dropped EXE
  PID:2568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AwEBgDH.exe

Path C:\Windows\System\AwEBgDH.exe
Size 6.0MB
SHA256 5de3de879c5b360128316b2c521069035a9634aca54d9c52f08ae4765693bab0
MD5 d193a9dd77d8106abda5cf16cb3f13ec
SHA1 e15844500366bda194e9268af99df19ac9f1a7ae
SHA512 5e3c82b6f8fb236186b10d101084d890e4858cb78bb86edc6ce40fbe7c783133991a97d79da667f0fb9cec4f1d27c769fd939444cccb06ee70597b1cadf28feb
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:T+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

BbzUVFV.exe

Path C:\Windows\System\BbzUVFV.exe
Size 6.0MB
SHA256 9f829f1bbc20689cc578facb8a874fb9af5c183eb392a815c713e51a2d0fc3f5
MD5 8833c3971a738e1d0423ebc019fa10bf
SHA1 32130decb23beea1d880a0928066ed96177e9b13
SHA512 33c27b847b14be4ae9dfb6cce060656fa14308ca49c2236d8d36a21ba4c779614c2478ad553f635a783d9580ea7ba9e1430f5ac55d638f8657b4dde42de59f47
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:T+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

GJgAZUi.exe

Path C:\Windows\System\GJgAZUi.exe
Size 6.0MB
SHA256 6ee5099e701e8308456f1c213859db22ec87b1cbce606f1ac7aac6c3fd568851
MD5 49bc02431c2a7e46ce2cbbab830c7adf
SHA1 5ada9c583bb2a0571d699f92776cbd0c9c51bd8f
SHA512 9efc9c82264452a6990ebca0984155a6d3eda04cd74fea8592126150aade08f59e983ba76f61d0cb30d9494efac3165fdb948573d312a9238a2fd6c7533f3534
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:T+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

KdpiYGC.exe

Path C:\Windows\System\KdpiYGC.exe
Size 6.0MB
SHA256 adaf1e33d7039a66d2a3f94c4145bb87d30f23288a39ab98c28451615d4aa45a
MD5 177ca6fb2ee579a76d4ae51fead1fae4
SHA1 c2a9dc35999d72ec53f1f8263081f3d0874835a9
SHA512 716b796a9b80a800b77f4be9d181a325dead2877fcfaefdaa0d1c6d32a9f63b3739a2c4cd828560ecb2edfa5523b62050654e8f7a5d33d5882328bd1a298fe47
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:T+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

MYeVjDY.exe

Path C:\Windows\System\MYeVjDY.exe
Size 6.0MB
SHA256 ccebc7fc5d32a9fb276d2b27b385a225bbf2152c3ae9416c56862ffb49abc0c4
MD5 cb6d552efb2248fec6ecf5f665c86e3e
SHA1 08d68f912d05edb18127ae0b87e528c9f8154fc8
SHA512 2ac09f79e71cf42fd5cf319092569820c88eaeddbe1d937a3de99e2762527981218e407ec5d6c18ba14ceb9241ea90537b094be738d9ec67048322531c325ed6
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:T+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

OzNXdlD.exe

Path C:\Windows\System\OzNXdlD.exe
Size 6.0MB
SHA256 ba951c90dd9ef7ea9594fadcc2c15f59ccd2e550f89cd33665aeb9dd8c711a13
MD5 42de3d3330cc0b12bfb43701727d1669
SHA1 a2fef3de61e9271178c5ea21b0c552a4ab8759e1
SHA512 31373b4868b94ad7538dcbb01434985691464b96e713d8443d108c355a6a5b405715ceba05c1ac9b32ef47055b869e93b3e1476b20ab8cea281f8a7b9c9f0158
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:T+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

PbUuXKP.exe

Path C:\Windows\System\PbUuXKP.exe
Size 6.0MB
SHA256 505b9a3bb2dae54b91f94a3f012e547be58938472accb4729bc247755799cea5
MD5 75b47ed7ebacb17744e864b4890668a5
SHA1 bdee6570dfe1798b6ff8188ff91e3d3cea7983f9
SHA512 d8421e862b1f429ac28d7bcb3b0a2f0c880633968daf51ca87af925beb635f733f35b46c86a01e17cd32603dfc6cc9aba5f0a16382a7cbecf9fd3d0249a7eba0
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:T+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

PcYteHi.exe

Path C:\Windows\System\PcYteHi.exe
Size 6.0MB
SHA256 a1f69ee6d7e32814d94397b3fb4fc37002275942347636600216fa594119088f
MD5 2aaeed5ea7375ec62d5bcbcf737497e6
SHA1 7dd3ee77775b2fafaa2c2692c7549c5c5abe4406
SHA512 07d4e93e68cced11b491f2fbebaf6062566b187538cc1b4ee0bcb2b3cff23145584dc75ecad24f3f004bb1cd69eea9cd5b58c18dd3dd2f2bbc614e51b91aa5a9
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:T+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

PoDKeZH.exe

Path C:\Windows\System\PoDKeZH.exe
Size 6.0MB
SHA256 cf19f198763c6ecac92879185e692bdda1a6d8154da40939e50cdb4f0ab03054
MD5 d067f7b588b287bbc8810e593d014edf
SHA1 b559af0ed7b656bbb6e0246a561e16ecd324a4d9
SHA512 e81f6f74fd230f3bae7794692ab7806a51aa738207a4c23870576dce397e7f189b48f344dc2b677b165ae47ac4bd2ae4b3e8fd3430a8cda94b5b8fc20e59f2a9
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:T+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

UwUdlBL.exe

Path C:\Windows\System\UwUdlBL.exe
Size 6.0MB
SHA256 e767f1f3b9ee36157497cc6eafca28ff1cbbc85d3fe7d0e5912c049b7d2e17b4
MD5 b047e197ce7245bd1857fdcf658d492b
SHA1 4104b00a77a8981cc7252d5249c79aad45250e41
SHA512 db128f844ce2b8f80e23ab73081867529c3f849be657f33e24bb26e16628221e23df03c4acb3872588c27d3bd079449c2d6ddc40f3a166ce143ffe95f3d8ec70
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:T+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

VfmTyJR.exe

Path C:\Windows\System\VfmTyJR.exe
Size 6.0MB
SHA256 d6056a1ac74ebc66b26904414fdbac9bb22891c3a0b10d70f1f2aeac777a98b2
MD5 eeb45b12e8da0d14454851fdbab5bf4d
SHA1 ffbc480ba7f1e07d8d69859632033afe2642e18b
SHA512 a44757a3a1bb025aa8230a69568bc2dd331baf886347299148ece81fccd884f4a8be81982d42f83bcdb20e78c26d59d30c017730ef18f98c7a38a338c0911632
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:T+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

aTQrcNK.exe

Path C:\Windows\System\aTQrcNK.exe
Size 6.0MB
SHA256 b76dcae1e487030ddfbb7c7236b9ff8303dc40a01c6bd92b9bd979db5c90be83
MD5 5065783677d4eeb978e232de0672ef74
SHA1 7d2ef57d5ed4a97a47a32d8c753e3e7a0ae9563f
SHA512 f88577071f469d4d5f02afd6d046a0d70605605ed1525eb3954db776ebae2e097208c9a2186a12983580318502648b1b901a70891500bfa25e4dcc7b0c3ed575
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:T+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

aZXQUHB.exe

Path C:\Windows\System\aZXQUHB.exe
Size 6.0MB
SHA256 e20bd2ec8eed5411ef12eaf06ed850e623dd706b6cba45ae955ca3a2db2a015f
MD5 0c3a4ed8d41cbbcdc02f9d32c4d7f9dd
SHA1 98d1f440329fc8f60dbfe4ea2875b407dfc81d20
SHA512 0bb7cc94fcef98d1b2655305e8b88989d15ee65cdafef1207e5be6cf78917e2275c3b66398290fbc3ef6496579834e88a80bf126ef3472b3b5f21ed57d5375af
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:T+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

baosKaz.exe

Path C:\Windows\System\baosKaz.exe
Size 6.0MB
SHA256 562a0d4a5e2a8ee07e692f8addd65379db35d1edcf5df5be70ea0befea633451
MD5 e740fd13fcc5beb486e5e18c9445b54f
SHA1 aa690345325ae5a6dea07e9b013b45d44a7dbb2a
SHA512 d645986a69c71897c9c46674d0f117ad2bdc35c7706965c90cffe5c96cba1f744e3b423a2f07d102a6b85a42213dadd9c9a3303fff1b4a11716dca2b4b78bca0
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:T+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

bvndusq.exe

Path C:\Windows\System\bvndusq.exe
Size 6.0MB
SHA256 9ae01dd438f7b7fbd3aff8f75b8d6e1947f86efd9c5c9214c120973c82bc95b4
MD5 15655c5b57a07ebe6e4a159e1683ac3f
SHA1 8ad898f5b99be11fc0f2f23cd7f108e53ee3770b
SHA512 a44c09d29aff9850b92752f3322ca0500dbc90b4fb3c77371df804132555af4914a97d2743fcdc8dde69fe39063f8626c07d3f430d1b38824488e2173223236e
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:T+856utgpPF8u/7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

nbNDogY.exe

Path C:\Windows\System\nbNDogY.exe
Size 6.0MB
SHA256 5ef949f534ba893f09c9e9c846e560befa5784581bc0ba6d8114c8b254aad833
MD5 282acfad684ea72e3ab894e20c8343c6
SHA1 b107fc69f4099fbc63e96fc50ffb5ea7f1041aec
SHA512 8d9ce659a36c4a624f1442faf6747b340ff968ea8a27f5b2ef2247da2aaecb598657d153d9b2b1c8b2f6c20aa059335472efed29321fde3e6632f801776b21ec
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:T+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

oUOnFiU.exe

Path C:\Windows\System\oUOnFiU.exe
Size 6.0MB
SHA256 3a2050c919924317c666f651b84475dd4b90d349ff0ac8dcfd0764c16a064efc
MD5 c10406928201ed0759e534eb85146ce0
SHA1 600e50531e606c73113667d1e29967c4e1087642
SHA512 04cd4db5ba25e4c0f5eec2d310a1c210c52b23d25335395d8adfd59bee2859d4d8cd49ebd08cfd8d4d61b0fb0f5c442e82c39a5b5b9ce80000f0aa9ce55480e1
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:T+856utgpPF8u/7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

phUQgvv.exe

Path C:\Windows\System\phUQgvv.exe
Size 6.0MB
SHA256 b54f8cfe3b66cc502ff8d33cfa071cfc458884bdc0fed329c1c714ee385e9d73
MD5 07c8c687f192ed24228f52fd83c1a257
SHA1 50bc12fcc24769e5b20f52df000993ce3b13679a
SHA512 34bdf10702f42da8700df2bef6cb8858abfd40166de542e971115bd46faa6fec8bae63a353e85b67ead67f4fc6efda5f455bdf5dd280b8a981d9ba62bb59d8f8
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:T+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

wOHyIYL.exe

Path C:\Windows\System\wOHyIYL.exe
Size 6.0MB
SHA256 b813b1c544094f3d211faa5f6b32b0118c37ea09ce9d1ea888afc96238d2674b
MD5 79d83db6e495e5fb3f9fefb54fe892c4
SHA1 af459028ff8bb113589585da08c34723dec1ce6a
SHA512 abc1f0ee428decd09b7b40cad9bc5d17898d2b5d92c5cab7180381b086b63b56372d3a3cb81ed990ed369f2ddb6b0fbc1f43f0a19061d8d83b0b60cd96dbbbe6
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:T+856utgpPF8u/7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

xKmvrWa.exe

Path C:\Windows\System\xKmvrWa.exe
Size 6.0MB
SHA256 03ba3f138645a31b6f883c963558920bcd3f4312c2804e78948b3692de3341e4
MD5 b6cdd2101ca50de46661e5a5f4c1ace7
SHA1 50ff164e55b0406ef71de223347e396a047cef5f
SHA512 4f8eedf8ddf421eaacf97c2fe5a1092d3ab843e52cb5fbef4b12e93730d2b58be5570ed71b69ce55c1e38c15bbe0af3fabafdd43dbce69772ee6707c9714b41d
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:T+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

yADZsVp.exe

Path C:\Windows\System\yADZsVp.exe
Size 6.0MB
SHA256 8d33432f71e307971a77616ee611d494064d9c2a66f14eb9e81f8ce713614783
MD5 1ed0a5bedebd4d28d710b13883f5242c
SHA1 52aa7dc3649838b88eaa7f78b320ab03e537ecdb
SHA512 e359a2e2a9ae9609b6a6314cbd76d7ad39e9a36c56acc08c2395cd18d38cd67bcbb1c9b57247334281ec444c42337105a24381ca10d584e3b7adb7ae14fc4409
SSDEEP 98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:T+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/768-74-0x00007FF7348E0000-0x00007FF734C34000-memory.dmp

Download

memory/768-149-0x00007FF7348E0000-0x00007FF734C34000-memory.dmp

Download

memory/768-136-0x00007FF7348E0000-0x00007FF734C34000-memory.dmp

Download

memory/928-127-0x00007FF75C920000-0x00007FF75CC74000-memory.dmp

Download

memory/928-141-0x00007FF75C920000-0x00007FF75CC74000-memory.dmp

Download

memory/928-26-0x00007FF75C920000-0x00007FF75CC74000-memory.dmp

Download

memory/988-145-0x00007FF60A820000-0x00007FF60AB74000-memory.dmp

Download

memory/988-51-0x00007FF60A820000-0x00007FF60AB74000-memory.dmp

Download

memory/1236-139-0x00007FF77D980000-0x00007FF77DCD4000-memory.dmp

Download

memory/1236-77-0x00007FF77D980000-0x00007FF77DCD4000-memory.dmp

Download

memory/1236-14-0x00007FF77D980000-0x00007FF77DCD4000-memory.dmp

Download

memory/1368-144-0x00007FF73EEF0000-0x00007FF73F244000-memory.dmp

Download

memory/1368-42-0x00007FF73EEF0000-0x00007FF73F244000-memory.dmp

Download

memory/1368-134-0x00007FF73EEF0000-0x00007FF73F244000-memory.dmp

Download

memory/1508-152-0x00007FF62F9A0000-0x00007FF62FCF4000-memory.dmp

Download

memory/1508-99-0x00007FF62F9A0000-0x00007FF62FCF4000-memory.dmp

Download

memory/1556-155-0x00007FF77F500000-0x00007FF77F854000-memory.dmp

Download

memory/1556-129-0x00007FF77F500000-0x00007FF77F854000-memory.dmp

Download

memory/1732-151-0x00007FF6739A0000-0x00007FF673CF4000-memory.dmp

Download

memory/1732-98-0x00007FF6739A0000-0x00007FF673CF4000-memory.dmp

Download

memory/2228-34-0x00007FF6D0AB0000-0x00007FF6D0E04000-memory.dmp

Download

memory/2228-142-0x00007FF6D0AB0000-0x00007FF6D0E04000-memory.dmp

Download

memory/2568-132-0x00007FF745A50000-0x00007FF745DA4000-memory.dmp

Download

memory/2568-157-0x00007FF745A50000-0x00007FF745DA4000-memory.dmp

Download

memory/2824-40-0x00007FF7ACFA0000-0x00007FF7AD2F4000-memory.dmp

Download

memory/2824-143-0x00007FF7ACFA0000-0x00007FF7AD2F4000-memory.dmp

Download

memory/2824-133-0x00007FF7ACFA0000-0x00007FF7AD2F4000-memory.dmp

Download

memory/2872-19-0x00007FF6FD8C0000-0x00007FF6FDC14000-memory.dmp

Download

memory/2872-95-0x00007FF6FD8C0000-0x00007FF6FDC14000-memory.dmp

Download

memory/2872-140-0x00007FF6FD8C0000-0x00007FF6FDC14000-memory.dmp

Download

memory/3056-96-0x00007FF7F0A50000-0x00007FF7F0DA4000-memory.dmp

Download

memory/3056-150-0x00007FF7F0A50000-0x00007FF7F0DA4000-memory.dmp

Download

memory/3240-72-0x00007FF77FF50000-0x00007FF7802A4000-memory.dmp

Download

memory/3240-135-0x00007FF77FF50000-0x00007FF7802A4000-memory.dmp

Download

memory/3240-148-0x00007FF77FF50000-0x00007FF7802A4000-memory.dmp

Download

memory/3324-131-0x00007FF6BFB70000-0x00007FF6BFEC4000-memory.dmp

Download

memory/3324-158-0x00007FF6BFB70000-0x00007FF6BFEC4000-memory.dmp

Download

memory/4492-102-0x00007FF747F30000-0x00007FF748284000-memory.dmp

Download

memory/4492-137-0x00007FF747F30000-0x00007FF748284000-memory.dmp

Download

memory/4492-153-0x00007FF747F30000-0x00007FF748284000-memory.dmp

Download

memory/4616-128-0x00007FF73C270000-0x00007FF73C5C4000-memory.dmp

Download

memory/4616-154-0x00007FF73C270000-0x00007FF73C5C4000-memory.dmp

Download

memory/4880-130-0x00007FF739BD0000-0x00007FF739F24000-memory.dmp

Download

memory/4880-156-0x00007FF739BD0000-0x00007FF739F24000-memory.dmp

Download

memory/4964-61-0x00007FF743040000-0x00007FF743394000-memory.dmp

Download

memory/4964-146-0x00007FF743040000-0x00007FF743394000-memory.dmp

Download

memory/4992-65-0x00007FF704450000-0x00007FF7047A4000-memory.dmp

Download

memory/4992-0-0x00007FF704450000-0x00007FF7047A4000-memory.dmp

Download

memory/4992-1-0x00000265E90D0000-0x00000265E90E0000-memory.dmp

Download

memory/5044-73-0x00007FF7F87E0000-0x00007FF7F8B34000-memory.dmp

Download

memory/5044-6-0x00007FF7F87E0000-0x00007FF7F8B34000-memory.dmp

Download

memory/5044-138-0x00007FF7F87E0000-0x00007FF7F8B34000-memory.dmp

Download

memory/5084-66-0x00007FF72E520000-0x00007FF72E874000-memory.dmp

Download

memory/5084-147-0x00007FF72E520000-0x00007FF72E874000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads