cobaltstrike | 8e35f57d4f433eab255f82c17e71d38c4371ed681105097f2a01d89d13664052

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-cabt8adf7y
SHA256 8e35f57d4f433eab255f82c17e71d38c4371ed681105097f2a01d89d13664052
MD5 539081b1ddcf82ceb603fe66f6d2dd10
SHA1 04e69fbf4c089829bb1aac1ffe17341ce563a988
SHA512 3c26b9015884fc4bdf2678f6478ba9c7a0cfffa501c67f6a4a45035a63717204a1442b24dc00a7d4d9888433501970978fd864f7f7d00b5c2262ca5b429997ce
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 18 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023430-6.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023434-13.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023435-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023436-21.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023437-27.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023438-36.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023431-40.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343a-53.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343f-85.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023441-100.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023442-105.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023444-115.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023443-110.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023440-91.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343e-84.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343d-68.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343c-64.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023439-46.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 18 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023430-6.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023434-13.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023435-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023436-21.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023437-27.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023438-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023431-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343a-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343f-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023441-100.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023442-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023444-115.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023443-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023440-91.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343e-84.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343d-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343c-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023439-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2108-0-0x00007FF6E2530000-0x00007FF6E2884000-memory.dmp	UPX
behavioral2/files/0x0008000000023430-6.dat	UPX
behavioral2/memory/2824-8-0x00007FF63F600000-0x00007FF63F954000-memory.dmp	UPX
behavioral2/files/0x0007000000023434-13.dat	UPX
behavioral2/memory/4788-12-0x00007FF60BB50000-0x00007FF60BEA4000-memory.dmp	UPX
behavioral2/files/0x0007000000023435-10.dat	UPX
behavioral2/memory/3716-18-0x00007FF60EB00000-0x00007FF60EE54000-memory.dmp	UPX
behavioral2/files/0x0007000000023436-21.dat	UPX
behavioral2/files/0x0007000000023437-27.dat	UPX
behavioral2/memory/5024-30-0x00007FF6E2090000-0x00007FF6E23E4000-memory.dmp	UPX
behavioral2/memory/432-24-0x00007FF60FA40000-0x00007FF60FD94000-memory.dmp	UPX
behavioral2/files/0x0007000000023438-36.dat	UPX
behavioral2/memory/1180-38-0x00007FF714630000-0x00007FF714984000-memory.dmp	UPX
behavioral2/files/0x0008000000023431-40.dat	UPX
behavioral2/files/0x0007000000023439-48.dat	UPX
behavioral2/memory/3928-47-0x00007FF6333E0000-0x00007FF633734000-memory.dmp	UPX
behavioral2/files/0x000700000002343a-53.dat	UPX
behavioral2/files/0x000700000002343b-56.dat	UPX
behavioral2/memory/2108-62-0x00007FF6E2530000-0x00007FF6E2884000-memory.dmp	UPX
behavioral2/memory/1552-67-0x00007FF7CC370000-0x00007FF7CC6C4000-memory.dmp	UPX
behavioral2/files/0x000700000002343c-73.dat	UPX
behavioral2/memory/4488-70-0x00007FF619B70000-0x00007FF619EC4000-memory.dmp	UPX
behavioral2/memory/3716-79-0x00007FF60EB00000-0x00007FF60EE54000-memory.dmp	UPX
behavioral2/files/0x000700000002343f-85.dat	UPX
behavioral2/files/0x0007000000023441-100.dat	UPX
behavioral2/files/0x0007000000023442-105.dat	UPX
behavioral2/files/0x0007000000023445-120.dat	UPX
behavioral2/files/0x0007000000023446-124.dat	UPX
behavioral2/files/0x0007000000023446-123.dat	UPX
behavioral2/files/0x0007000000023445-119.dat	UPX
behavioral2/files/0x0007000000023444-115.dat	UPX
behavioral2/files/0x0007000000023444-114.dat	UPX
behavioral2/files/0x0007000000023443-110.dat	UPX
behavioral2/files/0x0007000000023440-95.dat	UPX
behavioral2/memory/1312-94-0x00007FF7CB350000-0x00007FF7CB6A4000-memory.dmp	UPX
behavioral2/memory/4344-92-0x00007FF627720000-0x00007FF627A74000-memory.dmp	UPX
behavioral2/files/0x0007000000023440-91.dat	UPX
behavioral2/files/0x000700000002343e-84.dat	UPX
behavioral2/memory/5108-78-0x00007FF766C20000-0x00007FF766F74000-memory.dmp	UPX
behavioral2/memory/4788-76-0x00007FF60BB50000-0x00007FF60BEA4000-memory.dmp	UPX
behavioral2/memory/2356-75-0x00007FF713390000-0x00007FF7136E4000-memory.dmp	UPX
behavioral2/files/0x000700000002343d-77.dat	UPX
behavioral2/memory/2824-69-0x00007FF63F600000-0x00007FF63F954000-memory.dmp	UPX
behavioral2/files/0x000700000002343d-68.dat	UPX
behavioral2/files/0x000700000002343c-64.dat	UPX
behavioral2/memory/5068-61-0x00007FF6DA9F0000-0x00007FF6DAD44000-memory.dmp	UPX
behavioral2/memory/2748-51-0x00007FF602210000-0x00007FF602564000-memory.dmp	UPX
behavioral2/files/0x0007000000023439-46.dat	UPX
behavioral2/memory/760-132-0x00007FF7B9420000-0x00007FF7B9774000-memory.dmp	UPX
behavioral2/memory/208-129-0x00007FF7C9240000-0x00007FF7C9594000-memory.dmp	UPX
behavioral2/memory/1180-133-0x00007FF714630000-0x00007FF714984000-memory.dmp	UPX
behavioral2/memory/5068-134-0x00007FF6DA9F0000-0x00007FF6DAD44000-memory.dmp	UPX
behavioral2/memory/1552-135-0x00007FF7CC370000-0x00007FF7CC6C4000-memory.dmp	UPX
behavioral2/memory/2356-137-0x00007FF713390000-0x00007FF7136E4000-memory.dmp	UPX
behavioral2/memory/4488-136-0x00007FF619B70000-0x00007FF619EC4000-memory.dmp	UPX
behavioral2/memory/5108-138-0x00007FF766C20000-0x00007FF766F74000-memory.dmp	UPX
behavioral2/memory/1312-139-0x00007FF7CB350000-0x00007FF7CB6A4000-memory.dmp	UPX
behavioral2/memory/2824-140-0x00007FF63F600000-0x00007FF63F954000-memory.dmp	UPX
behavioral2/memory/4788-141-0x00007FF60BB50000-0x00007FF60BEA4000-memory.dmp	UPX
behavioral2/memory/432-142-0x00007FF60FA40000-0x00007FF60FD94000-memory.dmp	UPX
behavioral2/memory/5024-144-0x00007FF6E2090000-0x00007FF6E23E4000-memory.dmp	UPX
behavioral2/memory/3716-143-0x00007FF60EB00000-0x00007FF60EE54000-memory.dmp	UPX
behavioral2/memory/1180-145-0x00007FF714630000-0x00007FF714984000-memory.dmp	UPX
behavioral2/memory/3928-146-0x00007FF6333E0000-0x00007FF633734000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2108-0-0x00007FF6E2530000-0x00007FF6E2884000-memory.dmp	xmrig
behavioral2/files/0x0008000000023430-6.dat	xmrig
behavioral2/memory/2824-8-0x00007FF63F600000-0x00007FF63F954000-memory.dmp	xmrig
behavioral2/files/0x0007000000023434-13.dat	xmrig
behavioral2/memory/4788-12-0x00007FF60BB50000-0x00007FF60BEA4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023435-10.dat	xmrig
behavioral2/memory/3716-18-0x00007FF60EB00000-0x00007FF60EE54000-memory.dmp	xmrig
behavioral2/files/0x0007000000023436-21.dat	xmrig
behavioral2/files/0x0007000000023437-27.dat	xmrig
behavioral2/memory/5024-30-0x00007FF6E2090000-0x00007FF6E23E4000-memory.dmp	xmrig
behavioral2/memory/432-24-0x00007FF60FA40000-0x00007FF60FD94000-memory.dmp	xmrig
behavioral2/files/0x0007000000023438-36.dat	xmrig
behavioral2/memory/1180-38-0x00007FF714630000-0x00007FF714984000-memory.dmp	xmrig
behavioral2/files/0x0008000000023431-40.dat	xmrig
behavioral2/files/0x0007000000023439-48.dat	xmrig
behavioral2/memory/3928-47-0x00007FF6333E0000-0x00007FF633734000-memory.dmp	xmrig
behavioral2/files/0x000700000002343a-53.dat	xmrig
behavioral2/files/0x000700000002343b-56.dat	xmrig
behavioral2/memory/2108-62-0x00007FF6E2530000-0x00007FF6E2884000-memory.dmp	xmrig
behavioral2/memory/1552-67-0x00007FF7CC370000-0x00007FF7CC6C4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343c-73.dat	xmrig
behavioral2/memory/4488-70-0x00007FF619B70000-0x00007FF619EC4000-memory.dmp	xmrig
behavioral2/memory/3716-79-0x00007FF60EB00000-0x00007FF60EE54000-memory.dmp	xmrig
behavioral2/files/0x000700000002343f-85.dat	xmrig
behavioral2/files/0x0007000000023441-100.dat	xmrig
behavioral2/files/0x0007000000023442-105.dat	xmrig
behavioral2/files/0x0007000000023445-120.dat	xmrig
behavioral2/files/0x0007000000023446-124.dat	xmrig
behavioral2/files/0x0007000000023446-123.dat	xmrig
behavioral2/files/0x0007000000023445-119.dat	xmrig
behavioral2/files/0x0007000000023444-115.dat	xmrig
behavioral2/files/0x0007000000023444-114.dat	xmrig
behavioral2/files/0x0007000000023443-110.dat	xmrig
behavioral2/files/0x0007000000023440-95.dat	xmrig
behavioral2/memory/1312-94-0x00007FF7CB350000-0x00007FF7CB6A4000-memory.dmp	xmrig
behavioral2/memory/4344-92-0x00007FF627720000-0x00007FF627A74000-memory.dmp	xmrig
behavioral2/files/0x0007000000023440-91.dat	xmrig
behavioral2/files/0x000700000002343e-84.dat	xmrig
behavioral2/memory/5108-78-0x00007FF766C20000-0x00007FF766F74000-memory.dmp	xmrig
behavioral2/memory/4788-76-0x00007FF60BB50000-0x00007FF60BEA4000-memory.dmp	xmrig
behavioral2/memory/2356-75-0x00007FF713390000-0x00007FF7136E4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343d-77.dat	xmrig
behavioral2/memory/2824-69-0x00007FF63F600000-0x00007FF63F954000-memory.dmp	xmrig
behavioral2/files/0x000700000002343d-68.dat	xmrig
behavioral2/files/0x000700000002343c-64.dat	xmrig
behavioral2/memory/5068-61-0x00007FF6DA9F0000-0x00007FF6DAD44000-memory.dmp	xmrig
behavioral2/memory/2748-51-0x00007FF602210000-0x00007FF602564000-memory.dmp	xmrig
behavioral2/files/0x0007000000023439-46.dat	xmrig
behavioral2/memory/4396-127-0x00007FF7DD370000-0x00007FF7DD6C4000-memory.dmp	xmrig
behavioral2/memory/5024-126-0x00007FF6E2090000-0x00007FF6E23E4000-memory.dmp	xmrig
behavioral2/memory/3480-131-0x00007FF76FD30000-0x00007FF770084000-memory.dmp	xmrig
behavioral2/memory/760-132-0x00007FF7B9420000-0x00007FF7B9774000-memory.dmp	xmrig
behavioral2/memory/4192-130-0x00007FF739C90000-0x00007FF739FE4000-memory.dmp	xmrig
behavioral2/memory/208-129-0x00007FF7C9240000-0x00007FF7C9594000-memory.dmp	xmrig
behavioral2/memory/4104-128-0x00007FF603AF0000-0x00007FF603E44000-memory.dmp	xmrig
behavioral2/memory/1180-133-0x00007FF714630000-0x00007FF714984000-memory.dmp	xmrig
behavioral2/memory/5068-134-0x00007FF6DA9F0000-0x00007FF6DAD44000-memory.dmp	xmrig
behavioral2/memory/1552-135-0x00007FF7CC370000-0x00007FF7CC6C4000-memory.dmp	xmrig
behavioral2/memory/2356-137-0x00007FF713390000-0x00007FF7136E4000-memory.dmp	xmrig
behavioral2/memory/4488-136-0x00007FF619B70000-0x00007FF619EC4000-memory.dmp	xmrig
behavioral2/memory/5108-138-0x00007FF766C20000-0x00007FF766F74000-memory.dmp	xmrig
behavioral2/memory/1312-139-0x00007FF7CB350000-0x00007FF7CB6A4000-memory.dmp	xmrig
behavioral2/memory/2824-140-0x00007FF63F600000-0x00007FF63F954000-memory.dmp	xmrig
behavioral2/memory/4788-141-0x00007FF60BB50000-0x00007FF60BEA4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2824	OCWrrBw.exe
4788	lNdFlhh.exe
3716	BfFWNUW.exe
432	CGuCToQ.exe
5024	IBCfRAF.exe
1180	VhNdvpI.exe
3928	uhSczTj.exe
2748	BUaWrBw.exe
5068	kwQfKkH.exe
1552	wwcZkUk.exe
4488	AekQMHB.exe
2356	snXvShk.exe
5108	NypCsQJ.exe
4344	HkfhfbQ.exe
1312	XhfJUGT.exe
4396	DSkLCxp.exe
4104	RaIyLDM.exe
208	xsqAceI.exe
4192	RMxXqzs.exe
3480	ToTlrmN.exe
760	bQYhChl.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2108-0-0x00007FF6E2530000-0x00007FF6E2884000-memory.dmp	upx
behavioral2/files/0x0008000000023430-6.dat	upx
behavioral2/memory/2824-8-0x00007FF63F600000-0x00007FF63F954000-memory.dmp	upx
behavioral2/files/0x0007000000023434-13.dat	upx
behavioral2/memory/4788-12-0x00007FF60BB50000-0x00007FF60BEA4000-memory.dmp	upx
behavioral2/files/0x0007000000023435-10.dat	upx
behavioral2/memory/3716-18-0x00007FF60EB00000-0x00007FF60EE54000-memory.dmp	upx
behavioral2/files/0x0007000000023436-21.dat	upx
behavioral2/files/0x0007000000023437-27.dat	upx
behavioral2/memory/5024-30-0x00007FF6E2090000-0x00007FF6E23E4000-memory.dmp	upx
behavioral2/memory/432-24-0x00007FF60FA40000-0x00007FF60FD94000-memory.dmp	upx
behavioral2/files/0x0007000000023438-36.dat	upx
behavioral2/memory/1180-38-0x00007FF714630000-0x00007FF714984000-memory.dmp	upx
behavioral2/files/0x0008000000023431-40.dat	upx
behavioral2/files/0x0007000000023439-48.dat	upx
behavioral2/memory/3928-47-0x00007FF6333E0000-0x00007FF633734000-memory.dmp	upx
behavioral2/files/0x000700000002343a-53.dat	upx
behavioral2/files/0x000700000002343b-56.dat	upx
behavioral2/memory/2108-62-0x00007FF6E2530000-0x00007FF6E2884000-memory.dmp	upx
behavioral2/memory/1552-67-0x00007FF7CC370000-0x00007FF7CC6C4000-memory.dmp	upx
behavioral2/files/0x000700000002343c-73.dat	upx
behavioral2/memory/4488-70-0x00007FF619B70000-0x00007FF619EC4000-memory.dmp	upx
behavioral2/memory/3716-79-0x00007FF60EB00000-0x00007FF60EE54000-memory.dmp	upx
behavioral2/files/0x000700000002343f-85.dat	upx
behavioral2/files/0x0007000000023441-100.dat	upx
behavioral2/files/0x0007000000023442-105.dat	upx
behavioral2/files/0x0007000000023445-120.dat	upx
behavioral2/files/0x0007000000023446-124.dat	upx
behavioral2/files/0x0007000000023446-123.dat	upx
behavioral2/files/0x0007000000023445-119.dat	upx
behavioral2/files/0x0007000000023444-115.dat	upx
behavioral2/files/0x0007000000023444-114.dat	upx
behavioral2/files/0x0007000000023443-110.dat	upx
behavioral2/files/0x0007000000023440-95.dat	upx
behavioral2/memory/1312-94-0x00007FF7CB350000-0x00007FF7CB6A4000-memory.dmp	upx
behavioral2/memory/4344-92-0x00007FF627720000-0x00007FF627A74000-memory.dmp	upx
behavioral2/files/0x0007000000023440-91.dat	upx
behavioral2/files/0x000700000002343e-84.dat	upx
behavioral2/memory/5108-78-0x00007FF766C20000-0x00007FF766F74000-memory.dmp	upx
behavioral2/memory/4788-76-0x00007FF60BB50000-0x00007FF60BEA4000-memory.dmp	upx
behavioral2/memory/2356-75-0x00007FF713390000-0x00007FF7136E4000-memory.dmp	upx
behavioral2/files/0x000700000002343d-77.dat	upx
behavioral2/memory/2824-69-0x00007FF63F600000-0x00007FF63F954000-memory.dmp	upx
behavioral2/files/0x000700000002343d-68.dat	upx
behavioral2/files/0x000700000002343c-64.dat	upx
behavioral2/memory/5068-61-0x00007FF6DA9F0000-0x00007FF6DAD44000-memory.dmp	upx
behavioral2/memory/2748-51-0x00007FF602210000-0x00007FF602564000-memory.dmp	upx
behavioral2/files/0x0007000000023439-46.dat	upx
behavioral2/memory/4396-127-0x00007FF7DD370000-0x00007FF7DD6C4000-memory.dmp	upx
behavioral2/memory/5024-126-0x00007FF6E2090000-0x00007FF6E23E4000-memory.dmp	upx
behavioral2/memory/3480-131-0x00007FF76FD30000-0x00007FF770084000-memory.dmp	upx
behavioral2/memory/760-132-0x00007FF7B9420000-0x00007FF7B9774000-memory.dmp	upx
behavioral2/memory/4192-130-0x00007FF739C90000-0x00007FF739FE4000-memory.dmp	upx
behavioral2/memory/208-129-0x00007FF7C9240000-0x00007FF7C9594000-memory.dmp	upx
behavioral2/memory/4104-128-0x00007FF603AF0000-0x00007FF603E44000-memory.dmp	upx
behavioral2/memory/1180-133-0x00007FF714630000-0x00007FF714984000-memory.dmp	upx
behavioral2/memory/5068-134-0x00007FF6DA9F0000-0x00007FF6DAD44000-memory.dmp	upx
behavioral2/memory/1552-135-0x00007FF7CC370000-0x00007FF7CC6C4000-memory.dmp	upx
behavioral2/memory/2356-137-0x00007FF713390000-0x00007FF7136E4000-memory.dmp	upx
behavioral2/memory/4488-136-0x00007FF619B70000-0x00007FF619EC4000-memory.dmp	upx
behavioral2/memory/5108-138-0x00007FF766C20000-0x00007FF766F74000-memory.dmp	upx
behavioral2/memory/1312-139-0x00007FF7CB350000-0x00007FF7CB6A4000-memory.dmp	upx
behavioral2/memory/2824-140-0x00007FF63F600000-0x00007FF63F954000-memory.dmp	upx
behavioral2/memory/4788-141-0x00007FF60BB50000-0x00007FF60BEA4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\IBCfRAF.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VhNdvpI.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BUaWrBw.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NypCsQJ.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HkfhfbQ.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DSkLCxp.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RMxXqzs.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lNdFlhh.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\snXvShk.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AekQMHB.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uhSczTj.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RaIyLDM.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xsqAceI.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bQYhChl.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BfFWNUW.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CGuCToQ.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kwQfKkH.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wwcZkUk.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XhfJUGT.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ToTlrmN.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OCWrrBw.exe	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2824	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	83
PID 2108 wrote to memory of 2824	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	83
PID 2108 wrote to memory of 4788	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	84
PID 2108 wrote to memory of 4788	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	84
PID 2108 wrote to memory of 3716	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	85
PID 2108 wrote to memory of 3716	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	85
PID 2108 wrote to memory of 432	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	89
PID 2108 wrote to memory of 432	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	89
PID 2108 wrote to memory of 5024	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	90
PID 2108 wrote to memory of 5024	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	90
PID 2108 wrote to memory of 1180	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	91
PID 2108 wrote to memory of 1180	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	91
PID 2108 wrote to memory of 3928	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	92
PID 2108 wrote to memory of 3928	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	92
PID 2108 wrote to memory of 2748	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	93
PID 2108 wrote to memory of 2748	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	93
PID 2108 wrote to memory of 5068	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	94
PID 2108 wrote to memory of 5068	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	94
PID 2108 wrote to memory of 1552	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	95
PID 2108 wrote to memory of 1552	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	95
PID 2108 wrote to memory of 4488	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	96
PID 2108 wrote to memory of 4488	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	96
PID 2108 wrote to memory of 2356	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	97
PID 2108 wrote to memory of 2356	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	97
PID 2108 wrote to memory of 5108	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	98
PID 2108 wrote to memory of 5108	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	98
PID 2108 wrote to memory of 4344	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	99
PID 2108 wrote to memory of 4344	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	99
PID 2108 wrote to memory of 1312	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	100
PID 2108 wrote to memory of 1312	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	100
PID 2108 wrote to memory of 4396	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	101
PID 2108 wrote to memory of 4396	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	101
PID 2108 wrote to memory of 4104	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	102
PID 2108 wrote to memory of 4104	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	102
PID 2108 wrote to memory of 208	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	103
PID 2108 wrote to memory of 208	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	103
PID 2108 wrote to memory of 4192	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	104
PID 2108 wrote to memory of 4192	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	104
PID 2108 wrote to memory of 3480	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	105
PID 2108 wrote to memory of 3480	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	105
PID 2108 wrote to memory of 760	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	106
PID 2108 wrote to memory of 760	2108	2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe	106

C:\Users\Admin\AppData\Local\Temp\2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_539081b1ddcf82ceb603fe66f6d2dd10_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\System\OCWrrBw.exe
  C:\Windows\System\OCWrrBw.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\lNdFlhh.exe
  C:\Windows\System\lNdFlhh.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\BfFWNUW.exe
  C:\Windows\System\BfFWNUW.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\CGuCToQ.exe
  C:\Windows\System\CGuCToQ.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\IBCfRAF.exe
  C:\Windows\System\IBCfRAF.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\VhNdvpI.exe
  C:\Windows\System\VhNdvpI.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\uhSczTj.exe
  C:\Windows\System\uhSczTj.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\BUaWrBw.exe
  C:\Windows\System\BUaWrBw.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\kwQfKkH.exe
  C:\Windows\System\kwQfKkH.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\wwcZkUk.exe
  C:\Windows\System\wwcZkUk.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\AekQMHB.exe
  C:\Windows\System\AekQMHB.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\snXvShk.exe
  C:\Windows\System\snXvShk.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\NypCsQJ.exe
  C:\Windows\System\NypCsQJ.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\HkfhfbQ.exe
  C:\Windows\System\HkfhfbQ.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\XhfJUGT.exe
  C:\Windows\System\XhfJUGT.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\DSkLCxp.exe
  C:\Windows\System\DSkLCxp.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\RaIyLDM.exe
  C:\Windows\System\RaIyLDM.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\xsqAceI.exe
  C:\Windows\System\xsqAceI.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\RMxXqzs.exe
  C:\Windows\System\RMxXqzs.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\ToTlrmN.exe
  C:\Windows\System\ToTlrmN.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\bQYhChl.exe
  C:\Windows\System\bQYhChl.exe
  2⤵
  - Executes dropped EXE
  PID:760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AekQMHB.exe

Path C:\Windows\System\AekQMHB.exe
Size 5.9MB
SHA256 b858d42ffdbc5fafe0f866baacfee1588efb7880d8a1af17a6f1a43be6232b36
MD5 5b6cc8875f0e6e20d33f61b4dcb33551
SHA1 e85b51a972ba8c10bb6d847aca57b782e9e62f14
SHA512 db0bf1630c31a31380098123968b658936c27fef1aa78f2bcf51e6e9febe863015b99072d0f9d16fe53c9e002d530af704c4f6dfc3a2fe2bf4cd83cd5dcdae6e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

AekQMHB.exe

Path C:\Windows\System\AekQMHB.exe
Size 5.9MB
SHA256 05dd3d926d8f7a6b3411e38a31ef4f8229eb7d780b830e3fca3bbab5124eef86
MD5 f6cdfb3d88537b367792cbd894bd98ed
SHA1 3d3f99c94c72c456dffcf949bc5d30603a7e936c
SHA512 0da483abd45f0fc31271e46184ea3a074b58fa3e0dc6bb0072318eee13b5c0ffc1280f1aa582bb4e78cf8a2c355408182d9725282b3a73e6e2dadc9f4f43faa3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

BUaWrBw.exe

Path C:\Windows\System\BUaWrBw.exe
Size 5.9MB
SHA256 2b56b3d1b64fd3a424ed1ac85aa7f390ca50af03f2a2a51fbfb82bfc1cfc6541
MD5 01a576e3f1335ed309ef3919fac916a9
SHA1 8165606312355192c0de78485bb4d25de5ec2007
SHA512 2052cf14df42400fa927c28cc097afb7bcaedf7cbad1b0093901f19a2c972bd17ee8c685a5715764bcc16290a338c4fc3bff6b8291f19fcd43bd18b14b1075a0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

BUaWrBw.exe

Path C:\Windows\System\BUaWrBw.exe
Size 5.8MB
SHA256 1ee51685b7af314df3c8f01c4b39b91c739a420b0c8968c9cd986b716fd08dc9
MD5 d087d60bee972482ba414dde57d94064
SHA1 0e58102d75409e85387c950e86f4cc96da371515
SHA512 500b3e00dc02005c17b03b8494021fddbab5916723a913433d6ef89aa2cf4e6e68fc4172636b2bd68c73de2d44f0d00b4e792d1f453e109ae727ef66e97b6e2b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lS:Q+856utgpPF8u/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

BfFWNUW.exe

Path C:\Windows\System\BfFWNUW.exe
Size 5.9MB
SHA256 fc244ca3e27e5136f6fa28b547128688a0702b70775bb80d1a70abf519cd03ab
MD5 a9bd5031b9c96c192869e838810b10e9
SHA1 473e67565e83d310bd79afc03222ff73c1643c93
SHA512 52c1dd6a756fb4306b14057c8cd4281cbceef10d991bad4da18dc65198984a72db2bd260055315aff1cc796e0993f320f66ca45b62e91bd134767b5562b6bda1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

CGuCToQ.exe

Path C:\Windows\System\CGuCToQ.exe
Size 5.9MB
SHA256 571b59b95a28d334000f3f2daca8caf4aa9fbeb2dd1b82b143791101511d215f
MD5 766beabb16e64599b23170821370ad99
SHA1 62eab6cd42b24ae388b2039dbe55899d640d22e4
SHA512 97c067321f8b336169f732daa103c8da71adbbff30b9c035571e5907a43374cdc82484f5a43ac842f50895871f29963279ddadc060378393c9f30ffa55088887
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

DSkLCxp.exe

Path C:\Windows\System\DSkLCxp.exe
Size 5.9MB
SHA256 0b8e6fe3203697649a255ec782adeccdc6a21b78e3d417a9f3b1bc5408f29e08
MD5 06e3f45b9551e73fb3de14794d2f5c1d
SHA1 33c19f8944e55e8bde65a4bace95d464d051efaf
SHA512 722f65a8b67734e3629e5696013a52fe704a97646e53aca201889fd438eb8fb5784dbaa93362d950808ac95dfaaa32007f47a40a29cbae5c16cd1190e2a08300
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

HkfhfbQ.exe

Path C:\Windows\System\HkfhfbQ.exe
Size 5.9MB
SHA256 e65220be63d0d006388ae41fe3dbee4fa45cf583b27aa25638e1135874e67a8d
MD5 e9dca5492592d6ee5bdd4f8210a617c1
SHA1 61f9e612e49e2bc4e9d9bee58ce2f5d8e12aad1e
SHA512 80b9ca3c3f9bc7c34372b8c45b4ac02cbd590c468d0fdbe4c22c2c7dcfdaea1eff048d736f99e38bbabbb9daaf18092c2098b6c63d368ab94e2c7d2154b75c21
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

IBCfRAF.exe

Path C:\Windows\System\IBCfRAF.exe
Size 5.9MB
SHA256 1ca1403065115aab91177e791cf622afcbfaca50676642ef3970281893eed1e0
MD5 ad826020144ddcb072fd0a713deb39c7
SHA1 6e23b7fb3583e94e9cb8becb9aa226ccd7f0ba2a
SHA512 2017e15241d317c4538dd766c2ac2012fb62803796b3edb4c0d054f2b5131a795239e87fbdf5bbd8eef2674a9a49e892c7ec8073f1016c797ce859ca6dc4ee33
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

NypCsQJ.exe

Path C:\Windows\System\NypCsQJ.exe
Size 5.9MB
SHA256 8c255c9592851ff64a0ba6b6dd31488be1e5fe89fb217c5986c49e0b89b91231
MD5 c02fb3b16e7301165457d9ca11d050a1
SHA1 c7464664d390100c915c2213f86965643cc7dbcd
SHA512 4b5cd48944da4f26138f7fa943fe7a66d6d5baf842982bfe0f9fcec9a5e163ed14264ba1ab73208596f598ea3dea4402624e2936196e11e415d499038f01af81
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

OCWrrBw.exe

Path C:\Windows\System\OCWrrBw.exe
Size 5.9MB
SHA256 d1c7788a42d05e189c23b1c8739965c0dca146e04df5941ccebdb94f8f32dbe6
MD5 4814e7c3fe1d355b6691cb2c9c24b8cc
SHA1 ae5d85b1042b7090933c3302c1b9c33570920bdd
SHA512 cb6f69b6d6e05efdc5ec2ff058b3330c3529b3493808c986134a91b03f2017196776f17d87c008fc81cb7b3d5407771ea487674d362cd73fb50a3b32a4a44e4d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:Q+856utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

RMxXqzs.exe

Path C:\Windows\System\RMxXqzs.exe
Size 5.4MB
SHA256 caa068826195e26df36f4f536e4c6574635de1b7a9a02c85ee8ca5d8d8224bf8
MD5 8003c8ca1c6255c4a9df50b61d369786
SHA1 ef521c59d5519424152618453d9a1ec413a267cf
SHA512 0384a1e885e5629a148689a8b4027e18c5b2d083fe94b00bac0956a112bba29ab292c390c9a09436cf2e74109a83853e787b70a1e1be9d9ef015a376f3eba795
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32I:Q+856utgpPF8u/h
MD5 SHA1 SHA512 SSDEEP

Submit Download

RMxXqzs.exe

Path C:\Windows\System\RMxXqzs.exe
Size 5.9MB
SHA256 740d0214e10273256e32d33dabed10d1582dbbfc6cb904850fd02cd1ef547974
MD5 29d2f84685560d5c5533e4f2e904b126
SHA1 587a0ea5f40243075c52b6f2e2dd96c12690a39d
SHA512 093cefb105f13f38fdae3ec7acefcf353425ffb4eaee2301f6b6ccff9e5e108bbe096439dc4771e6a0455c140064c70ff4e998289de6f8334493235da9b568d6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

RaIyLDM.exe

Path C:\Windows\System\RaIyLDM.exe
Size 5.9MB
SHA256 297df0c9444175069e6df9cdd22075c57f25554277e9b414a3281e92090dd19f
MD5 676c4bb09b07c7cbe31d625dc4bda94a
SHA1 b070d78787edb6237f353d8882a447a7f594ba66
SHA512 5d2a113eb6f64883f3c7e9805a20dc34c5f7b5d60fcf6dd2a7ed069a43148caeb5f9aa2d200c2619a9cc469140ebfba4f8923d95415c17c9588aa627023cdb3d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

ToTlrmN.exe

Path C:\Windows\System\ToTlrmN.exe
Size 5.7MB
SHA256 15b21f96ab3bc949c328ae89ca4b8971cb600187d8a414a03ad62deea81f4ef1
MD5 1d51a6f9f8f706d40a78f27cac287065
SHA1 981c2096ede4558d1ebc91ef5d6ea849a5e05a26
SHA512 f88e4c79c055461a937a826fa6bbc551f208f7399466fa47521581ae4db3bc5d256e1bf01ae134b570a11c9d09f89930e6add7d4c8135ba334d8b29af2c44c97
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ326:Q+856utgpPF8u/D
MD5 SHA1 SHA512 SSDEEP

Submit Download

ToTlrmN.exe

Path C:\Windows\System\ToTlrmN.exe
Size 5.4MB
SHA256 b26b72ca0ef6d18aef032253470a78a13f48dcd486b2eb6e1570c96324293e82
MD5 6fb6863d9548f3879b1ba1b64fc45a68
SHA1 0dc40616de903c417cc9a8b581f9078af09ea60a
SHA512 cf09c13915872b96dcf1f62eac8174c1c1dfa4aabd64fb9272008df1f24e451a988f1edb48cb6ca8b7ef84d58508cf13cc3d0e709b84acf2687dd5617c6c3a61
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32c:Q+856utgpPF8u/p
MD5 SHA1 SHA512 SSDEEP

Submit Download

VhNdvpI.exe

Path C:\Windows\System\VhNdvpI.exe
Size 5.9MB
SHA256 ecb45bacc9ae0121b12dc2bf7a3c9fb1d33bb3a0b72eda01524e7d395be4627b
MD5 e01c95c3d6c3c535f61a4d5e795ef09d
SHA1 03b962618a79bd9cee0fa00e7ef2002ac38723b5
SHA512 6a87ff519666da9492352ce1d2bbad834eb92d014b426af2495051a54658ebb4d9102b1a0f3a935b9f1ce25e6a123c2413eb0fbb2a417917c27119894ecd7613
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

XhfJUGT.exe

Path C:\Windows\System\XhfJUGT.exe
Size 5.9MB
SHA256 cb8faf5d192dffb336f6c3ff32fa150e5464727d0a43944172b74833e424e1ca
MD5 f580b5d790053fee7fff4b76615a03b0
SHA1 989829a8668ec92829b511f8349529db56634e1a
SHA512 aee4c107f1f6fe7f5e0c0358ade0f322c151e02f1fbce2a71be92cfa6486910bb362b6c5c87bab451840438ecb85b10654b0f65432e85eee848ef862cfcc6600
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

XhfJUGT.exe

Path C:\Windows\System\XhfJUGT.exe
Size 4.9MB
SHA256 7a9c3203e1c7834cd1471b3acd063f85cd86718b34b8fa76cc4ae74be283c1c7
MD5 103e85d4eaac8ddfb6f3b5375a6a37fc
SHA1 6477ef58e65eacb00ee5af4a962a0d3112594662
SHA512 00a886159ad63e382e57439a0016449c3fb57a935ef7c5623b795c9d56fb88488e621c9a99e46faef2dc7d44e30da79c32680a0d59435f6d62b041529ca3b504
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32x:Q+856utgpPF8u/Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

bQYhChl.exe

Path C:\Windows\System\bQYhChl.exe
Size 5.8MB
SHA256 0d4a824efda706db87b77805c320758f4772451fa0404efc091a4e3040c61068
MD5 984a8cf637fc9f46a5be1646493a183b
SHA1 eff3045fcb5d0b4a9321004fdd3e94f3f336f5af
SHA512 f10e98d33b97922d86b629662f92ca9b0747603db9cee26627e84885ca9797232c0f5349bf7b35b6812a24bc6e60bd825c6020365d2a762c823adc6158a78b7d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32l5:Q+856utgpPF8u/O
MD5 SHA1 SHA512 SSDEEP

Submit Download

bQYhChl.exe

Path C:\Windows\System\bQYhChl.exe
Size 2.7MB
SHA256 4fd1d5231f529c0710d6a6cd40036ebe10563700b5f25c50aacacf0ccbeb0b9d
MD5 93bacfc3d845f374627b012c3a61a1e5
SHA1 f08219d5f19196fbc7a3a1e7ffbfb44e344c21ae
SHA512 63e909e0f694f7072b09c22815e6279a7448ff3ee9b219e1f03fa23b70411a9de5cd54205f2b9fac218aee1fe5bb1761b1d6308bcade318f7b85c7b720112b83
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIt56uL3pgrCEdMKPFotsgEBr6h:BemTLkNdfE0pZrt56utgpPFotBE6
MD5 SHA1 SHA512 SSDEEP

Submit Download

kwQfKkH.exe

Path C:\Windows\System\kwQfKkH.exe
Size 5.9MB
SHA256 33879e5a12a2a31b2c1696d99c6b00b9be4a86ed520d131f242b20335f2a7caa
MD5 97a3b32ab914edf61295d3e94c7c180f
SHA1 2c5d460cd4feaf57a1d08e24f7fc9d0734206578
SHA512 1d68f991bb283cb42f9f09307f5a86c18058b22f4303bd53e5dce98cb778c9d28f635df040495928b20ed202bd8b51231e992428374ca5475fbee05686374ecb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

lNdFlhh.exe

Path C:\Windows\System\lNdFlhh.exe
Size 5.9MB
SHA256 dfc2569fa25cccd0a4220d6650576af65ce1f16d71c61be9ffad47d81a3e7f77
MD5 f5c5aadf53383494128de801d9240dec
SHA1 3d79785af59d40984d6360aa8273e6e11cfd3ea8
SHA512 daa65c902024c92f425f1a9b62f95c198af693642524fe1856b727e803d69d505a2c4a3ab88016cd6f91c2495f5d8293b2c96114247490c06ebddeba8cb0bd7c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

snXvShk.exe

Path C:\Windows\System\snXvShk.exe
Size 5.9MB
SHA256 a0182c1e607ca54679ba03d7e79a820ff0590c56f6c8abfbe8bc7dea68d442bb
MD5 93d46d62d961e02a56e7181c67a0bc09
SHA1 c6389ab9e89efe7b99a0736d9d797061f214cff9
SHA512 614b0b36f7a483dfc371a701ba312eeb526758a01ce67307bde3467be04e48a6e69443b899629484dccbb069af4a086f81daf874f163c93b2093049b449e3544
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:Q+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

snXvShk.exe

Path C:\Windows\System\snXvShk.exe
Size 5.3MB
SHA256 cea51cc96156d8e8255e2ccada29ae7300a3315f995e7ba6d44446f87dc9a09d
MD5 e8c4508a392ccf08590d3627a36cc3c3
SHA1 3a57dd6c92ebc54582acaafd15cc9311eb0d15a2
SHA512 f92387e78f5fe98543d9e60ae371868a188c86c9137b7d0a0d3bf28026dbd3fc59a4eb30687c1a9721f81959fcdee80d280162f492d355d2ec0e6a7c5d939410
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32S:Q+856utgpPF8u/X
MD5 SHA1 SHA512 SSDEEP

Submit Download

uhSczTj.exe

Path C:\Windows\System\uhSczTj.exe
Size 5.9MB
SHA256 1574f50b90400779343321c5b45228f0c67f3236207f6f2e05d8f41d94100a99
MD5 3a83fba699aec2f700542d00957c1306
SHA1 980ff460bc254ca78bbd121d22a6724fd6632dda
SHA512 e8303b5c7d4447cbbf9d26e6e73e8b1eb9c193645a4b7fb8990f560cf2846f2fa4e795288b17818df8820779b75e773698422448830afcc53c2c11dabc425359
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

wwcZkUk.exe

Path C:\Windows\System\wwcZkUk.exe
Size 5.6MB
SHA256 54a03d5d208d751b31e23b71307944c1879786db4797c4e135ceee676e41235a
MD5 1e2459942327eb396bd8cd9cbc885d14
SHA1 b979cbcb517509c30843efb1d91bef30f1f24a44
SHA512 62534d80e6c8c22bb311b0a7f5fb302c5a153d567d6f207a17c6fee8290718e68d1dc2dc16c134b4032b4de9f3329105695e611408c440b9aa805aa38dc8aaf7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32C:Q+856utgpPF8u/j
MD5 SHA1 SHA512 SSDEEP

Submit Download

xsqAceI.exe

Path C:\Windows\System\xsqAceI.exe
Size 5.9MB
SHA256 200904411adac6d2f4ed063988c6d38da3019ca912e74097037f389ff3da2d12
MD5 b6ad2e9c5a69e4c25332dd6cbeac8dfb
SHA1 5717486199ba68ab9df2cde8731fedab301962bb
SHA512 9d74e3b5577e624687c00dfefb75f07f3d6bf40fab8a6806e41549efa74f1f9d69d6cd1ea5207229b320d91058baa6b3a9ce6aadaf249e809d12ed16bf379246
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-129-0x00007FF7C9240000-0x00007FF7C9594000-memory.dmp

Download

memory/208-157-0x00007FF7C9240000-0x00007FF7C9594000-memory.dmp

Download

memory/432-24-0x00007FF60FA40000-0x00007FF60FD94000-memory.dmp

Download

memory/432-142-0x00007FF60FA40000-0x00007FF60FD94000-memory.dmp

Download

memory/760-159-0x00007FF7B9420000-0x00007FF7B9774000-memory.dmp

Download

memory/760-132-0x00007FF7B9420000-0x00007FF7B9774000-memory.dmp

Download

memory/1180-145-0x00007FF714630000-0x00007FF714984000-memory.dmp

Download

memory/1180-133-0x00007FF714630000-0x00007FF714984000-memory.dmp

Download

memory/1180-38-0x00007FF714630000-0x00007FF714984000-memory.dmp

Download

memory/1312-154-0x00007FF7CB350000-0x00007FF7CB6A4000-memory.dmp

Download

memory/1312-94-0x00007FF7CB350000-0x00007FF7CB6A4000-memory.dmp

Download

memory/1312-139-0x00007FF7CB350000-0x00007FF7CB6A4000-memory.dmp

Download

memory/1552-135-0x00007FF7CC370000-0x00007FF7CC6C4000-memory.dmp

Download

memory/1552-151-0x00007FF7CC370000-0x00007FF7CC6C4000-memory.dmp

Download

memory/1552-67-0x00007FF7CC370000-0x00007FF7CC6C4000-memory.dmp

Download

memory/2108-0-0x00007FF6E2530000-0x00007FF6E2884000-memory.dmp

Download

memory/2108-62-0x00007FF6E2530000-0x00007FF6E2884000-memory.dmp

Download

memory/2108-1-0x0000020E23FA0000-0x0000020E23FB0000-memory.dmp

Download

memory/2356-75-0x00007FF713390000-0x00007FF7136E4000-memory.dmp

Download

memory/2356-137-0x00007FF713390000-0x00007FF7136E4000-memory.dmp

Download

memory/2356-150-0x00007FF713390000-0x00007FF7136E4000-memory.dmp

Download

memory/2748-51-0x00007FF602210000-0x00007FF602564000-memory.dmp

Download

memory/2748-147-0x00007FF602210000-0x00007FF602564000-memory.dmp

Download

memory/2824-69-0x00007FF63F600000-0x00007FF63F954000-memory.dmp

Download

memory/2824-140-0x00007FF63F600000-0x00007FF63F954000-memory.dmp

Download

memory/2824-8-0x00007FF63F600000-0x00007FF63F954000-memory.dmp

Download

memory/3480-131-0x00007FF76FD30000-0x00007FF770084000-memory.dmp

Download

memory/3480-160-0x00007FF76FD30000-0x00007FF770084000-memory.dmp

Download

memory/3716-18-0x00007FF60EB00000-0x00007FF60EE54000-memory.dmp

Download

memory/3716-143-0x00007FF60EB00000-0x00007FF60EE54000-memory.dmp

Download

memory/3716-79-0x00007FF60EB00000-0x00007FF60EE54000-memory.dmp

Download

memory/3928-47-0x00007FF6333E0000-0x00007FF633734000-memory.dmp

Download

memory/3928-146-0x00007FF6333E0000-0x00007FF633734000-memory.dmp

Download

memory/4104-128-0x00007FF603AF0000-0x00007FF603E44000-memory.dmp

Download

memory/4104-156-0x00007FF603AF0000-0x00007FF603E44000-memory.dmp

Download

memory/4192-130-0x00007FF739C90000-0x00007FF739FE4000-memory.dmp

Download

memory/4192-158-0x00007FF739C90000-0x00007FF739FE4000-memory.dmp

Download

memory/4344-153-0x00007FF627720000-0x00007FF627A74000-memory.dmp

Download

memory/4344-92-0x00007FF627720000-0x00007FF627A74000-memory.dmp

Download

memory/4396-155-0x00007FF7DD370000-0x00007FF7DD6C4000-memory.dmp

Download

memory/4396-127-0x00007FF7DD370000-0x00007FF7DD6C4000-memory.dmp

Download

memory/4488-136-0x00007FF619B70000-0x00007FF619EC4000-memory.dmp

Download

memory/4488-149-0x00007FF619B70000-0x00007FF619EC4000-memory.dmp

Download

memory/4488-70-0x00007FF619B70000-0x00007FF619EC4000-memory.dmp

Download

memory/4788-76-0x00007FF60BB50000-0x00007FF60BEA4000-memory.dmp

Download

memory/4788-12-0x00007FF60BB50000-0x00007FF60BEA4000-memory.dmp

Download

memory/4788-141-0x00007FF60BB50000-0x00007FF60BEA4000-memory.dmp

Download

memory/5024-30-0x00007FF6E2090000-0x00007FF6E23E4000-memory.dmp

Download

memory/5024-144-0x00007FF6E2090000-0x00007FF6E23E4000-memory.dmp

Download

memory/5024-126-0x00007FF6E2090000-0x00007FF6E23E4000-memory.dmp

Download

memory/5068-148-0x00007FF6DA9F0000-0x00007FF6DAD44000-memory.dmp

Download

memory/5068-134-0x00007FF6DA9F0000-0x00007FF6DAD44000-memory.dmp

Download

memory/5068-61-0x00007FF6DA9F0000-0x00007FF6DAD44000-memory.dmp

Download

memory/5108-152-0x00007FF766C20000-0x00007FF766F74000-memory.dmp

Download

memory/5108-138-0x00007FF766C20000-0x00007FF766F74000-memory.dmp

Download

memory/5108-78-0x00007FF766C20000-0x00007FF766F74000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads