cobaltstrike | 40c4c891d39ae7918c0dc45a87e6fa6a5c3fa6732c0412305492c8f69e59ec8b

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-cf8fdaeg64
SHA256 40c4c891d39ae7918c0dc45a87e6fa6a5c3fa6732c0412305492c8f69e59ec8b
MD5 85b069a8a846539b611fc33a5a8753a4
SHA1 f6209be1149a90a8b6cece16e023e7c77ad30edf
SHA512 41ae935d13b6c5a123cb6a9ee326f939eeeab24faa2208998105d3c550ec6d014b4d87a132db4701deac90706ca0a1c6d5b1b24529ed60ab2bdef266dc3413f1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00090000000235b8-6.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235c0-11.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235bf-10.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235c1-25.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235c2-30.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235c3-34.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000235bc-52.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235c6-57.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235c8-69.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235c9-71.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235ca-76.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235cd-90.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235d0-113.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235d1-123.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235cf-116.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235ce-101.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235cc-88.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235cb-85.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235c7-64.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235c5-48.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000235c4-45.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x00090000000235b8-6.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235c0-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235bf-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235c1-25.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235c2-30.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235c3-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00080000000235bc-52.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235c6-57.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235c8-69.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235c9-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235ca-76.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235cd-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235d0-113.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235d1-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235cf-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235ce-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235cc-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235cb-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235c7-64.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235c5-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000235c4-45.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1056-0-0x00007FF64DE10000-0x00007FF64E164000-memory.dmp	UPX
behavioral2/files/0x00090000000235b8-6.dat	UPX
behavioral2/memory/1392-9-0x00007FF615830000-0x00007FF615B84000-memory.dmp	UPX
behavioral2/files/0x00070000000235c0-11.dat	UPX
behavioral2/files/0x00070000000235bf-10.dat	UPX
behavioral2/memory/4608-14-0x00007FF7AA080000-0x00007FF7AA3D4000-memory.dmp	UPX
behavioral2/memory/3016-18-0x00007FF690400000-0x00007FF690754000-memory.dmp	UPX
behavioral2/memory/4800-24-0x00007FF7BB850000-0x00007FF7BBBA4000-memory.dmp	UPX
behavioral2/files/0x00070000000235c1-25.dat	UPX
behavioral2/files/0x00070000000235c2-30.dat	UPX
behavioral2/files/0x00070000000235c3-34.dat	UPX
behavioral2/memory/1728-40-0x00007FF6D8BD0000-0x00007FF6D8F24000-memory.dmp	UPX
behavioral2/files/0x00080000000235bc-52.dat	UPX
behavioral2/files/0x00070000000235c6-57.dat	UPX
behavioral2/files/0x00070000000235c8-69.dat	UPX
behavioral2/files/0x00070000000235c9-71.dat	UPX
behavioral2/files/0x00070000000235ca-76.dat	UPX
behavioral2/files/0x00070000000235cd-90.dat	UPX
behavioral2/memory/4056-92-0x00007FF688F30000-0x00007FF689284000-memory.dmp	UPX
behavioral2/memory/4952-99-0x00007FF7C2E60000-0x00007FF7C31B4000-memory.dmp	UPX
behavioral2/memory/384-105-0x00007FF63AF80000-0x00007FF63B2D4000-memory.dmp	UPX
behavioral2/files/0x00070000000235d0-113.dat	UPX
behavioral2/memory/1616-126-0x00007FF66DA60000-0x00007FF66DDB4000-memory.dmp	UPX
behavioral2/memory/536-127-0x00007FF759580000-0x00007FF7598D4000-memory.dmp	UPX
behavioral2/memory/3520-125-0x00007FF7649A0000-0x00007FF764CF4000-memory.dmp	UPX
behavioral2/files/0x00070000000235d1-123.dat	UPX
behavioral2/memory/4372-122-0x00007FF7ACCE0000-0x00007FF7AD034000-memory.dmp	UPX
behavioral2/memory/1932-119-0x00007FF72A380000-0x00007FF72A6D4000-memory.dmp	UPX
behavioral2/files/0x00070000000235cf-116.dat	UPX
behavioral2/memory/908-115-0x00007FF73BFB0000-0x00007FF73C304000-memory.dmp	UPX
behavioral2/memory/4048-112-0x00007FF7C0F10000-0x00007FF7C1264000-memory.dmp	UPX
behavioral2/memory/3472-111-0x00007FF6ED740000-0x00007FF6EDA94000-memory.dmp	UPX
behavioral2/memory/1356-104-0x00007FF6BAF50000-0x00007FF6BB2A4000-memory.dmp	UPX
behavioral2/memory/1408-103-0x00007FF64E910000-0x00007FF64EC64000-memory.dmp	UPX
behavioral2/files/0x00070000000235ce-101.dat	UPX
behavioral2/memory/2068-100-0x00007FF74AE70000-0x00007FF74B1C4000-memory.dmp	UPX
behavioral2/memory/3716-95-0x00007FF6CDD40000-0x00007FF6CE094000-memory.dmp	UPX
behavioral2/files/0x00070000000235cc-88.dat	UPX
behavioral2/files/0x00070000000235cb-85.dat	UPX
behavioral2/files/0x00070000000235c7-64.dat	UPX
behavioral2/files/0x00070000000235c5-48.dat	UPX
behavioral2/files/0x00070000000235c4-45.dat	UPX
behavioral2/memory/2340-38-0x00007FF6FF910000-0x00007FF6FFC64000-memory.dmp	UPX
behavioral2/memory/1056-128-0x00007FF64DE10000-0x00007FF64E164000-memory.dmp	UPX
behavioral2/memory/1392-129-0x00007FF615830000-0x00007FF615B84000-memory.dmp	UPX
behavioral2/memory/4608-130-0x00007FF7AA080000-0x00007FF7AA3D4000-memory.dmp	UPX
behavioral2/memory/3016-131-0x00007FF690400000-0x00007FF690754000-memory.dmp	UPX
behavioral2/memory/4800-132-0x00007FF7BB850000-0x00007FF7BBBA4000-memory.dmp	UPX
behavioral2/memory/1392-133-0x00007FF615830000-0x00007FF615B84000-memory.dmp	UPX
behavioral2/memory/4608-134-0x00007FF7AA080000-0x00007FF7AA3D4000-memory.dmp	UPX
behavioral2/memory/3016-135-0x00007FF690400000-0x00007FF690754000-memory.dmp	UPX
behavioral2/memory/2340-137-0x00007FF6FF910000-0x00007FF6FFC64000-memory.dmp	UPX
behavioral2/memory/4800-136-0x00007FF7BB850000-0x00007FF7BBBA4000-memory.dmp	UPX
behavioral2/memory/3716-139-0x00007FF6CDD40000-0x00007FF6CE094000-memory.dmp	UPX
behavioral2/memory/4056-141-0x00007FF688F30000-0x00007FF689284000-memory.dmp	UPX
behavioral2/memory/4952-140-0x00007FF7C2E60000-0x00007FF7C31B4000-memory.dmp	UPX
behavioral2/memory/1728-138-0x00007FF6D8BD0000-0x00007FF6D8F24000-memory.dmp	UPX
behavioral2/memory/2068-142-0x00007FF74AE70000-0x00007FF74B1C4000-memory.dmp	UPX
behavioral2/memory/1356-145-0x00007FF6BAF50000-0x00007FF6BB2A4000-memory.dmp	UPX
behavioral2/memory/4048-147-0x00007FF7C0F10000-0x00007FF7C1264000-memory.dmp	UPX
behavioral2/memory/908-148-0x00007FF73BFB0000-0x00007FF73C304000-memory.dmp	UPX
behavioral2/memory/1408-146-0x00007FF64E910000-0x00007FF64EC64000-memory.dmp	UPX
behavioral2/memory/384-144-0x00007FF63AF80000-0x00007FF63B2D4000-memory.dmp	UPX
behavioral2/memory/3472-143-0x00007FF6ED740000-0x00007FF6EDA94000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1056-0-0x00007FF64DE10000-0x00007FF64E164000-memory.dmp	xmrig
behavioral2/files/0x00090000000235b8-6.dat	xmrig
behavioral2/memory/1392-9-0x00007FF615830000-0x00007FF615B84000-memory.dmp	xmrig
behavioral2/files/0x00070000000235c0-11.dat	xmrig
behavioral2/files/0x00070000000235bf-10.dat	xmrig
behavioral2/memory/4608-14-0x00007FF7AA080000-0x00007FF7AA3D4000-memory.dmp	xmrig
behavioral2/memory/3016-18-0x00007FF690400000-0x00007FF690754000-memory.dmp	xmrig
behavioral2/memory/4800-24-0x00007FF7BB850000-0x00007FF7BBBA4000-memory.dmp	xmrig
behavioral2/files/0x00070000000235c1-25.dat	xmrig
behavioral2/files/0x00070000000235c2-30.dat	xmrig
behavioral2/files/0x00070000000235c3-34.dat	xmrig
behavioral2/memory/1728-40-0x00007FF6D8BD0000-0x00007FF6D8F24000-memory.dmp	xmrig
behavioral2/files/0x00080000000235bc-52.dat	xmrig
behavioral2/files/0x00070000000235c6-57.dat	xmrig
behavioral2/files/0x00070000000235c8-69.dat	xmrig
behavioral2/files/0x00070000000235c9-71.dat	xmrig
behavioral2/files/0x00070000000235ca-76.dat	xmrig
behavioral2/files/0x00070000000235cd-90.dat	xmrig
behavioral2/memory/4056-92-0x00007FF688F30000-0x00007FF689284000-memory.dmp	xmrig
behavioral2/memory/4952-99-0x00007FF7C2E60000-0x00007FF7C31B4000-memory.dmp	xmrig
behavioral2/memory/384-105-0x00007FF63AF80000-0x00007FF63B2D4000-memory.dmp	xmrig
behavioral2/files/0x00070000000235d0-113.dat	xmrig
behavioral2/memory/1616-126-0x00007FF66DA60000-0x00007FF66DDB4000-memory.dmp	xmrig
behavioral2/memory/536-127-0x00007FF759580000-0x00007FF7598D4000-memory.dmp	xmrig
behavioral2/memory/3520-125-0x00007FF7649A0000-0x00007FF764CF4000-memory.dmp	xmrig
behavioral2/files/0x00070000000235d1-123.dat	xmrig
behavioral2/memory/4372-122-0x00007FF7ACCE0000-0x00007FF7AD034000-memory.dmp	xmrig
behavioral2/memory/1932-119-0x00007FF72A380000-0x00007FF72A6D4000-memory.dmp	xmrig
behavioral2/files/0x00070000000235cf-116.dat	xmrig
behavioral2/memory/908-115-0x00007FF73BFB0000-0x00007FF73C304000-memory.dmp	xmrig
behavioral2/memory/4048-112-0x00007FF7C0F10000-0x00007FF7C1264000-memory.dmp	xmrig
behavioral2/memory/3472-111-0x00007FF6ED740000-0x00007FF6EDA94000-memory.dmp	xmrig
behavioral2/memory/1356-104-0x00007FF6BAF50000-0x00007FF6BB2A4000-memory.dmp	xmrig
behavioral2/memory/1408-103-0x00007FF64E910000-0x00007FF64EC64000-memory.dmp	xmrig
behavioral2/files/0x00070000000235ce-101.dat	xmrig
behavioral2/memory/2068-100-0x00007FF74AE70000-0x00007FF74B1C4000-memory.dmp	xmrig
behavioral2/memory/3716-95-0x00007FF6CDD40000-0x00007FF6CE094000-memory.dmp	xmrig
behavioral2/files/0x00070000000235cc-88.dat	xmrig
behavioral2/files/0x00070000000235cb-85.dat	xmrig
behavioral2/files/0x00070000000235c7-64.dat	xmrig
behavioral2/files/0x00070000000235c5-48.dat	xmrig
behavioral2/files/0x00070000000235c4-45.dat	xmrig
behavioral2/memory/2340-38-0x00007FF6FF910000-0x00007FF6FFC64000-memory.dmp	xmrig
behavioral2/memory/1056-128-0x00007FF64DE10000-0x00007FF64E164000-memory.dmp	xmrig
behavioral2/memory/1392-129-0x00007FF615830000-0x00007FF615B84000-memory.dmp	xmrig
behavioral2/memory/4608-130-0x00007FF7AA080000-0x00007FF7AA3D4000-memory.dmp	xmrig
behavioral2/memory/3016-131-0x00007FF690400000-0x00007FF690754000-memory.dmp	xmrig
behavioral2/memory/4800-132-0x00007FF7BB850000-0x00007FF7BBBA4000-memory.dmp	xmrig
behavioral2/memory/1392-133-0x00007FF615830000-0x00007FF615B84000-memory.dmp	xmrig
behavioral2/memory/4608-134-0x00007FF7AA080000-0x00007FF7AA3D4000-memory.dmp	xmrig
behavioral2/memory/3016-135-0x00007FF690400000-0x00007FF690754000-memory.dmp	xmrig
behavioral2/memory/2340-137-0x00007FF6FF910000-0x00007FF6FFC64000-memory.dmp	xmrig
behavioral2/memory/4800-136-0x00007FF7BB850000-0x00007FF7BBBA4000-memory.dmp	xmrig
behavioral2/memory/3716-139-0x00007FF6CDD40000-0x00007FF6CE094000-memory.dmp	xmrig
behavioral2/memory/4056-141-0x00007FF688F30000-0x00007FF689284000-memory.dmp	xmrig
behavioral2/memory/4952-140-0x00007FF7C2E60000-0x00007FF7C31B4000-memory.dmp	xmrig
behavioral2/memory/1728-138-0x00007FF6D8BD0000-0x00007FF6D8F24000-memory.dmp	xmrig
behavioral2/memory/2068-142-0x00007FF74AE70000-0x00007FF74B1C4000-memory.dmp	xmrig
behavioral2/memory/1356-145-0x00007FF6BAF50000-0x00007FF6BB2A4000-memory.dmp	xmrig
behavioral2/memory/4048-147-0x00007FF7C0F10000-0x00007FF7C1264000-memory.dmp	xmrig
behavioral2/memory/908-148-0x00007FF73BFB0000-0x00007FF73C304000-memory.dmp	xmrig
behavioral2/memory/1408-146-0x00007FF64E910000-0x00007FF64EC64000-memory.dmp	xmrig
behavioral2/memory/384-144-0x00007FF63AF80000-0x00007FF63B2D4000-memory.dmp	xmrig
behavioral2/memory/3472-143-0x00007FF6ED740000-0x00007FF6EDA94000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1392	YUJzdNG.exe
4608	UAdsQZH.exe
3016	NJuBeYe.exe
4800	CEQqUYA.exe
2340	kDbwrgQ.exe
1728	mLzaDBR.exe
4056	XLheihT.exe
3716	KTXWrkb.exe
4952	ZNcwVJp.exe
2068	qeiqUxe.exe
1408	LFwzXcM.exe
1356	ZbuALEb.exe
384	ojIbGQl.exe
3472	GggunFz.exe
4048	UpwIjay.exe
908	IxfwwjP.exe
1932	UJEElQv.exe
4372	ftCTltS.exe
3520	TGQaqPt.exe
1616	IUiiCEZ.exe
536	qAPwcha.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1056-0-0x00007FF64DE10000-0x00007FF64E164000-memory.dmp	upx
behavioral2/files/0x00090000000235b8-6.dat	upx
behavioral2/memory/1392-9-0x00007FF615830000-0x00007FF615B84000-memory.dmp	upx
behavioral2/files/0x00070000000235c0-11.dat	upx
behavioral2/files/0x00070000000235bf-10.dat	upx
behavioral2/memory/4608-14-0x00007FF7AA080000-0x00007FF7AA3D4000-memory.dmp	upx
behavioral2/memory/3016-18-0x00007FF690400000-0x00007FF690754000-memory.dmp	upx
behavioral2/memory/4800-24-0x00007FF7BB850000-0x00007FF7BBBA4000-memory.dmp	upx
behavioral2/files/0x00070000000235c1-25.dat	upx
behavioral2/files/0x00070000000235c2-30.dat	upx
behavioral2/files/0x00070000000235c3-34.dat	upx
behavioral2/memory/1728-40-0x00007FF6D8BD0000-0x00007FF6D8F24000-memory.dmp	upx
behavioral2/files/0x00080000000235bc-52.dat	upx
behavioral2/files/0x00070000000235c6-57.dat	upx
behavioral2/files/0x00070000000235c8-69.dat	upx
behavioral2/files/0x00070000000235c9-71.dat	upx
behavioral2/files/0x00070000000235ca-76.dat	upx
behavioral2/files/0x00070000000235cd-90.dat	upx
behavioral2/memory/4056-92-0x00007FF688F30000-0x00007FF689284000-memory.dmp	upx
behavioral2/memory/4952-99-0x00007FF7C2E60000-0x00007FF7C31B4000-memory.dmp	upx
behavioral2/memory/384-105-0x00007FF63AF80000-0x00007FF63B2D4000-memory.dmp	upx
behavioral2/files/0x00070000000235d0-113.dat	upx
behavioral2/memory/1616-126-0x00007FF66DA60000-0x00007FF66DDB4000-memory.dmp	upx
behavioral2/memory/536-127-0x00007FF759580000-0x00007FF7598D4000-memory.dmp	upx
behavioral2/memory/3520-125-0x00007FF7649A0000-0x00007FF764CF4000-memory.dmp	upx
behavioral2/files/0x00070000000235d1-123.dat	upx
behavioral2/memory/4372-122-0x00007FF7ACCE0000-0x00007FF7AD034000-memory.dmp	upx
behavioral2/memory/1932-119-0x00007FF72A380000-0x00007FF72A6D4000-memory.dmp	upx
behavioral2/files/0x00070000000235cf-116.dat	upx
behavioral2/memory/908-115-0x00007FF73BFB0000-0x00007FF73C304000-memory.dmp	upx
behavioral2/memory/4048-112-0x00007FF7C0F10000-0x00007FF7C1264000-memory.dmp	upx
behavioral2/memory/3472-111-0x00007FF6ED740000-0x00007FF6EDA94000-memory.dmp	upx
behavioral2/memory/1356-104-0x00007FF6BAF50000-0x00007FF6BB2A4000-memory.dmp	upx
behavioral2/memory/1408-103-0x00007FF64E910000-0x00007FF64EC64000-memory.dmp	upx
behavioral2/files/0x00070000000235ce-101.dat	upx
behavioral2/memory/2068-100-0x00007FF74AE70000-0x00007FF74B1C4000-memory.dmp	upx
behavioral2/memory/3716-95-0x00007FF6CDD40000-0x00007FF6CE094000-memory.dmp	upx
behavioral2/files/0x00070000000235cc-88.dat	upx
behavioral2/files/0x00070000000235cb-85.dat	upx
behavioral2/files/0x00070000000235c7-64.dat	upx
behavioral2/files/0x00070000000235c5-48.dat	upx
behavioral2/files/0x00070000000235c4-45.dat	upx
behavioral2/memory/2340-38-0x00007FF6FF910000-0x00007FF6FFC64000-memory.dmp	upx
behavioral2/memory/1056-128-0x00007FF64DE10000-0x00007FF64E164000-memory.dmp	upx
behavioral2/memory/1392-129-0x00007FF615830000-0x00007FF615B84000-memory.dmp	upx
behavioral2/memory/4608-130-0x00007FF7AA080000-0x00007FF7AA3D4000-memory.dmp	upx
behavioral2/memory/3016-131-0x00007FF690400000-0x00007FF690754000-memory.dmp	upx
behavioral2/memory/4800-132-0x00007FF7BB850000-0x00007FF7BBBA4000-memory.dmp	upx
behavioral2/memory/1392-133-0x00007FF615830000-0x00007FF615B84000-memory.dmp	upx
behavioral2/memory/4608-134-0x00007FF7AA080000-0x00007FF7AA3D4000-memory.dmp	upx
behavioral2/memory/3016-135-0x00007FF690400000-0x00007FF690754000-memory.dmp	upx
behavioral2/memory/2340-137-0x00007FF6FF910000-0x00007FF6FFC64000-memory.dmp	upx
behavioral2/memory/4800-136-0x00007FF7BB850000-0x00007FF7BBBA4000-memory.dmp	upx
behavioral2/memory/3716-139-0x00007FF6CDD40000-0x00007FF6CE094000-memory.dmp	upx
behavioral2/memory/4056-141-0x00007FF688F30000-0x00007FF689284000-memory.dmp	upx
behavioral2/memory/4952-140-0x00007FF7C2E60000-0x00007FF7C31B4000-memory.dmp	upx
behavioral2/memory/1728-138-0x00007FF6D8BD0000-0x00007FF6D8F24000-memory.dmp	upx
behavioral2/memory/2068-142-0x00007FF74AE70000-0x00007FF74B1C4000-memory.dmp	upx
behavioral2/memory/1356-145-0x00007FF6BAF50000-0x00007FF6BB2A4000-memory.dmp	upx
behavioral2/memory/4048-147-0x00007FF7C0F10000-0x00007FF7C1264000-memory.dmp	upx
behavioral2/memory/908-148-0x00007FF73BFB0000-0x00007FF73C304000-memory.dmp	upx
behavioral2/memory/1408-146-0x00007FF64E910000-0x00007FF64EC64000-memory.dmp	upx
behavioral2/memory/384-144-0x00007FF63AF80000-0x00007FF63B2D4000-memory.dmp	upx
behavioral2/memory/3472-143-0x00007FF6ED740000-0x00007FF6EDA94000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\IUiiCEZ.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YUJzdNG.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UAdsQZH.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qeiqUxe.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IxfwwjP.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ojIbGQl.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UpwIjay.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UJEElQv.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NJuBeYe.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CEQqUYA.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZNcwVJp.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LFwzXcM.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kDbwrgQ.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZbuALEb.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GggunFz.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qAPwcha.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TGQaqPt.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mLzaDBR.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XLheihT.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KTXWrkb.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ftCTltS.exe	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1392	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	93
PID 1056 wrote to memory of 1392	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	93
PID 1056 wrote to memory of 4608	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	94
PID 1056 wrote to memory of 4608	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	94
PID 1056 wrote to memory of 3016	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	95
PID 1056 wrote to memory of 3016	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	95
PID 1056 wrote to memory of 4800	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	96
PID 1056 wrote to memory of 4800	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	96
PID 1056 wrote to memory of 2340	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	97
PID 1056 wrote to memory of 2340	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	97
PID 1056 wrote to memory of 1728	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	98
PID 1056 wrote to memory of 1728	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	98
PID 1056 wrote to memory of 4056	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	99
PID 1056 wrote to memory of 4056	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	99
PID 1056 wrote to memory of 3716	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	100
PID 1056 wrote to memory of 3716	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	100
PID 1056 wrote to memory of 4952	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	101
PID 1056 wrote to memory of 4952	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	101
PID 1056 wrote to memory of 2068	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	102
PID 1056 wrote to memory of 2068	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	102
PID 1056 wrote to memory of 1408	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	103
PID 1056 wrote to memory of 1408	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	103
PID 1056 wrote to memory of 1356	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	104
PID 1056 wrote to memory of 1356	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	104
PID 1056 wrote to memory of 384	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	105
PID 1056 wrote to memory of 384	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	105
PID 1056 wrote to memory of 3472	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	106
PID 1056 wrote to memory of 3472	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	106
PID 1056 wrote to memory of 4048	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	107
PID 1056 wrote to memory of 4048	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	107
PID 1056 wrote to memory of 908	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	108
PID 1056 wrote to memory of 908	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	108
PID 1056 wrote to memory of 1932	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	109
PID 1056 wrote to memory of 1932	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	109
PID 1056 wrote to memory of 4372	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	110
PID 1056 wrote to memory of 4372	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	110
PID 1056 wrote to memory of 3520	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	111
PID 1056 wrote to memory of 3520	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	111
PID 1056 wrote to memory of 1616	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	112
PID 1056 wrote to memory of 1616	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	112
PID 1056 wrote to memory of 536	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	113
PID 1056 wrote to memory of 536	1056	2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe	113

C:\Users\Admin\AppData\Local\Temp\2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_85b069a8a846539b611fc33a5a8753a4_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\System\YUJzdNG.exe
  C:\Windows\System\YUJzdNG.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\UAdsQZH.exe
  C:\Windows\System\UAdsQZH.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\NJuBeYe.exe
  C:\Windows\System\NJuBeYe.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\CEQqUYA.exe
  C:\Windows\System\CEQqUYA.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\kDbwrgQ.exe
  C:\Windows\System\kDbwrgQ.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\mLzaDBR.exe
  C:\Windows\System\mLzaDBR.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\XLheihT.exe
  C:\Windows\System\XLheihT.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\KTXWrkb.exe
  C:\Windows\System\KTXWrkb.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\ZNcwVJp.exe
  C:\Windows\System\ZNcwVJp.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\qeiqUxe.exe
  C:\Windows\System\qeiqUxe.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\LFwzXcM.exe
  C:\Windows\System\LFwzXcM.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\ZbuALEb.exe
  C:\Windows\System\ZbuALEb.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\ojIbGQl.exe
  C:\Windows\System\ojIbGQl.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\GggunFz.exe
  C:\Windows\System\GggunFz.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\UpwIjay.exe
  C:\Windows\System\UpwIjay.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\IxfwwjP.exe
  C:\Windows\System\IxfwwjP.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\UJEElQv.exe
  C:\Windows\System\UJEElQv.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\ftCTltS.exe
  C:\Windows\System\ftCTltS.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\TGQaqPt.exe
  C:\Windows\System\TGQaqPt.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\IUiiCEZ.exe
  C:\Windows\System\IUiiCEZ.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\qAPwcha.exe
  C:\Windows\System\qAPwcha.exe
  2⤵
  - Executes dropped EXE
  PID:536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4368,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
1⤵
PID:4016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CEQqUYA.exe

Path C:\Windows\System\CEQqUYA.exe
Size 5.9MB
SHA256 fae504aaa78732311e4513b9c82ec0542ef57aa3fa3aab5cb5d61bf5d5061f10
MD5 af75cb98acfd713e6b9c17845faad0dd
SHA1 ac85d9336c523dd5e2f3536bd5df7ef7f4a91e24
SHA512 f121721e46ab7c3e36be451a78922ace0981c5a5df1ac112d8fafc309cefd1a9ac5482bf7edab9e1e97ec71e3a9464862f0a641476fc336a0c0e51373b413ccc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

GggunFz.exe

Path C:\Windows\System\GggunFz.exe
Size 5.9MB
SHA256 54977d4bdfcd85b2c8c5fd3036a5af69c7b92a14c098630a92b4502834f4e68a
MD5 a021b34379a51f9942df11538ab91175
SHA1 7ff551646a2d70b58a3028ea4c07ecbc495b29f8
SHA512 cdc03480783b314ab067e0b5a0482b1bc923cfe8dd698b387e5c644f8b59619623a72c44715805decf6bdc87b782e06a14c0d2ebe92c20a6b4758146dbd47856
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

IUiiCEZ.exe

Path C:\Windows\System\IUiiCEZ.exe
Size 5.9MB
SHA256 3ff525748e5cab554777d2250112cf718a33bdbea038986b871c93744796e18d
MD5 3a0fcf7abcd811869ba54e2eeae8e661
SHA1 d2f1b1e226760623ee9ee9272896dfa89f768c37
SHA512 e05c756dd5c742f1d993f1cd018653c30f2f7d1228429f9a234ed3bd668404b58b025bc73e7ff4ca5c5a1897bb7f4e30072b8fd87b0f66d599be0e31fee1c43c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

IxfwwjP.exe

Path C:\Windows\System\IxfwwjP.exe
Size 5.9MB
SHA256 62559116b0b573d9053b529b90944074e24a74a10601e882e77caf7bbaa824d4
MD5 da1faf2d4fb90103484038eb8a54b30d
SHA1 68e2d77c27692992ee36f75dc0db6588b11db4ab
SHA512 eea6dc11866993d6e37109df25ad54d76669e0bc55e076afd5fe57ae8ebac6d5d18927f5b6e4b17f45122a05368b78e230946dd41479f43e64fa8ccab35a81e5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

KTXWrkb.exe

Path C:\Windows\System\KTXWrkb.exe
Size 5.9MB
SHA256 10f369ee28f82f4c22864a8d3a440ae50e6992c457604f93ee5bd3a9398ab064
MD5 4f8ded73c5da2310fc886231c59d86fb
SHA1 6e46bed317fc556206a1fd1e392ff981a0a736cc
SHA512 f630384bd07e9b83d399cd17f73dd5049812ce6d05803e89bdcaf44b5002e7822cdacd76f38f38a91cd05ec209af6527257f7fdda262538851d8e707be4ddd8c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

LFwzXcM.exe

Path C:\Windows\System\LFwzXcM.exe
Size 5.9MB
SHA256 da6ce075fadd70604bbd83da12d63593e850d010578da7b5e70ff0fb353fd1a5
MD5 2f5991a1a816ccffc85ccb1aa04b6e3a
SHA1 f6e50b7273125131a3a2458027156512d7344d9e
SHA512 28ee9d102d9529191c373f646506c5c191dc971bfb3c056284a4430f5c86695debb4bb8dddbd16071c928d0a5df98b3d02d84bd767a88ab3c9b105939810c42a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

NJuBeYe.exe

Path C:\Windows\System\NJuBeYe.exe
Size 5.9MB
SHA256 c19f53445d8477c8aee5b24400f1b7efae8a06ead3d1eab54b245b4b354e8182
MD5 69296b3219b65bb562e4ab32443c3b35
SHA1 3e1233bd276362c6e691aaf5ecaf0e7331d43bfe
SHA512 679c95e34418ea1a6e8da3b74cbbdfed650e7e9eb3aa78b498e661e3102450d1f624cd1a5ca1bb2f6e03104a9e3ad0576a7b4c0d7284a903a32e7ec5dee0e977
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

TGQaqPt.exe

Path C:\Windows\System\TGQaqPt.exe
Size 5.9MB
SHA256 af93a5ccbeac9a170d21cea643c1f6e8488943adbe9da90c7ea96e955d75a90a
MD5 e3657e1286f4a3851b5252fa73a43cbd
SHA1 b75895d49654588099091cac2ffaa1632efdee94
SHA512 d7ad3ecc5b9335dd7d9b3d07a041c404f25ab296c314ca9511a6c3805686c37bd039ce0e23441602e6696b3b8f110629c8d030915b406a09e6b65bb0f0adcbdc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

UAdsQZH.exe

Path C:\Windows\System\UAdsQZH.exe
Size 5.9MB
SHA256 3a8ca49cca4f3263125238efc88cb143bff1e6017e9fae169a851813569f1701
MD5 5cc82687166c9649cd5987522105f08b
SHA1 83fd3384a625fc22dc07441f9e8868addcc60412
SHA512 e81d8b4b09e4169474b5a2816241d7b29846c12516830cb3dffad5d476bd3f9687efa65a56395e4e8dbcc07770ff0a224729731e8934008a027f6f4ae6c2fd13
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

UJEElQv.exe

Path C:\Windows\System\UJEElQv.exe
Size 5.9MB
SHA256 4ddc5fe14021c1920aa582b8d4ab6a812e217c9f8c93fe8a32b666388fa487bf
MD5 497c616158e836b89713dd0b707fba74
SHA1 1bdb4f3c1068e542c11c6adc336d7da1c3b26ec5
SHA512 b417da55d8575f9d8ea815106fcf3c273ec067504fc760819460b3b18d63621e001df7dc652cd1efd05cd89d7a338a7220ef1ddb3d379b939bf1ffa7dd87f648
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

UpwIjay.exe

Path C:\Windows\System\UpwIjay.exe
Size 5.9MB
SHA256 97d86fd71e76be2dd8a3451b077d3a24a63b202d0a9999bdf6d317a47fc73d09
MD5 21b56a0f91017896a951f411ec76373a
SHA1 a5e25c3cb7ecf8518479d171d5f50eb8b1d91330
SHA512 581e2c77d06fb640e6e2ee7a299d29ec3f91692fec59d2cf8072b047cd3240dac41d9d3c91c656ee5a503b26952b658a91efe6972ded0ecd6ca901654e3c8ed9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

XLheihT.exe

Path C:\Windows\System\XLheihT.exe
Size 5.9MB
SHA256 6b7429c1c111f25673a3c2659f142c2c6a59d3ad7d7f0730bc4217c60b7b5e1d
MD5 962c11ddcb905f2904a6247385907e76
SHA1 b88f3dbf7fef1fb4d097aaf44acb2e02b7d2db50
SHA512 cf1241ed2f21937cd117c16ffbe2c693abc4a54ea32eb3007d7af69c510da24a4bd7903784319c582acf1d611ebe127dbaa61e05d8e7ead8ac945fc1d46bb08d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

YUJzdNG.exe

Path C:\Windows\System\YUJzdNG.exe
Size 5.9MB
SHA256 40071567e0341480785a786a8633365cc5b64577ff3b646dcf4b347a2a0fcd10
MD5 8892e44fe6ab70fc2842464d37575a25
SHA1 09b084ac3708d326176b8f13954d415f572d14f9
SHA512 687a884fd954872d766da6031c2dbadf70d0d4b55eefdadaf2e33995a9e349c83e9d96963395ef7b6fb0785e6f6a5bc6d5cbb3abcd920f386387a815682649de
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZNcwVJp.exe

Path C:\Windows\System\ZNcwVJp.exe
Size 5.9MB
SHA256 e34ecfb36bb4a3be3cfe2a7320663342b369303eaa09283758ef10998f2855ff
MD5 f017c4b7b7b8ea52fde0588d7a6d0dce
SHA1 cc3f9d98e234d3ed4baf009b7d87008bd2ec2723
SHA512 ab603ef4e7e103abc4a17c831bafd4ff8c1cba08dac2ef70e5ea308feba86e4e8ddcbc608357a0784c4640ec10947e6d05d035a594e64c583c093fbd6b14fb21
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZbuALEb.exe

Path C:\Windows\System\ZbuALEb.exe
Size 5.9MB
SHA256 e3aa202a4061991b370aac57d745e25aaa76d033c4d2d498e66b6e97dbd08404
MD5 63d55f8c34177dbec900623bbec89a19
SHA1 969f0b88eae93017f1d793740c06bb40d6cb5692
SHA512 a16730cd1c65b711acba538785be2ff2b4d524bc00106b5a2283110a429c00a6839bf5bb74697d99fedde335f173b13c2fa795a92e3d63b096391baecd2e00ed
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:Q+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

ftCTltS.exe

Path C:\Windows\System\ftCTltS.exe
Size 5.9MB
SHA256 81e675f98140b2d825b3776e529b6f1202066b6f3e6c28d67854757ce4d0df2a
MD5 aed2a8c59e1998d8453d2bd43e4e75c5
SHA1 9d58110c282347679498bacd8474c032028aa287
SHA512 291604507bf230b2a8125b9036b322c1dc86a6f477edb11ef3c6dba664630c2bf093d5454967f43b595a3c9b1f2dd5cd2997a8585241e3177c08a90139eaf88f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

kDbwrgQ.exe

Path C:\Windows\System\kDbwrgQ.exe
Size 5.9MB
SHA256 105eb1d4c20af4ca5d9ea5ce4bcdb2df0948b907b88bc4aabde66d2c3df7a0da
MD5 a7526aa1e52b2c49e4b185625bcba069
SHA1 27e4b39d9f41937c686bfc5fe8a3633c5d7d17b1
SHA512 28e4f40944af43adc598b9b3d7d252e25b39709f4d1ae7c2815bb7dd578d3da1b6239670e347f221fe9c80d98c0cfc04dab467bd82228a2db68612bc05c215d1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
MD5 SHA1 SHA512 SSDEEP

Submit Download

mLzaDBR.exe

Path C:\Windows\System\mLzaDBR.exe
Size 5.9MB
SHA256 16c5fea36568290a5bc89294fde5c337d9cdc16863bf8603d990cd5c9233964c
MD5 f10f6b314f918d0b791ede9ad737d6f4
SHA1 6921dad9ffe622dd42bf670d3b9102706ab8d8ea
SHA512 94722b0617090a1c510f0481dcf32a28f20b3bb4e4fb925d7abe74754daefa3589546a4f4e41d038666256f68279d580e23f31969804382bbea7b0dba83f76fb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

ojIbGQl.exe

Path C:\Windows\System\ojIbGQl.exe
Size 5.9MB
SHA256 765740b27e2f10b10c7dd7a3812cb35bfaf18ecdb3ecc9728e4d1de5149fbacc
MD5 90e88bb272696da52f5bc64ce64cf78f
SHA1 cb94029d4757f0102245c4389c41be7b25341b7c
SHA512 c3c57a479b4f5da94cf2e3d4f4e7344ca64847a6467a5885c0658be2ad327634ac239f0e43939b9498e3ebb7cd5329214ad248db5fdffaf69b86241fb4f9ee9c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

qAPwcha.exe

Path C:\Windows\System\qAPwcha.exe
Size 5.9MB
SHA256 209c73d852e93aa951fe153e65ddb952350730691f11354d5fc44044cd28561f
MD5 21a2f42f2102356e0613d861ee8b846c
SHA1 3fa69d83c8290588a429b7910d17150c43f97fa4
SHA512 4526e7442249cc6cc4239dd0d444c547c4b61d5e4ac5720fd452ee9054b3d2dbf923b2d92a23706a12c1059d08495c352ce1c82b83adae8fdac7b9b9c5774a70
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

qeiqUxe.exe

Path C:\Windows\System\qeiqUxe.exe
Size 5.9MB
SHA256 4aa475cdf8dc6cbabb7a6e21b32f4802367adf41f973e8a8a7531e34058e3a42
MD5 299863641b428e69457b68f23336ae34
SHA1 fd5c4797050cd17a4bedee78a11811aaae30de2f
SHA512 1b595b822dbf20a494413c782ed8fc46106c40f65c4149b8ab5ee0a3e2eaafe8c01f812a2b6bc039dc14385cd939c80f077b3925f69538ba75a8638e641a441c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/384-105-0x00007FF63AF80000-0x00007FF63B2D4000-memory.dmp

Download

memory/384-144-0x00007FF63AF80000-0x00007FF63B2D4000-memory.dmp

Download

memory/536-127-0x00007FF759580000-0x00007FF7598D4000-memory.dmp

Download

memory/536-151-0x00007FF759580000-0x00007FF7598D4000-memory.dmp

Download

memory/908-115-0x00007FF73BFB0000-0x00007FF73C304000-memory.dmp

Download

memory/908-148-0x00007FF73BFB0000-0x00007FF73C304000-memory.dmp

Download

memory/1056-128-0x00007FF64DE10000-0x00007FF64E164000-memory.dmp

Download

memory/1056-0-0x00007FF64DE10000-0x00007FF64E164000-memory.dmp

Download

memory/1056-1-0x000001F914140000-0x000001F914150000-memory.dmp

Download

memory/1356-104-0x00007FF6BAF50000-0x00007FF6BB2A4000-memory.dmp

Download

memory/1356-145-0x00007FF6BAF50000-0x00007FF6BB2A4000-memory.dmp

Download

memory/1392-129-0x00007FF615830000-0x00007FF615B84000-memory.dmp

Download

memory/1392-9-0x00007FF615830000-0x00007FF615B84000-memory.dmp

Download

memory/1392-133-0x00007FF615830000-0x00007FF615B84000-memory.dmp

Download

memory/1408-103-0x00007FF64E910000-0x00007FF64EC64000-memory.dmp

Download

memory/1408-146-0x00007FF64E910000-0x00007FF64EC64000-memory.dmp

Download

memory/1616-150-0x00007FF66DA60000-0x00007FF66DDB4000-memory.dmp

Download

memory/1616-126-0x00007FF66DA60000-0x00007FF66DDB4000-memory.dmp

Download

memory/1728-138-0x00007FF6D8BD0000-0x00007FF6D8F24000-memory.dmp

Download

memory/1728-40-0x00007FF6D8BD0000-0x00007FF6D8F24000-memory.dmp

Download

memory/1932-119-0x00007FF72A380000-0x00007FF72A6D4000-memory.dmp

Download

memory/1932-149-0x00007FF72A380000-0x00007FF72A6D4000-memory.dmp

Download

memory/2068-142-0x00007FF74AE70000-0x00007FF74B1C4000-memory.dmp

Download

memory/2068-100-0x00007FF74AE70000-0x00007FF74B1C4000-memory.dmp

Download

memory/2340-137-0x00007FF6FF910000-0x00007FF6FFC64000-memory.dmp

Download

memory/2340-38-0x00007FF6FF910000-0x00007FF6FFC64000-memory.dmp

Download

memory/3016-131-0x00007FF690400000-0x00007FF690754000-memory.dmp

Download

memory/3016-18-0x00007FF690400000-0x00007FF690754000-memory.dmp

Download

memory/3016-135-0x00007FF690400000-0x00007FF690754000-memory.dmp

Download

memory/3472-143-0x00007FF6ED740000-0x00007FF6EDA94000-memory.dmp

Download

memory/3472-111-0x00007FF6ED740000-0x00007FF6EDA94000-memory.dmp

Download

memory/3520-125-0x00007FF7649A0000-0x00007FF764CF4000-memory.dmp

Download

memory/3520-152-0x00007FF7649A0000-0x00007FF764CF4000-memory.dmp

Download

memory/3716-95-0x00007FF6CDD40000-0x00007FF6CE094000-memory.dmp

Download

memory/3716-139-0x00007FF6CDD40000-0x00007FF6CE094000-memory.dmp

Download

memory/4048-112-0x00007FF7C0F10000-0x00007FF7C1264000-memory.dmp

Download

memory/4048-147-0x00007FF7C0F10000-0x00007FF7C1264000-memory.dmp

Download

memory/4056-141-0x00007FF688F30000-0x00007FF689284000-memory.dmp

Download

memory/4056-92-0x00007FF688F30000-0x00007FF689284000-memory.dmp

Download

memory/4372-153-0x00007FF7ACCE0000-0x00007FF7AD034000-memory.dmp

Download

memory/4372-122-0x00007FF7ACCE0000-0x00007FF7AD034000-memory.dmp

Download

memory/4608-134-0x00007FF7AA080000-0x00007FF7AA3D4000-memory.dmp

Download

memory/4608-14-0x00007FF7AA080000-0x00007FF7AA3D4000-memory.dmp

Download

memory/4608-130-0x00007FF7AA080000-0x00007FF7AA3D4000-memory.dmp

Download

memory/4800-136-0x00007FF7BB850000-0x00007FF7BBBA4000-memory.dmp

Download

memory/4800-24-0x00007FF7BB850000-0x00007FF7BBBA4000-memory.dmp

Download

memory/4800-132-0x00007FF7BB850000-0x00007FF7BBBA4000-memory.dmp

Download

memory/4952-99-0x00007FF7C2E60000-0x00007FF7C31B4000-memory.dmp

Download

memory/4952-140-0x00007FF7C2E60000-0x00007FF7C31B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads