cobaltstrike | 373605d3ddfbbee1620af6674cb46a695ba0ab2a9ea9fd7dfc95e1d5138039e2

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-cly4wsfa29
SHA256 373605d3ddfbbee1620af6674cb46a695ba0ab2a9ea9fd7dfc95e1d5138039e2
MD5 a910008adaf9450eea3202c7f36efe6f
SHA1 a4b718e0cc4f113e36a8aa456e0701ecc54a7e29
SHA512 ebe0249c68d326ca03fe837d621a55551442b86dfdae9341879c5c7c57e58d2f5d35fdf397980738a099be3c70d5dcbcc2888f5179fcfc2bb5553d2fbd28f0a1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0007000000023298-4.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023421-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023425-18.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023427-26.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023426-28.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023428-38.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023429-48.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342b-46.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342a-50.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342d-63.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342e-67.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342f-86.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023422-79.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342c-57.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023431-95.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023433-114.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023434-116.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023436-127.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023435-125.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023432-109.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023430-94.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023298-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023421-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023425-18.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023427-26.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023426-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023428-38.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023429-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342b-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342a-50.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342d-63.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342e-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342f-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023422-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342c-57.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023431-95.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023433-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023434-116.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023436-127.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023435-125.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023432-109.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023430-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1848-0-0x00007FF6A3F10000-0x00007FF6A4264000-memory.dmp	UPX
behavioral2/files/0x0007000000023298-4.dat	UPX
behavioral2/files/0x0008000000023421-10.dat	UPX
behavioral2/files/0x0007000000023425-18.dat	UPX
behavioral2/memory/3968-8-0x00007FF7025E0000-0x00007FF702934000-memory.dmp	UPX
behavioral2/files/0x0007000000023427-26.dat	UPX
behavioral2/files/0x0007000000023426-28.dat	UPX
behavioral2/memory/2152-30-0x00007FF7FE350000-0x00007FF7FE6A4000-memory.dmp	UPX
behavioral2/files/0x0007000000023428-38.dat	UPX
behavioral2/files/0x0007000000023429-48.dat	UPX
behavioral2/files/0x000700000002342b-46.dat	UPX
behavioral2/files/0x000700000002342a-50.dat	UPX
behavioral2/files/0x000700000002342d-63.dat	UPX
behavioral2/files/0x000700000002342e-67.dat	UPX
behavioral2/memory/2272-76-0x00007FF6B2120000-0x00007FF6B2474000-memory.dmp	UPX
behavioral2/memory/388-83-0x00007FF70A050000-0x00007FF70A3A4000-memory.dmp	UPX
behavioral2/memory/632-85-0x00007FF7DAB50000-0x00007FF7DAEA4000-memory.dmp	UPX
behavioral2/files/0x000700000002342f-86.dat	UPX
behavioral2/memory/1848-84-0x00007FF6A3F10000-0x00007FF6A4264000-memory.dmp	UPX
behavioral2/memory/804-82-0x00007FF6583C0000-0x00007FF658714000-memory.dmp	UPX
behavioral2/files/0x0008000000023422-79.dat	UPX
behavioral2/memory/856-71-0x00007FF6589C0000-0x00007FF658D14000-memory.dmp	UPX
behavioral2/memory/2656-66-0x00007FF690AD0000-0x00007FF690E24000-memory.dmp	UPX
behavioral2/files/0x000700000002342c-57.dat	UPX
behavioral2/memory/4696-53-0x00007FF7F4E30000-0x00007FF7F5184000-memory.dmp	UPX
behavioral2/memory/3324-45-0x00007FF7D0490000-0x00007FF7D07E4000-memory.dmp	UPX
behavioral2/memory/2508-35-0x00007FF6FA070000-0x00007FF6FA3C4000-memory.dmp	UPX
behavioral2/memory/4224-27-0x00007FF6C86D0000-0x00007FF6C8A24000-memory.dmp	UPX
behavioral2/memory/4068-22-0x00007FF704EC0000-0x00007FF705214000-memory.dmp	UPX
behavioral2/memory/3020-14-0x00007FF7B2B20000-0x00007FF7B2E74000-memory.dmp	UPX
behavioral2/memory/3968-91-0x00007FF7025E0000-0x00007FF702934000-memory.dmp	UPX
behavioral2/files/0x0007000000023431-95.dat	UPX
behavioral2/memory/4232-111-0x00007FF6F0710000-0x00007FF6F0A64000-memory.dmp	UPX
behavioral2/files/0x0007000000023433-114.dat	UPX
behavioral2/memory/1012-120-0x00007FF7CB7E0000-0x00007FF7CBB34000-memory.dmp	UPX
behavioral2/memory/3928-121-0x00007FF7342B0000-0x00007FF734604000-memory.dmp	UPX
behavioral2/files/0x0007000000023434-116.dat	UPX
behavioral2/files/0x0007000000023436-127.dat	UPX
behavioral2/files/0x0007000000023435-125.dat	UPX
behavioral2/memory/4224-112-0x00007FF6C86D0000-0x00007FF6C8A24000-memory.dmp	UPX
behavioral2/files/0x0007000000023432-109.dat	UPX
behavioral2/memory/1200-106-0x00007FF6241D0000-0x00007FF624524000-memory.dmp	UPX
behavioral2/files/0x0007000000023430-94.dat	UPX
behavioral2/memory/2624-96-0x00007FF6C3660000-0x00007FF6C39B4000-memory.dmp	UPX
behavioral2/memory/2152-129-0x00007FF7FE350000-0x00007FF7FE6A4000-memory.dmp	UPX
behavioral2/memory/3372-131-0x00007FF759710000-0x00007FF759A64000-memory.dmp	UPX
behavioral2/memory/2348-130-0x00007FF7A0F60000-0x00007FF7A12B4000-memory.dmp	UPX
behavioral2/memory/2508-132-0x00007FF6FA070000-0x00007FF6FA3C4000-memory.dmp	UPX
behavioral2/memory/4696-134-0x00007FF7F4E30000-0x00007FF7F5184000-memory.dmp	UPX
behavioral2/memory/856-135-0x00007FF6589C0000-0x00007FF658D14000-memory.dmp	UPX
behavioral2/memory/3324-133-0x00007FF7D0490000-0x00007FF7D07E4000-memory.dmp	UPX
behavioral2/memory/2624-137-0x00007FF6C3660000-0x00007FF6C39B4000-memory.dmp	UPX
behavioral2/memory/632-136-0x00007FF7DAB50000-0x00007FF7DAEA4000-memory.dmp	UPX
behavioral2/memory/1200-138-0x00007FF6241D0000-0x00007FF624524000-memory.dmp	UPX
behavioral2/memory/4232-139-0x00007FF6F0710000-0x00007FF6F0A64000-memory.dmp	UPX
behavioral2/memory/3968-140-0x00007FF7025E0000-0x00007FF702934000-memory.dmp	UPX
behavioral2/memory/3020-141-0x00007FF7B2B20000-0x00007FF7B2E74000-memory.dmp	UPX
behavioral2/memory/4068-142-0x00007FF704EC0000-0x00007FF705214000-memory.dmp	UPX
behavioral2/memory/4224-143-0x00007FF6C86D0000-0x00007FF6C8A24000-memory.dmp	UPX
behavioral2/memory/2152-144-0x00007FF7FE350000-0x00007FF7FE6A4000-memory.dmp	UPX
behavioral2/memory/2508-145-0x00007FF6FA070000-0x00007FF6FA3C4000-memory.dmp	UPX
behavioral2/memory/3324-146-0x00007FF7D0490000-0x00007FF7D07E4000-memory.dmp	UPX
behavioral2/memory/4696-148-0x00007FF7F4E30000-0x00007FF7F5184000-memory.dmp	UPX
behavioral2/memory/2656-147-0x00007FF690AD0000-0x00007FF690E24000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1848-0-0x00007FF6A3F10000-0x00007FF6A4264000-memory.dmp	xmrig
behavioral2/files/0x0007000000023298-4.dat	xmrig
behavioral2/files/0x0008000000023421-10.dat	xmrig
behavioral2/files/0x0007000000023425-18.dat	xmrig
behavioral2/memory/3968-8-0x00007FF7025E0000-0x00007FF702934000-memory.dmp	xmrig
behavioral2/files/0x0007000000023427-26.dat	xmrig
behavioral2/files/0x0007000000023426-28.dat	xmrig
behavioral2/memory/2152-30-0x00007FF7FE350000-0x00007FF7FE6A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023428-38.dat	xmrig
behavioral2/files/0x0007000000023429-48.dat	xmrig
behavioral2/files/0x000700000002342b-46.dat	xmrig
behavioral2/files/0x000700000002342a-50.dat	xmrig
behavioral2/files/0x000700000002342d-63.dat	xmrig
behavioral2/files/0x000700000002342e-67.dat	xmrig
behavioral2/memory/2272-76-0x00007FF6B2120000-0x00007FF6B2474000-memory.dmp	xmrig
behavioral2/memory/388-83-0x00007FF70A050000-0x00007FF70A3A4000-memory.dmp	xmrig
behavioral2/memory/632-85-0x00007FF7DAB50000-0x00007FF7DAEA4000-memory.dmp	xmrig
behavioral2/files/0x000700000002342f-86.dat	xmrig
behavioral2/memory/1848-84-0x00007FF6A3F10000-0x00007FF6A4264000-memory.dmp	xmrig
behavioral2/memory/804-82-0x00007FF6583C0000-0x00007FF658714000-memory.dmp	xmrig
behavioral2/files/0x0008000000023422-79.dat	xmrig
behavioral2/memory/856-71-0x00007FF6589C0000-0x00007FF658D14000-memory.dmp	xmrig
behavioral2/memory/2656-66-0x00007FF690AD0000-0x00007FF690E24000-memory.dmp	xmrig
behavioral2/files/0x000700000002342c-57.dat	xmrig
behavioral2/memory/4696-53-0x00007FF7F4E30000-0x00007FF7F5184000-memory.dmp	xmrig
behavioral2/memory/3324-45-0x00007FF7D0490000-0x00007FF7D07E4000-memory.dmp	xmrig
behavioral2/memory/2508-35-0x00007FF6FA070000-0x00007FF6FA3C4000-memory.dmp	xmrig
behavioral2/memory/4224-27-0x00007FF6C86D0000-0x00007FF6C8A24000-memory.dmp	xmrig
behavioral2/memory/4068-22-0x00007FF704EC0000-0x00007FF705214000-memory.dmp	xmrig
behavioral2/memory/3020-14-0x00007FF7B2B20000-0x00007FF7B2E74000-memory.dmp	xmrig
behavioral2/memory/3968-91-0x00007FF7025E0000-0x00007FF702934000-memory.dmp	xmrig
behavioral2/files/0x0007000000023431-95.dat	xmrig
behavioral2/memory/4232-111-0x00007FF6F0710000-0x00007FF6F0A64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023433-114.dat	xmrig
behavioral2/memory/1012-120-0x00007FF7CB7E0000-0x00007FF7CBB34000-memory.dmp	xmrig
behavioral2/memory/3928-121-0x00007FF7342B0000-0x00007FF734604000-memory.dmp	xmrig
behavioral2/files/0x0007000000023434-116.dat	xmrig
behavioral2/files/0x0007000000023436-127.dat	xmrig
behavioral2/files/0x0007000000023435-125.dat	xmrig
behavioral2/memory/4224-112-0x00007FF6C86D0000-0x00007FF6C8A24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023432-109.dat	xmrig
behavioral2/memory/1200-106-0x00007FF6241D0000-0x00007FF624524000-memory.dmp	xmrig
behavioral2/files/0x0007000000023430-94.dat	xmrig
behavioral2/memory/2624-96-0x00007FF6C3660000-0x00007FF6C39B4000-memory.dmp	xmrig
behavioral2/memory/2152-129-0x00007FF7FE350000-0x00007FF7FE6A4000-memory.dmp	xmrig
behavioral2/memory/3372-131-0x00007FF759710000-0x00007FF759A64000-memory.dmp	xmrig
behavioral2/memory/2348-130-0x00007FF7A0F60000-0x00007FF7A12B4000-memory.dmp	xmrig
behavioral2/memory/2508-132-0x00007FF6FA070000-0x00007FF6FA3C4000-memory.dmp	xmrig
behavioral2/memory/4696-134-0x00007FF7F4E30000-0x00007FF7F5184000-memory.dmp	xmrig
behavioral2/memory/856-135-0x00007FF6589C0000-0x00007FF658D14000-memory.dmp	xmrig
behavioral2/memory/3324-133-0x00007FF7D0490000-0x00007FF7D07E4000-memory.dmp	xmrig
behavioral2/memory/2624-137-0x00007FF6C3660000-0x00007FF6C39B4000-memory.dmp	xmrig
behavioral2/memory/632-136-0x00007FF7DAB50000-0x00007FF7DAEA4000-memory.dmp	xmrig
behavioral2/memory/1200-138-0x00007FF6241D0000-0x00007FF624524000-memory.dmp	xmrig
behavioral2/memory/4232-139-0x00007FF6F0710000-0x00007FF6F0A64000-memory.dmp	xmrig
behavioral2/memory/3968-140-0x00007FF7025E0000-0x00007FF702934000-memory.dmp	xmrig
behavioral2/memory/3020-141-0x00007FF7B2B20000-0x00007FF7B2E74000-memory.dmp	xmrig
behavioral2/memory/4068-142-0x00007FF704EC0000-0x00007FF705214000-memory.dmp	xmrig
behavioral2/memory/4224-143-0x00007FF6C86D0000-0x00007FF6C8A24000-memory.dmp	xmrig
behavioral2/memory/2152-144-0x00007FF7FE350000-0x00007FF7FE6A4000-memory.dmp	xmrig
behavioral2/memory/2508-145-0x00007FF6FA070000-0x00007FF6FA3C4000-memory.dmp	xmrig
behavioral2/memory/3324-146-0x00007FF7D0490000-0x00007FF7D07E4000-memory.dmp	xmrig
behavioral2/memory/4696-148-0x00007FF7F4E30000-0x00007FF7F5184000-memory.dmp	xmrig
behavioral2/memory/2656-147-0x00007FF690AD0000-0x00007FF690E24000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3968	jOmexhm.exe
3020	tFQjzyV.exe
4068	hmgXtoc.exe
4224	fSZtAuU.exe
2152	ybkklFw.exe
2508	lFKmwvO.exe
3324	buyUdOX.exe
4696	OQaOiuV.exe
2272	sgdlyLo.exe
2656	XfDPQph.exe
804	OZAAIoO.exe
856	iYFfEad.exe
388	eFldnIe.exe
632	BdzXCAN.exe
2624	hLihZjl.exe
1200	jweaeeA.exe
1012	OCzxLCA.exe
4232	vkKhDdq.exe
3928	FGASqSa.exe
2348	FYASsoQ.exe
3372	CRHZbAz.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1848-0-0x00007FF6A3F10000-0x00007FF6A4264000-memory.dmp	upx
behavioral2/files/0x0007000000023298-4.dat	upx
behavioral2/files/0x0008000000023421-10.dat	upx
behavioral2/files/0x0007000000023425-18.dat	upx
behavioral2/memory/3968-8-0x00007FF7025E0000-0x00007FF702934000-memory.dmp	upx
behavioral2/files/0x0007000000023427-26.dat	upx
behavioral2/files/0x0007000000023426-28.dat	upx
behavioral2/memory/2152-30-0x00007FF7FE350000-0x00007FF7FE6A4000-memory.dmp	upx
behavioral2/files/0x0007000000023428-38.dat	upx
behavioral2/files/0x0007000000023429-48.dat	upx
behavioral2/files/0x000700000002342b-46.dat	upx
behavioral2/files/0x000700000002342a-50.dat	upx
behavioral2/files/0x000700000002342d-63.dat	upx
behavioral2/files/0x000700000002342e-67.dat	upx
behavioral2/memory/2272-76-0x00007FF6B2120000-0x00007FF6B2474000-memory.dmp	upx
behavioral2/memory/388-83-0x00007FF70A050000-0x00007FF70A3A4000-memory.dmp	upx
behavioral2/memory/632-85-0x00007FF7DAB50000-0x00007FF7DAEA4000-memory.dmp	upx
behavioral2/files/0x000700000002342f-86.dat	upx
behavioral2/memory/1848-84-0x00007FF6A3F10000-0x00007FF6A4264000-memory.dmp	upx
behavioral2/memory/804-82-0x00007FF6583C0000-0x00007FF658714000-memory.dmp	upx
behavioral2/files/0x0008000000023422-79.dat	upx
behavioral2/memory/856-71-0x00007FF6589C0000-0x00007FF658D14000-memory.dmp	upx
behavioral2/memory/2656-66-0x00007FF690AD0000-0x00007FF690E24000-memory.dmp	upx
behavioral2/files/0x000700000002342c-57.dat	upx
behavioral2/memory/4696-53-0x00007FF7F4E30000-0x00007FF7F5184000-memory.dmp	upx
behavioral2/memory/3324-45-0x00007FF7D0490000-0x00007FF7D07E4000-memory.dmp	upx
behavioral2/memory/2508-35-0x00007FF6FA070000-0x00007FF6FA3C4000-memory.dmp	upx
behavioral2/memory/4224-27-0x00007FF6C86D0000-0x00007FF6C8A24000-memory.dmp	upx
behavioral2/memory/4068-22-0x00007FF704EC0000-0x00007FF705214000-memory.dmp	upx
behavioral2/memory/3020-14-0x00007FF7B2B20000-0x00007FF7B2E74000-memory.dmp	upx
behavioral2/memory/3968-91-0x00007FF7025E0000-0x00007FF702934000-memory.dmp	upx
behavioral2/files/0x0007000000023431-95.dat	upx
behavioral2/memory/4232-111-0x00007FF6F0710000-0x00007FF6F0A64000-memory.dmp	upx
behavioral2/files/0x0007000000023433-114.dat	upx
behavioral2/memory/1012-120-0x00007FF7CB7E0000-0x00007FF7CBB34000-memory.dmp	upx
behavioral2/memory/3928-121-0x00007FF7342B0000-0x00007FF734604000-memory.dmp	upx
behavioral2/files/0x0007000000023434-116.dat	upx
behavioral2/files/0x0007000000023436-127.dat	upx
behavioral2/files/0x0007000000023435-125.dat	upx
behavioral2/memory/4224-112-0x00007FF6C86D0000-0x00007FF6C8A24000-memory.dmp	upx
behavioral2/files/0x0007000000023432-109.dat	upx
behavioral2/memory/1200-106-0x00007FF6241D0000-0x00007FF624524000-memory.dmp	upx
behavioral2/files/0x0007000000023430-94.dat	upx
behavioral2/memory/2624-96-0x00007FF6C3660000-0x00007FF6C39B4000-memory.dmp	upx
behavioral2/memory/2152-129-0x00007FF7FE350000-0x00007FF7FE6A4000-memory.dmp	upx
behavioral2/memory/3372-131-0x00007FF759710000-0x00007FF759A64000-memory.dmp	upx
behavioral2/memory/2348-130-0x00007FF7A0F60000-0x00007FF7A12B4000-memory.dmp	upx
behavioral2/memory/2508-132-0x00007FF6FA070000-0x00007FF6FA3C4000-memory.dmp	upx
behavioral2/memory/4696-134-0x00007FF7F4E30000-0x00007FF7F5184000-memory.dmp	upx
behavioral2/memory/856-135-0x00007FF6589C0000-0x00007FF658D14000-memory.dmp	upx
behavioral2/memory/3324-133-0x00007FF7D0490000-0x00007FF7D07E4000-memory.dmp	upx
behavioral2/memory/2624-137-0x00007FF6C3660000-0x00007FF6C39B4000-memory.dmp	upx
behavioral2/memory/632-136-0x00007FF7DAB50000-0x00007FF7DAEA4000-memory.dmp	upx
behavioral2/memory/1200-138-0x00007FF6241D0000-0x00007FF624524000-memory.dmp	upx
behavioral2/memory/4232-139-0x00007FF6F0710000-0x00007FF6F0A64000-memory.dmp	upx
behavioral2/memory/3968-140-0x00007FF7025E0000-0x00007FF702934000-memory.dmp	upx
behavioral2/memory/3020-141-0x00007FF7B2B20000-0x00007FF7B2E74000-memory.dmp	upx
behavioral2/memory/4068-142-0x00007FF704EC0000-0x00007FF705214000-memory.dmp	upx
behavioral2/memory/4224-143-0x00007FF6C86D0000-0x00007FF6C8A24000-memory.dmp	upx
behavioral2/memory/2152-144-0x00007FF7FE350000-0x00007FF7FE6A4000-memory.dmp	upx
behavioral2/memory/2508-145-0x00007FF6FA070000-0x00007FF6FA3C4000-memory.dmp	upx
behavioral2/memory/3324-146-0x00007FF7D0490000-0x00007FF7D07E4000-memory.dmp	upx
behavioral2/memory/4696-148-0x00007FF7F4E30000-0x00007FF7F5184000-memory.dmp	upx
behavioral2/memory/2656-147-0x00007FF690AD0000-0x00007FF690E24000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\hmgXtoc.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CRHZbAz.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BdzXCAN.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OCzxLCA.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FGASqSa.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\sgdlyLo.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XfDPQph.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iYFfEad.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ybkklFw.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lFKmwvO.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OQaOiuV.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eFldnIe.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jweaeeA.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jOmexhm.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tFQjzyV.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fSZtAuU.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FYASsoQ.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vkKhDdq.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\buyUdOX.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OZAAIoO.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hLihZjl.exe	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 3968	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	83
PID 1848 wrote to memory of 3968	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	83
PID 1848 wrote to memory of 3020	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	84
PID 1848 wrote to memory of 3020	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	84
PID 1848 wrote to memory of 4068	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	85
PID 1848 wrote to memory of 4068	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	85
PID 1848 wrote to memory of 4224	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	86
PID 1848 wrote to memory of 4224	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	86
PID 1848 wrote to memory of 2152	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	87
PID 1848 wrote to memory of 2152	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	87
PID 1848 wrote to memory of 2508	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	88
PID 1848 wrote to memory of 2508	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	88
PID 1848 wrote to memory of 3324	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	89
PID 1848 wrote to memory of 3324	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	89
PID 1848 wrote to memory of 2272	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	90
PID 1848 wrote to memory of 2272	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	90
PID 1848 wrote to memory of 4696	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	91
PID 1848 wrote to memory of 4696	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	91
PID 1848 wrote to memory of 2656	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	92
PID 1848 wrote to memory of 2656	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	92
PID 1848 wrote to memory of 804	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	93
PID 1848 wrote to memory of 804	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	93
PID 1848 wrote to memory of 856	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	94
PID 1848 wrote to memory of 856	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	94
PID 1848 wrote to memory of 388	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	95
PID 1848 wrote to memory of 388	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	95
PID 1848 wrote to memory of 632	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	96
PID 1848 wrote to memory of 632	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	96
PID 1848 wrote to memory of 2624	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	97
PID 1848 wrote to memory of 2624	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	97
PID 1848 wrote to memory of 1200	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	98
PID 1848 wrote to memory of 1200	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	98
PID 1848 wrote to memory of 1012	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	99
PID 1848 wrote to memory of 1012	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	99
PID 1848 wrote to memory of 4232	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	101
PID 1848 wrote to memory of 4232	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	101
PID 1848 wrote to memory of 3928	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	102
PID 1848 wrote to memory of 3928	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	102
PID 1848 wrote to memory of 2348	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	103
PID 1848 wrote to memory of 2348	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	103
PID 1848 wrote to memory of 3372	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	104
PID 1848 wrote to memory of 3372	1848	2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe	104

C:\Users\Admin\AppData\Local\Temp\2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_a910008adaf9450eea3202c7f36efe6f_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\System\jOmexhm.exe
  C:\Windows\System\jOmexhm.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\tFQjzyV.exe
  C:\Windows\System\tFQjzyV.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\hmgXtoc.exe
  C:\Windows\System\hmgXtoc.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\fSZtAuU.exe
  C:\Windows\System\fSZtAuU.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\ybkklFw.exe
  C:\Windows\System\ybkklFw.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\lFKmwvO.exe
  C:\Windows\System\lFKmwvO.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\buyUdOX.exe
  C:\Windows\System\buyUdOX.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\sgdlyLo.exe
  C:\Windows\System\sgdlyLo.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\OQaOiuV.exe
  C:\Windows\System\OQaOiuV.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\XfDPQph.exe
  C:\Windows\System\XfDPQph.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\OZAAIoO.exe
  C:\Windows\System\OZAAIoO.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\iYFfEad.exe
  C:\Windows\System\iYFfEad.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\eFldnIe.exe
  C:\Windows\System\eFldnIe.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\BdzXCAN.exe
  C:\Windows\System\BdzXCAN.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\hLihZjl.exe
  C:\Windows\System\hLihZjl.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\jweaeeA.exe
  C:\Windows\System\jweaeeA.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\OCzxLCA.exe
  C:\Windows\System\OCzxLCA.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\vkKhDdq.exe
  C:\Windows\System\vkKhDdq.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\FGASqSa.exe
  C:\Windows\System\FGASqSa.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\FYASsoQ.exe
  C:\Windows\System\FYASsoQ.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\CRHZbAz.exe
  C:\Windows\System\CRHZbAz.exe
  2⤵
  - Executes dropped EXE
  PID:3372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BdzXCAN.exe

Path C:\Windows\System\BdzXCAN.exe
Size 5.9MB
SHA256 31dc1875ce9260726a39cc2bc4f552b8964fdc991cdbb82ad3b86bf8d2da78a7
MD5 c66ba6e8c31801312abad37deb533242
SHA1 60b194deed27fe468b822a411b7aeba621d54082
SHA512 0618367a34081b1b3cc9de425a8ec62812618168c0d282322bf0a531530f4a85d204350f14670ba9d01d1269350edf85685c9773a8bc0d03f798b8f5618b1a01
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

CRHZbAz.exe

Path C:\Windows\System\CRHZbAz.exe
Size 5.9MB
SHA256 1d281b7b145e4df4a96cd20dd11cff6fed0422a6cccf601f202fe7ae2d2648f2
MD5 0628f6b2b3c73c58f0f47a34f7980f3f
SHA1 92f5ecf1efed1bfe05b90d4f6aad2cd8f8330ef0
SHA512 f6e5f688ec0b82e80833a6e35f5e40d408a56983ab60599171132cf48ef69899533d4439dc16019b8b1d605a4cbafa40b6936d549bf513b48a879c9239774368
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

FGASqSa.exe

Path C:\Windows\System\FGASqSa.exe
Size 5.9MB
SHA256 5c616e8bb75898f76cd7a4c42bdb096891a62dff62c9e7e1846c0d665fc0a32e
MD5 8b29b9f08e1a44bc6c182e151978430c
SHA1 a827fa29ad04d8062747ff794fd7d3f83f42c2d6
SHA512 9a908e0a30ec7431af10a61089b7f953eab79a5e8d26b4601eb190eb413c9080c9cbfd4b0683453296dd4ccabc11c3b750965f75cbb468ca59078d1c10d4d2b5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

FYASsoQ.exe

Path C:\Windows\System\FYASsoQ.exe
Size 5.9MB
SHA256 cd66ee14ed021ed2664a7892d99929d1653078044791946bb92004d69003c970
MD5 2f60aa07270c18743e948889752ba7f4
SHA1 a8e0b7af7f87f972d4e79fc43c5966f677e9eed4
SHA512 526d220737c3e3993c18caa4de9f5cc19701763996a66c965b6df24c488acee2dbb8813b2c7d2fba94ac0ec76ff775f0473cee9ddf11a478bc51c6353d67db1c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

OCzxLCA.exe

Path C:\Windows\System\OCzxLCA.exe
Size 5.9MB
SHA256 9b37e1eb4892e242a388ee667ab25be116fd82958efe27dfb08b8447aadd9a7b
MD5 20dd476aa2cbd01285fb68769d6e3f39
SHA1 c2914f4f8805a093e337e33b3d2e782355a7ccc1
SHA512 d494e5dbfce9bac3aae5355dd9f4f27bd05eab8c338e020cb5fc8ef64a0a78ad8abb18dbdb3cb25d7314efc7e5da5a72358a6a9e93ab9b478e9dd649481c7d2c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:Q+856utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

OQaOiuV.exe

Path C:\Windows\System\OQaOiuV.exe
Size 5.9MB
SHA256 6cbe5587fa3199859687d59c3bf88b7751895bfa00b37030975c9c2f2f2f8dbf
MD5 0deb33d3cafe5bf6d24001defef375e1
SHA1 99435522c994cf929608d3d3e5aef1c064d8a7ea
SHA512 a5f72a294022e1a8c3869a431bcd8b3aad27be7e7c06eccc5940e83d210820ef00230349e9959d9800a8d9ffe82f8574824be8a8a05369c3a85d6c18c39e69ce
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

OZAAIoO.exe

Path C:\Windows\System\OZAAIoO.exe
Size 5.9MB
SHA256 325db1219131a4b0f764e813b93bb0d5da5afe20b217cc051e4abc79c0bc32eb
MD5 e0a6eef328a2ca94c54d0f673d8948ed
SHA1 cdcea59f60ca55ff554db292d5de854d5d8a8358
SHA512 0f38d97d3ffa2da7adf0d4b0c783c7b632e9a3570ea3670678bb0530b2603faa6282dd8a07635334ecbc4fbd14464d2d86b6415254205567365859a1966dd9aa
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

XfDPQph.exe

Path C:\Windows\System\XfDPQph.exe
Size 5.9MB
SHA256 761a99623799098e7ea2cf81a6aec15d62dccd1b8b81e69a3a31c3fef48bbe3a
MD5 594e579008375fb11ab368e5b5f1708b
SHA1 e478727f60cbc82a7eecc65e715b0b78791a9a9d
SHA512 a3dd66279db6b750c1df2743562adce1c12fb74518a14195c79eac66eea57102b75b51ad7bae92a83171197413a7eaf071a260d30d5aae58f7263b6f5b8afe90
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

buyUdOX.exe

Path C:\Windows\System\buyUdOX.exe
Size 5.9MB
SHA256 e1cec3a74570f571f469c5af47b5001d6e9506ca3384b83a7db3acedfa70d4c9
MD5 44b52ef97de23990940f3efeb590f81e
SHA1 4f485e49a69659eac8688f8dedd05f9beeff6a45
SHA512 8b107c8b41f661f63648806a0fcd01663471ea883b0358683b63b1a5e22f1f8003cb234d4d403c8b72b9b3a26b22145a48a9bad174659c4d8e6a9bbbd8cb320b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

eFldnIe.exe

Path C:\Windows\System\eFldnIe.exe
Size 5.9MB
SHA256 17acfb3e8820cec637a42a97d27483660764a6741017bebc411c5055da78dcc9
MD5 9e6fdad08db46894c0c2c2274d720199
SHA1 fb587171332866571e97b2f864e47da5d449f41d
SHA512 5e5871b41ab659b3c3f4e8c04af450e81832f21b3856646891378bda135a82f560ac8243a4f2b99a8ebb5d8b2b53f29c0c684e057f91508e865c9e387f2062d9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

fSZtAuU.exe

Path C:\Windows\System\fSZtAuU.exe
Size 5.9MB
SHA256 4f644e2658c0b8fd60fbcf7ca2d7a604f9dfc00804af62537fe7f62164b96f12
MD5 773ccec6d399405742fcd1af091d4b58
SHA1 c09c9fca96a8f865a170852cfdc81c9ba3f5e659
SHA512 8684a9cbac436365e2c90daca202a9d1f515a7ae8914b56f6e686ea9ed760a893721b81913298e7364bedf11e6a52c39118ecc8a790c2749bbc62dc68ea58869
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

hLihZjl.exe

Path C:\Windows\System\hLihZjl.exe
Size 5.9MB
SHA256 a78a7618df7166bb3784814ac8757cc720b55de4c8592dfc04644914473f10c4
MD5 0271029edffec6f0ffd9ba81405df508
SHA1 768b3fab0757282a9db753cbe140cf15179e6d89
SHA512 bcdafe613e0add9d8760f8671eca8759189b70b9acec69d5040b0ff97b748332bb24a2ed50f9681c0f5143a3b52c4b91653d73c1980e0ed7c511714a4e27bd08
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

hmgXtoc.exe

Path C:\Windows\System\hmgXtoc.exe
Size 5.9MB
SHA256 9f2f5b27d5f4eedee9672355de87fae21e5cdf5b600f7a3efb20e5773b94e6a1
MD5 a9bfb3ad3cfc99ca2d29ee3f203a232c
SHA1 c83f28fd2ac599ee41a31fafd4c4953cc8c9050a
SHA512 fb55449ae26e93ddce5f99506ca9bd8d3f9b0588873198b06a9bb85e22121b6aef7b7ecd858b9c8649f22557857a15145ba5950562844815885b545b7b6830b8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

iYFfEad.exe

Path C:\Windows\System\iYFfEad.exe
Size 5.9MB
SHA256 3c93387ac93f780e95e2ab93f25052560ed35bab105034b00c7edf22f41d0fb8
MD5 2796cf7a87b025878c9455bc46bd5a18
SHA1 b2f1ae76898778acad2b8df34974d7292a3e79af
SHA512 aa44562eac6a538f6c29fe896bab3231428fce47d0d453748abdc8ace8064cdf2c95a7783da9c72bb197e623af432ea01f42464b45ca5923506ecd18d9493322
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:Q+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

jOmexhm.exe

Path C:\Windows\System\jOmexhm.exe
Size 5.9MB
SHA256 19446a126ee5efcd7cb001a5b69cf013383fa1cf0a18bbd5096f00a9a14b081d
MD5 84870a002b4cfab8c5617f6a9941494d
SHA1 1501d09929e93fa690b180432591b4819ddf7aa3
SHA512 1a6003fb001e8dd924ff52ada1107f1433ba64ef958652665f58224fb2470f3e6b1e726e18e20d33d88b919964d3523c5d695bb10cf628e8c8af4f9123549acb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

jweaeeA.exe

Path C:\Windows\System\jweaeeA.exe
Size 5.9MB
SHA256 65c0976986047ef2d921059c870193564a40e7a668d151670541855c0aa59114
MD5 7d90ab526ea2f72ef14894994c7cd6bd
SHA1 849eea85f6967e54ace334be3b2e42a9ebbe35d9
SHA512 f5f143ccb7f2d64f8af347cb5564fc4d86e6055b23fe4177b2e370a2498fe8e11600d7c86482c6d2ff4a18fff6648341a36af5eee6ab7bb3157373a17f357600
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

lFKmwvO.exe

Path C:\Windows\System\lFKmwvO.exe
Size 5.9MB
SHA256 a7ceeafe80eba7d831229bcf8a5fffb8430dc8af2bbb4ffb0ce4c669d9b18114
MD5 1534587dcce010610b5a4317a422a325
SHA1 9dc5ef7532d5baa3000d02f3b95c277a259322b8
SHA512 97ca965656d47c05e4d3ac93db3f95ff53657361552ffb9c322e98a1a4cb02171b0b1f505be45a4e32e7eae62e3ca378a96afa3f005af4fe8bc35900786547ac
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

sgdlyLo.exe

Path C:\Windows\System\sgdlyLo.exe
Size 5.9MB
SHA256 9c3126d7ff759deb78aa2d07f70a1d06684e661374646679860c5932a2f1087e
MD5 2e1c9c8e4004856035679b2777ffe88a
SHA1 bc7f853882f36b6d1d245e07bfb2de0036dce7ed
SHA512 ba53dea9b7e8ce1427ef2ffcb01dbb2a2a4bd47df7a5655472e8d5ed1cd4704e8d10b73fcbd748e2928f8c8ddc6a3d8d048270058bc505e3fa5a9e0eebad8baa
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

tFQjzyV.exe

Path C:\Windows\System\tFQjzyV.exe
Size 5.9MB
SHA256 c622defd6927a02ef99b2745fac84c62292d94a0caeba2d452721e6a45305229
MD5 e62b34a00701d39bb4b80c129665e25e
SHA1 13516ab1fcbf399855ee7d53bbd7daaa35c66b48
SHA512 40540e8c468100b6a0243d162a76c0b468006ff9178d81843ffa7ef996d97622a470d34c24a49534a2c7394c575cac8d251361fd312f920d61b6ab56fd02a189
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

vkKhDdq.exe

Path C:\Windows\System\vkKhDdq.exe
Size 5.9MB
SHA256 4fa8dfe2a4c09d8c7b6712bd93b9632b58941d42e9ed36c7aa097619742bce17
MD5 2cc66b714904a63c9b1f2d1076dfb70d
SHA1 cfc33a163aec6bf165345d3de3694814aaabc68b
SHA512 8aad97fb1ba8e0fe8bc89657570663a476ed95940be13c829a951d60611875344ea1511e01919e64200bb2fecc76384405dad4935159f9a505be6d6552923e6c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

ybkklFw.exe

Path C:\Windows\System\ybkklFw.exe
Size 5.9MB
SHA256 a4025228420d55c99d11246f6a0eed8ef464ccac4039c9f28215d1390426f7fa
MD5 8c15def02dfe23e5a9a3a6f731910d9d
SHA1 b537fb2f3473b7746da45147615779f3d2e1812b
SHA512 e7707147c442c2af1b20ebe63f81574754673497d2d49e837f4ba7433fc774c54a247372dea48058eb28d92e584381fcfcb6681381edc034a4b93f201cd94ee0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/388-83-0x00007FF70A050000-0x00007FF70A3A4000-memory.dmp

Download

memory/388-152-0x00007FF70A050000-0x00007FF70A3A4000-memory.dmp

Download

memory/632-85-0x00007FF7DAB50000-0x00007FF7DAEA4000-memory.dmp

Download

memory/632-136-0x00007FF7DAB50000-0x00007FF7DAEA4000-memory.dmp

Download

memory/632-153-0x00007FF7DAB50000-0x00007FF7DAEA4000-memory.dmp

Download

memory/804-82-0x00007FF6583C0000-0x00007FF658714000-memory.dmp

Download

memory/804-150-0x00007FF6583C0000-0x00007FF658714000-memory.dmp

Download

memory/856-135-0x00007FF6589C0000-0x00007FF658D14000-memory.dmp

Download

memory/856-71-0x00007FF6589C0000-0x00007FF658D14000-memory.dmp

Download

memory/856-151-0x00007FF6589C0000-0x00007FF658D14000-memory.dmp

Download

memory/1012-156-0x00007FF7CB7E0000-0x00007FF7CBB34000-memory.dmp

Download

memory/1012-120-0x00007FF7CB7E0000-0x00007FF7CBB34000-memory.dmp

Download

memory/1200-106-0x00007FF6241D0000-0x00007FF624524000-memory.dmp

Download

memory/1200-138-0x00007FF6241D0000-0x00007FF624524000-memory.dmp

Download

memory/1200-155-0x00007FF6241D0000-0x00007FF624524000-memory.dmp

Download

memory/1848-0-0x00007FF6A3F10000-0x00007FF6A4264000-memory.dmp

Download

memory/1848-1-0x00000215FB8E0000-0x00000215FB8F0000-memory.dmp

Download

memory/1848-84-0x00007FF6A3F10000-0x00007FF6A4264000-memory.dmp

Download

memory/2152-144-0x00007FF7FE350000-0x00007FF7FE6A4000-memory.dmp

Download

memory/2152-30-0x00007FF7FE350000-0x00007FF7FE6A4000-memory.dmp

Download

memory/2152-129-0x00007FF7FE350000-0x00007FF7FE6A4000-memory.dmp

Download

memory/2272-149-0x00007FF6B2120000-0x00007FF6B2474000-memory.dmp

Download

memory/2272-76-0x00007FF6B2120000-0x00007FF6B2474000-memory.dmp

Download

memory/2348-160-0x00007FF7A0F60000-0x00007FF7A12B4000-memory.dmp

Download

memory/2348-130-0x00007FF7A0F60000-0x00007FF7A12B4000-memory.dmp

Download

memory/2508-145-0x00007FF6FA070000-0x00007FF6FA3C4000-memory.dmp

Download

memory/2508-35-0x00007FF6FA070000-0x00007FF6FA3C4000-memory.dmp

Download

memory/2508-132-0x00007FF6FA070000-0x00007FF6FA3C4000-memory.dmp

Download

memory/2624-137-0x00007FF6C3660000-0x00007FF6C39B4000-memory.dmp

Download

memory/2624-154-0x00007FF6C3660000-0x00007FF6C39B4000-memory.dmp

Download

memory/2624-96-0x00007FF6C3660000-0x00007FF6C39B4000-memory.dmp

Download

memory/2656-147-0x00007FF690AD0000-0x00007FF690E24000-memory.dmp

Download

memory/2656-66-0x00007FF690AD0000-0x00007FF690E24000-memory.dmp

Download

memory/3020-14-0x00007FF7B2B20000-0x00007FF7B2E74000-memory.dmp

Download

memory/3020-141-0x00007FF7B2B20000-0x00007FF7B2E74000-memory.dmp

Download

memory/3324-45-0x00007FF7D0490000-0x00007FF7D07E4000-memory.dmp

Download

memory/3324-133-0x00007FF7D0490000-0x00007FF7D07E4000-memory.dmp

Download

memory/3324-146-0x00007FF7D0490000-0x00007FF7D07E4000-memory.dmp

Download

memory/3372-159-0x00007FF759710000-0x00007FF759A64000-memory.dmp

Download

memory/3372-131-0x00007FF759710000-0x00007FF759A64000-memory.dmp

Download

memory/3928-158-0x00007FF7342B0000-0x00007FF734604000-memory.dmp

Download

memory/3928-121-0x00007FF7342B0000-0x00007FF734604000-memory.dmp

Download

memory/3968-140-0x00007FF7025E0000-0x00007FF702934000-memory.dmp

Download

memory/3968-8-0x00007FF7025E0000-0x00007FF702934000-memory.dmp

Download

memory/3968-91-0x00007FF7025E0000-0x00007FF702934000-memory.dmp

Download

memory/4068-22-0x00007FF704EC0000-0x00007FF705214000-memory.dmp

Download

memory/4068-142-0x00007FF704EC0000-0x00007FF705214000-memory.dmp

Download

memory/4224-143-0x00007FF6C86D0000-0x00007FF6C8A24000-memory.dmp

Download

memory/4224-27-0x00007FF6C86D0000-0x00007FF6C8A24000-memory.dmp

Download

memory/4224-112-0x00007FF6C86D0000-0x00007FF6C8A24000-memory.dmp

Download

memory/4232-111-0x00007FF6F0710000-0x00007FF6F0A64000-memory.dmp

Download

memory/4232-157-0x00007FF6F0710000-0x00007FF6F0A64000-memory.dmp

Download

memory/4232-139-0x00007FF6F0710000-0x00007FF6F0A64000-memory.dmp

Download

memory/4696-148-0x00007FF7F4E30000-0x00007FF7F5184000-memory.dmp

Download

memory/4696-134-0x00007FF7F4E30000-0x00007FF7F5184000-memory.dmp

Download

memory/4696-53-0x00007FF7F4E30000-0x00007FF7F5184000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads