cobaltstrike | 88d46dc0a05fd53639f0364ade97a26eaa60b76903d356ef502d04eeb7e45f33

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 02:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-cpakpsec9v
SHA256 88d46dc0a05fd53639f0364ade97a26eaa60b76903d356ef502d04eeb7e45f33
MD5 fda155143673621098f40cfd8d422f73
SHA1 08d13af1d97f46366221c650ab53a14e7f825f94
SHA512 22c31123d031e179c3d1d10be6f73fd32abce05c74a8a2dd916941de633f79043f280d4d056227cad124784f4ec190535cc780316a36268dce10a7529367ebba
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00080000000233c9-5.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233cd-10.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ce-11.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233cf-24.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d0-28.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d1-35.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000233ca-46.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d3-50.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d5-60.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d7-70.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d8-77.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233da-86.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233db-90.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233dd-100.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233df-110.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233de-107.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233dc-98.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d9-81.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d6-68.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d4-58.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d2-41.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x00080000000233c9-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233cd-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233ce-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233cf-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d0-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d1-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00080000000233ca-46.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d3-50.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d5-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d7-70.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d8-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233da-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233db-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233dd-100.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233df-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233de-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233dc-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d9-81.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d6-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d4-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d2-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4560-0-0x00007FF701CF0000-0x00007FF702044000-memory.dmp	UPX
behavioral2/files/0x00080000000233c9-5.dat	UPX
behavioral2/memory/4172-8-0x00007FF7DE0F0000-0x00007FF7DE444000-memory.dmp	UPX
behavioral2/files/0x00070000000233cd-10.dat	UPX
behavioral2/files/0x00070000000233ce-11.dat	UPX
behavioral2/memory/1284-19-0x00007FF7113E0000-0x00007FF711734000-memory.dmp	UPX
behavioral2/memory/4124-20-0x00007FF6E1BF0000-0x00007FF6E1F44000-memory.dmp	UPX
behavioral2/files/0x00070000000233cf-24.dat	UPX
behavioral2/files/0x00070000000233d0-28.dat	UPX
behavioral2/files/0x00070000000233d1-35.dat	UPX
behavioral2/files/0x00080000000233ca-46.dat	UPX
behavioral2/files/0x00070000000233d3-50.dat	UPX
behavioral2/files/0x00070000000233d5-60.dat	UPX
behavioral2/files/0x00070000000233d7-70.dat	UPX
behavioral2/files/0x00070000000233d8-77.dat	UPX
behavioral2/files/0x00070000000233da-86.dat	UPX
behavioral2/files/0x00070000000233db-90.dat	UPX
behavioral2/files/0x00070000000233dd-100.dat	UPX
behavioral2/files/0x00070000000233df-110.dat	UPX
behavioral2/files/0x00070000000233de-107.dat	UPX
behavioral2/files/0x00070000000233dc-98.dat	UPX
behavioral2/files/0x00070000000233d9-81.dat	UPX
behavioral2/files/0x00070000000233d6-68.dat	UPX
behavioral2/files/0x00070000000233d4-58.dat	UPX
behavioral2/files/0x00070000000233d2-41.dat	UPX
behavioral2/memory/3524-34-0x00007FF64FC00000-0x00007FF64FF54000-memory.dmp	UPX
behavioral2/memory/3428-26-0x00007FF7F8710000-0x00007FF7F8A64000-memory.dmp	UPX
behavioral2/memory/4648-112-0x00007FF7FACC0000-0x00007FF7FB014000-memory.dmp	UPX
behavioral2/memory/3456-113-0x00007FF78B2D0000-0x00007FF78B624000-memory.dmp	UPX
behavioral2/memory/1444-114-0x00007FF6AD540000-0x00007FF6AD894000-memory.dmp	UPX
behavioral2/memory/1500-115-0x00007FF655E10000-0x00007FF656164000-memory.dmp	UPX
behavioral2/memory/2136-116-0x00007FF748860000-0x00007FF748BB4000-memory.dmp	UPX
behavioral2/memory/3504-117-0x00007FF627170000-0x00007FF6274C4000-memory.dmp	UPX
behavioral2/memory/3616-118-0x00007FF7024A0000-0x00007FF7027F4000-memory.dmp	UPX
behavioral2/memory/2980-119-0x00007FF680C20000-0x00007FF680F74000-memory.dmp	UPX
behavioral2/memory/2340-121-0x00007FF7D0810000-0x00007FF7D0B64000-memory.dmp	UPX
behavioral2/memory/3412-122-0x00007FF70CD30000-0x00007FF70D084000-memory.dmp	UPX
behavioral2/memory/1804-124-0x00007FF750EA0000-0x00007FF7511F4000-memory.dmp	UPX
behavioral2/memory/5032-126-0x00007FF61D000000-0x00007FF61D354000-memory.dmp	UPX
behavioral2/memory/4580-127-0x00007FF6EAE10000-0x00007FF6EB164000-memory.dmp	UPX
behavioral2/memory/1060-125-0x00007FF6B5A80000-0x00007FF6B5DD4000-memory.dmp	UPX
behavioral2/memory/468-123-0x00007FF6EE3A0000-0x00007FF6EE6F4000-memory.dmp	UPX
behavioral2/memory/3328-120-0x00007FF6CB1D0000-0x00007FF6CB524000-memory.dmp	UPX
behavioral2/memory/4560-128-0x00007FF701CF0000-0x00007FF702044000-memory.dmp	UPX
behavioral2/memory/1284-129-0x00007FF7113E0000-0x00007FF711734000-memory.dmp	UPX
behavioral2/memory/4172-130-0x00007FF7DE0F0000-0x00007FF7DE444000-memory.dmp	UPX
behavioral2/memory/1284-131-0x00007FF7113E0000-0x00007FF711734000-memory.dmp	UPX
behavioral2/memory/4124-132-0x00007FF6E1BF0000-0x00007FF6E1F44000-memory.dmp	UPX
behavioral2/memory/3428-133-0x00007FF7F8710000-0x00007FF7F8A64000-memory.dmp	UPX
behavioral2/memory/3524-134-0x00007FF64FC00000-0x00007FF64FF54000-memory.dmp	UPX
behavioral2/memory/4648-135-0x00007FF7FACC0000-0x00007FF7FB014000-memory.dmp	UPX
behavioral2/memory/3456-136-0x00007FF78B2D0000-0x00007FF78B624000-memory.dmp	UPX
behavioral2/memory/1444-137-0x00007FF6AD540000-0x00007FF6AD894000-memory.dmp	UPX
behavioral2/memory/1500-138-0x00007FF655E10000-0x00007FF656164000-memory.dmp	UPX
behavioral2/memory/2136-139-0x00007FF748860000-0x00007FF748BB4000-memory.dmp	UPX
behavioral2/memory/3504-140-0x00007FF627170000-0x00007FF6274C4000-memory.dmp	UPX
behavioral2/memory/3328-143-0x00007FF6CB1D0000-0x00007FF6CB524000-memory.dmp	UPX
behavioral2/memory/2980-146-0x00007FF680C20000-0x00007FF680F74000-memory.dmp	UPX
behavioral2/memory/2340-145-0x00007FF7D0810000-0x00007FF7D0B64000-memory.dmp	UPX
behavioral2/memory/468-144-0x00007FF6EE3A0000-0x00007FF6EE6F4000-memory.dmp	UPX
behavioral2/memory/3412-142-0x00007FF70CD30000-0x00007FF70D084000-memory.dmp	UPX
behavioral2/memory/3616-141-0x00007FF7024A0000-0x00007FF7027F4000-memory.dmp	UPX
behavioral2/memory/4580-148-0x00007FF6EAE10000-0x00007FF6EB164000-memory.dmp	UPX
behavioral2/memory/1060-149-0x00007FF6B5A80000-0x00007FF6B5DD4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4560-0-0x00007FF701CF0000-0x00007FF702044000-memory.dmp	xmrig
behavioral2/files/0x00080000000233c9-5.dat	xmrig
behavioral2/memory/4172-8-0x00007FF7DE0F0000-0x00007FF7DE444000-memory.dmp	xmrig
behavioral2/files/0x00070000000233cd-10.dat	xmrig
behavioral2/files/0x00070000000233ce-11.dat	xmrig
behavioral2/memory/1284-19-0x00007FF7113E0000-0x00007FF711734000-memory.dmp	xmrig
behavioral2/memory/4124-20-0x00007FF6E1BF0000-0x00007FF6E1F44000-memory.dmp	xmrig
behavioral2/files/0x00070000000233cf-24.dat	xmrig
behavioral2/files/0x00070000000233d0-28.dat	xmrig
behavioral2/files/0x00070000000233d1-35.dat	xmrig
behavioral2/files/0x00080000000233ca-46.dat	xmrig
behavioral2/files/0x00070000000233d3-50.dat	xmrig
behavioral2/files/0x00070000000233d5-60.dat	xmrig
behavioral2/files/0x00070000000233d7-70.dat	xmrig
behavioral2/files/0x00070000000233d8-77.dat	xmrig
behavioral2/files/0x00070000000233da-86.dat	xmrig
behavioral2/files/0x00070000000233db-90.dat	xmrig
behavioral2/files/0x00070000000233dd-100.dat	xmrig
behavioral2/files/0x00070000000233df-110.dat	xmrig
behavioral2/files/0x00070000000233de-107.dat	xmrig
behavioral2/files/0x00070000000233dc-98.dat	xmrig
behavioral2/files/0x00070000000233d9-81.dat	xmrig
behavioral2/files/0x00070000000233d6-68.dat	xmrig
behavioral2/files/0x00070000000233d4-58.dat	xmrig
behavioral2/files/0x00070000000233d2-41.dat	xmrig
behavioral2/memory/3524-34-0x00007FF64FC00000-0x00007FF64FF54000-memory.dmp	xmrig
behavioral2/memory/3428-26-0x00007FF7F8710000-0x00007FF7F8A64000-memory.dmp	xmrig
behavioral2/memory/4648-112-0x00007FF7FACC0000-0x00007FF7FB014000-memory.dmp	xmrig
behavioral2/memory/3456-113-0x00007FF78B2D0000-0x00007FF78B624000-memory.dmp	xmrig
behavioral2/memory/1444-114-0x00007FF6AD540000-0x00007FF6AD894000-memory.dmp	xmrig
behavioral2/memory/1500-115-0x00007FF655E10000-0x00007FF656164000-memory.dmp	xmrig
behavioral2/memory/2136-116-0x00007FF748860000-0x00007FF748BB4000-memory.dmp	xmrig
behavioral2/memory/3504-117-0x00007FF627170000-0x00007FF6274C4000-memory.dmp	xmrig
behavioral2/memory/3616-118-0x00007FF7024A0000-0x00007FF7027F4000-memory.dmp	xmrig
behavioral2/memory/2980-119-0x00007FF680C20000-0x00007FF680F74000-memory.dmp	xmrig
behavioral2/memory/2340-121-0x00007FF7D0810000-0x00007FF7D0B64000-memory.dmp	xmrig
behavioral2/memory/3412-122-0x00007FF70CD30000-0x00007FF70D084000-memory.dmp	xmrig
behavioral2/memory/1804-124-0x00007FF750EA0000-0x00007FF7511F4000-memory.dmp	xmrig
behavioral2/memory/5032-126-0x00007FF61D000000-0x00007FF61D354000-memory.dmp	xmrig
behavioral2/memory/4580-127-0x00007FF6EAE10000-0x00007FF6EB164000-memory.dmp	xmrig
behavioral2/memory/1060-125-0x00007FF6B5A80000-0x00007FF6B5DD4000-memory.dmp	xmrig
behavioral2/memory/468-123-0x00007FF6EE3A0000-0x00007FF6EE6F4000-memory.dmp	xmrig
behavioral2/memory/3328-120-0x00007FF6CB1D0000-0x00007FF6CB524000-memory.dmp	xmrig
behavioral2/memory/4560-128-0x00007FF701CF0000-0x00007FF702044000-memory.dmp	xmrig
behavioral2/memory/1284-129-0x00007FF7113E0000-0x00007FF711734000-memory.dmp	xmrig
behavioral2/memory/4172-130-0x00007FF7DE0F0000-0x00007FF7DE444000-memory.dmp	xmrig
behavioral2/memory/1284-131-0x00007FF7113E0000-0x00007FF711734000-memory.dmp	xmrig
behavioral2/memory/4124-132-0x00007FF6E1BF0000-0x00007FF6E1F44000-memory.dmp	xmrig
behavioral2/memory/3428-133-0x00007FF7F8710000-0x00007FF7F8A64000-memory.dmp	xmrig
behavioral2/memory/3524-134-0x00007FF64FC00000-0x00007FF64FF54000-memory.dmp	xmrig
behavioral2/memory/4648-135-0x00007FF7FACC0000-0x00007FF7FB014000-memory.dmp	xmrig
behavioral2/memory/3456-136-0x00007FF78B2D0000-0x00007FF78B624000-memory.dmp	xmrig
behavioral2/memory/1444-137-0x00007FF6AD540000-0x00007FF6AD894000-memory.dmp	xmrig
behavioral2/memory/1500-138-0x00007FF655E10000-0x00007FF656164000-memory.dmp	xmrig
behavioral2/memory/2136-139-0x00007FF748860000-0x00007FF748BB4000-memory.dmp	xmrig
behavioral2/memory/3504-140-0x00007FF627170000-0x00007FF6274C4000-memory.dmp	xmrig
behavioral2/memory/3328-143-0x00007FF6CB1D0000-0x00007FF6CB524000-memory.dmp	xmrig
behavioral2/memory/2980-146-0x00007FF680C20000-0x00007FF680F74000-memory.dmp	xmrig
behavioral2/memory/2340-145-0x00007FF7D0810000-0x00007FF7D0B64000-memory.dmp	xmrig
behavioral2/memory/468-144-0x00007FF6EE3A0000-0x00007FF6EE6F4000-memory.dmp	xmrig
behavioral2/memory/3412-142-0x00007FF70CD30000-0x00007FF70D084000-memory.dmp	xmrig
behavioral2/memory/3616-141-0x00007FF7024A0000-0x00007FF7027F4000-memory.dmp	xmrig
behavioral2/memory/4580-148-0x00007FF6EAE10000-0x00007FF6EB164000-memory.dmp	xmrig
behavioral2/memory/1060-149-0x00007FF6B5A80000-0x00007FF6B5DD4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4172	DZsGfGg.exe
1284	XIxTJeh.exe
4124	mIndfIL.exe
3428	UAiBRQC.exe
3524	tTGaUQX.exe
4648	CFnNnEW.exe
3456	DDUAZfj.exe
1444	ZFgUeJq.exe
1500	KKRrBqn.exe
2136	EnrLQXM.exe
3504	MupaMXk.exe
3616	uMzKODm.exe
2980	CMNLDPp.exe
3328	hAPjkWo.exe
2340	VdgKqAZ.exe
3412	nIWOJQm.exe
468	BwrOVyo.exe
1804	nkSDGuA.exe
1060	QeZelYS.exe
5032	gqRjdSV.exe
4580	ZAkXitB.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4560-0-0x00007FF701CF0000-0x00007FF702044000-memory.dmp	upx
behavioral2/files/0x00080000000233c9-5.dat	upx
behavioral2/memory/4172-8-0x00007FF7DE0F0000-0x00007FF7DE444000-memory.dmp	upx
behavioral2/files/0x00070000000233cd-10.dat	upx
behavioral2/files/0x00070000000233ce-11.dat	upx
behavioral2/memory/1284-19-0x00007FF7113E0000-0x00007FF711734000-memory.dmp	upx
behavioral2/memory/4124-20-0x00007FF6E1BF0000-0x00007FF6E1F44000-memory.dmp	upx
behavioral2/files/0x00070000000233cf-24.dat	upx
behavioral2/files/0x00070000000233d0-28.dat	upx
behavioral2/files/0x00070000000233d1-35.dat	upx
behavioral2/files/0x00080000000233ca-46.dat	upx
behavioral2/files/0x00070000000233d3-50.dat	upx
behavioral2/files/0x00070000000233d5-60.dat	upx
behavioral2/files/0x00070000000233d7-70.dat	upx
behavioral2/files/0x00070000000233d8-77.dat	upx
behavioral2/files/0x00070000000233da-86.dat	upx
behavioral2/files/0x00070000000233db-90.dat	upx
behavioral2/files/0x00070000000233dd-100.dat	upx
behavioral2/files/0x00070000000233df-110.dat	upx
behavioral2/files/0x00070000000233de-107.dat	upx
behavioral2/files/0x00070000000233dc-98.dat	upx
behavioral2/files/0x00070000000233d9-81.dat	upx
behavioral2/files/0x00070000000233d6-68.dat	upx
behavioral2/files/0x00070000000233d4-58.dat	upx
behavioral2/files/0x00070000000233d2-41.dat	upx
behavioral2/memory/3524-34-0x00007FF64FC00000-0x00007FF64FF54000-memory.dmp	upx
behavioral2/memory/3428-26-0x00007FF7F8710000-0x00007FF7F8A64000-memory.dmp	upx
behavioral2/memory/4648-112-0x00007FF7FACC0000-0x00007FF7FB014000-memory.dmp	upx
behavioral2/memory/3456-113-0x00007FF78B2D0000-0x00007FF78B624000-memory.dmp	upx
behavioral2/memory/1444-114-0x00007FF6AD540000-0x00007FF6AD894000-memory.dmp	upx
behavioral2/memory/1500-115-0x00007FF655E10000-0x00007FF656164000-memory.dmp	upx
behavioral2/memory/2136-116-0x00007FF748860000-0x00007FF748BB4000-memory.dmp	upx
behavioral2/memory/3504-117-0x00007FF627170000-0x00007FF6274C4000-memory.dmp	upx
behavioral2/memory/3616-118-0x00007FF7024A0000-0x00007FF7027F4000-memory.dmp	upx
behavioral2/memory/2980-119-0x00007FF680C20000-0x00007FF680F74000-memory.dmp	upx
behavioral2/memory/2340-121-0x00007FF7D0810000-0x00007FF7D0B64000-memory.dmp	upx
behavioral2/memory/3412-122-0x00007FF70CD30000-0x00007FF70D084000-memory.dmp	upx
behavioral2/memory/1804-124-0x00007FF750EA0000-0x00007FF7511F4000-memory.dmp	upx
behavioral2/memory/5032-126-0x00007FF61D000000-0x00007FF61D354000-memory.dmp	upx
behavioral2/memory/4580-127-0x00007FF6EAE10000-0x00007FF6EB164000-memory.dmp	upx
behavioral2/memory/1060-125-0x00007FF6B5A80000-0x00007FF6B5DD4000-memory.dmp	upx
behavioral2/memory/468-123-0x00007FF6EE3A0000-0x00007FF6EE6F4000-memory.dmp	upx
behavioral2/memory/3328-120-0x00007FF6CB1D0000-0x00007FF6CB524000-memory.dmp	upx
behavioral2/memory/4560-128-0x00007FF701CF0000-0x00007FF702044000-memory.dmp	upx
behavioral2/memory/1284-129-0x00007FF7113E0000-0x00007FF711734000-memory.dmp	upx
behavioral2/memory/4172-130-0x00007FF7DE0F0000-0x00007FF7DE444000-memory.dmp	upx
behavioral2/memory/1284-131-0x00007FF7113E0000-0x00007FF711734000-memory.dmp	upx
behavioral2/memory/4124-132-0x00007FF6E1BF0000-0x00007FF6E1F44000-memory.dmp	upx
behavioral2/memory/3428-133-0x00007FF7F8710000-0x00007FF7F8A64000-memory.dmp	upx
behavioral2/memory/3524-134-0x00007FF64FC00000-0x00007FF64FF54000-memory.dmp	upx
behavioral2/memory/4648-135-0x00007FF7FACC0000-0x00007FF7FB014000-memory.dmp	upx
behavioral2/memory/3456-136-0x00007FF78B2D0000-0x00007FF78B624000-memory.dmp	upx
behavioral2/memory/1444-137-0x00007FF6AD540000-0x00007FF6AD894000-memory.dmp	upx
behavioral2/memory/1500-138-0x00007FF655E10000-0x00007FF656164000-memory.dmp	upx
behavioral2/memory/2136-139-0x00007FF748860000-0x00007FF748BB4000-memory.dmp	upx
behavioral2/memory/3504-140-0x00007FF627170000-0x00007FF6274C4000-memory.dmp	upx
behavioral2/memory/3328-143-0x00007FF6CB1D0000-0x00007FF6CB524000-memory.dmp	upx
behavioral2/memory/2980-146-0x00007FF680C20000-0x00007FF680F74000-memory.dmp	upx
behavioral2/memory/2340-145-0x00007FF7D0810000-0x00007FF7D0B64000-memory.dmp	upx
behavioral2/memory/468-144-0x00007FF6EE3A0000-0x00007FF6EE6F4000-memory.dmp	upx
behavioral2/memory/3412-142-0x00007FF70CD30000-0x00007FF70D084000-memory.dmp	upx
behavioral2/memory/3616-141-0x00007FF7024A0000-0x00007FF7027F4000-memory.dmp	upx
behavioral2/memory/4580-148-0x00007FF6EAE10000-0x00007FF6EB164000-memory.dmp	upx
behavioral2/memory/1060-149-0x00007FF6B5A80000-0x00007FF6B5DD4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\QeZelYS.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DZsGfGg.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tTGaUQX.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nkSDGuA.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CMNLDPp.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mIndfIL.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UAiBRQC.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uMzKODm.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EnrLQXM.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hAPjkWo.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VdgKqAZ.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\nIWOJQm.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BwrOVyo.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XIxTJeh.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CFnNnEW.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DDUAZfj.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gqRjdSV.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZAkXitB.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZFgUeJq.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KKRrBqn.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MupaMXk.exe	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 4172	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	83
PID 4560 wrote to memory of 4172	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	83
PID 4560 wrote to memory of 1284	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	84
PID 4560 wrote to memory of 1284	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	84
PID 4560 wrote to memory of 4124	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	85
PID 4560 wrote to memory of 4124	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	85
PID 4560 wrote to memory of 3428	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	86
PID 4560 wrote to memory of 3428	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	86
PID 4560 wrote to memory of 3524	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	87
PID 4560 wrote to memory of 3524	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	87
PID 4560 wrote to memory of 4648	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	88
PID 4560 wrote to memory of 4648	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	88
PID 4560 wrote to memory of 3456	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	89
PID 4560 wrote to memory of 3456	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	89
PID 4560 wrote to memory of 1444	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	90
PID 4560 wrote to memory of 1444	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	90
PID 4560 wrote to memory of 1500	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	91
PID 4560 wrote to memory of 1500	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	91
PID 4560 wrote to memory of 2136	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	92
PID 4560 wrote to memory of 2136	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	92
PID 4560 wrote to memory of 3504	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	93
PID 4560 wrote to memory of 3504	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	93
PID 4560 wrote to memory of 3616	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	94
PID 4560 wrote to memory of 3616	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	94
PID 4560 wrote to memory of 2980	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	95
PID 4560 wrote to memory of 2980	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	95
PID 4560 wrote to memory of 3328	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	96
PID 4560 wrote to memory of 3328	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	96
PID 4560 wrote to memory of 2340	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	97
PID 4560 wrote to memory of 2340	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	97
PID 4560 wrote to memory of 3412	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	98
PID 4560 wrote to memory of 3412	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	98
PID 4560 wrote to memory of 468	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	99
PID 4560 wrote to memory of 468	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	99
PID 4560 wrote to memory of 1804	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	100
PID 4560 wrote to memory of 1804	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	100
PID 4560 wrote to memory of 1060	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	101
PID 4560 wrote to memory of 1060	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	101
PID 4560 wrote to memory of 5032	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	102
PID 4560 wrote to memory of 5032	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	102
PID 4560 wrote to memory of 4580	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	103
PID 4560 wrote to memory of 4580	4560	2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe	103

C:\Users\Admin\AppData\Local\Temp\2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_fda155143673621098f40cfd8d422f73_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\System\DZsGfGg.exe
  C:\Windows\System\DZsGfGg.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\XIxTJeh.exe
  C:\Windows\System\XIxTJeh.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\mIndfIL.exe
  C:\Windows\System\mIndfIL.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\UAiBRQC.exe
  C:\Windows\System\UAiBRQC.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\tTGaUQX.exe
  C:\Windows\System\tTGaUQX.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\CFnNnEW.exe
  C:\Windows\System\CFnNnEW.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\DDUAZfj.exe
  C:\Windows\System\DDUAZfj.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\ZFgUeJq.exe
  C:\Windows\System\ZFgUeJq.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\KKRrBqn.exe
  C:\Windows\System\KKRrBqn.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\EnrLQXM.exe
  C:\Windows\System\EnrLQXM.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\MupaMXk.exe
  C:\Windows\System\MupaMXk.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\uMzKODm.exe
  C:\Windows\System\uMzKODm.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\CMNLDPp.exe
  C:\Windows\System\CMNLDPp.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\hAPjkWo.exe
  C:\Windows\System\hAPjkWo.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\VdgKqAZ.exe
  C:\Windows\System\VdgKqAZ.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\nIWOJQm.exe
  C:\Windows\System\nIWOJQm.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\BwrOVyo.exe
  C:\Windows\System\BwrOVyo.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\nkSDGuA.exe
  C:\Windows\System\nkSDGuA.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\QeZelYS.exe
  C:\Windows\System\QeZelYS.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\gqRjdSV.exe
  C:\Windows\System\gqRjdSV.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\ZAkXitB.exe
  C:\Windows\System\ZAkXitB.exe
  2⤵
  - Executes dropped EXE
  PID:4580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BwrOVyo.exe

Path C:\Windows\System\BwrOVyo.exe
Size 5.9MB
SHA256 363b0ffac095bedcc5b26c447367f1efc98f43f95a7c20bba83d79d560fa5766
MD5 2b359112dc6de128c14dd1f6c9a47317
SHA1 bc719e37be7bbedafe882cf09b9713bdc5fb8c46
SHA512 d7bf4ce9724f7403d60280580f718b0f17806a0be38990a2774e44b204637ea9c09e0a3ecaf9347a0b2618c96b2b6d40b612496c7adb003ad237ff38d348a760
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

CFnNnEW.exe

Path C:\Windows\System\CFnNnEW.exe
Size 5.9MB
SHA256 a4f89a5793c4b950dd2e620d8017796fd38f33e61b0afc92af486558b26f85df
MD5 48a25f0f99d8853087e76c39e229c052
SHA1 4fa29834192f07b0951d0bda25d602bbcc1c6800
SHA512 8230a41ce63d23e74172fee58d135bbefe13ae11443e1944ed6b32b5fa7a48d383bfe0249f1285d3e6d4cda06d5054186503ded63cf5544f3635a92337a712cf
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

CMNLDPp.exe

Path C:\Windows\System\CMNLDPp.exe
Size 5.9MB
SHA256 cb2379244a9f714cb14c354c43b311f5f45deee2719e9612c05af5a10bf20d97
MD5 41be9fb8030bd037c387c2ee7ac168d1
SHA1 b009a85b5188463933b58206d148fa62cc1cc428
SHA512 ef40bc9fa911365fe057721902ec52a4b4a15ac2661ec2bbeb99350ef109d9082ab147004017fdc06985c148e70845fa44d92c25b31ab39339897bc6e34116c6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

DDUAZfj.exe

Path C:\Windows\System\DDUAZfj.exe
Size 5.9MB
SHA256 2556c460d4b775c820319ce041d389f1d8f8e39c30674178aa801d4aceca6c75
MD5 1373bfcbcb3b135b921da69f420fab5f
SHA1 009a5b098059bf15317f8e3f2789d1ff429b3108
SHA512 dd10f28e9415ae0e82d6149f6eca349fade71c2763cdb1a0a7cc1ab42d588150653f8c3738f29468e016689446467167f464408e47a6043acea501b899896f4b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

DZsGfGg.exe

Path C:\Windows\System\DZsGfGg.exe
Size 5.9MB
SHA256 80f9e3910cf9bf05eec73801158b52f03ea9ce45e21eab6c983e4b3cfee6ee4a
MD5 32b5113b15f95f647f04046ab637431a
SHA1 97d1717f21ad21b72202d34ff7a15c37015d6ebc
SHA512 a344560bdf248973cfc7af6f8ee32b626c71e3a7703616e53ed5362339abeb116ebc4cc3c96c558101aa5e6715cd3e73c0a315e339777c3b62ca19bc27981b64
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

EnrLQXM.exe

Path C:\Windows\System\EnrLQXM.exe
Size 5.9MB
SHA256 46f4e2dc9a5f80461f1f6c3ad3b64f67f615bb8ed1ae9f9d0e6780e9576eba6d
MD5 6b0c73d684fe5c40da3a219bdca00ede
SHA1 32d85117874252313083720dba51b1bb0a548dc4
SHA512 f8e2d39a76864460e1f0df38c5cbd7b40b8f7ab561f4e65d510e685f15ccf0b57950a5835ea5b96d56e55dc33bc18576a68c2445b8070eb06cfbed79249b2f80
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:Q+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

KKRrBqn.exe

Path C:\Windows\System\KKRrBqn.exe
Size 5.9MB
SHA256 9579d323c078fd0184e741080b67e66579b3f6910a0810f68f3998f77e7d6136
MD5 b8d75034929bb417440b967a2d0102e8
SHA1 8e6e27bf949c848b8c68356449b9f139505bcfac
SHA512 61cee9b53617449e7357eb138998c6fa4b8b33cffaf93a5579e2e0703e78ef663241b051723f5d459de48b5e6c9798509636b6d401273c2499721b8920c0a888
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

MupaMXk.exe

Path C:\Windows\System\MupaMXk.exe
Size 5.9MB
SHA256 fa79d8b8bbcef6abaaf09da265cbd42efca8afcb0f708f2973588a5a03822b29
MD5 caddf713f3e6621cede22cc2b8e75421
SHA1 59e470c198cca573690078d15b90b29ffc316f6e
SHA512 d4c5c6457aff7aaf6c6965788925778a99461ad8607a3b4616054dbccd5402f79b3b757011041963962cbcb1250347b93cbcb5563050e7d2c07ba13fbeb4550e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

QeZelYS.exe

Path C:\Windows\System\QeZelYS.exe
Size 5.9MB
SHA256 b12045dd1ce7a2220ed317db355c89d6b1a3cfce5307f0c94bd3cf57ddfc7d48
MD5 d3d2409cf320045d64cd35a5b51b39f9
SHA1 612a81bf54ccc4aec5012aa0ae3197f85b4da1ca
SHA512 4e573cb71f06e324a97dead1be17152edb34423963e1cadb36ea1d826a3784c562e6270658f365658f7c878665a2f68bc6d2d99d98278ac667d5d101b97d0c69
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

UAiBRQC.exe

Path C:\Windows\System\UAiBRQC.exe
Size 5.9MB
SHA256 2eb14a1c6c45934cbfec6cd77887e231b5104f4d2cad96d1b587e96b61428252
MD5 48ab39ba3826b139b41abd2dfa856e05
SHA1 a586ea072ef3303582f86fab14cf1acf9d7bf03b
SHA512 cab97cabb8cd75075304393f35da3e18fb3aa329f38d4b7f8a7826e98c2b0af1fcf5203896b8cbb425aabacd178d1bb27787331314a6a7c2e79c1cb77a182dd2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

VdgKqAZ.exe

Path C:\Windows\System\VdgKqAZ.exe
Size 5.9MB
SHA256 175503f1e7d88dbe1a2f72bc9b5db3dc730d9ecd8cff2076e8204571480e6da3
MD5 9b4873c347664e01e66a77337b82a8a6
SHA1 cdca0b2012f601700b790d7b2b16e3f54be77f43
SHA512 864d8cac9159083453b581d0adaf396a308210c2aec07731893d603fd4d634d33b219ce1e68cd2e2b0d152be90d3cd57b85ba9c8f67087a98dd1bcf8e236c53e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

XIxTJeh.exe

Path C:\Windows\System\XIxTJeh.exe
Size 5.9MB
SHA256 c0bc5da2a918191fffa790970e73ede07262f1f3c329c54aa50531018283c9c1
MD5 93eddbb8afd5b2d30f18f722baeea61e
SHA1 6efba84e244627a7375317a0744a40d0b39a3608
SHA512 787d29cb6ee1d397a59bf5efa67d2b813902b5dedd207c7165f01a41ee8ecf1966082fcf8d3f2f1e90d50ba304979f02a002e2f8b05541ca13f914e6dab8ae99
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZAkXitB.exe

Path C:\Windows\System\ZAkXitB.exe
Size 5.9MB
SHA256 a78ad82622260b4271697a8904d17974a0e7a479c2b50bc8c1d899144cd834be
MD5 33195fd6a46cb9b296ad1827ae88c2a5
SHA1 a0cc33db50572129c8036e0f7b79276ab01fc3a3
SHA512 2d221df5e4b63e995110847c9799cca9340ff67d25b7c3ae2f81782a23ca406aafee676ea2f57c1ec8b370356505b3783509e7f4df139c46802924e669acb79a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZFgUeJq.exe

Path C:\Windows\System\ZFgUeJq.exe
Size 5.9MB
SHA256 baad52179c55f8646749accfe72df9c0aed3cf093320f428ddee49cc764cfd3b
MD5 305ac6b39ea040beb3c5dc9508900fcb
SHA1 35a0c2f77ca3bc049e10958fc518cc2d89b6ab07
SHA512 55395fb02f7e7b9ad256a23e7763330c9899bb61607d6bd1b7f2ff4d303e6f6c9c3f2a6b39ab4e39b0d4ae9859c6bb2f3be9b3ef715863e91d11e9b86f9a019a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:Q+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

gqRjdSV.exe

Path C:\Windows\System\gqRjdSV.exe
Size 5.9MB
SHA256 8a3ef1b9104597229a7be79861021f3edf56e7b49f0b6571bf1e203d1bab282a
MD5 5aea31c7a80263a44d641813f14d16ca
SHA1 ac6982542ddda95be9c78f29d66c969e0e46a727
SHA512 724bf3dacaef7f1c70bd5b16a8c78aae337534dca94a78e63166576ed0308f95331e9056e9c3fbbbecaf25198df4a79292874b74d0f09eacfc9bb59f48c0c927
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

hAPjkWo.exe

Path C:\Windows\System\hAPjkWo.exe
Size 5.9MB
SHA256 1482c0b815d1ba76f187df8bdba80677f29b1decca39e8c85f51bd997d99bb85
MD5 658425dbcdae7557b7704cff0b915398
SHA1 c32a4b03855a06618b8172c64bff552291318ab9
SHA512 1f8c1fad611dceab04be7b6db3352131b5ed141566675561b254cd94b9fabce799dcb65d4b5379a9bca3cb683653fef199914283c7bb33121ce3a8c8112cb4ca
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

mIndfIL.exe

Path C:\Windows\System\mIndfIL.exe
Size 5.9MB
SHA256 5247d9c412d5a268b2fc4c58618dcd3707af7522e8f84543e97319fe9ee07170
MD5 1cadf1e7fa8109c815277085fa72fe66
SHA1 7e44f2d1da52857a8ce6ac21367c77745f0b02b4
SHA512 910dddcfd42dda3015be8b470a75409687d83b169f0fa28fa9f69b7b9d6a1f5c90f469ff38fb919f2a3d54c718c9a3d136bddee6205341ee645b4099ee620916
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

nIWOJQm.exe

Path C:\Windows\System\nIWOJQm.exe
Size 5.9MB
SHA256 30673eeb7cce963f0fd6e350e070f7e210c5ede0743c932baf2ac572f3f6d061
MD5 36b52cd70231ae3ed8ce67bc54bdc73b
SHA1 f66ca41358fa5797af8d07413afab708579a0690
SHA512 24a66133cd3ed8528df09a887d7ae87239b0a778bf184d712ce4ed01bb0c5881e77d2552a853b45f9f33a082e3796ce2d8418459f5442c348270e9cdead19b7d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

nkSDGuA.exe

Path C:\Windows\System\nkSDGuA.exe
Size 5.9MB
SHA256 79f545ea799e6d3280e310aaba29e85ccd6fb838dfc0e8356be128d510b46f04
MD5 612205fac662f8fc131062c44c97a9be
SHA1 07945d30e7e7fd7b0cd1727163f0da4f508672ff
SHA512 7e8a9d60ff7e1cee8fd1e61a5f2a62d2cb90a39d2c107f0408c366d1de4f9d53c34d53eb70e3e8621fbe0ac65c777a08759cbf02c550e984ed2ada36ca317e90
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

tTGaUQX.exe

Path C:\Windows\System\tTGaUQX.exe
Size 5.9MB
SHA256 c3d26dd1f7cdc12ced6b2ee50ee9ce8881b8885eb7a5c1f470b9d338098b43e8
MD5 ebd1ef5248c84063b86657fc3ab68f03
SHA1 3986d7b39c545d7485b36ee8f8e27f161c6861a2
SHA512 253264dbd19d11dfa0042cbc560f948f3037a0a80bfe68671934fa3d872ae129fb6818f6f14d09f7dbb9ba44296e9c78398d66a82e396f17627476b714a9c658
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:Q+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

uMzKODm.exe

Path C:\Windows\System\uMzKODm.exe
Size 5.9MB
SHA256 bd4faf4b6f2141cff39881bb5a8ee3c671a96cc398c1bb8f2c1c3f04cbaa7400
MD5 fa1e7903b813926f3978e27caac59ef2
SHA1 7eb26b8f30c3004620991404d1d75e917da411f8
SHA512 6c1364b6ef7fb35f4521a487d3bc349a435972415b90dea5d363533ee358da384b4ef395d3d3626c9af3a30703ae20696c9654bc86e94d1aa335d988488ebf1b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/468-144-0x00007FF6EE3A0000-0x00007FF6EE6F4000-memory.dmp

Download

memory/468-123-0x00007FF6EE3A0000-0x00007FF6EE6F4000-memory.dmp

Download

memory/1060-125-0x00007FF6B5A80000-0x00007FF6B5DD4000-memory.dmp

Download

memory/1060-149-0x00007FF6B5A80000-0x00007FF6B5DD4000-memory.dmp

Download

memory/1284-19-0x00007FF7113E0000-0x00007FF711734000-memory.dmp

Download

memory/1284-131-0x00007FF7113E0000-0x00007FF711734000-memory.dmp

Download

memory/1284-129-0x00007FF7113E0000-0x00007FF711734000-memory.dmp

Download

memory/1444-114-0x00007FF6AD540000-0x00007FF6AD894000-memory.dmp

Download

memory/1444-137-0x00007FF6AD540000-0x00007FF6AD894000-memory.dmp

Download

memory/1500-138-0x00007FF655E10000-0x00007FF656164000-memory.dmp

Download

memory/1500-115-0x00007FF655E10000-0x00007FF656164000-memory.dmp

Download

memory/1804-147-0x00007FF750EA0000-0x00007FF7511F4000-memory.dmp

Download

memory/1804-124-0x00007FF750EA0000-0x00007FF7511F4000-memory.dmp

Download

memory/2136-116-0x00007FF748860000-0x00007FF748BB4000-memory.dmp

Download

memory/2136-139-0x00007FF748860000-0x00007FF748BB4000-memory.dmp

Download

memory/2340-121-0x00007FF7D0810000-0x00007FF7D0B64000-memory.dmp

Download

memory/2340-145-0x00007FF7D0810000-0x00007FF7D0B64000-memory.dmp

Download

memory/2980-119-0x00007FF680C20000-0x00007FF680F74000-memory.dmp

Download

memory/2980-146-0x00007FF680C20000-0x00007FF680F74000-memory.dmp

Download

memory/3328-120-0x00007FF6CB1D0000-0x00007FF6CB524000-memory.dmp

Download

memory/3328-143-0x00007FF6CB1D0000-0x00007FF6CB524000-memory.dmp

Download

memory/3412-142-0x00007FF70CD30000-0x00007FF70D084000-memory.dmp

Download

memory/3412-122-0x00007FF70CD30000-0x00007FF70D084000-memory.dmp

Download

memory/3428-26-0x00007FF7F8710000-0x00007FF7F8A64000-memory.dmp

Download

memory/3428-133-0x00007FF7F8710000-0x00007FF7F8A64000-memory.dmp

Download

memory/3456-113-0x00007FF78B2D0000-0x00007FF78B624000-memory.dmp

Download

memory/3456-136-0x00007FF78B2D0000-0x00007FF78B624000-memory.dmp

Download

memory/3504-140-0x00007FF627170000-0x00007FF6274C4000-memory.dmp

Download

memory/3504-117-0x00007FF627170000-0x00007FF6274C4000-memory.dmp

Download

memory/3524-34-0x00007FF64FC00000-0x00007FF64FF54000-memory.dmp

Download

memory/3524-134-0x00007FF64FC00000-0x00007FF64FF54000-memory.dmp

Download

memory/3616-141-0x00007FF7024A0000-0x00007FF7027F4000-memory.dmp

Download

memory/3616-118-0x00007FF7024A0000-0x00007FF7027F4000-memory.dmp

Download

memory/4124-20-0x00007FF6E1BF0000-0x00007FF6E1F44000-memory.dmp

Download

memory/4124-132-0x00007FF6E1BF0000-0x00007FF6E1F44000-memory.dmp

Download

memory/4172-130-0x00007FF7DE0F0000-0x00007FF7DE444000-memory.dmp

Download

memory/4172-8-0x00007FF7DE0F0000-0x00007FF7DE444000-memory.dmp

Download

memory/4560-128-0x00007FF701CF0000-0x00007FF702044000-memory.dmp

Download

memory/4560-0-0x00007FF701CF0000-0x00007FF702044000-memory.dmp

Download

memory/4560-1-0x000001C025E00000-0x000001C025E10000-memory.dmp

Download

memory/4580-127-0x00007FF6EAE10000-0x00007FF6EB164000-memory.dmp

Download

memory/4580-148-0x00007FF6EAE10000-0x00007FF6EB164000-memory.dmp

Download

memory/4648-135-0x00007FF7FACC0000-0x00007FF7FB014000-memory.dmp

Download

memory/4648-112-0x00007FF7FACC0000-0x00007FF7FB014000-memory.dmp

Download

memory/5032-126-0x00007FF61D000000-0x00007FF61D354000-memory.dmp

Download

memory/5032-150-0x00007FF61D000000-0x00007FF61D354000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads