cobaltstrike | d50c18e056a3c90b312b78c6b2ba54d7e20a9eaf4bc2bba24ee9e874b4b37311

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 02:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-cvxbnaef2w
SHA256 d50c18e056a3c90b312b78c6b2ba54d7e20a9eaf4bc2bba24ee9e874b4b37311
MD5 ca981df9780aa4016873a2dd82f249f9
SHA1 a8c059c0006998acade23627ad7abcaef59b6a72
SHA512 4ec472b5907658c26771c09341095cfaed196bda1dfe801330d0a3a60338d508eef57e8621adf0e2d9e84bb1ff6c6192b8da9757cf8defd926b7fa7bf5db29e9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000800000002346d-6.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023471-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023472-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023473-22.dat	cobalt_reflective_dll
behavioral2/files/0x000300000001e732-28.dat	cobalt_reflective_dll
behavioral2/files/0x000800000002346e-35.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023474-42.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023475-47.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023476-51.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023477-56.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002347a-75.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002347e-101.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023481-110.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023482-117.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023480-111.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002347f-105.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002347d-96.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002347c-91.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002347b-83.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023478-76.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023479-73.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000800000002346d-6.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023471-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023472-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023473-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000300000001e732-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000800000002346e-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023474-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023475-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023476-51.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023477-56.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002347a-75.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002347e-101.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023481-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023482-117.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023480-111.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002347f-105.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002347d-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002347c-91.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002347b-83.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023478-76.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023479-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1884-0-0x00007FF6F4D80000-0x00007FF6F50D4000-memory.dmp	UPX
behavioral2/files/0x000800000002346d-6.dat	UPX
behavioral2/memory/3164-8-0x00007FF665440000-0x00007FF665794000-memory.dmp	UPX
behavioral2/files/0x0007000000023471-11.dat	UPX
behavioral2/files/0x0007000000023472-10.dat	UPX
behavioral2/memory/3536-13-0x00007FF79CA00000-0x00007FF79CD54000-memory.dmp	UPX
behavioral2/memory/1016-20-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp	UPX
behavioral2/files/0x0007000000023473-22.dat	UPX
behavioral2/memory/2344-25-0x00007FF639380000-0x00007FF6396D4000-memory.dmp	UPX
behavioral2/files/0x000300000001e732-28.dat	UPX
behavioral2/memory/2912-30-0x00007FF721360000-0x00007FF7216B4000-memory.dmp	UPX
behavioral2/files/0x000800000002346e-35.dat	UPX
behavioral2/memory/2068-38-0x00007FF707800000-0x00007FF707B54000-memory.dmp	UPX
behavioral2/files/0x0007000000023474-42.dat	UPX
behavioral2/files/0x0007000000023475-47.dat	UPX
behavioral2/files/0x0007000000023476-51.dat	UPX
behavioral2/files/0x0007000000023477-56.dat	UPX
behavioral2/memory/3184-69-0x00007FF7520E0000-0x00007FF752434000-memory.dmp	UPX
behavioral2/files/0x000700000002347a-75.dat	UPX
behavioral2/files/0x000700000002347e-101.dat	UPX
behavioral2/files/0x0007000000023481-110.dat	UPX
behavioral2/files/0x0007000000023482-117.dat	UPX
behavioral2/files/0x0007000000023480-111.dat	UPX
behavioral2/files/0x000700000002347f-105.dat	UPX
behavioral2/files/0x000700000002347d-96.dat	UPX
behavioral2/files/0x000700000002347c-91.dat	UPX
behavioral2/files/0x000700000002347b-83.dat	UPX
behavioral2/files/0x0007000000023478-76.dat	UPX
behavioral2/files/0x0007000000023479-73.dat	UPX
behavioral2/memory/4820-72-0x00007FF673AB0000-0x00007FF673E04000-memory.dmp	UPX
behavioral2/memory/4468-60-0x00007FF7C6D50000-0x00007FF7C70A4000-memory.dmp	UPX
behavioral2/memory/4660-59-0x00007FF7377A0000-0x00007FF737AF4000-memory.dmp	UPX
behavioral2/memory/2220-57-0x00007FF716FD0000-0x00007FF717324000-memory.dmp	UPX
behavioral2/memory/3852-54-0x00007FF711BE0000-0x00007FF711F34000-memory.dmp	UPX
behavioral2/memory/1884-119-0x00007FF6F4D80000-0x00007FF6F50D4000-memory.dmp	UPX
behavioral2/memory/4032-121-0x00007FF607F10000-0x00007FF608264000-memory.dmp	UPX
behavioral2/memory/4460-120-0x00007FF7316B0000-0x00007FF731A04000-memory.dmp	UPX
behavioral2/memory/1588-122-0x00007FF7D2AD0000-0x00007FF7D2E24000-memory.dmp	UPX
behavioral2/memory/4840-123-0x00007FF7D35E0000-0x00007FF7D3934000-memory.dmp	UPX
behavioral2/memory/3196-124-0x00007FF6F8D20000-0x00007FF6F9074000-memory.dmp	UPX
behavioral2/memory/2356-125-0x00007FF7180F0000-0x00007FF718444000-memory.dmp	UPX
behavioral2/memory/2280-127-0x00007FF6C50B0000-0x00007FF6C5404000-memory.dmp	UPX
behavioral2/memory/4636-128-0x00007FF75D210000-0x00007FF75D564000-memory.dmp	UPX
behavioral2/memory/4092-126-0x00007FF6ADE00000-0x00007FF6AE154000-memory.dmp	UPX
behavioral2/memory/3164-129-0x00007FF665440000-0x00007FF665794000-memory.dmp	UPX
behavioral2/memory/3536-130-0x00007FF79CA00000-0x00007FF79CD54000-memory.dmp	UPX
behavioral2/memory/1016-131-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp	UPX
behavioral2/memory/2344-132-0x00007FF639380000-0x00007FF6396D4000-memory.dmp	UPX
behavioral2/memory/2912-133-0x00007FF721360000-0x00007FF7216B4000-memory.dmp	UPX
behavioral2/memory/4468-134-0x00007FF7C6D50000-0x00007FF7C70A4000-memory.dmp	UPX
behavioral2/memory/3184-135-0x00007FF7520E0000-0x00007FF752434000-memory.dmp	UPX
behavioral2/memory/4820-136-0x00007FF673AB0000-0x00007FF673E04000-memory.dmp	UPX
behavioral2/memory/3164-137-0x00007FF665440000-0x00007FF665794000-memory.dmp	UPX
behavioral2/memory/3536-138-0x00007FF79CA00000-0x00007FF79CD54000-memory.dmp	UPX
behavioral2/memory/1016-139-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp	UPX
behavioral2/memory/2344-140-0x00007FF639380000-0x00007FF6396D4000-memory.dmp	UPX
behavioral2/memory/2912-141-0x00007FF721360000-0x00007FF7216B4000-memory.dmp	UPX
behavioral2/memory/2068-142-0x00007FF707800000-0x00007FF707B54000-memory.dmp	UPX
behavioral2/memory/3852-143-0x00007FF711BE0000-0x00007FF711F34000-memory.dmp	UPX
behavioral2/memory/4660-144-0x00007FF7377A0000-0x00007FF737AF4000-memory.dmp	UPX
behavioral2/memory/2220-145-0x00007FF716FD0000-0x00007FF717324000-memory.dmp	UPX
behavioral2/memory/4468-146-0x00007FF7C6D50000-0x00007FF7C70A4000-memory.dmp	UPX
behavioral2/memory/4820-147-0x00007FF673AB0000-0x00007FF673E04000-memory.dmp	UPX
behavioral2/memory/3184-148-0x00007FF7520E0000-0x00007FF752434000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1884-0-0x00007FF6F4D80000-0x00007FF6F50D4000-memory.dmp	xmrig
behavioral2/files/0x000800000002346d-6.dat	xmrig
behavioral2/memory/3164-8-0x00007FF665440000-0x00007FF665794000-memory.dmp	xmrig
behavioral2/files/0x0007000000023471-11.dat	xmrig
behavioral2/files/0x0007000000023472-10.dat	xmrig
behavioral2/memory/3536-13-0x00007FF79CA00000-0x00007FF79CD54000-memory.dmp	xmrig
behavioral2/memory/1016-20-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp	xmrig
behavioral2/files/0x0007000000023473-22.dat	xmrig
behavioral2/memory/2344-25-0x00007FF639380000-0x00007FF6396D4000-memory.dmp	xmrig
behavioral2/files/0x000300000001e732-28.dat	xmrig
behavioral2/memory/2912-30-0x00007FF721360000-0x00007FF7216B4000-memory.dmp	xmrig
behavioral2/files/0x000800000002346e-35.dat	xmrig
behavioral2/memory/2068-38-0x00007FF707800000-0x00007FF707B54000-memory.dmp	xmrig
behavioral2/files/0x0007000000023474-42.dat	xmrig
behavioral2/files/0x0007000000023475-47.dat	xmrig
behavioral2/files/0x0007000000023476-51.dat	xmrig
behavioral2/files/0x0007000000023477-56.dat	xmrig
behavioral2/memory/3184-69-0x00007FF7520E0000-0x00007FF752434000-memory.dmp	xmrig
behavioral2/files/0x000700000002347a-75.dat	xmrig
behavioral2/files/0x000700000002347e-101.dat	xmrig
behavioral2/files/0x0007000000023481-110.dat	xmrig
behavioral2/files/0x0007000000023482-117.dat	xmrig
behavioral2/files/0x0007000000023480-111.dat	xmrig
behavioral2/files/0x000700000002347f-105.dat	xmrig
behavioral2/files/0x000700000002347d-96.dat	xmrig
behavioral2/files/0x000700000002347c-91.dat	xmrig
behavioral2/files/0x000700000002347b-83.dat	xmrig
behavioral2/files/0x0007000000023478-76.dat	xmrig
behavioral2/files/0x0007000000023479-73.dat	xmrig
behavioral2/memory/4820-72-0x00007FF673AB0000-0x00007FF673E04000-memory.dmp	xmrig
behavioral2/memory/4468-60-0x00007FF7C6D50000-0x00007FF7C70A4000-memory.dmp	xmrig
behavioral2/memory/4660-59-0x00007FF7377A0000-0x00007FF737AF4000-memory.dmp	xmrig
behavioral2/memory/2220-57-0x00007FF716FD0000-0x00007FF717324000-memory.dmp	xmrig
behavioral2/memory/3852-54-0x00007FF711BE0000-0x00007FF711F34000-memory.dmp	xmrig
behavioral2/memory/1884-119-0x00007FF6F4D80000-0x00007FF6F50D4000-memory.dmp	xmrig
behavioral2/memory/4032-121-0x00007FF607F10000-0x00007FF608264000-memory.dmp	xmrig
behavioral2/memory/4460-120-0x00007FF7316B0000-0x00007FF731A04000-memory.dmp	xmrig
behavioral2/memory/1588-122-0x00007FF7D2AD0000-0x00007FF7D2E24000-memory.dmp	xmrig
behavioral2/memory/4840-123-0x00007FF7D35E0000-0x00007FF7D3934000-memory.dmp	xmrig
behavioral2/memory/3196-124-0x00007FF6F8D20000-0x00007FF6F9074000-memory.dmp	xmrig
behavioral2/memory/2356-125-0x00007FF7180F0000-0x00007FF718444000-memory.dmp	xmrig
behavioral2/memory/2280-127-0x00007FF6C50B0000-0x00007FF6C5404000-memory.dmp	xmrig
behavioral2/memory/4636-128-0x00007FF75D210000-0x00007FF75D564000-memory.dmp	xmrig
behavioral2/memory/4092-126-0x00007FF6ADE00000-0x00007FF6AE154000-memory.dmp	xmrig
behavioral2/memory/3164-129-0x00007FF665440000-0x00007FF665794000-memory.dmp	xmrig
behavioral2/memory/3536-130-0x00007FF79CA00000-0x00007FF79CD54000-memory.dmp	xmrig
behavioral2/memory/1016-131-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp	xmrig
behavioral2/memory/2344-132-0x00007FF639380000-0x00007FF6396D4000-memory.dmp	xmrig
behavioral2/memory/2912-133-0x00007FF721360000-0x00007FF7216B4000-memory.dmp	xmrig
behavioral2/memory/4468-134-0x00007FF7C6D50000-0x00007FF7C70A4000-memory.dmp	xmrig
behavioral2/memory/3184-135-0x00007FF7520E0000-0x00007FF752434000-memory.dmp	xmrig
behavioral2/memory/4820-136-0x00007FF673AB0000-0x00007FF673E04000-memory.dmp	xmrig
behavioral2/memory/3164-137-0x00007FF665440000-0x00007FF665794000-memory.dmp	xmrig
behavioral2/memory/3536-138-0x00007FF79CA00000-0x00007FF79CD54000-memory.dmp	xmrig
behavioral2/memory/1016-139-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp	xmrig
behavioral2/memory/2344-140-0x00007FF639380000-0x00007FF6396D4000-memory.dmp	xmrig
behavioral2/memory/2912-141-0x00007FF721360000-0x00007FF7216B4000-memory.dmp	xmrig
behavioral2/memory/2068-142-0x00007FF707800000-0x00007FF707B54000-memory.dmp	xmrig
behavioral2/memory/3852-143-0x00007FF711BE0000-0x00007FF711F34000-memory.dmp	xmrig
behavioral2/memory/4660-144-0x00007FF7377A0000-0x00007FF737AF4000-memory.dmp	xmrig
behavioral2/memory/2220-145-0x00007FF716FD0000-0x00007FF717324000-memory.dmp	xmrig
behavioral2/memory/4468-146-0x00007FF7C6D50000-0x00007FF7C70A4000-memory.dmp	xmrig
behavioral2/memory/4820-147-0x00007FF673AB0000-0x00007FF673E04000-memory.dmp	xmrig
behavioral2/memory/3184-148-0x00007FF7520E0000-0x00007FF752434000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3164	geUXSbj.exe
3536	sdIAsql.exe
1016	DBqyGqC.exe
2344	rvpPElN.exe
2912	YiFMFnq.exe
2068	XspuvEW.exe
3852	MslYKZM.exe
4660	zqMGNTR.exe
2220	lRYLGIS.exe
4468	PCbFVQw.exe
3184	KZsoNqI.exe
4820	iPuAAqq.exe
4460	QpumNuV.exe
4636	uQEOIwn.exe
4032	gyfavYs.exe
1588	gtamfCR.exe
4840	ERohUpG.exe
3196	OAWlhif.exe
2356	zFGknos.exe
4092	OwGjHGv.exe
2280	IeqhwUK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1884-0-0x00007FF6F4D80000-0x00007FF6F50D4000-memory.dmp	upx
behavioral2/files/0x000800000002346d-6.dat	upx
behavioral2/memory/3164-8-0x00007FF665440000-0x00007FF665794000-memory.dmp	upx
behavioral2/files/0x0007000000023471-11.dat	upx
behavioral2/files/0x0007000000023472-10.dat	upx
behavioral2/memory/3536-13-0x00007FF79CA00000-0x00007FF79CD54000-memory.dmp	upx
behavioral2/memory/1016-20-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp	upx
behavioral2/files/0x0007000000023473-22.dat	upx
behavioral2/memory/2344-25-0x00007FF639380000-0x00007FF6396D4000-memory.dmp	upx
behavioral2/files/0x000300000001e732-28.dat	upx
behavioral2/memory/2912-30-0x00007FF721360000-0x00007FF7216B4000-memory.dmp	upx
behavioral2/files/0x000800000002346e-35.dat	upx
behavioral2/memory/2068-38-0x00007FF707800000-0x00007FF707B54000-memory.dmp	upx
behavioral2/files/0x0007000000023474-42.dat	upx
behavioral2/files/0x0007000000023475-47.dat	upx
behavioral2/files/0x0007000000023476-51.dat	upx
behavioral2/files/0x0007000000023477-56.dat	upx
behavioral2/memory/3184-69-0x00007FF7520E0000-0x00007FF752434000-memory.dmp	upx
behavioral2/files/0x000700000002347a-75.dat	upx
behavioral2/files/0x000700000002347e-101.dat	upx
behavioral2/files/0x0007000000023481-110.dat	upx
behavioral2/files/0x0007000000023482-117.dat	upx
behavioral2/files/0x0007000000023480-111.dat	upx
behavioral2/files/0x000700000002347f-105.dat	upx
behavioral2/files/0x000700000002347d-96.dat	upx
behavioral2/files/0x000700000002347c-91.dat	upx
behavioral2/files/0x000700000002347b-83.dat	upx
behavioral2/files/0x0007000000023478-76.dat	upx
behavioral2/files/0x0007000000023479-73.dat	upx
behavioral2/memory/4820-72-0x00007FF673AB0000-0x00007FF673E04000-memory.dmp	upx
behavioral2/memory/4468-60-0x00007FF7C6D50000-0x00007FF7C70A4000-memory.dmp	upx
behavioral2/memory/4660-59-0x00007FF7377A0000-0x00007FF737AF4000-memory.dmp	upx
behavioral2/memory/2220-57-0x00007FF716FD0000-0x00007FF717324000-memory.dmp	upx
behavioral2/memory/3852-54-0x00007FF711BE0000-0x00007FF711F34000-memory.dmp	upx
behavioral2/memory/1884-119-0x00007FF6F4D80000-0x00007FF6F50D4000-memory.dmp	upx
behavioral2/memory/4032-121-0x00007FF607F10000-0x00007FF608264000-memory.dmp	upx
behavioral2/memory/4460-120-0x00007FF7316B0000-0x00007FF731A04000-memory.dmp	upx
behavioral2/memory/1588-122-0x00007FF7D2AD0000-0x00007FF7D2E24000-memory.dmp	upx
behavioral2/memory/4840-123-0x00007FF7D35E0000-0x00007FF7D3934000-memory.dmp	upx
behavioral2/memory/3196-124-0x00007FF6F8D20000-0x00007FF6F9074000-memory.dmp	upx
behavioral2/memory/2356-125-0x00007FF7180F0000-0x00007FF718444000-memory.dmp	upx
behavioral2/memory/2280-127-0x00007FF6C50B0000-0x00007FF6C5404000-memory.dmp	upx
behavioral2/memory/4636-128-0x00007FF75D210000-0x00007FF75D564000-memory.dmp	upx
behavioral2/memory/4092-126-0x00007FF6ADE00000-0x00007FF6AE154000-memory.dmp	upx
behavioral2/memory/3164-129-0x00007FF665440000-0x00007FF665794000-memory.dmp	upx
behavioral2/memory/3536-130-0x00007FF79CA00000-0x00007FF79CD54000-memory.dmp	upx
behavioral2/memory/1016-131-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp	upx
behavioral2/memory/2344-132-0x00007FF639380000-0x00007FF6396D4000-memory.dmp	upx
behavioral2/memory/2912-133-0x00007FF721360000-0x00007FF7216B4000-memory.dmp	upx
behavioral2/memory/4468-134-0x00007FF7C6D50000-0x00007FF7C70A4000-memory.dmp	upx
behavioral2/memory/3184-135-0x00007FF7520E0000-0x00007FF752434000-memory.dmp	upx
behavioral2/memory/4820-136-0x00007FF673AB0000-0x00007FF673E04000-memory.dmp	upx
behavioral2/memory/3164-137-0x00007FF665440000-0x00007FF665794000-memory.dmp	upx
behavioral2/memory/3536-138-0x00007FF79CA00000-0x00007FF79CD54000-memory.dmp	upx
behavioral2/memory/1016-139-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp	upx
behavioral2/memory/2344-140-0x00007FF639380000-0x00007FF6396D4000-memory.dmp	upx
behavioral2/memory/2912-141-0x00007FF721360000-0x00007FF7216B4000-memory.dmp	upx
behavioral2/memory/2068-142-0x00007FF707800000-0x00007FF707B54000-memory.dmp	upx
behavioral2/memory/3852-143-0x00007FF711BE0000-0x00007FF711F34000-memory.dmp	upx
behavioral2/memory/4660-144-0x00007FF7377A0000-0x00007FF737AF4000-memory.dmp	upx
behavioral2/memory/2220-145-0x00007FF716FD0000-0x00007FF717324000-memory.dmp	upx
behavioral2/memory/4468-146-0x00007FF7C6D50000-0x00007FF7C70A4000-memory.dmp	upx
behavioral2/memory/4820-147-0x00007FF673AB0000-0x00007FF673E04000-memory.dmp	upx
behavioral2/memory/3184-148-0x00007FF7520E0000-0x00007FF752434000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\OwGjHGv.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\sdIAsql.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YiFMFnq.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zqMGNTR.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KZsoNqI.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gyfavYs.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gtamfCR.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ERohUpG.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IeqhwUK.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\geUXSbj.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XspuvEW.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PCbFVQw.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QpumNuV.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MslYKZM.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lRYLGIS.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uQEOIwn.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OAWlhif.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DBqyGqC.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\rvpPElN.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iPuAAqq.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zFGknos.exe	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 3164	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	84
PID 1884 wrote to memory of 3164	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	84
PID 1884 wrote to memory of 3536	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	85
PID 1884 wrote to memory of 3536	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	85
PID 1884 wrote to memory of 1016	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	86
PID 1884 wrote to memory of 1016	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	86
PID 1884 wrote to memory of 2344	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	88
PID 1884 wrote to memory of 2344	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	88
PID 1884 wrote to memory of 2912	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	91
PID 1884 wrote to memory of 2912	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	91
PID 1884 wrote to memory of 2068	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	92
PID 1884 wrote to memory of 2068	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	92
PID 1884 wrote to memory of 3852	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	93
PID 1884 wrote to memory of 3852	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	93
PID 1884 wrote to memory of 4660	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	94
PID 1884 wrote to memory of 4660	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	94
PID 1884 wrote to memory of 2220	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	95
PID 1884 wrote to memory of 2220	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	95
PID 1884 wrote to memory of 4468	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	96
PID 1884 wrote to memory of 4468	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	96
PID 1884 wrote to memory of 3184	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	97
PID 1884 wrote to memory of 3184	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	97
PID 1884 wrote to memory of 4820	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	98
PID 1884 wrote to memory of 4820	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	98
PID 1884 wrote to memory of 4460	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	99
PID 1884 wrote to memory of 4460	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	99
PID 1884 wrote to memory of 4636	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	100
PID 1884 wrote to memory of 4636	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	100
PID 1884 wrote to memory of 4032	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	101
PID 1884 wrote to memory of 4032	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	101
PID 1884 wrote to memory of 1588	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	102
PID 1884 wrote to memory of 1588	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	102
PID 1884 wrote to memory of 4840	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	103
PID 1884 wrote to memory of 4840	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	103
PID 1884 wrote to memory of 3196	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	104
PID 1884 wrote to memory of 3196	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	104
PID 1884 wrote to memory of 2356	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	105
PID 1884 wrote to memory of 2356	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	105
PID 1884 wrote to memory of 4092	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	106
PID 1884 wrote to memory of 4092	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	106
PID 1884 wrote to memory of 2280	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	107
PID 1884 wrote to memory of 2280	1884	2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe	107

C:\Users\Admin\AppData\Local\Temp\2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_ca981df9780aa4016873a2dd82f249f9_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\System\geUXSbj.exe
  C:\Windows\System\geUXSbj.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\sdIAsql.exe
  C:\Windows\System\sdIAsql.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\DBqyGqC.exe
  C:\Windows\System\DBqyGqC.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\rvpPElN.exe
  C:\Windows\System\rvpPElN.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\YiFMFnq.exe
  C:\Windows\System\YiFMFnq.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\XspuvEW.exe
  C:\Windows\System\XspuvEW.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\MslYKZM.exe
  C:\Windows\System\MslYKZM.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\zqMGNTR.exe
  C:\Windows\System\zqMGNTR.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\lRYLGIS.exe
  C:\Windows\System\lRYLGIS.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\PCbFVQw.exe
  C:\Windows\System\PCbFVQw.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\KZsoNqI.exe
  C:\Windows\System\KZsoNqI.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\iPuAAqq.exe
  C:\Windows\System\iPuAAqq.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\QpumNuV.exe
  C:\Windows\System\QpumNuV.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\uQEOIwn.exe
  C:\Windows\System\uQEOIwn.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\gyfavYs.exe
  C:\Windows\System\gyfavYs.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\gtamfCR.exe
  C:\Windows\System\gtamfCR.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\ERohUpG.exe
  C:\Windows\System\ERohUpG.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\OAWlhif.exe
  C:\Windows\System\OAWlhif.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\zFGknos.exe
  C:\Windows\System\zFGknos.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\OwGjHGv.exe
  C:\Windows\System\OwGjHGv.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\IeqhwUK.exe
  C:\Windows\System\IeqhwUK.exe
  2⤵
  - Executes dropped EXE
  PID:2280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DBqyGqC.exe

Path C:\Windows\System\DBqyGqC.exe
Size 5.9MB
SHA256 6fc5ffa4d8fadf41b5b6095c58860872f311d6d893686f73ff6aad82d31e616d
MD5 d16167bac74c853e1f6b8f9b035af733
SHA1 a6135e62415a66a2c10590f0ed9bb86bdbd8a170
SHA512 dc1d3f1dc759bb297487daa0a0562c0a63fc639db27b65a752392a764e05c692b51b20f1877d849952a2dc4b580f60ef9a5c1567e937b8188e78bc686254a527
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

ERohUpG.exe

Path C:\Windows\System\ERohUpG.exe
Size 5.9MB
SHA256 31d208fff92e22ea4ef5fe19f0c04f6beae5be826e3191ecbdffb94415e3de50
MD5 ce959b9acdf6ca36634ec94d6ec318ee
SHA1 07a28c4926f673a8b387b22ffeece3b0a3915642
SHA512 8e9312ea72c4bba18b5699e1ec3f8aebcdd73a93df67fd44912ec057b373de59f9f8a1856abd3964a4bfd78a2d11a1daffa74e72403baa559b796ceae75f1804
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

IeqhwUK.exe

Path C:\Windows\System\IeqhwUK.exe
Size 5.9MB
SHA256 3ea8ccf8f252d59de27c454cdc538e55f234498465d22a89682e129cc97c77b9
MD5 b430b37fbf95fd227fdaf9c256d035ec
SHA1 2c62f1bac519a435786628468723d31db039a670
SHA512 35a8c7bd3c84c220189bf82931dd2742c89f21a333d25e1e36bebc4156a2378998fc6516f730694a69e9b4a694b1e65652f02dff5ef68ce9db4cfeada0f269dc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

KZsoNqI.exe

Path C:\Windows\System\KZsoNqI.exe
Size 5.9MB
SHA256 b3cd6503e1dc3d3ff92b4db4a64d0d14147b56b08c86e50ba415288487204f89
MD5 f9d9dc791d5e09edbbbd8234f3ca76cf
SHA1 56a5710eb0be9f291cd128b553be87fcd37df1a5
SHA512 713c574edac11b47fcbe9b50c0ef93b6f5d34bad05831142e26881abe060c425726ebe389168551dc440d2ee79b1888d3d6ec378d9476c84c2dc42dd5b3b8b3d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

MslYKZM.exe

Path C:\Windows\System\MslYKZM.exe
Size 5.9MB
SHA256 d37d81dd3540349656ab7e4d5aef9d67039b9f8516f8cd73e6b0ded6b9b41bf7
MD5 12b98003a054791b541abcd70fcc3267
SHA1 f1d0c26ceb5378d3d51afab04fa499dbdb7b70ca
SHA512 b1504d1910f7d0898b8a8c90182f8752e420a6155d18e7566632a7855b3f6d2d2a05007e15d222b191748e05be92f030592d686c33579c268646910266dd40a5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

OAWlhif.exe

Path C:\Windows\System\OAWlhif.exe
Size 5.9MB
SHA256 948f33d8370ae07f0b6e985b3fe489927207b366934c5f3ac6747f335b78636b
MD5 2d347204cf5597253aadeffe386c8014
SHA1 08250634a3e30bf2a777878f2fa730ab41443fc3
SHA512 a5e421442b81bb4419dfd5f8671c68de0c8586694106bce778a2ab1da9e98e3be2ba625fd9cd16955eaa9cdb0ab798ecdb5ac6ddb1f0accac0b6b711301fee99
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:Q+856utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

OwGjHGv.exe

Path C:\Windows\System\OwGjHGv.exe
Size 5.9MB
SHA256 0669f5953aa77fd009ad5cd5de2a6d438b0bf0167d640301cc906cfa4b3f0f99
MD5 9cbdce18cc2e9a10cdf4f226fb545de7
SHA1 b667784da3e107a2488f322864d28c4bd748c65d
SHA512 c8cc7e29eb3abc1603c18002a4fd5f7efcf5a3651a5a0a4a4e9bffcbc0130a6fe8b6fbd0ba34ba593b1a7ef89aed5d6e9982845f9a35a69cc46da7486b96809b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

PCbFVQw.exe

Path C:\Windows\System\PCbFVQw.exe
Size 5.9MB
SHA256 895ba6ce32d92dea506eda83c0964265dace57917772c844e397486f6aafbd40
MD5 3ce9f67f1305d7858d70b7307b83d354
SHA1 98daf5f6398b90237b2a46d2b305f8e1e9a04527
SHA512 79f0bcb2f6353ce4c279e835eb5298a8badd762ec26f06ff8e3d4ec798dfea7f0ec722f2617105d59a33502b7e84bc836ba4ee4130484bb765e4291b42aea8dd
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUI:Q+856utgpPF8u/7I
MD5 SHA1 SHA512 SSDEEP

Submit Download

QpumNuV.exe

Path C:\Windows\System\QpumNuV.exe
Size 5.9MB
SHA256 3ea26660b4eea6ad08a45bedf40db4c9de5ea295b80614d101935b0af3e8ff9b
MD5 032fb72921ce2f5ce409cae2a9b4044f
SHA1 35d376139e3ed2c10b8f0ed8d33b1a899d348aa7
SHA512 bea58f7d58c6741e847209ee153410fb42a86a1ca717160d4c87a57071bed0f51402d37ab019eae9298705649f3b3c9c9e5c70ef4fd06230ab66b334758d2e05
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

XspuvEW.exe

Path C:\Windows\System\XspuvEW.exe
Size 5.9MB
SHA256 7f42cc29e84349081d0ada8ec7332f29f6b1e1df79ca093863a7db31fa8fdcb1
MD5 5ce07daf8823ae874b703e1e8de1f121
SHA1 bcc02b0859ecda712f363a2a4c3a599c15c45bd3
SHA512 c6e2113d428a73729e4203e0fbea2023b8c12e45d6129133d8d486cc5c02b335b4fd1ed7219f9f53cbf21750b9cd4fd7595833d9c8c085349012b80399aa24a3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

YiFMFnq.exe

Path C:\Windows\System\YiFMFnq.exe
Size 5.9MB
SHA256 eb52c51fc469c82b473c8b312b71d5ae7656b307bdfe5c00be0b768da3c847f8
MD5 21b8ff43ebea489a5b3581dee1f692bc
SHA1 dd4e29e704e0822d078891d2a77a948692be24a8
SHA512 d160bf2829fc92e0dabe32442fa516e71493c48a449698a3ef38eb2e3b2ae395678e117e0f944105a3352862d3920a9a492ee7e4fd194a437fe3a85a63d3786e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

geUXSbj.exe

Path C:\Windows\System\geUXSbj.exe
Size 5.9MB
SHA256 50eb72472b7242b6f25f766dbdfab069b0971aabd8f4d6bffe6f3745c2e5bf23
MD5 5ffc7a39033756df9967835c8e105a86
SHA1 81b765ba811907609ca6657fb0f6f310f2f7d9c5
SHA512 dd6947cf9a509f14d9eca38f2c4497e6f44e9f6608782610316a5fdcd703e6cf5db96d4ed85cc91a8c26e8062671ba185894289f7031393df2f4cf6c85271406
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

gtamfCR.exe

Path C:\Windows\System\gtamfCR.exe
Size 5.9MB
SHA256 6d1978464bc886e71cef1966e30f60294074f6338d16c634c4ddd7741ec7ddbf
MD5 9387116000c2123c060176f9de38155b
SHA1 d6dd94811c3da1404186765d9d0476e6eaa245d3
SHA512 63cf2bcac4fbd082aff986e704eaa4cb80da3d73437904865756f2daf7969d26c120c6f367eb8ba1eb82fe99f0b8a941708f3d7ee2efe4dfc1a00da79eb14be6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

gyfavYs.exe

Path C:\Windows\System\gyfavYs.exe
Size 5.9MB
SHA256 20264c7ad4a159f36bd7de28581c35be143ce50201e8dbdfdd17da84fa51a0a6
MD5 c000e4ccfb9b53a0986e8600e12f5a2b
SHA1 c061d8e1f01200147b9e4c14d0cd1e4cada8f8fc
SHA512 123121e55ac6f2a783b34101a96198a899d6b2a31953945b767214c519d08b3aea41d0bf0d2efb2c11ce08c8159213271b8712ea5d29219e8b643267e28ab31b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:Q+856utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

iPuAAqq.exe

Path C:\Windows\System\iPuAAqq.exe
Size 5.9MB
SHA256 b01e44a8da46ef47ce302dd45cdf9aa868b6c68e6c498c5679de055c9a753803
MD5 693027f2ac8873a84e483116eb79fa5f
SHA1 bf32c902e32c9b02e41fda4825ea79afa5e9abee
SHA512 ddde55e932eec9246e65aa10dd5ee256b167f735caee10d284adebf6fdb92d270a19af188039813e176d12860d58f00f57112c2e5f69d6c75d6f547f7521ab4e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

lRYLGIS.exe

Path C:\Windows\System\lRYLGIS.exe
Size 5.9MB
SHA256 4ac6c974c0913da281b7f8778870f909dc2406643c911fa621d8dcd0bbaec3f9
MD5 f5ab822e229d8bed6cb07848ce8b4cc8
SHA1 47d42f5cf6a2d64aea2c3ba8c1fb1ce0b7679895
SHA512 ca39668674efa8d3c4490418b3b4c110b4a6fcb05b937a0d6655991a5bf2b611f2019fc341d3a093a4cc9a0cee325c52fe6b4dbb97e5ad8f883b989e5a064461
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

rvpPElN.exe

Path C:\Windows\System\rvpPElN.exe
Size 5.9MB
SHA256 6a2977bdc99e934ef9bf259d43a570997da2126b3b929d5b942075acd648d8c0
MD5 aa35f8045eacf08cb365d6e4ab7e34cb
SHA1 b93dd70d59c19e81abeb577404c7f137fd72d5ad
SHA512 53c018998c4d92ac127548a22eabf94dcf7b1880ee582e154bb655a8f068c1de9749eceb7ebd804ed1f8758166ea0e5690b66e48df132527fb4fdb0c16d2da28
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

sdIAsql.exe

Path C:\Windows\System\sdIAsql.exe
Size 5.9MB
SHA256 57abff8ca4d8074cc33d76d73bf1724fe267dcf1c2446493d63b97649bdaf648
MD5 c29d295470ca5c81c7920d2aad3de8e4
SHA1 4c6446e93a8e46dba243682e9408cb73af0f00b5
SHA512 9b5e0a8ec56acf923fa6a0986e1ba92744c82d0b226bf50e5f9ef32247faeff7d1bedc50a5873c60ba71eea078371fc56c9d06d5f14c714cab57818ee3002780
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

uQEOIwn.exe

Path C:\Windows\System\uQEOIwn.exe
Size 5.9MB
SHA256 7a6d32c8ce244d46a0938497b7d3e8f9485a4c681ddf70789e156df7f763d289
MD5 823a571e3a4a58a6936d5b212aa0260c
SHA1 5f204aa49261b6187fb7db2dee3dd4a2d61fcf93
SHA512 01ee7e0ba486b811790c499de265b759a9be0bdf1a10d791e63bf40dc0c0e0a05a9bc6612a1dc1037123e9fc27026dba119ceb5e23402fb147675c0b3a840f38
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

zFGknos.exe

Path C:\Windows\System\zFGknos.exe
Size 5.9MB
SHA256 ccff3d6d9d2e19d43601c6963489c2313909eb023f1ba7054558df8f6dcd83cc
MD5 324bd5130c750908ade8256fb1ce3a5c
SHA1 a2b277d8eb508a78db9b1248c6938cd4cdc911f3
SHA512 a0c0249bd2d9aeef8c38378ba0c00ee293e1193707da45bc5df4af36a872f69b3ab309d476eefdf7d90c708ae4a50fe20fc3238fb89f889e1fd1e5b46902d526
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

zqMGNTR.exe

Path C:\Windows\System\zqMGNTR.exe
Size 5.9MB
SHA256 e1e71aaa5a2d008886fe87bee0b682cdf91487c0bae28a192c48df6f4d31e81c
MD5 904309278f3bbe5412ab052bf9f0bb64
SHA1 c5576b0bd626876d209977c01a8fbcd93d32ad31
SHA512 01c90861822f1873b3f454ef761aa67917f54c0c74ac73124ca458f0c3ab4aa66cc6745dcc2724d57a0b24e163a802744530fe49be386ec5a33e583fe8fe771b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1016-20-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp

Download

memory/1016-131-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp

Download

memory/1016-139-0x00007FF6BC4C0000-0x00007FF6BC814000-memory.dmp

Download

memory/1588-122-0x00007FF7D2AD0000-0x00007FF7D2E24000-memory.dmp

Download

memory/1588-151-0x00007FF7D2AD0000-0x00007FF7D2E24000-memory.dmp

Download

memory/1884-0-0x00007FF6F4D80000-0x00007FF6F50D4000-memory.dmp

Download

memory/1884-119-0x00007FF6F4D80000-0x00007FF6F50D4000-memory.dmp

Download

memory/1884-1-0x0000017EE3710000-0x0000017EE3720000-memory.dmp

Download

memory/2068-38-0x00007FF707800000-0x00007FF707B54000-memory.dmp

Download

memory/2068-142-0x00007FF707800000-0x00007FF707B54000-memory.dmp

Download

memory/2220-57-0x00007FF716FD0000-0x00007FF717324000-memory.dmp

Download

memory/2220-145-0x00007FF716FD0000-0x00007FF717324000-memory.dmp

Download

memory/2280-157-0x00007FF6C50B0000-0x00007FF6C5404000-memory.dmp

Download

memory/2280-127-0x00007FF6C50B0000-0x00007FF6C5404000-memory.dmp

Download

memory/2344-25-0x00007FF639380000-0x00007FF6396D4000-memory.dmp

Download

memory/2344-140-0x00007FF639380000-0x00007FF6396D4000-memory.dmp

Download

memory/2344-132-0x00007FF639380000-0x00007FF6396D4000-memory.dmp

Download

memory/2356-155-0x00007FF7180F0000-0x00007FF718444000-memory.dmp

Download

memory/2356-125-0x00007FF7180F0000-0x00007FF718444000-memory.dmp

Download

memory/2912-30-0x00007FF721360000-0x00007FF7216B4000-memory.dmp

Download

memory/2912-133-0x00007FF721360000-0x00007FF7216B4000-memory.dmp

Download

memory/2912-141-0x00007FF721360000-0x00007FF7216B4000-memory.dmp

Download

memory/3164-137-0x00007FF665440000-0x00007FF665794000-memory.dmp

Download

memory/3164-129-0x00007FF665440000-0x00007FF665794000-memory.dmp

Download

memory/3164-8-0x00007FF665440000-0x00007FF665794000-memory.dmp

Download

memory/3184-135-0x00007FF7520E0000-0x00007FF752434000-memory.dmp

Download

memory/3184-69-0x00007FF7520E0000-0x00007FF752434000-memory.dmp

Download

memory/3184-148-0x00007FF7520E0000-0x00007FF752434000-memory.dmp

Download

memory/3196-124-0x00007FF6F8D20000-0x00007FF6F9074000-memory.dmp

Download

memory/3196-154-0x00007FF6F8D20000-0x00007FF6F9074000-memory.dmp

Download

memory/3536-13-0x00007FF79CA00000-0x00007FF79CD54000-memory.dmp

Download

memory/3536-130-0x00007FF79CA00000-0x00007FF79CD54000-memory.dmp

Download

memory/3536-138-0x00007FF79CA00000-0x00007FF79CD54000-memory.dmp

Download

memory/3852-54-0x00007FF711BE0000-0x00007FF711F34000-memory.dmp

Download

memory/3852-143-0x00007FF711BE0000-0x00007FF711F34000-memory.dmp

Download

memory/4032-121-0x00007FF607F10000-0x00007FF608264000-memory.dmp

Download

memory/4032-152-0x00007FF607F10000-0x00007FF608264000-memory.dmp

Download

memory/4092-156-0x00007FF6ADE00000-0x00007FF6AE154000-memory.dmp

Download

memory/4092-126-0x00007FF6ADE00000-0x00007FF6AE154000-memory.dmp

Download

memory/4460-149-0x00007FF7316B0000-0x00007FF731A04000-memory.dmp

Download

memory/4460-120-0x00007FF7316B0000-0x00007FF731A04000-memory.dmp

Download

memory/4468-146-0x00007FF7C6D50000-0x00007FF7C70A4000-memory.dmp

Download

memory/4468-134-0x00007FF7C6D50000-0x00007FF7C70A4000-memory.dmp

Download

memory/4468-60-0x00007FF7C6D50000-0x00007FF7C70A4000-memory.dmp

Download

memory/4636-128-0x00007FF75D210000-0x00007FF75D564000-memory.dmp

Download

memory/4636-150-0x00007FF75D210000-0x00007FF75D564000-memory.dmp

Download

memory/4660-59-0x00007FF7377A0000-0x00007FF737AF4000-memory.dmp

Download

memory/4660-144-0x00007FF7377A0000-0x00007FF737AF4000-memory.dmp

Download

memory/4820-72-0x00007FF673AB0000-0x00007FF673E04000-memory.dmp

Download

memory/4820-136-0x00007FF673AB0000-0x00007FF673E04000-memory.dmp

Download

memory/4820-147-0x00007FF673AB0000-0x00007FF673E04000-memory.dmp

Download

memory/4840-153-0x00007FF7D35E0000-0x00007FF7D3934000-memory.dmp

Download

memory/4840-123-0x00007FF7D35E0000-0x00007FF7D3934000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads