cobaltstrike | 00d8bb9a84840cace6185c5bffeaef6bd426057ed5cd428d4c0b9fbfe67f1003

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-dl2epafg2s
SHA256 00d8bb9a84840cace6185c5bffeaef6bd426057ed5cd428d4c0b9fbfe67f1003
MD5 1390e76f89e60ebf02cbedbf282ad067
SHA1 fbd2705fde7ff3a7a5bdb3c8555ce937bbb3a52a
SHA512 8d02f1ab2f1371d29b3d361b4658a83558407a1fefb6b2927b22ac2506fdd570f501b56f104742126cae208277acf1e5d1c50e23546cb1cf4beb1998ad791cd4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0005000000023266-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023413-10.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023412-12.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023414-24.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023415-28.dat	cobalt_reflective_dll
behavioral2/files/0x000a0000000233f8-35.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023416-41.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-47.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023419-53.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023418-59.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341a-66.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341c-74.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341d-79.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341e-93.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341f-91.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023420-99.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002292d-107.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002296e-106.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002297c-119.dat	cobalt_reflective_dll
behavioral2/files/0x000b000000023389-126.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023421-123.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0005000000023266-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023413-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023412-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023414-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023415-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a0000000233f8-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023416-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023419-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023418-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341a-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341c-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341d-79.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341e-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341f-91.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023420-99.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002292d-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002296e-106.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002297c-119.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000b000000023389-126.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023421-123.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1596-0-0x00007FF722F40000-0x00007FF723294000-memory.dmp	UPX
behavioral2/files/0x0005000000023266-4.dat	UPX
behavioral2/memory/1136-7-0x00007FF7215F0000-0x00007FF721944000-memory.dmp	UPX
behavioral2/files/0x0007000000023413-10.dat	UPX
behavioral2/files/0x0008000000023412-12.dat	UPX
behavioral2/memory/2532-13-0x00007FF70E170000-0x00007FF70E4C4000-memory.dmp	UPX
behavioral2/memory/1512-20-0x00007FF6B2B80000-0x00007FF6B2ED4000-memory.dmp	UPX
behavioral2/files/0x0007000000023414-24.dat	UPX
behavioral2/memory/1808-26-0x00007FF6AAD50000-0x00007FF6AB0A4000-memory.dmp	UPX
behavioral2/files/0x0007000000023415-28.dat	UPX
behavioral2/files/0x000a0000000233f8-35.dat	UPX
behavioral2/memory/1592-34-0x00007FF667DD0000-0x00007FF668124000-memory.dmp	UPX
behavioral2/memory/756-38-0x00007FF7446D0000-0x00007FF744A24000-memory.dmp	UPX
behavioral2/files/0x0007000000023416-41.dat	UPX
behavioral2/files/0x0007000000023417-47.dat	UPX
behavioral2/memory/1696-46-0x00007FF73E4E0000-0x00007FF73E834000-memory.dmp	UPX
behavioral2/memory/1620-49-0x00007FF73E9B0000-0x00007FF73ED04000-memory.dmp	UPX
behavioral2/files/0x0007000000023419-53.dat	UPX
behavioral2/files/0x0007000000023418-59.dat	UPX
behavioral2/files/0x000700000002341a-66.dat	UPX
behavioral2/memory/1136-67-0x00007FF7215F0000-0x00007FF721944000-memory.dmp	UPX
behavioral2/files/0x000700000002341c-74.dat	UPX
behavioral2/files/0x000700000002341d-79.dat	UPX
behavioral2/memory/4772-83-0x00007FF7C7760000-0x00007FF7C7AB4000-memory.dmp	UPX
behavioral2/memory/4268-89-0x00007FF73F500000-0x00007FF73F854000-memory.dmp	UPX
behavioral2/files/0x000700000002341e-93.dat	UPX
behavioral2/memory/2652-94-0x00007FF62D4D0000-0x00007FF62D824000-memory.dmp	UPX
behavioral2/files/0x000700000002341f-91.dat	UPX
behavioral2/memory/556-90-0x00007FF6AAF30000-0x00007FF6AB284000-memory.dmp	UPX
behavioral2/memory/2532-78-0x00007FF70E170000-0x00007FF70E4C4000-memory.dmp	UPX
behavioral2/memory/2952-70-0x00007FF635700000-0x00007FF635A54000-memory.dmp	UPX
behavioral2/memory/3784-63-0x00007FF625280000-0x00007FF6255D4000-memory.dmp	UPX
behavioral2/memory/1596-62-0x00007FF722F40000-0x00007FF723294000-memory.dmp	UPX
behavioral2/memory/4716-54-0x00007FF746DB0000-0x00007FF747104000-memory.dmp	UPX
behavioral2/files/0x0007000000023420-99.dat	UPX
behavioral2/files/0x000700000002292d-107.dat	UPX
behavioral2/files/0x000700000002296e-106.dat	UPX
behavioral2/memory/3120-109-0x00007FF7B2C60000-0x00007FF7B2FB4000-memory.dmp	UPX
behavioral2/files/0x000700000002297c-119.dat	UPX
behavioral2/files/0x000b000000023389-126.dat	UPX
behavioral2/files/0x0007000000023421-123.dat	UPX
behavioral2/memory/3456-115-0x00007FF78A2E0000-0x00007FF78A634000-memory.dmp	UPX
behavioral2/memory/1956-103-0x00007FF606DB0000-0x00007FF607104000-memory.dmp	UPX
behavioral2/memory/4636-128-0x00007FF6B2730000-0x00007FF6B2A84000-memory.dmp	UPX
behavioral2/memory/1620-130-0x00007FF73E9B0000-0x00007FF73ED04000-memory.dmp	UPX
behavioral2/memory/4716-132-0x00007FF746DB0000-0x00007FF747104000-memory.dmp	UPX
behavioral2/memory/1368-131-0x00007FF67DBB0000-0x00007FF67DF04000-memory.dmp	UPX
behavioral2/memory/5016-129-0x00007FF7C7820000-0x00007FF7C7B74000-memory.dmp	UPX
behavioral2/memory/2952-133-0x00007FF635700000-0x00007FF635A54000-memory.dmp	UPX
behavioral2/memory/556-134-0x00007FF6AAF30000-0x00007FF6AB284000-memory.dmp	UPX
behavioral2/memory/3120-135-0x00007FF7B2C60000-0x00007FF7B2FB4000-memory.dmp	UPX
behavioral2/memory/3456-136-0x00007FF78A2E0000-0x00007FF78A634000-memory.dmp	UPX
behavioral2/memory/1136-137-0x00007FF7215F0000-0x00007FF721944000-memory.dmp	UPX
behavioral2/memory/2532-138-0x00007FF70E170000-0x00007FF70E4C4000-memory.dmp	UPX
behavioral2/memory/1512-139-0x00007FF6B2B80000-0x00007FF6B2ED4000-memory.dmp	UPX
behavioral2/memory/1808-140-0x00007FF6AAD50000-0x00007FF6AB0A4000-memory.dmp	UPX
behavioral2/memory/1592-141-0x00007FF667DD0000-0x00007FF668124000-memory.dmp	UPX
behavioral2/memory/756-142-0x00007FF7446D0000-0x00007FF744A24000-memory.dmp	UPX
behavioral2/memory/1696-143-0x00007FF73E4E0000-0x00007FF73E834000-memory.dmp	UPX
behavioral2/memory/4716-144-0x00007FF746DB0000-0x00007FF747104000-memory.dmp	UPX
behavioral2/memory/3784-146-0x00007FF625280000-0x00007FF6255D4000-memory.dmp	UPX
behavioral2/memory/1620-145-0x00007FF73E9B0000-0x00007FF73ED04000-memory.dmp	UPX
behavioral2/memory/2952-147-0x00007FF635700000-0x00007FF635A54000-memory.dmp	UPX
behavioral2/memory/4772-148-0x00007FF7C7760000-0x00007FF7C7AB4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1596-0-0x00007FF722F40000-0x00007FF723294000-memory.dmp	xmrig
behavioral2/files/0x0005000000023266-4.dat	xmrig
behavioral2/memory/1136-7-0x00007FF7215F0000-0x00007FF721944000-memory.dmp	xmrig
behavioral2/files/0x0007000000023413-10.dat	xmrig
behavioral2/files/0x0008000000023412-12.dat	xmrig
behavioral2/memory/2532-13-0x00007FF70E170000-0x00007FF70E4C4000-memory.dmp	xmrig
behavioral2/memory/1512-20-0x00007FF6B2B80000-0x00007FF6B2ED4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-24.dat	xmrig
behavioral2/memory/1808-26-0x00007FF6AAD50000-0x00007FF6AB0A4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023415-28.dat	xmrig
behavioral2/files/0x000a0000000233f8-35.dat	xmrig
behavioral2/memory/1592-34-0x00007FF667DD0000-0x00007FF668124000-memory.dmp	xmrig
behavioral2/memory/756-38-0x00007FF7446D0000-0x00007FF744A24000-memory.dmp	xmrig
behavioral2/files/0x0007000000023416-41.dat	xmrig
behavioral2/files/0x0007000000023417-47.dat	xmrig
behavioral2/memory/1696-46-0x00007FF73E4E0000-0x00007FF73E834000-memory.dmp	xmrig
behavioral2/memory/1620-49-0x00007FF73E9B0000-0x00007FF73ED04000-memory.dmp	xmrig
behavioral2/files/0x0007000000023419-53.dat	xmrig
behavioral2/files/0x0007000000023418-59.dat	xmrig
behavioral2/files/0x000700000002341a-66.dat	xmrig
behavioral2/memory/1136-67-0x00007FF7215F0000-0x00007FF721944000-memory.dmp	xmrig
behavioral2/files/0x000700000002341c-74.dat	xmrig
behavioral2/files/0x000700000002341d-79.dat	xmrig
behavioral2/memory/4772-83-0x00007FF7C7760000-0x00007FF7C7AB4000-memory.dmp	xmrig
behavioral2/memory/4268-89-0x00007FF73F500000-0x00007FF73F854000-memory.dmp	xmrig
behavioral2/files/0x000700000002341e-93.dat	xmrig
behavioral2/memory/2652-94-0x00007FF62D4D0000-0x00007FF62D824000-memory.dmp	xmrig
behavioral2/files/0x000700000002341f-91.dat	xmrig
behavioral2/memory/556-90-0x00007FF6AAF30000-0x00007FF6AB284000-memory.dmp	xmrig
behavioral2/memory/2532-78-0x00007FF70E170000-0x00007FF70E4C4000-memory.dmp	xmrig
behavioral2/memory/2952-70-0x00007FF635700000-0x00007FF635A54000-memory.dmp	xmrig
behavioral2/memory/3784-63-0x00007FF625280000-0x00007FF6255D4000-memory.dmp	xmrig
behavioral2/memory/1596-62-0x00007FF722F40000-0x00007FF723294000-memory.dmp	xmrig
behavioral2/memory/4716-54-0x00007FF746DB0000-0x00007FF747104000-memory.dmp	xmrig
behavioral2/files/0x0007000000023420-99.dat	xmrig
behavioral2/files/0x000700000002292d-107.dat	xmrig
behavioral2/files/0x000700000002296e-106.dat	xmrig
behavioral2/memory/3120-109-0x00007FF7B2C60000-0x00007FF7B2FB4000-memory.dmp	xmrig
behavioral2/files/0x000700000002297c-119.dat	xmrig
behavioral2/files/0x000b000000023389-126.dat	xmrig
behavioral2/files/0x0007000000023421-123.dat	xmrig
behavioral2/memory/3456-115-0x00007FF78A2E0000-0x00007FF78A634000-memory.dmp	xmrig
behavioral2/memory/1956-103-0x00007FF606DB0000-0x00007FF607104000-memory.dmp	xmrig
behavioral2/memory/4636-128-0x00007FF6B2730000-0x00007FF6B2A84000-memory.dmp	xmrig
behavioral2/memory/1620-130-0x00007FF73E9B0000-0x00007FF73ED04000-memory.dmp	xmrig
behavioral2/memory/4716-132-0x00007FF746DB0000-0x00007FF747104000-memory.dmp	xmrig
behavioral2/memory/1368-131-0x00007FF67DBB0000-0x00007FF67DF04000-memory.dmp	xmrig
behavioral2/memory/5016-129-0x00007FF7C7820000-0x00007FF7C7B74000-memory.dmp	xmrig
behavioral2/memory/2952-133-0x00007FF635700000-0x00007FF635A54000-memory.dmp	xmrig
behavioral2/memory/556-134-0x00007FF6AAF30000-0x00007FF6AB284000-memory.dmp	xmrig
behavioral2/memory/3120-135-0x00007FF7B2C60000-0x00007FF7B2FB4000-memory.dmp	xmrig
behavioral2/memory/3456-136-0x00007FF78A2E0000-0x00007FF78A634000-memory.dmp	xmrig
behavioral2/memory/1136-137-0x00007FF7215F0000-0x00007FF721944000-memory.dmp	xmrig
behavioral2/memory/2532-138-0x00007FF70E170000-0x00007FF70E4C4000-memory.dmp	xmrig
behavioral2/memory/1512-139-0x00007FF6B2B80000-0x00007FF6B2ED4000-memory.dmp	xmrig
behavioral2/memory/1808-140-0x00007FF6AAD50000-0x00007FF6AB0A4000-memory.dmp	xmrig
behavioral2/memory/1592-141-0x00007FF667DD0000-0x00007FF668124000-memory.dmp	xmrig
behavioral2/memory/756-142-0x00007FF7446D0000-0x00007FF744A24000-memory.dmp	xmrig
behavioral2/memory/1696-143-0x00007FF73E4E0000-0x00007FF73E834000-memory.dmp	xmrig
behavioral2/memory/4716-144-0x00007FF746DB0000-0x00007FF747104000-memory.dmp	xmrig
behavioral2/memory/3784-146-0x00007FF625280000-0x00007FF6255D4000-memory.dmp	xmrig
behavioral2/memory/1620-145-0x00007FF73E9B0000-0x00007FF73ED04000-memory.dmp	xmrig
behavioral2/memory/2952-147-0x00007FF635700000-0x00007FF635A54000-memory.dmp	xmrig
behavioral2/memory/4772-148-0x00007FF7C7760000-0x00007FF7C7AB4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1136	RKmSXWQ.exe
2532	kXGjjFl.exe
1512	OHevKea.exe
1808	EnHqTCV.exe
1592	SfOelpB.exe
756	lqLrDUj.exe
1696	eBNkFaC.exe
1620	PGOdTDM.exe
4716	AODeNMz.exe
3784	MtgKIxS.exe
2952	KqCkXlm.exe
4772	TtMwVWA.exe
4268	gRQwsKN.exe
556	mKYjXzQ.exe
2652	IjfObNl.exe
1956	txVmdmX.exe
3120	tUajjTS.exe
3456	xZGFWqq.exe
4636	HSnuXtJ.exe
1368	YPWkDck.exe
5016	zBbZJOE.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1596-0-0x00007FF722F40000-0x00007FF723294000-memory.dmp	upx
behavioral2/files/0x0005000000023266-4.dat	upx
behavioral2/memory/1136-7-0x00007FF7215F0000-0x00007FF721944000-memory.dmp	upx
behavioral2/files/0x0007000000023413-10.dat	upx
behavioral2/files/0x0008000000023412-12.dat	upx
behavioral2/memory/2532-13-0x00007FF70E170000-0x00007FF70E4C4000-memory.dmp	upx
behavioral2/memory/1512-20-0x00007FF6B2B80000-0x00007FF6B2ED4000-memory.dmp	upx
behavioral2/files/0x0007000000023414-24.dat	upx
behavioral2/memory/1808-26-0x00007FF6AAD50000-0x00007FF6AB0A4000-memory.dmp	upx
behavioral2/files/0x0007000000023415-28.dat	upx
behavioral2/files/0x000a0000000233f8-35.dat	upx
behavioral2/memory/1592-34-0x00007FF667DD0000-0x00007FF668124000-memory.dmp	upx
behavioral2/memory/756-38-0x00007FF7446D0000-0x00007FF744A24000-memory.dmp	upx
behavioral2/files/0x0007000000023416-41.dat	upx
behavioral2/files/0x0007000000023417-47.dat	upx
behavioral2/memory/1696-46-0x00007FF73E4E0000-0x00007FF73E834000-memory.dmp	upx
behavioral2/memory/1620-49-0x00007FF73E9B0000-0x00007FF73ED04000-memory.dmp	upx
behavioral2/files/0x0007000000023419-53.dat	upx
behavioral2/files/0x0007000000023418-59.dat	upx
behavioral2/files/0x000700000002341a-66.dat	upx
behavioral2/memory/1136-67-0x00007FF7215F0000-0x00007FF721944000-memory.dmp	upx
behavioral2/files/0x000700000002341c-74.dat	upx
behavioral2/files/0x000700000002341d-79.dat	upx
behavioral2/memory/4772-83-0x00007FF7C7760000-0x00007FF7C7AB4000-memory.dmp	upx
behavioral2/memory/4268-89-0x00007FF73F500000-0x00007FF73F854000-memory.dmp	upx
behavioral2/files/0x000700000002341e-93.dat	upx
behavioral2/memory/2652-94-0x00007FF62D4D0000-0x00007FF62D824000-memory.dmp	upx
behavioral2/files/0x000700000002341f-91.dat	upx
behavioral2/memory/556-90-0x00007FF6AAF30000-0x00007FF6AB284000-memory.dmp	upx
behavioral2/memory/2532-78-0x00007FF70E170000-0x00007FF70E4C4000-memory.dmp	upx
behavioral2/memory/2952-70-0x00007FF635700000-0x00007FF635A54000-memory.dmp	upx
behavioral2/memory/3784-63-0x00007FF625280000-0x00007FF6255D4000-memory.dmp	upx
behavioral2/memory/1596-62-0x00007FF722F40000-0x00007FF723294000-memory.dmp	upx
behavioral2/memory/4716-54-0x00007FF746DB0000-0x00007FF747104000-memory.dmp	upx
behavioral2/files/0x0007000000023420-99.dat	upx
behavioral2/files/0x000700000002292d-107.dat	upx
behavioral2/files/0x000700000002296e-106.dat	upx
behavioral2/memory/3120-109-0x00007FF7B2C60000-0x00007FF7B2FB4000-memory.dmp	upx
behavioral2/files/0x000700000002297c-119.dat	upx
behavioral2/files/0x000b000000023389-126.dat	upx
behavioral2/files/0x0007000000023421-123.dat	upx
behavioral2/memory/3456-115-0x00007FF78A2E0000-0x00007FF78A634000-memory.dmp	upx
behavioral2/memory/1956-103-0x00007FF606DB0000-0x00007FF607104000-memory.dmp	upx
behavioral2/memory/4636-128-0x00007FF6B2730000-0x00007FF6B2A84000-memory.dmp	upx
behavioral2/memory/1620-130-0x00007FF73E9B0000-0x00007FF73ED04000-memory.dmp	upx
behavioral2/memory/4716-132-0x00007FF746DB0000-0x00007FF747104000-memory.dmp	upx
behavioral2/memory/1368-131-0x00007FF67DBB0000-0x00007FF67DF04000-memory.dmp	upx
behavioral2/memory/5016-129-0x00007FF7C7820000-0x00007FF7C7B74000-memory.dmp	upx
behavioral2/memory/2952-133-0x00007FF635700000-0x00007FF635A54000-memory.dmp	upx
behavioral2/memory/556-134-0x00007FF6AAF30000-0x00007FF6AB284000-memory.dmp	upx
behavioral2/memory/3120-135-0x00007FF7B2C60000-0x00007FF7B2FB4000-memory.dmp	upx
behavioral2/memory/3456-136-0x00007FF78A2E0000-0x00007FF78A634000-memory.dmp	upx
behavioral2/memory/1136-137-0x00007FF7215F0000-0x00007FF721944000-memory.dmp	upx
behavioral2/memory/2532-138-0x00007FF70E170000-0x00007FF70E4C4000-memory.dmp	upx
behavioral2/memory/1512-139-0x00007FF6B2B80000-0x00007FF6B2ED4000-memory.dmp	upx
behavioral2/memory/1808-140-0x00007FF6AAD50000-0x00007FF6AB0A4000-memory.dmp	upx
behavioral2/memory/1592-141-0x00007FF667DD0000-0x00007FF668124000-memory.dmp	upx
behavioral2/memory/756-142-0x00007FF7446D0000-0x00007FF744A24000-memory.dmp	upx
behavioral2/memory/1696-143-0x00007FF73E4E0000-0x00007FF73E834000-memory.dmp	upx
behavioral2/memory/4716-144-0x00007FF746DB0000-0x00007FF747104000-memory.dmp	upx
behavioral2/memory/3784-146-0x00007FF625280000-0x00007FF6255D4000-memory.dmp	upx
behavioral2/memory/1620-145-0x00007FF73E9B0000-0x00007FF73ED04000-memory.dmp	upx
behavioral2/memory/2952-147-0x00007FF635700000-0x00007FF635A54000-memory.dmp	upx
behavioral2/memory/4772-148-0x00007FF7C7760000-0x00007FF7C7AB4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\RKmSXWQ.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AODeNMz.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mKYjXzQ.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\txVmdmX.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xZGFWqq.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HSnuXtJ.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lqLrDUj.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PGOdTDM.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MtgKIxS.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KqCkXlm.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gRQwsKN.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zBbZJOE.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EnHqTCV.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tUajjTS.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kXGjjFl.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OHevKea.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SfOelpB.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\eBNkFaC.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TtMwVWA.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\IjfObNl.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YPWkDck.exe	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 1136	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	84
PID 1596 wrote to memory of 1136	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	84
PID 1596 wrote to memory of 2532	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	85
PID 1596 wrote to memory of 2532	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	85
PID 1596 wrote to memory of 1512	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	86
PID 1596 wrote to memory of 1512	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	86
PID 1596 wrote to memory of 1808	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	87
PID 1596 wrote to memory of 1808	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	87
PID 1596 wrote to memory of 1592	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	89
PID 1596 wrote to memory of 1592	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	89
PID 1596 wrote to memory of 756	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	90
PID 1596 wrote to memory of 756	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	90
PID 1596 wrote to memory of 1696	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	91
PID 1596 wrote to memory of 1696	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	91
PID 1596 wrote to memory of 1620	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	92
PID 1596 wrote to memory of 1620	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	92
PID 1596 wrote to memory of 3784	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	94
PID 1596 wrote to memory of 3784	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	94
PID 1596 wrote to memory of 4716	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	95
PID 1596 wrote to memory of 4716	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	95
PID 1596 wrote to memory of 2952	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	97
PID 1596 wrote to memory of 2952	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	97
PID 1596 wrote to memory of 4772	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	98
PID 1596 wrote to memory of 4772	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	98
PID 1596 wrote to memory of 4268	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	99
PID 1596 wrote to memory of 4268	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	99
PID 1596 wrote to memory of 556	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	100
PID 1596 wrote to memory of 556	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	100
PID 1596 wrote to memory of 2652	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	101
PID 1596 wrote to memory of 2652	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	101
PID 1596 wrote to memory of 1956	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	102
PID 1596 wrote to memory of 1956	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	102
PID 1596 wrote to memory of 3120	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	103
PID 1596 wrote to memory of 3120	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	103
PID 1596 wrote to memory of 3456	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	104
PID 1596 wrote to memory of 3456	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	104
PID 1596 wrote to memory of 4636	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	105
PID 1596 wrote to memory of 4636	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	105
PID 1596 wrote to memory of 5016	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	106
PID 1596 wrote to memory of 5016	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	106
PID 1596 wrote to memory of 1368	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	107
PID 1596 wrote to memory of 1368	1596	2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe	107

C:\Users\Admin\AppData\Local\Temp\2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_1390e76f89e60ebf02cbedbf282ad067_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\System\RKmSXWQ.exe
  C:\Windows\System\RKmSXWQ.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\kXGjjFl.exe
  C:\Windows\System\kXGjjFl.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\OHevKea.exe
  C:\Windows\System\OHevKea.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\EnHqTCV.exe
  C:\Windows\System\EnHqTCV.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\SfOelpB.exe
  C:\Windows\System\SfOelpB.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\lqLrDUj.exe
  C:\Windows\System\lqLrDUj.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\eBNkFaC.exe
  C:\Windows\System\eBNkFaC.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\PGOdTDM.exe
  C:\Windows\System\PGOdTDM.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\MtgKIxS.exe
  C:\Windows\System\MtgKIxS.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\AODeNMz.exe
  C:\Windows\System\AODeNMz.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\KqCkXlm.exe
  C:\Windows\System\KqCkXlm.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\TtMwVWA.exe
  C:\Windows\System\TtMwVWA.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\gRQwsKN.exe
  C:\Windows\System\gRQwsKN.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\mKYjXzQ.exe
  C:\Windows\System\mKYjXzQ.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\IjfObNl.exe
  C:\Windows\System\IjfObNl.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\txVmdmX.exe
  C:\Windows\System\txVmdmX.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\tUajjTS.exe
  C:\Windows\System\tUajjTS.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\xZGFWqq.exe
  C:\Windows\System\xZGFWqq.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\HSnuXtJ.exe
  C:\Windows\System\HSnuXtJ.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\zBbZJOE.exe
  C:\Windows\System\zBbZJOE.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\YPWkDck.exe
  C:\Windows\System\YPWkDck.exe
  2⤵
  - Executes dropped EXE
  PID:1368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AODeNMz.exe

Path C:\Windows\System\AODeNMz.exe
Size 5.9MB
SHA256 9e7dd843be658692f3ffdf3666281043bf9079bdd6b98ceca269e2c6956a5698
MD5 023bd04b653fac9248c00062f8ac0fb6
SHA1 688cf95eac55ea769098fae98920b788990653cd
SHA512 4386e6a7fcd4465cba1dd642c072d2a279eaeb2abd5bffcfa3b89503331ae5cd433ed7f60376bb932a79919fbf2c19c0e10817d97745bf4e458117c736aa2299
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

EnHqTCV.exe

Path C:\Windows\System\EnHqTCV.exe
Size 5.9MB
SHA256 34a4a49d9867e0b3455a7fb2d5d95834168175b913d8985982124e62936fa197
MD5 df5017105c7a6c180fe5ea084742b8ff
SHA1 c87969a097ffaa971238bdf2feec84776afd737d
SHA512 8314ee6530b54c2e3abca6883124b2db9750198aef7e7656f65e34fee100f63a4d585bf8caf8f5c32cf6763c3c01f40aa4c923750558956648e5d08f235b24ea
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

HSnuXtJ.exe

Path C:\Windows\System\HSnuXtJ.exe
Size 5.9MB
SHA256 bfb4555eb73951eb35d73960944568317655718ce56f5dba57c04f4d7e1f9050
MD5 2f7ed284cc33ce637ff8f87b54ffe771
SHA1 79fb98d89404bd3e9be2d0190b2a608c07a1e350
SHA512 b25d312d3c40fd114cfa0736af6a97b22a29653d265356c7202d4776ab0c7636741a65c445a5d102f878c1bf1521d4420e6d5654835846fa03343242c27f3729
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

IjfObNl.exe

Path C:\Windows\System\IjfObNl.exe
Size 5.9MB
SHA256 145bbb235f413f6dcee4b4273508cf7bc8a3311c7534b44da5695de5f1e2cb3e
MD5 33f27b3ca896afbedb25be8e0cfbb49f
SHA1 a28b006adb6166b5c6b2890ede30633d209ef171
SHA512 91bf2045c804c8aedfad690f5ddb09103515edbb2adac3e9e06359d466ac128b410ea8a156fbfe839d29396a7a1de7dc3f75b6c77b6b0ff6385be07da7050e0b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

KqCkXlm.exe

Path C:\Windows\System\KqCkXlm.exe
Size 5.9MB
SHA256 82d3073304ea49edbd3cdff035159a7c09b0ee2db4261376ce71028f6443eace
MD5 121b56ba93232fb17d0555d63f57ecf3
SHA1 d3e99afa06693b2725f86aa006b5d4cbb3605d8c
SHA512 c33b06bec3519df2bc107198ff7f1b10f4f6c3edbbadacb388b84375b9c7ea21e4672f960628e78b869a264ba9cc8dad0a70b2712983bfa084c384bcd6340a4a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

MtgKIxS.exe

Path C:\Windows\System\MtgKIxS.exe
Size 5.9MB
SHA256 5c3d62a710d84d4e1bf59029f417a9215b864ce03a87075251d729f097e5a5a1
MD5 40f183304cfc53d16dc6d9c90839e518
SHA1 2a76c6a82ab531999975314c3fdb91be6aef2c39
SHA512 2ad5376bc32674ea9e2594628bad25432e8c899ba2d9fb9cfb031ecc52311a6dcc51e197afbea01268f72c3db09e4f96518614b3aa93dfe3cbfe4f1e125b1ac3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

OHevKea.exe

Path C:\Windows\System\OHevKea.exe
Size 5.9MB
SHA256 438dcf00c44e15828af68f36179dd482ae063711c92bb681c45d5cb60c3f6627
MD5 265355f60e12cfea2c85864f0bb85652
SHA1 4e896659c72a46f4cc20ec187f6c5c3ccd55be8b
SHA512 78717417b0e3adbcc66099b0a5e71d71c8ffd9f863e3b2c3f5b004fbd67be9b239e84e37a4b52770116f3b80a108911709a52b7bab35d24e05c3d59673590fb7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

PGOdTDM.exe

Path C:\Windows\System\PGOdTDM.exe
Size 5.9MB
SHA256 a38d250c1ad96ce8db206826288c6cb3484f5463b5f99debeda9f81f6099412c
MD5 f36c58196573f1d9b100f7c818f8b141
SHA1 2f2986eb38b972fab74c61bfe758f5d4b09da81b
SHA512 6fc05eba115953518e51183dce1d91faaa1d18cc9b433908042ff4408e91c6203ee8dab0933c7c665fd26a4968dc538d32ad5e82c0b7c98b36d315f649b9e503
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

RKmSXWQ.exe

Path C:\Windows\System\RKmSXWQ.exe
Size 5.9MB
SHA256 a20579353020bd181ba7c1098885719552a9390dae5d0060a94d28a86fa685fe
MD5 a02bfe451559028024a915589ab22f17
SHA1 19146d5cab3854a8e66bd219260f05be0d3d0107
SHA512 4ca0c03ed85fc668e4418a4ab002a901ae6eb8df6ee92cfe9ba898cd5ee8a1e94a98c1b4c9057da73d1d731aae804340196236adba36e6fbdde96a33dcd2f1fb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SfOelpB.exe

Path C:\Windows\System\SfOelpB.exe
Size 5.9MB
SHA256 ce74b2cea1dc073237b8c3a6a73a4ef4194b4e2e5602b502c368f1cf2b91c9c4
MD5 2a02ab4465e45a8fb4f9e11121b29f34
SHA1 46094c7e4946860fba624b6acae1f2b11104848a
SHA512 108aadaa2092d1a3831254f2f1bd1a0c3043c7af0c9a82328fa93ca6a483923fc22027c6b8392cd8c88c814228bc53f7fb23c0a7c3fb0ffeeb47fb2140b160de
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

TtMwVWA.exe

Path C:\Windows\System\TtMwVWA.exe
Size 5.9MB
SHA256 b873b72b83f0e523804da89c340095eec95eef18915a6e116c9337c78d0a96d3
MD5 2632a56e1308a8120a9773dba4310456
SHA1 ef4a0565331fce7b731fd949c671b5348f844368
SHA512 ab3ae425adf897ce279b4c413917aaabdd45f524b71a882bf6b33813eb93c122ca6a4417ca8b9bf996a3e22db85e88d6fd1a005b567ae472685abce391d5e6ee
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

YPWkDck.exe

Path C:\Windows\System\YPWkDck.exe
Size 5.9MB
SHA256 d5928e3c8a8fd4a9edd0764c7323491d57231ee099c7bf51cb8cbf413909a8cf
MD5 16cc8a45526e8ad68451b3941d03fabf
SHA1 0a6f9bbe1e2b77fa263ac43823fd8e784f7d6f9a
SHA512 5ef555af8bc44e19aa75d6f367394b42f94b8005500bb8b0e1f18ef11309da6194db7d154e9170a545e82a3350809271f970a424a668e54995b0f6f789c851a2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

eBNkFaC.exe

Path C:\Windows\System\eBNkFaC.exe
Size 5.9MB
SHA256 5ab73272053e31eee0c268475fe06b2b2f4b6e49ec08ae364178ab56301f9a6b
MD5 b75b515033ac6bdbab5936a2067d277a
SHA1 d579eaa68b94287635122a51b2b27380a821658a
SHA512 5eed875c403a31eb51a56fd7ac4ddc0a012a38318c8753025ecc0c2a23b44d4b2ec5db5eda44f82d27db56f30c49fa64abfb107b3e78f481b0615958a3d338b7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

gRQwsKN.exe

Path C:\Windows\System\gRQwsKN.exe
Size 5.9MB
SHA256 a8f4328f075953092c106a7b4e9fcddcc958affc39d14174b47d81ab009b3cd9
MD5 9d1f213fec22208b5e241db9db233c63
SHA1 f65ddbd910cfe7cd8f792c6666ab0a9cfcba74fb
SHA512 54b84b38b02bda3aa82f2510b043e98ab3a50b2f58adbdd1fc577b0ff953cea339f4e004f6eb5bce9bf1f6659006c7fba4e493986adcab2c37ec67197b527610
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

kXGjjFl.exe

Path C:\Windows\System\kXGjjFl.exe
Size 5.9MB
SHA256 7af1283948ab9dfd3e050a0b5c8fde929e7ba60e6fbea4d0814f4c3d722d6d9a
MD5 1cc70d0e479f518756e74d829b249c97
SHA1 985e42660e5b687e9a273f88ce089f69806d7553
SHA512 c0acdec399784f565ceb9da88a2d3502999f647ba6058fd7758e5f8513b4a90794bd5e6ae0599a489481d9411587f24d5883378f4109899949140b5f4afde804
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

lqLrDUj.exe

Path C:\Windows\System\lqLrDUj.exe
Size 5.9MB
SHA256 fbc9f9d5d5bab2d3ecf8f8cac629ad2a97f116268fb2b112e276d51b2bbdd4b2
MD5 50d1d71a9997648f3136815880351f22
SHA1 6df24b9709ac74e9f74e94e833ef38164e1b2a3b
SHA512 492fde94154cef4d2d8e531847593dd9f4dc5bed2a79172c06686bdd7feecd21bbfd45dabf715072e87592efaa7ed2cb25ab2e295bf84eed5ddf87e9b4a7576b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

mKYjXzQ.exe

Path C:\Windows\System\mKYjXzQ.exe
Size 5.9MB
SHA256 b4b0db74c4a66554e02f44f535af12766c88281ee8951808792613010e01602d
MD5 f59b3b6c3def64a0f34253ebf260220c
SHA1 670bbc76aa1fc301d4ce1e63b8d72b37e9b9853f
SHA512 a5562f7859dc509dd6cfe6ea1b58585215fd71bbf3cbfd196ec035dd77e28a5fd6d20747163cc6da3330a1d8c32df4d5ef506adf68e78984384cccb7ffb02089
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

tUajjTS.exe

Path C:\Windows\System\tUajjTS.exe
Size 5.9MB
SHA256 003b3faa65a3521e7eb0e838c0f765705afda4f996a7fe82a2938bc10897e7a1
MD5 33769a651d734cd12a8ae7eaf92a8c30
SHA1 dfc9556fc8163eb76331a58eb466f097b57df675
SHA512 ee07a027412ff15b4fe4caea1801875d70d042c28ea8942d409c1092970ea11605fe04f027730b95f3f67e65efea5d1a296390a298aa692a87aef1e85e6aac7f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUO:Q+856utgpPF8u/7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

txVmdmX.exe

Path C:\Windows\System\txVmdmX.exe
Size 5.9MB
SHA256 c4df56bf6dcd58ac4b5aae4c05c8f99be9a3f27abe3a9f9ebcac82f1e08d9275
MD5 2b724e4cdceee75b5207d8ef05e6eeb2
SHA1 77e5e3a53e58800555123ec9b9ff783fdb67dda9
SHA512 7be21405af31d0cf6aba98d9628f27a08b1f925af0c4f3b0964a2203f76c70b55c32133fb3ac098dfa7020bd0de8f3e02627a01230301c6fa13d455150479bd7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

xZGFWqq.exe

Path C:\Windows\System\xZGFWqq.exe
Size 5.9MB
SHA256 633cef6fe802fd6eebfa75d66ba76123d2ae7cfb510e7c8abb286975202b103b
MD5 410c9bf6c0f36bd5825e0343369fad76
SHA1 aa298cecb774aaab41ef5de0314a23c03614de13
SHA512 7c91f84299eea8e7d6ef8e9df8dd98fec6e1a7ab2426a19f71057aa5894375f0e711e8357dd3d9b4d74cab88d9c69ebb1a87e2d76ac584de02221923c6f45dbe
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

zBbZJOE.exe

Path C:\Windows\System\zBbZJOE.exe
Size 5.9MB
SHA256 a28c5117787422e5c617af54311b8ce515a0acff88d9a038f230ba27ad3fb9cb
MD5 12d9884fe3997c4cf260867881c162b8
SHA1 6f312297364892b6f7e453c68eac36fab72d522b
SHA512 3aff6f3c01e04bfebf062b7c23b60b4a2e752494c8b351188e213ff1a2342aeba6bd985c465bf35db79c82a2c16e23d1a2c499cc257ea192b6261f9ed2433cda
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/556-134-0x00007FF6AAF30000-0x00007FF6AB284000-memory.dmp

Download

memory/556-151-0x00007FF6AAF30000-0x00007FF6AB284000-memory.dmp

Download

memory/556-90-0x00007FF6AAF30000-0x00007FF6AB284000-memory.dmp

Download

memory/756-38-0x00007FF7446D0000-0x00007FF744A24000-memory.dmp

Download

memory/756-142-0x00007FF7446D0000-0x00007FF744A24000-memory.dmp

Download

memory/1136-137-0x00007FF7215F0000-0x00007FF721944000-memory.dmp

Download

memory/1136-7-0x00007FF7215F0000-0x00007FF721944000-memory.dmp

Download

memory/1136-67-0x00007FF7215F0000-0x00007FF721944000-memory.dmp

Download

memory/1368-156-0x00007FF67DBB0000-0x00007FF67DF04000-memory.dmp

Download

memory/1368-131-0x00007FF67DBB0000-0x00007FF67DF04000-memory.dmp

Download

memory/1512-139-0x00007FF6B2B80000-0x00007FF6B2ED4000-memory.dmp

Download

memory/1512-20-0x00007FF6B2B80000-0x00007FF6B2ED4000-memory.dmp

Download

memory/1592-141-0x00007FF667DD0000-0x00007FF668124000-memory.dmp

Download

memory/1592-34-0x00007FF667DD0000-0x00007FF668124000-memory.dmp

Download

memory/1596-1-0x000001D9B0E20000-0x000001D9B0E30000-memory.dmp

Download

memory/1596-0-0x00007FF722F40000-0x00007FF723294000-memory.dmp

Download

memory/1596-62-0x00007FF722F40000-0x00007FF723294000-memory.dmp

Download

memory/1620-145-0x00007FF73E9B0000-0x00007FF73ED04000-memory.dmp

Download

memory/1620-49-0x00007FF73E9B0000-0x00007FF73ED04000-memory.dmp

Download

memory/1620-130-0x00007FF73E9B0000-0x00007FF73ED04000-memory.dmp

Download

memory/1696-46-0x00007FF73E4E0000-0x00007FF73E834000-memory.dmp

Download

memory/1696-143-0x00007FF73E4E0000-0x00007FF73E834000-memory.dmp

Download

memory/1808-26-0x00007FF6AAD50000-0x00007FF6AB0A4000-memory.dmp

Download

memory/1808-140-0x00007FF6AAD50000-0x00007FF6AB0A4000-memory.dmp

Download

memory/1956-103-0x00007FF606DB0000-0x00007FF607104000-memory.dmp

Download

memory/1956-152-0x00007FF606DB0000-0x00007FF607104000-memory.dmp

Download

memory/2532-13-0x00007FF70E170000-0x00007FF70E4C4000-memory.dmp

Download

memory/2532-78-0x00007FF70E170000-0x00007FF70E4C4000-memory.dmp

Download

memory/2532-138-0x00007FF70E170000-0x00007FF70E4C4000-memory.dmp

Download

memory/2652-150-0x00007FF62D4D0000-0x00007FF62D824000-memory.dmp

Download

memory/2652-94-0x00007FF62D4D0000-0x00007FF62D824000-memory.dmp

Download

memory/2952-70-0x00007FF635700000-0x00007FF635A54000-memory.dmp

Download

memory/2952-147-0x00007FF635700000-0x00007FF635A54000-memory.dmp

Download

memory/2952-133-0x00007FF635700000-0x00007FF635A54000-memory.dmp

Download

memory/3120-135-0x00007FF7B2C60000-0x00007FF7B2FB4000-memory.dmp

Download

memory/3120-153-0x00007FF7B2C60000-0x00007FF7B2FB4000-memory.dmp

Download

memory/3120-109-0x00007FF7B2C60000-0x00007FF7B2FB4000-memory.dmp

Download

memory/3456-154-0x00007FF78A2E0000-0x00007FF78A634000-memory.dmp

Download

memory/3456-136-0x00007FF78A2E0000-0x00007FF78A634000-memory.dmp

Download

memory/3456-115-0x00007FF78A2E0000-0x00007FF78A634000-memory.dmp

Download

memory/3784-63-0x00007FF625280000-0x00007FF6255D4000-memory.dmp

Download

memory/3784-146-0x00007FF625280000-0x00007FF6255D4000-memory.dmp

Download

memory/4268-89-0x00007FF73F500000-0x00007FF73F854000-memory.dmp

Download

memory/4268-149-0x00007FF73F500000-0x00007FF73F854000-memory.dmp

Download

memory/4636-128-0x00007FF6B2730000-0x00007FF6B2A84000-memory.dmp

Download

memory/4636-155-0x00007FF6B2730000-0x00007FF6B2A84000-memory.dmp

Download

memory/4716-54-0x00007FF746DB0000-0x00007FF747104000-memory.dmp

Download

memory/4716-144-0x00007FF746DB0000-0x00007FF747104000-memory.dmp

Download

memory/4716-132-0x00007FF746DB0000-0x00007FF747104000-memory.dmp

Download

memory/4772-148-0x00007FF7C7760000-0x00007FF7C7AB4000-memory.dmp

Download

memory/4772-83-0x00007FF7C7760000-0x00007FF7C7AB4000-memory.dmp

Download

memory/5016-129-0x00007FF7C7820000-0x00007FF7C7B74000-memory.dmp

Download

memory/5016-157-0x00007FF7C7820000-0x00007FF7C7B74000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads