cobaltstrike | ca167e6872d3cf69c5f45583095bf03c099d04e80e56092269e5a35aef66b0ef

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 03:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-dys9vagg95
SHA256 ca167e6872d3cf69c5f45583095bf03c099d04e80e56092269e5a35aef66b0ef
MD5 b6fa1c3ee28b5260a78f487f754b25fe
SHA1 a2928b7dc81d00b8e42bd0681588bcfae2f77f67
SHA512 74e64b733df69793dc7362fab71f71fc58818eba8b3fc8ad64daff8ee3fc0467ef4765c7bfeb6e24d365cc25a413bfb817467c72dd0887ace99c40316068a4d7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x00090000000233e0-4.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023412-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023413-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023414-20.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023415-27.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023416-32.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023418-43.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023419-47.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-50.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341a-56.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341b-65.dat	cobalt_reflective_dll
behavioral2/files/0x000a0000000233f8-73.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341e-85.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341f-90.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023420-96.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023421-103.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023423-120.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023425-128.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023424-126.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023422-114.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341c-78.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233e0-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023412-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023413-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023414-20.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023415-27.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023416-32.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023418-43.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023419-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-50.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341a-56.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341b-65.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a0000000233f8-73.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341e-85.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341f-90.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023420-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023421-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023423-120.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023425-128.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023424-126.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023422-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341c-78.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4956-0-0x00007FF766CE0000-0x00007FF767034000-memory.dmp	UPX
behavioral2/files/0x00090000000233e0-4.dat	UPX
behavioral2/files/0x0008000000023412-10.dat	UPX
behavioral2/files/0x0007000000023413-11.dat	UPX
behavioral2/memory/2676-13-0x00007FF7BDC90000-0x00007FF7BDFE4000-memory.dmp	UPX
behavioral2/files/0x0007000000023414-20.dat	UPX
behavioral2/memory/2732-22-0x00007FF6B62D0000-0x00007FF6B6624000-memory.dmp	UPX
behavioral2/files/0x0007000000023415-27.dat	UPX
behavioral2/memory/1532-30-0x00007FF670CB0000-0x00007FF671004000-memory.dmp	UPX
behavioral2/files/0x0007000000023416-32.dat	UPX
behavioral2/memory/5056-37-0x00007FF65A0B0000-0x00007FF65A404000-memory.dmp	UPX
behavioral2/files/0x0007000000023418-43.dat	UPX
behavioral2/files/0x0007000000023419-47.dat	UPX
behavioral2/files/0x0007000000023417-50.dat	UPX
behavioral2/files/0x000700000002341a-56.dat	UPX
behavioral2/files/0x000700000002341b-65.dat	UPX
behavioral2/files/0x000a0000000233f8-73.dat	UPX
behavioral2/memory/1972-72-0x00007FF68E880000-0x00007FF68EBD4000-memory.dmp	UPX
behavioral2/memory/4712-71-0x00007FF75E970000-0x00007FF75ECC4000-memory.dmp	UPX
behavioral2/memory/3180-68-0x00007FF6FEFB0000-0x00007FF6FF304000-memory.dmp	UPX
behavioral2/memory/4576-54-0x00007FF6A94E0000-0x00007FF6A9834000-memory.dmp	UPX
behavioral2/memory/628-49-0x00007FF681930000-0x00007FF681C84000-memory.dmp	UPX
behavioral2/memory/3812-45-0x00007FF65D660000-0x00007FF65D9B4000-memory.dmp	UPX
behavioral2/memory/4348-28-0x00007FF6A3600000-0x00007FF6A3954000-memory.dmp	UPX
behavioral2/memory/3540-9-0x00007FF658CD0000-0x00007FF659024000-memory.dmp	UPX
behavioral2/memory/4956-80-0x00007FF766CE0000-0x00007FF767034000-memory.dmp	UPX
behavioral2/files/0x000700000002341e-85.dat	UPX
behavioral2/memory/3540-87-0x00007FF658CD0000-0x00007FF659024000-memory.dmp	UPX
behavioral2/files/0x000700000002341f-90.dat	UPX
behavioral2/files/0x0007000000023420-96.dat	UPX
behavioral2/files/0x0007000000023421-103.dat	UPX
behavioral2/files/0x0007000000023423-120.dat	UPX
behavioral2/files/0x0007000000023425-128.dat	UPX
behavioral2/files/0x0007000000023424-126.dat	UPX
behavioral2/files/0x0007000000023422-114.dat	UPX
behavioral2/memory/3464-108-0x00007FF60C6A0000-0x00007FF60C9F4000-memory.dmp	UPX
behavioral2/memory/1532-105-0x00007FF670CB0000-0x00007FF671004000-memory.dmp	UPX
behavioral2/memory/4208-104-0x00007FF6F5CB0000-0x00007FF6F6004000-memory.dmp	UPX
behavioral2/memory/2732-101-0x00007FF6B62D0000-0x00007FF6B6624000-memory.dmp	UPX
behavioral2/memory/516-99-0x00007FF61CD80000-0x00007FF61D0D4000-memory.dmp	UPX
behavioral2/memory/4348-95-0x00007FF6A3600000-0x00007FF6A3954000-memory.dmp	UPX
behavioral2/memory/2676-94-0x00007FF7BDC90000-0x00007FF7BDFE4000-memory.dmp	UPX
behavioral2/memory/4268-91-0x00007FF6C2350000-0x00007FF6C26A4000-memory.dmp	UPX
behavioral2/memory/3204-81-0x00007FF7FAD10000-0x00007FF7FB064000-memory.dmp	UPX
behavioral2/files/0x000700000002341c-78.dat	UPX
behavioral2/memory/628-132-0x00007FF681930000-0x00007FF681C84000-memory.dmp	UPX
behavioral2/memory/5020-133-0x00007FF718C20000-0x00007FF718F74000-memory.dmp	UPX
behavioral2/memory/1608-134-0x00007FF746080000-0x00007FF7463D4000-memory.dmp	UPX
behavioral2/memory/3948-136-0x00007FF79A170000-0x00007FF79A4C4000-memory.dmp	UPX
behavioral2/memory/212-135-0x00007FF604CC0000-0x00007FF605014000-memory.dmp	UPX
behavioral2/memory/3812-131-0x00007FF65D660000-0x00007FF65D9B4000-memory.dmp	UPX
behavioral2/memory/5056-130-0x00007FF65A0B0000-0x00007FF65A404000-memory.dmp	UPX
behavioral2/memory/4576-137-0x00007FF6A94E0000-0x00007FF6A9834000-memory.dmp	UPX
behavioral2/memory/4712-138-0x00007FF75E970000-0x00007FF75ECC4000-memory.dmp	UPX
behavioral2/memory/1972-139-0x00007FF68E880000-0x00007FF68EBD4000-memory.dmp	UPX
behavioral2/memory/4208-140-0x00007FF6F5CB0000-0x00007FF6F6004000-memory.dmp	UPX
behavioral2/memory/3464-141-0x00007FF60C6A0000-0x00007FF60C9F4000-memory.dmp	UPX
behavioral2/memory/3540-142-0x00007FF658CD0000-0x00007FF659024000-memory.dmp	UPX
behavioral2/memory/2676-143-0x00007FF7BDC90000-0x00007FF7BDFE4000-memory.dmp	UPX
behavioral2/memory/4348-144-0x00007FF6A3600000-0x00007FF6A3954000-memory.dmp	UPX
behavioral2/memory/2732-145-0x00007FF6B62D0000-0x00007FF6B6624000-memory.dmp	UPX
behavioral2/memory/1532-146-0x00007FF670CB0000-0x00007FF671004000-memory.dmp	UPX
behavioral2/memory/5056-147-0x00007FF65A0B0000-0x00007FF65A404000-memory.dmp	UPX
behavioral2/memory/3812-148-0x00007FF65D660000-0x00007FF65D9B4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4956-0-0x00007FF766CE0000-0x00007FF767034000-memory.dmp	xmrig
behavioral2/files/0x00090000000233e0-4.dat	xmrig
behavioral2/files/0x0008000000023412-10.dat	xmrig
behavioral2/files/0x0007000000023413-11.dat	xmrig
behavioral2/memory/2676-13-0x00007FF7BDC90000-0x00007FF7BDFE4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-20.dat	xmrig
behavioral2/memory/2732-22-0x00007FF6B62D0000-0x00007FF6B6624000-memory.dmp	xmrig
behavioral2/files/0x0007000000023415-27.dat	xmrig
behavioral2/memory/1532-30-0x00007FF670CB0000-0x00007FF671004000-memory.dmp	xmrig
behavioral2/files/0x0007000000023416-32.dat	xmrig
behavioral2/memory/5056-37-0x00007FF65A0B0000-0x00007FF65A404000-memory.dmp	xmrig
behavioral2/files/0x0007000000023418-43.dat	xmrig
behavioral2/files/0x0007000000023419-47.dat	xmrig
behavioral2/files/0x0007000000023417-50.dat	xmrig
behavioral2/files/0x000700000002341a-56.dat	xmrig
behavioral2/files/0x000700000002341b-65.dat	xmrig
behavioral2/files/0x000a0000000233f8-73.dat	xmrig
behavioral2/memory/1972-72-0x00007FF68E880000-0x00007FF68EBD4000-memory.dmp	xmrig
behavioral2/memory/4712-71-0x00007FF75E970000-0x00007FF75ECC4000-memory.dmp	xmrig
behavioral2/memory/3180-68-0x00007FF6FEFB0000-0x00007FF6FF304000-memory.dmp	xmrig
behavioral2/memory/4576-54-0x00007FF6A94E0000-0x00007FF6A9834000-memory.dmp	xmrig
behavioral2/memory/628-49-0x00007FF681930000-0x00007FF681C84000-memory.dmp	xmrig
behavioral2/memory/3812-45-0x00007FF65D660000-0x00007FF65D9B4000-memory.dmp	xmrig
behavioral2/memory/4348-28-0x00007FF6A3600000-0x00007FF6A3954000-memory.dmp	xmrig
behavioral2/memory/3540-9-0x00007FF658CD0000-0x00007FF659024000-memory.dmp	xmrig
behavioral2/memory/4956-80-0x00007FF766CE0000-0x00007FF767034000-memory.dmp	xmrig
behavioral2/files/0x000700000002341e-85.dat	xmrig
behavioral2/memory/3540-87-0x00007FF658CD0000-0x00007FF659024000-memory.dmp	xmrig
behavioral2/files/0x000700000002341f-90.dat	xmrig
behavioral2/files/0x0007000000023420-96.dat	xmrig
behavioral2/files/0x0007000000023421-103.dat	xmrig
behavioral2/files/0x0007000000023423-120.dat	xmrig
behavioral2/files/0x0007000000023425-128.dat	xmrig
behavioral2/files/0x0007000000023424-126.dat	xmrig
behavioral2/files/0x0007000000023422-114.dat	xmrig
behavioral2/memory/3464-108-0x00007FF60C6A0000-0x00007FF60C9F4000-memory.dmp	xmrig
behavioral2/memory/1532-105-0x00007FF670CB0000-0x00007FF671004000-memory.dmp	xmrig
behavioral2/memory/4208-104-0x00007FF6F5CB0000-0x00007FF6F6004000-memory.dmp	xmrig
behavioral2/memory/2732-101-0x00007FF6B62D0000-0x00007FF6B6624000-memory.dmp	xmrig
behavioral2/memory/516-99-0x00007FF61CD80000-0x00007FF61D0D4000-memory.dmp	xmrig
behavioral2/memory/4348-95-0x00007FF6A3600000-0x00007FF6A3954000-memory.dmp	xmrig
behavioral2/memory/2676-94-0x00007FF7BDC90000-0x00007FF7BDFE4000-memory.dmp	xmrig
behavioral2/memory/4268-91-0x00007FF6C2350000-0x00007FF6C26A4000-memory.dmp	xmrig
behavioral2/memory/3204-81-0x00007FF7FAD10000-0x00007FF7FB064000-memory.dmp	xmrig
behavioral2/files/0x000700000002341c-78.dat	xmrig
behavioral2/memory/628-132-0x00007FF681930000-0x00007FF681C84000-memory.dmp	xmrig
behavioral2/memory/5020-133-0x00007FF718C20000-0x00007FF718F74000-memory.dmp	xmrig
behavioral2/memory/1608-134-0x00007FF746080000-0x00007FF7463D4000-memory.dmp	xmrig
behavioral2/memory/3948-136-0x00007FF79A170000-0x00007FF79A4C4000-memory.dmp	xmrig
behavioral2/memory/212-135-0x00007FF604CC0000-0x00007FF605014000-memory.dmp	xmrig
behavioral2/memory/3812-131-0x00007FF65D660000-0x00007FF65D9B4000-memory.dmp	xmrig
behavioral2/memory/5056-130-0x00007FF65A0B0000-0x00007FF65A404000-memory.dmp	xmrig
behavioral2/memory/4576-137-0x00007FF6A94E0000-0x00007FF6A9834000-memory.dmp	xmrig
behavioral2/memory/4712-138-0x00007FF75E970000-0x00007FF75ECC4000-memory.dmp	xmrig
behavioral2/memory/1972-139-0x00007FF68E880000-0x00007FF68EBD4000-memory.dmp	xmrig
behavioral2/memory/4208-140-0x00007FF6F5CB0000-0x00007FF6F6004000-memory.dmp	xmrig
behavioral2/memory/3464-141-0x00007FF60C6A0000-0x00007FF60C9F4000-memory.dmp	xmrig
behavioral2/memory/3540-142-0x00007FF658CD0000-0x00007FF659024000-memory.dmp	xmrig
behavioral2/memory/2676-143-0x00007FF7BDC90000-0x00007FF7BDFE4000-memory.dmp	xmrig
behavioral2/memory/4348-144-0x00007FF6A3600000-0x00007FF6A3954000-memory.dmp	xmrig
behavioral2/memory/2732-145-0x00007FF6B62D0000-0x00007FF6B6624000-memory.dmp	xmrig
behavioral2/memory/1532-146-0x00007FF670CB0000-0x00007FF671004000-memory.dmp	xmrig
behavioral2/memory/5056-147-0x00007FF65A0B0000-0x00007FF65A404000-memory.dmp	xmrig
behavioral2/memory/3812-148-0x00007FF65D660000-0x00007FF65D9B4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3540	dvAceVL.exe
2676	SZNuhgv.exe
2732	BDrigul.exe
4348	wdhuEVh.exe
1532	ZosOPSP.exe
5056	LdhyKfA.exe
3812	cfsGVLa.exe
628	EuFHLuL.exe
4576	AmRGzdi.exe
3180	VLeAzkA.exe
4712	RXZimIm.exe
1972	spiXuUy.exe
3204	MMndVmC.exe
4268	cATIdwp.exe
516	fLVjQHx.exe
4208	vTpbbmd.exe
3464	qdbRvzM.exe
5020	bmmIQcS.exe
1608	qtbxsDm.exe
212	JegVldD.exe
3948	kknksJp.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4956-0-0x00007FF766CE0000-0x00007FF767034000-memory.dmp	upx
behavioral2/files/0x00090000000233e0-4.dat	upx
behavioral2/files/0x0008000000023412-10.dat	upx
behavioral2/files/0x0007000000023413-11.dat	upx
behavioral2/memory/2676-13-0x00007FF7BDC90000-0x00007FF7BDFE4000-memory.dmp	upx
behavioral2/files/0x0007000000023414-20.dat	upx
behavioral2/memory/2732-22-0x00007FF6B62D0000-0x00007FF6B6624000-memory.dmp	upx
behavioral2/files/0x0007000000023415-27.dat	upx
behavioral2/memory/1532-30-0x00007FF670CB0000-0x00007FF671004000-memory.dmp	upx
behavioral2/files/0x0007000000023416-32.dat	upx
behavioral2/memory/5056-37-0x00007FF65A0B0000-0x00007FF65A404000-memory.dmp	upx
behavioral2/files/0x0007000000023418-43.dat	upx
behavioral2/files/0x0007000000023419-47.dat	upx
behavioral2/files/0x0007000000023417-50.dat	upx
behavioral2/files/0x000700000002341a-56.dat	upx
behavioral2/files/0x000700000002341b-65.dat	upx
behavioral2/files/0x000a0000000233f8-73.dat	upx
behavioral2/memory/1972-72-0x00007FF68E880000-0x00007FF68EBD4000-memory.dmp	upx
behavioral2/memory/4712-71-0x00007FF75E970000-0x00007FF75ECC4000-memory.dmp	upx
behavioral2/memory/3180-68-0x00007FF6FEFB0000-0x00007FF6FF304000-memory.dmp	upx
behavioral2/memory/4576-54-0x00007FF6A94E0000-0x00007FF6A9834000-memory.dmp	upx
behavioral2/memory/628-49-0x00007FF681930000-0x00007FF681C84000-memory.dmp	upx
behavioral2/memory/3812-45-0x00007FF65D660000-0x00007FF65D9B4000-memory.dmp	upx
behavioral2/memory/4348-28-0x00007FF6A3600000-0x00007FF6A3954000-memory.dmp	upx
behavioral2/memory/3540-9-0x00007FF658CD0000-0x00007FF659024000-memory.dmp	upx
behavioral2/memory/4956-80-0x00007FF766CE0000-0x00007FF767034000-memory.dmp	upx
behavioral2/files/0x000700000002341e-85.dat	upx
behavioral2/memory/3540-87-0x00007FF658CD0000-0x00007FF659024000-memory.dmp	upx
behavioral2/files/0x000700000002341f-90.dat	upx
behavioral2/files/0x0007000000023420-96.dat	upx
behavioral2/files/0x0007000000023421-103.dat	upx
behavioral2/files/0x0007000000023423-120.dat	upx
behavioral2/files/0x0007000000023425-128.dat	upx
behavioral2/files/0x0007000000023424-126.dat	upx
behavioral2/files/0x0007000000023422-114.dat	upx
behavioral2/memory/3464-108-0x00007FF60C6A0000-0x00007FF60C9F4000-memory.dmp	upx
behavioral2/memory/1532-105-0x00007FF670CB0000-0x00007FF671004000-memory.dmp	upx
behavioral2/memory/4208-104-0x00007FF6F5CB0000-0x00007FF6F6004000-memory.dmp	upx
behavioral2/memory/2732-101-0x00007FF6B62D0000-0x00007FF6B6624000-memory.dmp	upx
behavioral2/memory/516-99-0x00007FF61CD80000-0x00007FF61D0D4000-memory.dmp	upx
behavioral2/memory/4348-95-0x00007FF6A3600000-0x00007FF6A3954000-memory.dmp	upx
behavioral2/memory/2676-94-0x00007FF7BDC90000-0x00007FF7BDFE4000-memory.dmp	upx
behavioral2/memory/4268-91-0x00007FF6C2350000-0x00007FF6C26A4000-memory.dmp	upx
behavioral2/memory/3204-81-0x00007FF7FAD10000-0x00007FF7FB064000-memory.dmp	upx
behavioral2/files/0x000700000002341c-78.dat	upx
behavioral2/memory/628-132-0x00007FF681930000-0x00007FF681C84000-memory.dmp	upx
behavioral2/memory/5020-133-0x00007FF718C20000-0x00007FF718F74000-memory.dmp	upx
behavioral2/memory/1608-134-0x00007FF746080000-0x00007FF7463D4000-memory.dmp	upx
behavioral2/memory/3948-136-0x00007FF79A170000-0x00007FF79A4C4000-memory.dmp	upx
behavioral2/memory/212-135-0x00007FF604CC0000-0x00007FF605014000-memory.dmp	upx
behavioral2/memory/3812-131-0x00007FF65D660000-0x00007FF65D9B4000-memory.dmp	upx
behavioral2/memory/5056-130-0x00007FF65A0B0000-0x00007FF65A404000-memory.dmp	upx
behavioral2/memory/4576-137-0x00007FF6A94E0000-0x00007FF6A9834000-memory.dmp	upx
behavioral2/memory/4712-138-0x00007FF75E970000-0x00007FF75ECC4000-memory.dmp	upx
behavioral2/memory/1972-139-0x00007FF68E880000-0x00007FF68EBD4000-memory.dmp	upx
behavioral2/memory/4208-140-0x00007FF6F5CB0000-0x00007FF6F6004000-memory.dmp	upx
behavioral2/memory/3464-141-0x00007FF60C6A0000-0x00007FF60C9F4000-memory.dmp	upx
behavioral2/memory/3540-142-0x00007FF658CD0000-0x00007FF659024000-memory.dmp	upx
behavioral2/memory/2676-143-0x00007FF7BDC90000-0x00007FF7BDFE4000-memory.dmp	upx
behavioral2/memory/4348-144-0x00007FF6A3600000-0x00007FF6A3954000-memory.dmp	upx
behavioral2/memory/2732-145-0x00007FF6B62D0000-0x00007FF6B6624000-memory.dmp	upx
behavioral2/memory/1532-146-0x00007FF670CB0000-0x00007FF671004000-memory.dmp	upx
behavioral2/memory/5056-147-0x00007FF65A0B0000-0x00007FF65A404000-memory.dmp	upx
behavioral2/memory/3812-148-0x00007FF65D660000-0x00007FF65D9B4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\MMndVmC.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fLVjQHx.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JegVldD.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dvAceVL.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BDrigul.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wdhuEVh.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZosOPSP.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RXZimIm.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AmRGzdi.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bmmIQcS.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qtbxsDm.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\kknksJp.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\spiXuUy.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\cATIdwp.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vTpbbmd.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qdbRvzM.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SZNuhgv.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LdhyKfA.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\cfsGVLa.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EuFHLuL.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VLeAzkA.exe	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 3540	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	82
PID 4956 wrote to memory of 3540	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	82
PID 4956 wrote to memory of 2676	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	83
PID 4956 wrote to memory of 2676	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	83
PID 4956 wrote to memory of 2732	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	84
PID 4956 wrote to memory of 2732	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	84
PID 4956 wrote to memory of 4348	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	85
PID 4956 wrote to memory of 4348	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	85
PID 4956 wrote to memory of 1532	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	86
PID 4956 wrote to memory of 1532	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	86
PID 4956 wrote to memory of 5056	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	87
PID 4956 wrote to memory of 5056	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	87
PID 4956 wrote to memory of 3812	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	88
PID 4956 wrote to memory of 3812	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	88
PID 4956 wrote to memory of 628	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	89
PID 4956 wrote to memory of 628	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	89
PID 4956 wrote to memory of 4576	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	90
PID 4956 wrote to memory of 4576	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	90
PID 4956 wrote to memory of 3180	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	91
PID 4956 wrote to memory of 3180	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	91
PID 4956 wrote to memory of 4712	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	93
PID 4956 wrote to memory of 4712	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	93
PID 4956 wrote to memory of 1972	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	94
PID 4956 wrote to memory of 1972	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	94
PID 4956 wrote to memory of 3204	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	95
PID 4956 wrote to memory of 3204	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	95
PID 4956 wrote to memory of 4268	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	97
PID 4956 wrote to memory of 4268	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	97
PID 4956 wrote to memory of 516	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	98
PID 4956 wrote to memory of 516	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	98
PID 4956 wrote to memory of 4208	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	99
PID 4956 wrote to memory of 4208	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	99
PID 4956 wrote to memory of 3464	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	100
PID 4956 wrote to memory of 3464	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	100
PID 4956 wrote to memory of 5020	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	101
PID 4956 wrote to memory of 5020	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	101
PID 4956 wrote to memory of 1608	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	103
PID 4956 wrote to memory of 1608	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	103
PID 4956 wrote to memory of 212	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	104
PID 4956 wrote to memory of 212	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	104
PID 4956 wrote to memory of 3948	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	105
PID 4956 wrote to memory of 3948	4956	2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe	105

C:\Users\Admin\AppData\Local\Temp\2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_b6fa1c3ee28b5260a78f487f754b25fe_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\System\dvAceVL.exe
  C:\Windows\System\dvAceVL.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\SZNuhgv.exe
  C:\Windows\System\SZNuhgv.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\BDrigul.exe
  C:\Windows\System\BDrigul.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\wdhuEVh.exe
  C:\Windows\System\wdhuEVh.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\ZosOPSP.exe
  C:\Windows\System\ZosOPSP.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\LdhyKfA.exe
  C:\Windows\System\LdhyKfA.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\cfsGVLa.exe
  C:\Windows\System\cfsGVLa.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\EuFHLuL.exe
  C:\Windows\System\EuFHLuL.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\AmRGzdi.exe
  C:\Windows\System\AmRGzdi.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\VLeAzkA.exe
  C:\Windows\System\VLeAzkA.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\RXZimIm.exe
  C:\Windows\System\RXZimIm.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\spiXuUy.exe
  C:\Windows\System\spiXuUy.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\MMndVmC.exe
  C:\Windows\System\MMndVmC.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\cATIdwp.exe
  C:\Windows\System\cATIdwp.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\fLVjQHx.exe
  C:\Windows\System\fLVjQHx.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\vTpbbmd.exe
  C:\Windows\System\vTpbbmd.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\qdbRvzM.exe
  C:\Windows\System\qdbRvzM.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\bmmIQcS.exe
  C:\Windows\System\bmmIQcS.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\qtbxsDm.exe
  C:\Windows\System\qtbxsDm.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\JegVldD.exe
  C:\Windows\System\JegVldD.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\kknksJp.exe
  C:\Windows\System\kknksJp.exe
  2⤵
  - Executes dropped EXE
  PID:3948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AmRGzdi.exe

Path C:\Windows\System\AmRGzdi.exe
Size 5.9MB
SHA256 b08d619db0176fa63dbc5b4a744e3391689c913d9ac303741cc67a129d2d213d
MD5 89debde7d60dd6fd5411dcf6dbdd919a
SHA1 7f0b30048f5ac2d9509065c4a38de3da5c29f1d2
SHA512 033c3c70e4c2dd236bcac3615a0a5a0d6e5441d77e4fc52ae476c46d052447c853c35606686e18f88d41425a9e46af7c95968a5884ceb675bbdee0c6b47be8ae
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

BDrigul.exe

Path C:\Windows\System\BDrigul.exe
Size 5.9MB
SHA256 a5fedd61ee1df8848725ae894314624b81f05ead7fda60b9cb1d89ed9552555b
MD5 5c31c0f89406daddadb45e7a3c732862
SHA1 6b6edfb5434b113a376f708908798ad3c5d294d8
SHA512 32e025d02acac72d6ca94670d37d140f9ce4861922545f086b0c4fe8b4f1b4a6a7f54edfa9198ebcb7c01aedbdbd1a8c5224a73d5e213401f681b64412d662f5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:Q+856utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

EuFHLuL.exe

Path C:\Windows\System\EuFHLuL.exe
Size 5.9MB
SHA256 bbed0bb7b45361cefde9bd55505e08b6d87efe7fac9669561a48dbd66d821e8e
MD5 7558c3c33e8c8aefa79efd9dd8ebb92c
SHA1 7b74db3449de840268fa88da577d28be3339be76
SHA512 275ef17eda83d2c1e0619595bf1bf4d8dbba8dbce45e358012ed421c0f6e2e3fbe67c3f66144b9e267c886a8650c2a58b6c7b188c4fe2e5cfb6b245ca2a114f1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

JegVldD.exe

Path C:\Windows\System\JegVldD.exe
Size 5.9MB
SHA256 0edc35816325e82b09d9080959076d6363ad2ba40a6f32ac34786c31bd5257bb
MD5 900257e817f1ec41a62048228862b5f2
SHA1 883d368a85d72ce6b8269e86951ee19a619e7577
SHA512 a5977c147baf2fdb7a7abbaa416eb8d228cf8ef61a5746f75c8a385e3a6b2c914cb76bb6533b18e2c176a4f91e7551282254d33f9d13fb957bd9e4a1f19cc563
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

LdhyKfA.exe

Path C:\Windows\System\LdhyKfA.exe
Size 5.9MB
SHA256 dc2e82bfedce02ae8310cc0e4c258234e0b19ff3a3f3aa74b8252d7ed444ea97
MD5 bcf03d1dbefdcddf72a92cb56e04f80e
SHA1 c4c0678ffe391d6848e988b0aaf89036abd94593
SHA512 91e25005debfb2d5d6215ec943bedb14bee9e3d4f0ac0575c799a81940d11b223e2b82bc02f71fc3a4f0ea18f284d2bce4545a01be7c0eb2c9f928354858edb4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

MMndVmC.exe

Path C:\Windows\System\MMndVmC.exe
Size 5.9MB
SHA256 0f917284376c76f8dbc23daf85b9d29e47c01f94c655a619b7124adafda373a9
MD5 fa8052a1c0ed7203ee28127050816e1b
SHA1 c6a8259e64f2c534c3a89e8d0d9d35d108891604
SHA512 4921652d6465931613a45ecb4e75af57c154c4dfd16c78b0358306781b6281e5514622fb7bf821b0085ed63ebe4b5f55fac383c86c293a9c6efd65879ad20cdc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

RXZimIm.exe

Path C:\Windows\System\RXZimIm.exe
Size 5.9MB
SHA256 52911bab97cb393debd1a863ef3a122444823c71c9ac3f1508cf7bc3c1cb4352
MD5 b253d527f8c6b285643a3ed0a5aeca65
SHA1 19909de808d49fea46cc03f272f0bc7d6cb55b56
SHA512 e3f63225ea7202b156ca774727ce5af9df200d16f5b7a398bf9443f8f1080bfa67d4677c790620ab894b95d544406e0cf5705eae6257c49f5479690be295cb5a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

SZNuhgv.exe

Path C:\Windows\System\SZNuhgv.exe
Size 5.9MB
SHA256 82c5b98b4d5734d69f771dd3eb36546ceea24f3302ae6b294617bfc6aa9d8ecf
MD5 5d2f847875421a8530038173da21d1ef
SHA1 8237ddb43f5b165613c64573e4e967df6bff5911
SHA512 dbcf0573db2d81475acb7d3d7e1a5f324975cb7ff1a7619362ecc2e1ad3f60e029516e55c59e8580776541ce299e022770d21e9205f97c3bb8d492fae3680670
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

VLeAzkA.exe

Path C:\Windows\System\VLeAzkA.exe
Size 5.9MB
SHA256 7c034a9c9a5bacdd2893e7241c2a557875117a03c47aecbc08d1e0a2938f5102
MD5 21864a6cc2f95c7adae014750cde67b4
SHA1 a5f6595b25b0b637cd7fe725a7fbd245f4cbe0a6
SHA512 7f14d0ac73ee4c65921d82b50060b1a16128f90c37febe461d7e20bd403e5d550a452242936ef3e5bca8dfdbf91d3d8e836ae7c2c0b19845f71d1c3e31eddc0a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZosOPSP.exe

Path C:\Windows\System\ZosOPSP.exe
Size 5.9MB
SHA256 35bbc052728b3d0ba8ccbe7382f012f6b0cb5b711f0da9d7efd350fbf55a25f6
MD5 497455450f66f30885574e1b346c2307
SHA1 203e4d46ec4535995494f7b75015123a71386abf
SHA512 3bef8029b8d8321c95f7c210cffe86d6b04e143fa6f3b5c549b2068ce0503702773c2228d2fdbdc84a42fa8f28299068036c80e415111847f6c27b0c7bda66f4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

bmmIQcS.exe

Path C:\Windows\System\bmmIQcS.exe
Size 5.9MB
SHA256 2b5d95f8347af4330fc64c9b5faff9233f0cb9d57e7af7bb994da56e58404e7a
MD5 d25eb3ee95d0450158d37f017cbe16cf
SHA1 6abbf267d3c59b9dc8410ae23790cdb1058051ac
SHA512 e7646106436720a7c8664fa089280c81cae744e6a6d1a0b5a8f144557621ff524b87fa44860b7d9480fca5d9fd17e1d61279a74a7bd50724de1058d2c3789f78
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

cATIdwp.exe

Path C:\Windows\System\cATIdwp.exe
Size 5.9MB
SHA256 6329206d8ed3a4c71d4057ed5b87e86b43bf62fa31b7615fb452d07f0f5a2285
MD5 4b6f9f4b8206e215a671c5a8cf4c7263
SHA1 990c5d915f32824cd02fc9300d3ea433510578d7
SHA512 b3b3d413d34b31c9bb56fb6f483fa38a875c84245237205b3cd5d2f2f3e0845aee24306a754ffdb3dbb80278a9eb339d78cf78b7e10db80d1a967bb73bc6f542
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

cfsGVLa.exe

Path C:\Windows\System\cfsGVLa.exe
Size 5.9MB
SHA256 2d1277edcdb7fc31ae0336da9cff08ec4b7170843c676913510ddf7248acfcde
MD5 ea7c89df6ac79dc2b54e634d660ef4dd
SHA1 a028e244474e0cecbfaec531026c3c6a95a7c643
SHA512 f6a15cc9f46feb44817049cf2610e8fc65db73168b7837d9c3844841507c4a82ffdb458003c9b32df531bf3e3434f181f5f89930f14a91ac01246d0860db42da
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU+:Q+856utgpPF8u/7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

dvAceVL.exe

Path C:\Windows\System\dvAceVL.exe
Size 5.9MB
SHA256 4e7b446006b062aa09eb8a515249f084cf2004dab86c6ad25f855eda40fe9756
MD5 c8967f0ab5751bff25d3f4d228294c60
SHA1 11eaa63b7cc49ceadd9ba09fcbda48ea2a73f3ee
SHA512 aef7f14e261112fb06e7b7fbc6a3410cefed8547a31162c88d66305015f8c0d474d3607996e8b7d87305fef001d0a9b11d97c2360c86594f7c63793c73421b3c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

fLVjQHx.exe

Path C:\Windows\System\fLVjQHx.exe
Size 5.9MB
SHA256 3255061675375c00f04eef9f495c9d802c2d03f1edcf0baad3d2af8c3d10d221
MD5 ede3237c377b4b72a9780525d106d95c
SHA1 072c67ecb058ab14a44a778d20ef44ee4d63a26d
SHA512 f199e11064b9374fc31088759bde592a2481b746f12ad64859c0fff47f9d4bf9df080d597deaa2698e64c64c45382c987321d4ffdae37a4dcda9bead1d3ee2cc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

kknksJp.exe

Path C:\Windows\System\kknksJp.exe
Size 5.9MB
SHA256 81da9d2efac23b5b6460c85efc4084e3eb35d6bbf892d11c88699d53f15c47c1
MD5 0c4247defe2a09f927d85f740547ba9d
SHA1 e902ba1cee0f590b2905432637f3cbe32df04490
SHA512 3f293fae6d81ba1e7fa7249e59a263dffd472dc3caa274d50024f7d8fb5b3ad3ee2d3a4c37cacfaacf27127019896cede949c42edb51cb89fcf4605555c891cc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

qdbRvzM.exe

Path C:\Windows\System\qdbRvzM.exe
Size 5.9MB
SHA256 941b35b3f8c6f39f51ac5fe3b6ee44d450242416708210ae14c18a336196a655
MD5 8fd3908774ff69351e792bbaecffb2dd
SHA1 6b3f636f24b408042aa5c17c788cade5e24dbdae
SHA512 03dad71b1eea139cceadc5e351e82c0428e7bfdc9cd4410363868006d4a384ced5ec54b6c15319067d13ecf170ae4df929ddca9ff35aa6ab7fafef7504018bed
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

qtbxsDm.exe

Path C:\Windows\System\qtbxsDm.exe
Size 5.9MB
SHA256 06ab7d395ef048ef76ee7afbc9bfd76d1ebacc7297a37c3b7c90f3977ac03cd0
MD5 36a7cb47750d5080e7a2b14fd6801b72
SHA1 8261211d8e6f193d0c024c0885723d7b4ad244c4
SHA512 6fb2011f61ac67e487e308335dbcf03af2758be402d3a84ccf914c065f531b0c853f7f4f1eda4d8d4ade1167038f1a9496e967f79f01c4bc1fd4cc77b0d0e950
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

spiXuUy.exe

Path C:\Windows\System\spiXuUy.exe
Size 5.9MB
SHA256 feedb9f30c1e7ad3a0370e59a75178e4028fe83f62abd4b076316a0988900746
MD5 0dfd80798b23f76e16c7ed48e85f3af3
SHA1 6d3f478dbfa979ee095bb8d8f85a4eb84db173ed
SHA512 f6bb95607647958bc18e333c2fe1d1349ddf85efc6a2450932fd84517539474b2ddbf2854f9a02baaec0e8997f4c6f8eb1cd41b4ca4186e8fb96c318d518a449
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:Q+856utgpPF8u/7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

vTpbbmd.exe

Path C:\Windows\System\vTpbbmd.exe
Size 5.9MB
SHA256 d86c964fe65979dc00a7efac89bcc574715506ecbd105b442adf7265251c6ec6
MD5 bbfc253e2472be1c43dbc720fe957025
SHA1 39ae18397ffaa6050d20513a9af6b8935b5074ec
SHA512 64fa1b87e758976f5f0e4b6b337728725922378d5e3a31181e6d07aaf636f8db18012977387211fe0ce7d730c7930dcb81dc751bf1a9b427f967465645dc4aff
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUm:Q+856utgpPF8u/7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

wdhuEVh.exe

Path C:\Windows\System\wdhuEVh.exe
Size 5.9MB
SHA256 c2d6f38c46a002453826011e7e5f53451c5b6f94b811ea6e4d2906ef7513c62c
MD5 73ed291de9072c3aabbc86d91e124631
SHA1 f923e621f51a41d8da140373a0ad9edc3e096982
SHA512 b374113bb989666e95bb4cd277f7b1a79032ebc6712c859e75b73b923390cda3ec77f3d6981320a5948459c1e2ad46c6657a3b3949d2eee8991d59fbbc843440
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-135-0x00007FF604CC0000-0x00007FF605014000-memory.dmp

Download

memory/212-160-0x00007FF604CC0000-0x00007FF605014000-memory.dmp

Download

memory/516-99-0x00007FF61CD80000-0x00007FF61D0D4000-memory.dmp

Download

memory/516-156-0x00007FF61CD80000-0x00007FF61D0D4000-memory.dmp

Download

memory/628-149-0x00007FF681930000-0x00007FF681C84000-memory.dmp

Download

memory/628-49-0x00007FF681930000-0x00007FF681C84000-memory.dmp

Download

memory/628-132-0x00007FF681930000-0x00007FF681C84000-memory.dmp

Download

memory/1532-30-0x00007FF670CB0000-0x00007FF671004000-memory.dmp

Download

memory/1532-146-0x00007FF670CB0000-0x00007FF671004000-memory.dmp

Download

memory/1532-105-0x00007FF670CB0000-0x00007FF671004000-memory.dmp

Download

memory/1608-134-0x00007FF746080000-0x00007FF7463D4000-memory.dmp

Download

memory/1608-161-0x00007FF746080000-0x00007FF7463D4000-memory.dmp

Download

memory/1972-72-0x00007FF68E880000-0x00007FF68EBD4000-memory.dmp

Download

memory/1972-153-0x00007FF68E880000-0x00007FF68EBD4000-memory.dmp

Download

memory/1972-139-0x00007FF68E880000-0x00007FF68EBD4000-memory.dmp

Download

memory/2676-94-0x00007FF7BDC90000-0x00007FF7BDFE4000-memory.dmp

Download

memory/2676-13-0x00007FF7BDC90000-0x00007FF7BDFE4000-memory.dmp

Download

memory/2676-143-0x00007FF7BDC90000-0x00007FF7BDFE4000-memory.dmp

Download

memory/2732-22-0x00007FF6B62D0000-0x00007FF6B6624000-memory.dmp

Download

memory/2732-101-0x00007FF6B62D0000-0x00007FF6B6624000-memory.dmp

Download

memory/2732-145-0x00007FF6B62D0000-0x00007FF6B6624000-memory.dmp

Download

memory/3180-68-0x00007FF6FEFB0000-0x00007FF6FF304000-memory.dmp

Download

memory/3180-150-0x00007FF6FEFB0000-0x00007FF6FF304000-memory.dmp

Download

memory/3204-154-0x00007FF7FAD10000-0x00007FF7FB064000-memory.dmp

Download

memory/3204-81-0x00007FF7FAD10000-0x00007FF7FB064000-memory.dmp

Download

memory/3464-158-0x00007FF60C6A0000-0x00007FF60C9F4000-memory.dmp

Download

memory/3464-141-0x00007FF60C6A0000-0x00007FF60C9F4000-memory.dmp

Download

memory/3464-108-0x00007FF60C6A0000-0x00007FF60C9F4000-memory.dmp

Download

memory/3540-87-0x00007FF658CD0000-0x00007FF659024000-memory.dmp

Download

memory/3540-9-0x00007FF658CD0000-0x00007FF659024000-memory.dmp

Download

memory/3540-142-0x00007FF658CD0000-0x00007FF659024000-memory.dmp

Download

memory/3812-131-0x00007FF65D660000-0x00007FF65D9B4000-memory.dmp

Download

memory/3812-148-0x00007FF65D660000-0x00007FF65D9B4000-memory.dmp

Download

memory/3812-45-0x00007FF65D660000-0x00007FF65D9B4000-memory.dmp

Download

memory/3948-136-0x00007FF79A170000-0x00007FF79A4C4000-memory.dmp

Download

memory/3948-162-0x00007FF79A170000-0x00007FF79A4C4000-memory.dmp

Download

memory/4208-140-0x00007FF6F5CB0000-0x00007FF6F6004000-memory.dmp

Download

memory/4208-104-0x00007FF6F5CB0000-0x00007FF6F6004000-memory.dmp

Download

memory/4208-157-0x00007FF6F5CB0000-0x00007FF6F6004000-memory.dmp

Download

memory/4268-155-0x00007FF6C2350000-0x00007FF6C26A4000-memory.dmp

Download

memory/4268-91-0x00007FF6C2350000-0x00007FF6C26A4000-memory.dmp

Download

memory/4348-28-0x00007FF6A3600000-0x00007FF6A3954000-memory.dmp

Download

memory/4348-95-0x00007FF6A3600000-0x00007FF6A3954000-memory.dmp

Download

memory/4348-144-0x00007FF6A3600000-0x00007FF6A3954000-memory.dmp

Download

memory/4576-137-0x00007FF6A94E0000-0x00007FF6A9834000-memory.dmp

Download

memory/4576-151-0x00007FF6A94E0000-0x00007FF6A9834000-memory.dmp

Download

memory/4576-54-0x00007FF6A94E0000-0x00007FF6A9834000-memory.dmp

Download

memory/4712-71-0x00007FF75E970000-0x00007FF75ECC4000-memory.dmp

Download

memory/4712-152-0x00007FF75E970000-0x00007FF75ECC4000-memory.dmp

Download

memory/4712-138-0x00007FF75E970000-0x00007FF75ECC4000-memory.dmp

Download

memory/4956-0-0x00007FF766CE0000-0x00007FF767034000-memory.dmp

Download

memory/4956-80-0x00007FF766CE0000-0x00007FF767034000-memory.dmp

Download

memory/4956-1-0x0000025336B40000-0x0000025336B50000-memory.dmp

Download

memory/5020-159-0x00007FF718C20000-0x00007FF718F74000-memory.dmp

Download

memory/5020-133-0x00007FF718C20000-0x00007FF718F74000-memory.dmp

Download

memory/5056-147-0x00007FF65A0B0000-0x00007FF65A404000-memory.dmp

Download

memory/5056-130-0x00007FF65A0B0000-0x00007FF65A404000-memory.dmp

Download

memory/5056-37-0x00007FF65A0B0000-0x00007FF65A404000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads