cobaltstrike | 0a15b947e4ed61d9423c4b12dffacdcc9a8986ab81bde3c5c5139492f7dee13c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 06:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-g999aade35
SHA256 0a15b947e4ed61d9423c4b12dffacdcc9a8986ab81bde3c5c5139492f7dee13c
MD5 6aa4ae98d5455cbab222b218a441a11f
SHA1 0f7eea0fb647e2c764a39e8fe9dae77e23fe2307
SHA512 c21904c02b3870f13eb270f9a3549dd7257cc8b28501fd8d1be11f92193ced7ee3dbf0a6352159a3aec9bf80c29cbbc57048282e2759657630754b0abc1210b7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000900000002341e-5.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342a-9.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023429-11.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023421-24.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342c-29.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342d-32.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342e-42.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002342f-48.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023430-53.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023431-59.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023432-68.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023433-74.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023434-82.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023436-88.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023435-86.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023437-98.dat	cobalt_reflective_dll
behavioral2/files/0x000a00000002338c-103.dat	cobalt_reflective_dll
behavioral2/files/0x000900000002338e-121.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023391-125.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023439-127.dat	cobalt_reflective_dll
behavioral2/files/0x000d00000002338f-118.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000900000002341e-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342a-9.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023429-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0009000000023421-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342c-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342d-32.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342e-42.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002342f-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023430-53.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023431-59.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023432-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023433-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023434-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023436-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023435-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023437-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a00000002338c-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000900000002338e-121.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a000000023391-125.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023439-127.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d00000002338f-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/4764-0-0x00007FF672A70000-0x00007FF672DC4000-memory.dmp	UPX
behavioral2/files/0x000900000002341e-5.dat	UPX
behavioral2/memory/3160-6-0x00007FF792A20000-0x00007FF792D74000-memory.dmp	UPX
behavioral2/files/0x000700000002342a-9.dat	UPX
behavioral2/files/0x0007000000023429-11.dat	UPX
behavioral2/memory/5080-12-0x00007FF6F2A60000-0x00007FF6F2DB4000-memory.dmp	UPX
behavioral2/memory/2448-20-0x00007FF701D70000-0x00007FF7020C4000-memory.dmp	UPX
behavioral2/files/0x0009000000023421-24.dat	UPX
behavioral2/memory/1892-26-0x00007FF62D3C0000-0x00007FF62D714000-memory.dmp	UPX
behavioral2/files/0x000700000002342c-29.dat	UPX
behavioral2/files/0x000700000002342d-32.dat	UPX
behavioral2/memory/2208-30-0x00007FF658FB0000-0x00007FF659304000-memory.dmp	UPX
behavioral2/memory/3292-34-0x00007FF79BA50000-0x00007FF79BDA4000-memory.dmp	UPX
behavioral2/files/0x000700000002342e-42.dat	UPX
behavioral2/memory/1688-44-0x00007FF6841A0000-0x00007FF6844F4000-memory.dmp	UPX
behavioral2/files/0x000700000002342f-48.dat	UPX
behavioral2/memory/3668-51-0x00007FF6D18B0000-0x00007FF6D1C04000-memory.dmp	UPX
behavioral2/files/0x0007000000023430-53.dat	UPX
behavioral2/memory/1476-56-0x00007FF6485A0000-0x00007FF6488F4000-memory.dmp	UPX
behavioral2/files/0x0007000000023431-59.dat	UPX
behavioral2/memory/4764-62-0x00007FF672A70000-0x00007FF672DC4000-memory.dmp	UPX
behavioral2/memory/4488-65-0x00007FF7EE960000-0x00007FF7EECB4000-memory.dmp	UPX
behavioral2/memory/3160-67-0x00007FF792A20000-0x00007FF792D74000-memory.dmp	UPX
behavioral2/memory/3088-69-0x00007FF602E00000-0x00007FF603154000-memory.dmp	UPX
behavioral2/files/0x0007000000023432-68.dat	UPX
behavioral2/files/0x0007000000023433-74.dat	UPX
behavioral2/files/0x0007000000023434-82.dat	UPX
behavioral2/files/0x0007000000023436-88.dat	UPX
behavioral2/memory/4616-90-0x00007FF6556D0000-0x00007FF655A24000-memory.dmp	UPX
behavioral2/memory/880-93-0x00007FF687CF0000-0x00007FF688044000-memory.dmp	UPX
behavioral2/memory/2944-95-0x00007FF625400000-0x00007FF625754000-memory.dmp	UPX
behavioral2/memory/1544-94-0x00007FF62D410000-0x00007FF62D764000-memory.dmp	UPX
behavioral2/memory/5080-89-0x00007FF6F2A60000-0x00007FF6F2DB4000-memory.dmp	UPX
behavioral2/files/0x0007000000023435-86.dat	UPX
behavioral2/files/0x0007000000023437-98.dat	UPX
behavioral2/files/0x000a00000002338c-103.dat	UPX
behavioral2/memory/4552-116-0x00007FF7513E0000-0x00007FF751734000-memory.dmp	UPX
behavioral2/memory/2912-117-0x00007FF72EAF0000-0x00007FF72EE44000-memory.dmp	UPX
behavioral2/files/0x000900000002338e-121.dat	UPX
behavioral2/files/0x000a000000023391-125.dat	UPX
behavioral2/files/0x0007000000023439-127.dat	UPX
behavioral2/files/0x000d00000002338f-118.dat	UPX
behavioral2/memory/2208-113-0x00007FF658FB0000-0x00007FF659304000-memory.dmp	UPX
behavioral2/memory/1468-107-0x00007FF620440000-0x00007FF620794000-memory.dmp	UPX
behavioral2/memory/4848-101-0x00007FF75E6A0000-0x00007FF75E9F4000-memory.dmp	UPX
behavioral2/memory/3292-130-0x00007FF79BA50000-0x00007FF79BDA4000-memory.dmp	UPX
behavioral2/memory/4020-131-0x00007FF6A30F0000-0x00007FF6A3444000-memory.dmp	UPX
behavioral2/memory/4432-132-0x00007FF624A20000-0x00007FF624D74000-memory.dmp	UPX
behavioral2/memory/1476-133-0x00007FF6485A0000-0x00007FF6488F4000-memory.dmp	UPX
behavioral2/memory/3088-134-0x00007FF602E00000-0x00007FF603154000-memory.dmp	UPX
behavioral2/memory/4848-135-0x00007FF75E6A0000-0x00007FF75E9F4000-memory.dmp	UPX
behavioral2/memory/1468-136-0x00007FF620440000-0x00007FF620794000-memory.dmp	UPX
behavioral2/memory/3160-137-0x00007FF792A20000-0x00007FF792D74000-memory.dmp	UPX
behavioral2/memory/5080-138-0x00007FF6F2A60000-0x00007FF6F2DB4000-memory.dmp	UPX
behavioral2/memory/2448-139-0x00007FF701D70000-0x00007FF7020C4000-memory.dmp	UPX
behavioral2/memory/4552-140-0x00007FF7513E0000-0x00007FF751734000-memory.dmp	UPX
behavioral2/memory/2912-141-0x00007FF72EAF0000-0x00007FF72EE44000-memory.dmp	UPX
behavioral2/memory/1892-142-0x00007FF62D3C0000-0x00007FF62D714000-memory.dmp	UPX
behavioral2/memory/3292-143-0x00007FF79BA50000-0x00007FF79BDA4000-memory.dmp	UPX
behavioral2/memory/2208-144-0x00007FF658FB0000-0x00007FF659304000-memory.dmp	UPX
behavioral2/memory/1688-145-0x00007FF6841A0000-0x00007FF6844F4000-memory.dmp	UPX
behavioral2/memory/3668-146-0x00007FF6D18B0000-0x00007FF6D1C04000-memory.dmp	UPX
behavioral2/memory/1476-147-0x00007FF6485A0000-0x00007FF6488F4000-memory.dmp	UPX
behavioral2/memory/4488-148-0x00007FF7EE960000-0x00007FF7EECB4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4764-0-0x00007FF672A70000-0x00007FF672DC4000-memory.dmp	xmrig
behavioral2/files/0x000900000002341e-5.dat	xmrig
behavioral2/memory/3160-6-0x00007FF792A20000-0x00007FF792D74000-memory.dmp	xmrig
behavioral2/files/0x000700000002342a-9.dat	xmrig
behavioral2/files/0x0007000000023429-11.dat	xmrig
behavioral2/memory/5080-12-0x00007FF6F2A60000-0x00007FF6F2DB4000-memory.dmp	xmrig
behavioral2/memory/2448-20-0x00007FF701D70000-0x00007FF7020C4000-memory.dmp	xmrig
behavioral2/files/0x0009000000023421-24.dat	xmrig
behavioral2/memory/1892-26-0x00007FF62D3C0000-0x00007FF62D714000-memory.dmp	xmrig
behavioral2/files/0x000700000002342c-29.dat	xmrig
behavioral2/files/0x000700000002342d-32.dat	xmrig
behavioral2/memory/2208-30-0x00007FF658FB0000-0x00007FF659304000-memory.dmp	xmrig
behavioral2/memory/3292-34-0x00007FF79BA50000-0x00007FF79BDA4000-memory.dmp	xmrig
behavioral2/files/0x000700000002342e-42.dat	xmrig
behavioral2/memory/1688-44-0x00007FF6841A0000-0x00007FF6844F4000-memory.dmp	xmrig
behavioral2/files/0x000700000002342f-48.dat	xmrig
behavioral2/memory/3668-51-0x00007FF6D18B0000-0x00007FF6D1C04000-memory.dmp	xmrig
behavioral2/files/0x0007000000023430-53.dat	xmrig
behavioral2/memory/1476-56-0x00007FF6485A0000-0x00007FF6488F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023431-59.dat	xmrig
behavioral2/memory/4764-62-0x00007FF672A70000-0x00007FF672DC4000-memory.dmp	xmrig
behavioral2/memory/4488-65-0x00007FF7EE960000-0x00007FF7EECB4000-memory.dmp	xmrig
behavioral2/memory/3160-67-0x00007FF792A20000-0x00007FF792D74000-memory.dmp	xmrig
behavioral2/memory/3088-69-0x00007FF602E00000-0x00007FF603154000-memory.dmp	xmrig
behavioral2/files/0x0007000000023432-68.dat	xmrig
behavioral2/files/0x0007000000023433-74.dat	xmrig
behavioral2/files/0x0007000000023434-82.dat	xmrig
behavioral2/files/0x0007000000023436-88.dat	xmrig
behavioral2/memory/4616-90-0x00007FF6556D0000-0x00007FF655A24000-memory.dmp	xmrig
behavioral2/memory/880-93-0x00007FF687CF0000-0x00007FF688044000-memory.dmp	xmrig
behavioral2/memory/2944-95-0x00007FF625400000-0x00007FF625754000-memory.dmp	xmrig
behavioral2/memory/1544-94-0x00007FF62D410000-0x00007FF62D764000-memory.dmp	xmrig
behavioral2/memory/5080-89-0x00007FF6F2A60000-0x00007FF6F2DB4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023435-86.dat	xmrig
behavioral2/files/0x0007000000023437-98.dat	xmrig
behavioral2/files/0x000a00000002338c-103.dat	xmrig
behavioral2/memory/4552-116-0x00007FF7513E0000-0x00007FF751734000-memory.dmp	xmrig
behavioral2/memory/2912-117-0x00007FF72EAF0000-0x00007FF72EE44000-memory.dmp	xmrig
behavioral2/files/0x000900000002338e-121.dat	xmrig
behavioral2/files/0x000a000000023391-125.dat	xmrig
behavioral2/files/0x0007000000023439-127.dat	xmrig
behavioral2/files/0x000d00000002338f-118.dat	xmrig
behavioral2/memory/2208-113-0x00007FF658FB0000-0x00007FF659304000-memory.dmp	xmrig
behavioral2/memory/1468-107-0x00007FF620440000-0x00007FF620794000-memory.dmp	xmrig
behavioral2/memory/4848-101-0x00007FF75E6A0000-0x00007FF75E9F4000-memory.dmp	xmrig
behavioral2/memory/3292-130-0x00007FF79BA50000-0x00007FF79BDA4000-memory.dmp	xmrig
behavioral2/memory/4020-131-0x00007FF6A30F0000-0x00007FF6A3444000-memory.dmp	xmrig
behavioral2/memory/4432-132-0x00007FF624A20000-0x00007FF624D74000-memory.dmp	xmrig
behavioral2/memory/1476-133-0x00007FF6485A0000-0x00007FF6488F4000-memory.dmp	xmrig
behavioral2/memory/3088-134-0x00007FF602E00000-0x00007FF603154000-memory.dmp	xmrig
behavioral2/memory/4848-135-0x00007FF75E6A0000-0x00007FF75E9F4000-memory.dmp	xmrig
behavioral2/memory/1468-136-0x00007FF620440000-0x00007FF620794000-memory.dmp	xmrig
behavioral2/memory/3160-137-0x00007FF792A20000-0x00007FF792D74000-memory.dmp	xmrig
behavioral2/memory/5080-138-0x00007FF6F2A60000-0x00007FF6F2DB4000-memory.dmp	xmrig
behavioral2/memory/2448-139-0x00007FF701D70000-0x00007FF7020C4000-memory.dmp	xmrig
behavioral2/memory/4552-140-0x00007FF7513E0000-0x00007FF751734000-memory.dmp	xmrig
behavioral2/memory/2912-141-0x00007FF72EAF0000-0x00007FF72EE44000-memory.dmp	xmrig
behavioral2/memory/1892-142-0x00007FF62D3C0000-0x00007FF62D714000-memory.dmp	xmrig
behavioral2/memory/3292-143-0x00007FF79BA50000-0x00007FF79BDA4000-memory.dmp	xmrig
behavioral2/memory/2208-144-0x00007FF658FB0000-0x00007FF659304000-memory.dmp	xmrig
behavioral2/memory/1688-145-0x00007FF6841A0000-0x00007FF6844F4000-memory.dmp	xmrig
behavioral2/memory/3668-146-0x00007FF6D18B0000-0x00007FF6D1C04000-memory.dmp	xmrig
behavioral2/memory/1476-147-0x00007FF6485A0000-0x00007FF6488F4000-memory.dmp	xmrig
behavioral2/memory/4488-148-0x00007FF7EE960000-0x00007FF7EECB4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3160	JahaOkI.exe
5080	ZcaFgiW.exe
2448	wUzEtMG.exe
1892	KcDSOiP.exe
2208	gvvUQVy.exe
3292	ykbJimy.exe
1688	VDdWFHB.exe
3668	qUmItfs.exe
1476	FQosnjc.exe
4488	oeLsNog.exe
3088	zmVlLEo.exe
4616	PKnkIjk.exe
880	cDlNYVt.exe
1544	WdEIEhz.exe
2944	WFIzFet.exe
4848	tiKQgZu.exe
1468	VPbHtce.exe
4552	JvmozBk.exe
2912	uWaloaR.exe
4020	gLZrYvN.exe
4432	sCfgwVG.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4764-0-0x00007FF672A70000-0x00007FF672DC4000-memory.dmp	upx
behavioral2/files/0x000900000002341e-5.dat	upx
behavioral2/memory/3160-6-0x00007FF792A20000-0x00007FF792D74000-memory.dmp	upx
behavioral2/files/0x000700000002342a-9.dat	upx
behavioral2/files/0x0007000000023429-11.dat	upx
behavioral2/memory/5080-12-0x00007FF6F2A60000-0x00007FF6F2DB4000-memory.dmp	upx
behavioral2/memory/2448-20-0x00007FF701D70000-0x00007FF7020C4000-memory.dmp	upx
behavioral2/files/0x0009000000023421-24.dat	upx
behavioral2/memory/1892-26-0x00007FF62D3C0000-0x00007FF62D714000-memory.dmp	upx
behavioral2/files/0x000700000002342c-29.dat	upx
behavioral2/files/0x000700000002342d-32.dat	upx
behavioral2/memory/2208-30-0x00007FF658FB0000-0x00007FF659304000-memory.dmp	upx
behavioral2/memory/3292-34-0x00007FF79BA50000-0x00007FF79BDA4000-memory.dmp	upx
behavioral2/files/0x000700000002342e-42.dat	upx
behavioral2/memory/1688-44-0x00007FF6841A0000-0x00007FF6844F4000-memory.dmp	upx
behavioral2/files/0x000700000002342f-48.dat	upx
behavioral2/memory/3668-51-0x00007FF6D18B0000-0x00007FF6D1C04000-memory.dmp	upx
behavioral2/files/0x0007000000023430-53.dat	upx
behavioral2/memory/1476-56-0x00007FF6485A0000-0x00007FF6488F4000-memory.dmp	upx
behavioral2/files/0x0007000000023431-59.dat	upx
behavioral2/memory/4764-62-0x00007FF672A70000-0x00007FF672DC4000-memory.dmp	upx
behavioral2/memory/4488-65-0x00007FF7EE960000-0x00007FF7EECB4000-memory.dmp	upx
behavioral2/memory/3160-67-0x00007FF792A20000-0x00007FF792D74000-memory.dmp	upx
behavioral2/memory/3088-69-0x00007FF602E00000-0x00007FF603154000-memory.dmp	upx
behavioral2/files/0x0007000000023432-68.dat	upx
behavioral2/files/0x0007000000023433-74.dat	upx
behavioral2/files/0x0007000000023434-82.dat	upx
behavioral2/files/0x0007000000023436-88.dat	upx
behavioral2/memory/4616-90-0x00007FF6556D0000-0x00007FF655A24000-memory.dmp	upx
behavioral2/memory/880-93-0x00007FF687CF0000-0x00007FF688044000-memory.dmp	upx
behavioral2/memory/2944-95-0x00007FF625400000-0x00007FF625754000-memory.dmp	upx
behavioral2/memory/1544-94-0x00007FF62D410000-0x00007FF62D764000-memory.dmp	upx
behavioral2/memory/5080-89-0x00007FF6F2A60000-0x00007FF6F2DB4000-memory.dmp	upx
behavioral2/files/0x0007000000023435-86.dat	upx
behavioral2/files/0x0007000000023437-98.dat	upx
behavioral2/files/0x000a00000002338c-103.dat	upx
behavioral2/memory/4552-116-0x00007FF7513E0000-0x00007FF751734000-memory.dmp	upx
behavioral2/memory/2912-117-0x00007FF72EAF0000-0x00007FF72EE44000-memory.dmp	upx
behavioral2/files/0x000900000002338e-121.dat	upx
behavioral2/files/0x000a000000023391-125.dat	upx
behavioral2/files/0x0007000000023439-127.dat	upx
behavioral2/files/0x000d00000002338f-118.dat	upx
behavioral2/memory/2208-113-0x00007FF658FB0000-0x00007FF659304000-memory.dmp	upx
behavioral2/memory/1468-107-0x00007FF620440000-0x00007FF620794000-memory.dmp	upx
behavioral2/memory/4848-101-0x00007FF75E6A0000-0x00007FF75E9F4000-memory.dmp	upx
behavioral2/memory/3292-130-0x00007FF79BA50000-0x00007FF79BDA4000-memory.dmp	upx
behavioral2/memory/4020-131-0x00007FF6A30F0000-0x00007FF6A3444000-memory.dmp	upx
behavioral2/memory/4432-132-0x00007FF624A20000-0x00007FF624D74000-memory.dmp	upx
behavioral2/memory/1476-133-0x00007FF6485A0000-0x00007FF6488F4000-memory.dmp	upx
behavioral2/memory/3088-134-0x00007FF602E00000-0x00007FF603154000-memory.dmp	upx
behavioral2/memory/4848-135-0x00007FF75E6A0000-0x00007FF75E9F4000-memory.dmp	upx
behavioral2/memory/1468-136-0x00007FF620440000-0x00007FF620794000-memory.dmp	upx
behavioral2/memory/3160-137-0x00007FF792A20000-0x00007FF792D74000-memory.dmp	upx
behavioral2/memory/5080-138-0x00007FF6F2A60000-0x00007FF6F2DB4000-memory.dmp	upx
behavioral2/memory/2448-139-0x00007FF701D70000-0x00007FF7020C4000-memory.dmp	upx
behavioral2/memory/4552-140-0x00007FF7513E0000-0x00007FF751734000-memory.dmp	upx
behavioral2/memory/2912-141-0x00007FF72EAF0000-0x00007FF72EE44000-memory.dmp	upx
behavioral2/memory/1892-142-0x00007FF62D3C0000-0x00007FF62D714000-memory.dmp	upx
behavioral2/memory/3292-143-0x00007FF79BA50000-0x00007FF79BDA4000-memory.dmp	upx
behavioral2/memory/2208-144-0x00007FF658FB0000-0x00007FF659304000-memory.dmp	upx
behavioral2/memory/1688-145-0x00007FF6841A0000-0x00007FF6844F4000-memory.dmp	upx
behavioral2/memory/3668-146-0x00007FF6D18B0000-0x00007FF6D1C04000-memory.dmp	upx
behavioral2/memory/1476-147-0x00007FF6485A0000-0x00007FF6488F4000-memory.dmp	upx
behavioral2/memory/4488-148-0x00007FF7EE960000-0x00007FF7EECB4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\wUzEtMG.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\qUmItfs.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oeLsNog.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VPbHtce.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\sCfgwVG.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZcaFgiW.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KcDSOiP.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gvvUQVy.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WdEIEhz.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uWaloaR.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gLZrYvN.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JahaOkI.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ykbJimy.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VDdWFHB.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\cDlNYVt.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WFIzFet.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JvmozBk.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FQosnjc.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zmVlLEo.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PKnkIjk.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tiKQgZu.exe	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 3160	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	84
PID 4764 wrote to memory of 3160	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	84
PID 4764 wrote to memory of 5080	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	85
PID 4764 wrote to memory of 5080	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	85
PID 4764 wrote to memory of 2448	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	86
PID 4764 wrote to memory of 2448	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	86
PID 4764 wrote to memory of 1892	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	87
PID 4764 wrote to memory of 1892	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	87
PID 4764 wrote to memory of 2208	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	88
PID 4764 wrote to memory of 2208	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	88
PID 4764 wrote to memory of 3292	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	90
PID 4764 wrote to memory of 3292	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	90
PID 4764 wrote to memory of 1688	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	91
PID 4764 wrote to memory of 1688	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	91
PID 4764 wrote to memory of 3668	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	92
PID 4764 wrote to memory of 3668	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	92
PID 4764 wrote to memory of 1476	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	96
PID 4764 wrote to memory of 1476	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	96
PID 4764 wrote to memory of 4488	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	98
PID 4764 wrote to memory of 4488	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	98
PID 4764 wrote to memory of 3088	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	99
PID 4764 wrote to memory of 3088	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	99
PID 4764 wrote to memory of 4616	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	100
PID 4764 wrote to memory of 4616	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	100
PID 4764 wrote to memory of 880	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	101
PID 4764 wrote to memory of 880	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	101
PID 4764 wrote to memory of 1544	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	102
PID 4764 wrote to memory of 1544	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	102
PID 4764 wrote to memory of 2944	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	103
PID 4764 wrote to memory of 2944	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	103
PID 4764 wrote to memory of 4848	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	105
PID 4764 wrote to memory of 4848	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	105
PID 4764 wrote to memory of 1468	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	106
PID 4764 wrote to memory of 1468	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	106
PID 4764 wrote to memory of 4552	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	107
PID 4764 wrote to memory of 4552	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	107
PID 4764 wrote to memory of 2912	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	108
PID 4764 wrote to memory of 2912	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	108
PID 4764 wrote to memory of 4020	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	109
PID 4764 wrote to memory of 4020	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	109
PID 4764 wrote to memory of 4432	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	110
PID 4764 wrote to memory of 4432	4764	2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe	110

C:\Users\Admin\AppData\Local\Temp\2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_6aa4ae98d5455cbab222b218a441a11f_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\System\JahaOkI.exe
  C:\Windows\System\JahaOkI.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\ZcaFgiW.exe
  C:\Windows\System\ZcaFgiW.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\wUzEtMG.exe
  C:\Windows\System\wUzEtMG.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\KcDSOiP.exe
  C:\Windows\System\KcDSOiP.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\gvvUQVy.exe
  C:\Windows\System\gvvUQVy.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\ykbJimy.exe
  C:\Windows\System\ykbJimy.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\VDdWFHB.exe
  C:\Windows\System\VDdWFHB.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\qUmItfs.exe
  C:\Windows\System\qUmItfs.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\FQosnjc.exe
  C:\Windows\System\FQosnjc.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\oeLsNog.exe
  C:\Windows\System\oeLsNog.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\zmVlLEo.exe
  C:\Windows\System\zmVlLEo.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\PKnkIjk.exe
  C:\Windows\System\PKnkIjk.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\cDlNYVt.exe
  C:\Windows\System\cDlNYVt.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\WdEIEhz.exe
  C:\Windows\System\WdEIEhz.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\WFIzFet.exe
  C:\Windows\System\WFIzFet.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\tiKQgZu.exe
  C:\Windows\System\tiKQgZu.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\VPbHtce.exe
  C:\Windows\System\VPbHtce.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\JvmozBk.exe
  C:\Windows\System\JvmozBk.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\uWaloaR.exe
  C:\Windows\System\uWaloaR.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\gLZrYvN.exe
  C:\Windows\System\gLZrYvN.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\sCfgwVG.exe
  C:\Windows\System\sCfgwVG.exe
  2⤵
  - Executes dropped EXE
  PID:4432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

FQosnjc.exe

Path C:\Windows\System\FQosnjc.exe
Size 5.9MB
SHA256 42aeb914469ad8d15811a8df2f31a0e15ca81401bacd1eedfdbbff991a2a980d
MD5 bddd1caf25b1351c8a60adc2c2b857ba
SHA1 1149a48e3c943f9541536688284d84d976265437
SHA512 3b7e5029c7ea025a6900ab6c94c15cfb373cc76afbff28fccdec37b1aac645dd258274e3498f2a1cd3dc6b0cfec720baa1c01b6726270619dde0cf43ec9e3424
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

JahaOkI.exe

Path C:\Windows\System\JahaOkI.exe
Size 5.9MB
SHA256 875cacf25c146eed5259e728f0bf5a8fb9eea7708ace32587dfaf482ec540137
MD5 3c3558be81fae556737cc7106ccf0898
SHA1 bdf72edaffdebb0d3f1a4f6b19d5b2b017442b9d
SHA512 dd9166b538f2a00d6922e4702b0b50c7e3a4a53a52f54edff3c74363b5844dda1e9e19eb305e29dde0cc19886e79b0e6ccc2822ded879241cae7d70c50ce2446
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

JvmozBk.exe

Path C:\Windows\System\JvmozBk.exe
Size 5.9MB
SHA256 59a542e3259ae6019f3b55092dd16f54b9cb173330aed252d896f6d4c059deb5
MD5 4be23d5d6d4d94d532cac2712ce012ff
SHA1 3c61047c1026e030fc783059cb8e5354eb99514d
SHA512 89f5ae5611b557af9a73bcc92d001b1b3953900630a1a65403f175adfc0b4e086b96ad275e37a449685206430a6b344ad006a0377dd67826ef472da0ebd250d2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

KcDSOiP.exe

Path C:\Windows\System\KcDSOiP.exe
Size 5.9MB
SHA256 a1e01530af30bb1df66f0a6e922ee24799d9fa44c15ec3b922c0dfc4d3ae5f78
MD5 2c430b8a5496adda938d1ec65375c0c4
SHA1 2f70baf586fbb6dee77ed8f85ed669fd0439f121
SHA512 86c41b6afd150200cbd4e08438f69f2c56e439c283fcf3f2d7c1c8e795e2cbb574308a8df2ae663cf66ce295c808c21d1102b81e9474aa119213d91fd6d0ac60
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

PKnkIjk.exe

Path C:\Windows\System\PKnkIjk.exe
Size 5.9MB
SHA256 c42e3c62a3de8ebe85238fa86086e55a0e0dd0f40ccb324a5300800076ef7c17
MD5 8c220408711ce556178f9211b04f8514
SHA1 4013be397707ba2ee0b183c49e6e3ef7c791c55c
SHA512 757eb6630c0412cc65401571d61b2ffb5423166815048e7ccf909e5e5fdbe7491f2f177a297ad3923c12b396325b96f9af1b5e33288e2f759b76005b7432ab4d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

VDdWFHB.exe

Path C:\Windows\System\VDdWFHB.exe
Size 5.9MB
SHA256 ba6f9fb25305cf4b102adfc7d90bed4cb0b51d3ab570aa4de4e9a590bcb23ab6
MD5 3cee6eeab0531d63cd3caefeeed0d50b
SHA1 dc6ed42d5e62adc27fc2cacd8ec5373818a62187
SHA512 1f41611dc328bf28efde43e379924468fb37c95f453c21a418084275b13b4a747341c47c45a5ea85f260eaefe7a287f9865f2cc54d6ffb5365c8884773ed10b3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

VPbHtce.exe

Path C:\Windows\System\VPbHtce.exe
Size 5.9MB
SHA256 7921555d17a77adeb0f43712db83cbe80aae1985eaba3e67ea16ea973a07cc1a
MD5 c54b8c837fe4a4f2e6baa6107595b281
SHA1 7663ffbc921999fefdd8cddcb1d77ba87659cb74
SHA512 dc0d4884c59a46cea16f925de54ea5b8b5639e84a3028352272322e553aeef557c40bd168bce2eb3b126d3f0bd7c23c41ab7f596375f21bd22b60d738c640dab
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

WFIzFet.exe

Path C:\Windows\System\WFIzFet.exe
Size 5.9MB
SHA256 373843b1d51a1f0a6a6306bd30a480eb34089a2d7c0c91cecd4a373aeb3e8353
MD5 11bdb73ace3d05164a445f55588f400a
SHA1 1c8f885b0226022f7b92849fac0efc83acf40381
SHA512 4918decd23d1e1de9a24946c8dd5fe062cfeb33013a4054a653d91c878f2bab90a37ca2012c1b5b537c836b84dcf77f89a9e151111f4905703e83eed64ca2141
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

WdEIEhz.exe

Path C:\Windows\System\WdEIEhz.exe
Size 5.9MB
SHA256 d7b9df5107a9b01372664df492b5962d38b46f103f2fae6687e0dfea56cc1984
MD5 19a966103fe1c85b92f7bcec8e4031da
SHA1 ea5ab6022ed7022300320afb408ef9abc2b7af8c
SHA512 89545cb7e395786517c5d12189f4d23049da949c2fa2ccc7fd4b292b0438c128e58113fa002199fa2dc3c40b3bb6180bd4a4db36bc4ad1c7bce5b82189867651
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:Q+856utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZcaFgiW.exe

Path C:\Windows\System\ZcaFgiW.exe
Size 5.9MB
SHA256 4a5a4eb715fe761daa382abfd6ff114df736a3204ecd731f51658988ea847ce1
MD5 b59559ccb8eac36a69b858f0b979a422
SHA1 447deaf5262734a436d18d02d57b7e73b6541297
SHA512 ad3f27a05c1e1c98e6b2da2ed3b37b1fe7e5af387649cc4dd44d36817616224842fd7f2c5c68eb84ca10dc2595325602219a9d3ab59897fed64e251316d862e1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

cDlNYVt.exe

Path C:\Windows\System\cDlNYVt.exe
Size 5.9MB
SHA256 ec7b99c490fe6f9ba3a1f774b927cbdcb259d8b5ef0f359f11760755eb66a8e4
MD5 b527bb58377654e2655b98e8e81fe9b0
SHA1 f1851fbff8eae8fef05fb96c67c132e25bdb89be
SHA512 12a92dfde0f31f91cbc21fe8cda39b3691016ec3267e8127583212790cedf3b621c17bdfd02ffdd935c68a869f1ad7b182bae344afdea38e907a2736f162bfa7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

gLZrYvN.exe

Path C:\Windows\System\gLZrYvN.exe
Size 5.9MB
SHA256 de76ba0e58be9b71ccd2b981062fe3cd14f1c9dc337324e4eee406edb192818a
MD5 a3952a6713abcbfebbbf7b4181e36441
SHA1 189a2ea744499c8a51cb4fdb3a52468f4cae68fc
SHA512 d08fdb14662eef9a73b7b0925e196512a3116b6ca2076b5ed686e707f6f3335e383aeed7366586af2a8f4958fbb9604dde2f16d330e96d01b5f5b351af1f9a72
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

gvvUQVy.exe

Path C:\Windows\System\gvvUQVy.exe
Size 5.9MB
SHA256 fd082fa0dcff1c9ab8165ea1c9a018fa8e5d166dfeff9c03251e012d44643946
MD5 1a036a2290e41e29a28daa979e57b2cb
SHA1 9984dd46dac8a774c3f6ceac41a06324931af3e5
SHA512 63a8a269f848ba6eec3f5f3e2c09f3f0bd37b5980c5f289d945d6cdd420d2539207e58dcddf7405306f0c9a2d798ab171565473748a64ba944b6a7ae49740acd
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

oeLsNog.exe

Path C:\Windows\System\oeLsNog.exe
Size 5.9MB
SHA256 4d7b418d78f9079a436031e117e04d5e5a250c5420369d2775685514f4611bb3
MD5 e646a5da4b1b90330be7506af99fcca8
SHA1 461ec22e85bbb2e626a8fe69a3125dc884d0df3b
SHA512 09e47f9e776f54d440ec081b88f2b5b7ace576b7727fa98484d3e58258ba3e9e531db24d2bffd9c24104c937e60ff6d35be0d793630d6e102c6702f875726859
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

qUmItfs.exe

Path C:\Windows\System\qUmItfs.exe
Size 5.9MB
SHA256 d30d972300b7a9c68f7feebea136e3f8dd377e3a2b978ea611a0574a1a0691f7
MD5 b2b41b3108f620ce742be82356dc3200
SHA1 b69eaf4f9efaa80dcefff85dfdadca3d0ca036f1
SHA512 8329affdd2a0db63d83d2876cd24ed477ddc30a38816f890c2a83443a458a2087014c540019f8138a5d8afd5be896574e907afc7e51e41d9e41e2dd39f7b957b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUh:Q+856utgpPF8u/7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

sCfgwVG.exe

Path C:\Windows\System\sCfgwVG.exe
Size 5.9MB
SHA256 2ebb70c285429b8d55b971f5dcfd073f7c6e588023da6ba8526cb8104d78221c
MD5 7cbe016468e6187b82007c87510ae4b2
SHA1 3eb028ed9bc98665bc37d353b1565b5912f0b0c8
SHA512 2a72f82e79bbe8a702f2c88d37469add28ef116d5e039ccc63c093957a476a742bc792eae7f8feb078d40f16ead14c03350fc4e39f0a107af49ac1f69444f3d0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

tiKQgZu.exe

Path C:\Windows\System\tiKQgZu.exe
Size 5.9MB
SHA256 2521b2d195c230e3cd91150a5193e12419b68ed06868df0d8c3329225f52107e
MD5 0fce27b1fe415bcabc743d39c1b582ee
SHA1 b953cc4ba5101cc9009daa4145ee4e964ee09c24
SHA512 b8a15850c5f890117adaad500e43e1ef7cc00fa25a94508a3c427cb803c0c142445f8817ebc96e67029651e9b5b73e4fe6eba4fb8c2b222e104ea2561cb89dad
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

uWaloaR.exe

Path C:\Windows\System\uWaloaR.exe
Size 5.9MB
SHA256 73f27f943afc011adc5ea09a65ce152ee1e515dffd20a89eae1ccb6ff44eac14
MD5 a185f4099016090674edd21f2ac4762e
SHA1 1793b27aba33bf13392f760c206628cfd38c1dc9
SHA512 a272e0b897423053c428cae1686d6077158f335f6628d3d863ec233467da244686c3f73363b7bb8ce400096796fcf2f6787abc03e2cd3e935ecce2e374302db4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

wUzEtMG.exe

Path C:\Windows\System\wUzEtMG.exe
Size 5.9MB
SHA256 afb745220aa93071dd830a6145951a4b65afefbb6625ea8290a4a35384be30bc
MD5 f8b916e8b0b751ce3a7bf280d47d5627
SHA1 875f60134834f4f3ef8afa815fdc6e0c09c5af64
SHA512 139d29869b18548f70a978133a9ad4bb5b00d238f36fa0e61a2f7bc6240c1c82cf9003401f8049b741e0fe6307c9425ddf0b3bd7639c2f80ca4362934db0e40a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

ykbJimy.exe

Path C:\Windows\System\ykbJimy.exe
Size 5.9MB
SHA256 446ce9e02f8259ae7387e5472fbb7ad6aebc85ca793560ba5cedfdd2aeb1068b
MD5 9b236ae5724c1d3b076f1eadbb089ead
SHA1 aab42b401b4f907b483a467d63a606fd1ff1b519
SHA512 49b1ea8d51ccdf8dec0e95f18e119e4aab949f01077e8e5e7c3ddd23e2e0ef6fbc23d6fbb072fee04a9a406667d7fbac755e650f0336a7b854563725a71519b5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

zmVlLEo.exe

Path C:\Windows\System\zmVlLEo.exe
Size 5.9MB
SHA256 a9d0b277a410b6183d42b49ace742cdb0dfb7b3db2778d537e7a20980aa6cf66
MD5 040fb509f2433ed2f17e026b428fb2b1
SHA1 00a1d807d282b25f65ca3b477d1ac10d05fe1fbf
SHA512 d3a1ef966b72d92488ce6588395cbccc43d4df02c7928cd07fcf553cf0e77aa3c106ff6163bb18ffe7f3d134afd883d5222b59a9a06701e47be096d242a314c1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUA:Q+856utgpPF8u/7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/880-93-0x00007FF687CF0000-0x00007FF688044000-memory.dmp

Download

memory/880-151-0x00007FF687CF0000-0x00007FF688044000-memory.dmp

Download

memory/1468-155-0x00007FF620440000-0x00007FF620794000-memory.dmp

Download

memory/1468-136-0x00007FF620440000-0x00007FF620794000-memory.dmp

Download

memory/1468-107-0x00007FF620440000-0x00007FF620794000-memory.dmp

Download

memory/1476-133-0x00007FF6485A0000-0x00007FF6488F4000-memory.dmp

Download

memory/1476-56-0x00007FF6485A0000-0x00007FF6488F4000-memory.dmp

Download

memory/1476-147-0x00007FF6485A0000-0x00007FF6488F4000-memory.dmp

Download

memory/1544-94-0x00007FF62D410000-0x00007FF62D764000-memory.dmp

Download

memory/1544-152-0x00007FF62D410000-0x00007FF62D764000-memory.dmp

Download

memory/1688-145-0x00007FF6841A0000-0x00007FF6844F4000-memory.dmp

Download

memory/1688-44-0x00007FF6841A0000-0x00007FF6844F4000-memory.dmp

Download

memory/1892-26-0x00007FF62D3C0000-0x00007FF62D714000-memory.dmp

Download

memory/1892-142-0x00007FF62D3C0000-0x00007FF62D714000-memory.dmp

Download

memory/2208-113-0x00007FF658FB0000-0x00007FF659304000-memory.dmp

Download

memory/2208-144-0x00007FF658FB0000-0x00007FF659304000-memory.dmp

Download

memory/2208-30-0x00007FF658FB0000-0x00007FF659304000-memory.dmp

Download

memory/2448-20-0x00007FF701D70000-0x00007FF7020C4000-memory.dmp

Download

memory/2448-139-0x00007FF701D70000-0x00007FF7020C4000-memory.dmp

Download

memory/2912-117-0x00007FF72EAF0000-0x00007FF72EE44000-memory.dmp

Download

memory/2912-141-0x00007FF72EAF0000-0x00007FF72EE44000-memory.dmp

Download

memory/2912-156-0x00007FF72EAF0000-0x00007FF72EE44000-memory.dmp

Download

memory/2944-153-0x00007FF625400000-0x00007FF625754000-memory.dmp

Download

memory/2944-95-0x00007FF625400000-0x00007FF625754000-memory.dmp

Download

memory/3088-149-0x00007FF602E00000-0x00007FF603154000-memory.dmp

Download

memory/3088-134-0x00007FF602E00000-0x00007FF603154000-memory.dmp

Download

memory/3088-69-0x00007FF602E00000-0x00007FF603154000-memory.dmp

Download

memory/3160-6-0x00007FF792A20000-0x00007FF792D74000-memory.dmp

Download

memory/3160-137-0x00007FF792A20000-0x00007FF792D74000-memory.dmp

Download

memory/3160-67-0x00007FF792A20000-0x00007FF792D74000-memory.dmp

Download

memory/3292-34-0x00007FF79BA50000-0x00007FF79BDA4000-memory.dmp

Download

memory/3292-130-0x00007FF79BA50000-0x00007FF79BDA4000-memory.dmp

Download

memory/3292-143-0x00007FF79BA50000-0x00007FF79BDA4000-memory.dmp

Download

memory/3668-51-0x00007FF6D18B0000-0x00007FF6D1C04000-memory.dmp

Download

memory/3668-146-0x00007FF6D18B0000-0x00007FF6D1C04000-memory.dmp

Download

memory/4020-158-0x00007FF6A30F0000-0x00007FF6A3444000-memory.dmp

Download

memory/4020-131-0x00007FF6A30F0000-0x00007FF6A3444000-memory.dmp

Download

memory/4432-157-0x00007FF624A20000-0x00007FF624D74000-memory.dmp

Download

memory/4432-132-0x00007FF624A20000-0x00007FF624D74000-memory.dmp

Download

memory/4488-65-0x00007FF7EE960000-0x00007FF7EECB4000-memory.dmp

Download

memory/4488-148-0x00007FF7EE960000-0x00007FF7EECB4000-memory.dmp

Download

memory/4552-159-0x00007FF7513E0000-0x00007FF751734000-memory.dmp

Download

memory/4552-140-0x00007FF7513E0000-0x00007FF751734000-memory.dmp

Download

memory/4552-116-0x00007FF7513E0000-0x00007FF751734000-memory.dmp

Download

memory/4616-90-0x00007FF6556D0000-0x00007FF655A24000-memory.dmp

Download

memory/4616-150-0x00007FF6556D0000-0x00007FF655A24000-memory.dmp

Download

memory/4764-62-0x00007FF672A70000-0x00007FF672DC4000-memory.dmp

Download

memory/4764-1-0x000001BEDD630000-0x000001BEDD640000-memory.dmp

Download

memory/4764-0-0x00007FF672A70000-0x00007FF672DC4000-memory.dmp

Download

memory/4848-154-0x00007FF75E6A0000-0x00007FF75E9F4000-memory.dmp

Download

memory/4848-101-0x00007FF75E6A0000-0x00007FF75E9F4000-memory.dmp

Download

memory/4848-135-0x00007FF75E6A0000-0x00007FF75E9F4000-memory.dmp

Download

memory/5080-12-0x00007FF6F2A60000-0x00007FF6F2DB4000-memory.dmp

Download

memory/5080-89-0x00007FF6F2A60000-0x00007FF6F2DB4000-memory.dmp

Download

memory/5080-138-0x00007FF6F2A60000-0x00007FF6F2DB4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads