cobaltstrike | 7d7a08fa42441addadf380179bcf5a3002e8f0652d5faa6d9505d533e5e6728f

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-h2de1sed48
SHA256 7d7a08fa42441addadf380179bcf5a3002e8f0652d5faa6d9505d533e5e6728f
MD5 2414837c0707a74c9f88a6228216014d
SHA1 50a10a33e06400748a358905f365331314212358
SHA512 894cbda1814aceeae7d4ac83c9baf7110f777f83d58dd06ce944f8d9dc195504ef58892971c967af916f494f7ea7a6f264d6c9320bbb4925c55acbc513492319
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000600000002326f-4.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d2-12.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d4-19.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d3-21.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d5-29.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000233cf-35.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d8-44.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d7-54.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233da-58.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233d9-60.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233db-68.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233dd-74.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e0-92.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e2-103.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e5-114.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e4-112.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e3-107.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233e1-98.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233df-88.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233de-82.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233dc-72.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000600000002326f-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d2-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d4-19.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d3-21.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d5-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00080000000233cf-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d8-44.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d7-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233da-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233d9-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233db-68.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233dd-74.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e0-92.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e2-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e5-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e4-112.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e3-107.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233e1-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233df-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233de-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x00070000000233dc-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3500-0-0x00007FF603180000-0x00007FF6034D4000-memory.dmp	UPX
behavioral2/files/0x000600000002326f-4.dat	UPX
behavioral2/files/0x00070000000233d2-12.dat	UPX
behavioral2/memory/1640-10-0x00007FF76D760000-0x00007FF76DAB4000-memory.dmp	UPX
behavioral2/memory/2436-16-0x00007FF662F20000-0x00007FF663274000-memory.dmp	UPX
behavioral2/files/0x00070000000233d4-19.dat	UPX
behavioral2/memory/2772-26-0x00007FF736310000-0x00007FF736664000-memory.dmp	UPX
behavioral2/memory/3504-25-0x00007FF706F50000-0x00007FF7072A4000-memory.dmp	UPX
behavioral2/files/0x00070000000233d3-21.dat	UPX
behavioral2/files/0x00070000000233d5-29.dat	UPX
behavioral2/memory/3116-32-0x00007FF646850000-0x00007FF646BA4000-memory.dmp	UPX
behavioral2/files/0x00080000000233cf-35.dat	UPX
behavioral2/files/0x00070000000233d8-44.dat	UPX
behavioral2/memory/2964-51-0x00007FF676FE0000-0x00007FF677334000-memory.dmp	UPX
behavioral2/files/0x00070000000233d7-54.dat	UPX
behavioral2/files/0x00070000000233da-58.dat	UPX
behavioral2/files/0x00070000000233d9-60.dat	UPX
behavioral2/memory/3312-57-0x00007FF6C8160000-0x00007FF6C84B4000-memory.dmp	UPX
behavioral2/files/0x00070000000233db-68.dat	UPX
behavioral2/files/0x00070000000233dd-74.dat	UPX
behavioral2/files/0x00070000000233e0-92.dat	UPX
behavioral2/files/0x00070000000233e2-103.dat	UPX
behavioral2/files/0x00070000000233e5-114.dat	UPX
behavioral2/files/0x00070000000233e4-112.dat	UPX
behavioral2/files/0x00070000000233e3-107.dat	UPX
behavioral2/files/0x00070000000233e1-98.dat	UPX
behavioral2/files/0x00070000000233df-88.dat	UPX
behavioral2/files/0x00070000000233de-82.dat	UPX
behavioral2/files/0x00070000000233dc-72.dat	UPX
behavioral2/memory/5040-50-0x00007FF75B750000-0x00007FF75BAA4000-memory.dmp	UPX
behavioral2/memory/1812-43-0x00007FF637420000-0x00007FF637774000-memory.dmp	UPX
behavioral2/memory/3436-116-0x00007FF7F0460000-0x00007FF7F07B4000-memory.dmp	UPX
behavioral2/memory/2224-117-0x00007FF7C1490000-0x00007FF7C17E4000-memory.dmp	UPX
behavioral2/memory/3044-118-0x00007FF71AE20000-0x00007FF71B174000-memory.dmp	UPX
behavioral2/memory/1112-119-0x00007FF70AC80000-0x00007FF70AFD4000-memory.dmp	UPX
behavioral2/memory/3096-120-0x00007FF744390000-0x00007FF7446E4000-memory.dmp	UPX
behavioral2/memory/3888-121-0x00007FF67D5D0000-0x00007FF67D924000-memory.dmp	UPX
behavioral2/memory/1708-122-0x00007FF693FE0000-0x00007FF694334000-memory.dmp	UPX
behavioral2/memory/4776-123-0x00007FF7E1900000-0x00007FF7E1C54000-memory.dmp	UPX
behavioral2/memory/2444-124-0x00007FF7FF360000-0x00007FF7FF6B4000-memory.dmp	UPX
behavioral2/memory/1372-125-0x00007FF74BA80000-0x00007FF74BDD4000-memory.dmp	UPX
behavioral2/memory/3948-126-0x00007FF7022F0000-0x00007FF702644000-memory.dmp	UPX
behavioral2/memory/3500-127-0x00007FF603180000-0x00007FF6034D4000-memory.dmp	UPX
behavioral2/memory/3064-128-0x00007FF684170000-0x00007FF6844C4000-memory.dmp	UPX
behavioral2/memory/2436-129-0x00007FF662F20000-0x00007FF663274000-memory.dmp	UPX
behavioral2/memory/3504-130-0x00007FF706F50000-0x00007FF7072A4000-memory.dmp	UPX
behavioral2/memory/3116-131-0x00007FF646850000-0x00007FF646BA4000-memory.dmp	UPX
behavioral2/memory/1812-132-0x00007FF637420000-0x00007FF637774000-memory.dmp	UPX
behavioral2/memory/2964-133-0x00007FF676FE0000-0x00007FF677334000-memory.dmp	UPX
behavioral2/memory/3312-134-0x00007FF6C8160000-0x00007FF6C84B4000-memory.dmp	UPX
behavioral2/memory/1640-135-0x00007FF76D760000-0x00007FF76DAB4000-memory.dmp	UPX
behavioral2/memory/2436-136-0x00007FF662F20000-0x00007FF663274000-memory.dmp	UPX
behavioral2/memory/3504-137-0x00007FF706F50000-0x00007FF7072A4000-memory.dmp	UPX
behavioral2/memory/2772-138-0x00007FF736310000-0x00007FF736664000-memory.dmp	UPX
behavioral2/memory/3116-139-0x00007FF646850000-0x00007FF646BA4000-memory.dmp	UPX
behavioral2/memory/1812-140-0x00007FF637420000-0x00007FF637774000-memory.dmp	UPX
behavioral2/memory/5040-141-0x00007FF75B750000-0x00007FF75BAA4000-memory.dmp	UPX
behavioral2/memory/3436-142-0x00007FF7F0460000-0x00007FF7F07B4000-memory.dmp	UPX
behavioral2/memory/3312-143-0x00007FF6C8160000-0x00007FF6C84B4000-memory.dmp	UPX
behavioral2/memory/2964-144-0x00007FF676FE0000-0x00007FF677334000-memory.dmp	UPX
behavioral2/memory/2224-145-0x00007FF7C1490000-0x00007FF7C17E4000-memory.dmp	UPX
behavioral2/memory/3064-146-0x00007FF684170000-0x00007FF6844C4000-memory.dmp	UPX
behavioral2/memory/3044-147-0x00007FF71AE20000-0x00007FF71B174000-memory.dmp	UPX
behavioral2/memory/3888-152-0x00007FF67D5D0000-0x00007FF67D924000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3500-0-0x00007FF603180000-0x00007FF6034D4000-memory.dmp	xmrig
behavioral2/files/0x000600000002326f-4.dat	xmrig
behavioral2/files/0x00070000000233d2-12.dat	xmrig
behavioral2/memory/1640-10-0x00007FF76D760000-0x00007FF76DAB4000-memory.dmp	xmrig
behavioral2/memory/2436-16-0x00007FF662F20000-0x00007FF663274000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d4-19.dat	xmrig
behavioral2/memory/2772-26-0x00007FF736310000-0x00007FF736664000-memory.dmp	xmrig
behavioral2/memory/3504-25-0x00007FF706F50000-0x00007FF7072A4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d3-21.dat	xmrig
behavioral2/files/0x00070000000233d5-29.dat	xmrig
behavioral2/memory/3116-32-0x00007FF646850000-0x00007FF646BA4000-memory.dmp	xmrig
behavioral2/files/0x00080000000233cf-35.dat	xmrig
behavioral2/files/0x00070000000233d8-44.dat	xmrig
behavioral2/memory/2964-51-0x00007FF676FE0000-0x00007FF677334000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d7-54.dat	xmrig
behavioral2/files/0x00070000000233da-58.dat	xmrig
behavioral2/files/0x00070000000233d9-60.dat	xmrig
behavioral2/memory/3312-57-0x00007FF6C8160000-0x00007FF6C84B4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233db-68.dat	xmrig
behavioral2/files/0x00070000000233dd-74.dat	xmrig
behavioral2/files/0x00070000000233e0-92.dat	xmrig
behavioral2/files/0x00070000000233e2-103.dat	xmrig
behavioral2/files/0x00070000000233e5-114.dat	xmrig
behavioral2/files/0x00070000000233e4-112.dat	xmrig
behavioral2/files/0x00070000000233e3-107.dat	xmrig
behavioral2/files/0x00070000000233e1-98.dat	xmrig
behavioral2/files/0x00070000000233df-88.dat	xmrig
behavioral2/files/0x00070000000233de-82.dat	xmrig
behavioral2/files/0x00070000000233dc-72.dat	xmrig
behavioral2/memory/5040-50-0x00007FF75B750000-0x00007FF75BAA4000-memory.dmp	xmrig
behavioral2/memory/1812-43-0x00007FF637420000-0x00007FF637774000-memory.dmp	xmrig
behavioral2/memory/3436-116-0x00007FF7F0460000-0x00007FF7F07B4000-memory.dmp	xmrig
behavioral2/memory/2224-117-0x00007FF7C1490000-0x00007FF7C17E4000-memory.dmp	xmrig
behavioral2/memory/3044-118-0x00007FF71AE20000-0x00007FF71B174000-memory.dmp	xmrig
behavioral2/memory/1112-119-0x00007FF70AC80000-0x00007FF70AFD4000-memory.dmp	xmrig
behavioral2/memory/3096-120-0x00007FF744390000-0x00007FF7446E4000-memory.dmp	xmrig
behavioral2/memory/3888-121-0x00007FF67D5D0000-0x00007FF67D924000-memory.dmp	xmrig
behavioral2/memory/1708-122-0x00007FF693FE0000-0x00007FF694334000-memory.dmp	xmrig
behavioral2/memory/4776-123-0x00007FF7E1900000-0x00007FF7E1C54000-memory.dmp	xmrig
behavioral2/memory/2444-124-0x00007FF7FF360000-0x00007FF7FF6B4000-memory.dmp	xmrig
behavioral2/memory/1372-125-0x00007FF74BA80000-0x00007FF74BDD4000-memory.dmp	xmrig
behavioral2/memory/3948-126-0x00007FF7022F0000-0x00007FF702644000-memory.dmp	xmrig
behavioral2/memory/3500-127-0x00007FF603180000-0x00007FF6034D4000-memory.dmp	xmrig
behavioral2/memory/3064-128-0x00007FF684170000-0x00007FF6844C4000-memory.dmp	xmrig
behavioral2/memory/2436-129-0x00007FF662F20000-0x00007FF663274000-memory.dmp	xmrig
behavioral2/memory/3504-130-0x00007FF706F50000-0x00007FF7072A4000-memory.dmp	xmrig
behavioral2/memory/3116-131-0x00007FF646850000-0x00007FF646BA4000-memory.dmp	xmrig
behavioral2/memory/1812-132-0x00007FF637420000-0x00007FF637774000-memory.dmp	xmrig
behavioral2/memory/2964-133-0x00007FF676FE0000-0x00007FF677334000-memory.dmp	xmrig
behavioral2/memory/3312-134-0x00007FF6C8160000-0x00007FF6C84B4000-memory.dmp	xmrig
behavioral2/memory/1640-135-0x00007FF76D760000-0x00007FF76DAB4000-memory.dmp	xmrig
behavioral2/memory/2436-136-0x00007FF662F20000-0x00007FF663274000-memory.dmp	xmrig
behavioral2/memory/3504-137-0x00007FF706F50000-0x00007FF7072A4000-memory.dmp	xmrig
behavioral2/memory/2772-138-0x00007FF736310000-0x00007FF736664000-memory.dmp	xmrig
behavioral2/memory/3116-139-0x00007FF646850000-0x00007FF646BA4000-memory.dmp	xmrig
behavioral2/memory/1812-140-0x00007FF637420000-0x00007FF637774000-memory.dmp	xmrig
behavioral2/memory/5040-141-0x00007FF75B750000-0x00007FF75BAA4000-memory.dmp	xmrig
behavioral2/memory/3436-142-0x00007FF7F0460000-0x00007FF7F07B4000-memory.dmp	xmrig
behavioral2/memory/3312-143-0x00007FF6C8160000-0x00007FF6C84B4000-memory.dmp	xmrig
behavioral2/memory/2964-144-0x00007FF676FE0000-0x00007FF677334000-memory.dmp	xmrig
behavioral2/memory/2224-145-0x00007FF7C1490000-0x00007FF7C17E4000-memory.dmp	xmrig
behavioral2/memory/3064-146-0x00007FF684170000-0x00007FF6844C4000-memory.dmp	xmrig
behavioral2/memory/3044-147-0x00007FF71AE20000-0x00007FF71B174000-memory.dmp	xmrig
behavioral2/memory/3888-152-0x00007FF67D5D0000-0x00007FF67D924000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1640	QoszihL.exe
2436	XGyxgZm.exe
3504	jtIUNxq.exe
2772	fcsAIGa.exe
3116	vMkKetx.exe
1812	ljXKBgJ.exe
5040	lUxXuol.exe
3312	jotXVKU.exe
2964	gZWIWIU.exe
3436	dJEHhBn.exe
3064	tPEDdOy.exe
2224	shnlJok.exe
3044	SEcanHo.exe
1112	YBunsxq.exe
3096	mzrWiRJ.exe
3888	ytCoXmv.exe
1708	ZdAKHwT.exe
4776	pNhQcpZ.exe
2444	DFIuCBH.exe
1372	KWZwEoh.exe
3948	CMbXiML.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3500-0-0x00007FF603180000-0x00007FF6034D4000-memory.dmp	upx
behavioral2/files/0x000600000002326f-4.dat	upx
behavioral2/files/0x00070000000233d2-12.dat	upx
behavioral2/memory/1640-10-0x00007FF76D760000-0x00007FF76DAB4000-memory.dmp	upx
behavioral2/memory/2436-16-0x00007FF662F20000-0x00007FF663274000-memory.dmp	upx
behavioral2/files/0x00070000000233d4-19.dat	upx
behavioral2/memory/2772-26-0x00007FF736310000-0x00007FF736664000-memory.dmp	upx
behavioral2/memory/3504-25-0x00007FF706F50000-0x00007FF7072A4000-memory.dmp	upx
behavioral2/files/0x00070000000233d3-21.dat	upx
behavioral2/files/0x00070000000233d5-29.dat	upx
behavioral2/memory/3116-32-0x00007FF646850000-0x00007FF646BA4000-memory.dmp	upx
behavioral2/files/0x00080000000233cf-35.dat	upx
behavioral2/files/0x00070000000233d8-44.dat	upx
behavioral2/memory/2964-51-0x00007FF676FE0000-0x00007FF677334000-memory.dmp	upx
behavioral2/files/0x00070000000233d7-54.dat	upx
behavioral2/files/0x00070000000233da-58.dat	upx
behavioral2/files/0x00070000000233d9-60.dat	upx
behavioral2/memory/3312-57-0x00007FF6C8160000-0x00007FF6C84B4000-memory.dmp	upx
behavioral2/files/0x00070000000233db-68.dat	upx
behavioral2/files/0x00070000000233dd-74.dat	upx
behavioral2/files/0x00070000000233e0-92.dat	upx
behavioral2/files/0x00070000000233e2-103.dat	upx
behavioral2/files/0x00070000000233e5-114.dat	upx
behavioral2/files/0x00070000000233e4-112.dat	upx
behavioral2/files/0x00070000000233e3-107.dat	upx
behavioral2/files/0x00070000000233e1-98.dat	upx
behavioral2/files/0x00070000000233df-88.dat	upx
behavioral2/files/0x00070000000233de-82.dat	upx
behavioral2/files/0x00070000000233dc-72.dat	upx
behavioral2/memory/5040-50-0x00007FF75B750000-0x00007FF75BAA4000-memory.dmp	upx
behavioral2/memory/1812-43-0x00007FF637420000-0x00007FF637774000-memory.dmp	upx
behavioral2/memory/3436-116-0x00007FF7F0460000-0x00007FF7F07B4000-memory.dmp	upx
behavioral2/memory/2224-117-0x00007FF7C1490000-0x00007FF7C17E4000-memory.dmp	upx
behavioral2/memory/3044-118-0x00007FF71AE20000-0x00007FF71B174000-memory.dmp	upx
behavioral2/memory/1112-119-0x00007FF70AC80000-0x00007FF70AFD4000-memory.dmp	upx
behavioral2/memory/3096-120-0x00007FF744390000-0x00007FF7446E4000-memory.dmp	upx
behavioral2/memory/3888-121-0x00007FF67D5D0000-0x00007FF67D924000-memory.dmp	upx
behavioral2/memory/1708-122-0x00007FF693FE0000-0x00007FF694334000-memory.dmp	upx
behavioral2/memory/4776-123-0x00007FF7E1900000-0x00007FF7E1C54000-memory.dmp	upx
behavioral2/memory/2444-124-0x00007FF7FF360000-0x00007FF7FF6B4000-memory.dmp	upx
behavioral2/memory/1372-125-0x00007FF74BA80000-0x00007FF74BDD4000-memory.dmp	upx
behavioral2/memory/3948-126-0x00007FF7022F0000-0x00007FF702644000-memory.dmp	upx
behavioral2/memory/3500-127-0x00007FF603180000-0x00007FF6034D4000-memory.dmp	upx
behavioral2/memory/3064-128-0x00007FF684170000-0x00007FF6844C4000-memory.dmp	upx
behavioral2/memory/2436-129-0x00007FF662F20000-0x00007FF663274000-memory.dmp	upx
behavioral2/memory/3504-130-0x00007FF706F50000-0x00007FF7072A4000-memory.dmp	upx
behavioral2/memory/3116-131-0x00007FF646850000-0x00007FF646BA4000-memory.dmp	upx
behavioral2/memory/1812-132-0x00007FF637420000-0x00007FF637774000-memory.dmp	upx
behavioral2/memory/2964-133-0x00007FF676FE0000-0x00007FF677334000-memory.dmp	upx
behavioral2/memory/3312-134-0x00007FF6C8160000-0x00007FF6C84B4000-memory.dmp	upx
behavioral2/memory/1640-135-0x00007FF76D760000-0x00007FF76DAB4000-memory.dmp	upx
behavioral2/memory/2436-136-0x00007FF662F20000-0x00007FF663274000-memory.dmp	upx
behavioral2/memory/3504-137-0x00007FF706F50000-0x00007FF7072A4000-memory.dmp	upx
behavioral2/memory/2772-138-0x00007FF736310000-0x00007FF736664000-memory.dmp	upx
behavioral2/memory/3116-139-0x00007FF646850000-0x00007FF646BA4000-memory.dmp	upx
behavioral2/memory/1812-140-0x00007FF637420000-0x00007FF637774000-memory.dmp	upx
behavioral2/memory/5040-141-0x00007FF75B750000-0x00007FF75BAA4000-memory.dmp	upx
behavioral2/memory/3436-142-0x00007FF7F0460000-0x00007FF7F07B4000-memory.dmp	upx
behavioral2/memory/3312-143-0x00007FF6C8160000-0x00007FF6C84B4000-memory.dmp	upx
behavioral2/memory/2964-144-0x00007FF676FE0000-0x00007FF677334000-memory.dmp	upx
behavioral2/memory/2224-145-0x00007FF7C1490000-0x00007FF7C17E4000-memory.dmp	upx
behavioral2/memory/3064-146-0x00007FF684170000-0x00007FF6844C4000-memory.dmp	upx
behavioral2/memory/3044-147-0x00007FF71AE20000-0x00007FF71B174000-memory.dmp	upx
behavioral2/memory/3888-152-0x00007FF67D5D0000-0x00007FF67D924000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\pNhQcpZ.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KWZwEoh.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XGyxgZm.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lUxXuol.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YBunsxq.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ytCoXmv.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\shnlJok.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mzrWiRJ.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZdAKHwT.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vMkKetx.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ljXKBgJ.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jotXVKU.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dJEHhBn.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DFIuCBH.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\QoszihL.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\jtIUNxq.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gZWIWIU.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\tPEDdOy.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fcsAIGa.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\SEcanHo.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CMbXiML.exe	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 1640	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	85
PID 3500 wrote to memory of 1640	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	85
PID 3500 wrote to memory of 2436	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	86
PID 3500 wrote to memory of 2436	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	86
PID 3500 wrote to memory of 3504	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	87
PID 3500 wrote to memory of 3504	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	87
PID 3500 wrote to memory of 2772	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	88
PID 3500 wrote to memory of 2772	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	88
PID 3500 wrote to memory of 3116	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	89
PID 3500 wrote to memory of 3116	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	89
PID 3500 wrote to memory of 1812	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	90
PID 3500 wrote to memory of 1812	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	90
PID 3500 wrote to memory of 3312	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	91
PID 3500 wrote to memory of 3312	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	91
PID 3500 wrote to memory of 5040	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	92
PID 3500 wrote to memory of 5040	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	92
PID 3500 wrote to memory of 2964	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	93
PID 3500 wrote to memory of 2964	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	93
PID 3500 wrote to memory of 3436	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	94
PID 3500 wrote to memory of 3436	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	94
PID 3500 wrote to memory of 3064	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	95
PID 3500 wrote to memory of 3064	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	95
PID 3500 wrote to memory of 2224	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	96
PID 3500 wrote to memory of 2224	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	96
PID 3500 wrote to memory of 3044	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	97
PID 3500 wrote to memory of 3044	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	97
PID 3500 wrote to memory of 1112	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	98
PID 3500 wrote to memory of 1112	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	98
PID 3500 wrote to memory of 3096	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	99
PID 3500 wrote to memory of 3096	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	99
PID 3500 wrote to memory of 3888	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	100
PID 3500 wrote to memory of 3888	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	100
PID 3500 wrote to memory of 1708	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	101
PID 3500 wrote to memory of 1708	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	101
PID 3500 wrote to memory of 4776	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	102
PID 3500 wrote to memory of 4776	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	102
PID 3500 wrote to memory of 2444	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	103
PID 3500 wrote to memory of 2444	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	103
PID 3500 wrote to memory of 1372	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	104
PID 3500 wrote to memory of 1372	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	104
PID 3500 wrote to memory of 3948	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	105
PID 3500 wrote to memory of 3948	3500	2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe	105

C:\Users\Admin\AppData\Local\Temp\2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_2414837c0707a74c9f88a6228216014d_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\System\QoszihL.exe
  C:\Windows\System\QoszihL.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\XGyxgZm.exe
  C:\Windows\System\XGyxgZm.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\jtIUNxq.exe
  C:\Windows\System\jtIUNxq.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\fcsAIGa.exe
  C:\Windows\System\fcsAIGa.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\vMkKetx.exe
  C:\Windows\System\vMkKetx.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\ljXKBgJ.exe
  C:\Windows\System\ljXKBgJ.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\jotXVKU.exe
  C:\Windows\System\jotXVKU.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\lUxXuol.exe
  C:\Windows\System\lUxXuol.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\gZWIWIU.exe
  C:\Windows\System\gZWIWIU.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\dJEHhBn.exe
  C:\Windows\System\dJEHhBn.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\tPEDdOy.exe
  C:\Windows\System\tPEDdOy.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\shnlJok.exe
  C:\Windows\System\shnlJok.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\SEcanHo.exe
  C:\Windows\System\SEcanHo.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\YBunsxq.exe
  C:\Windows\System\YBunsxq.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\mzrWiRJ.exe
  C:\Windows\System\mzrWiRJ.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\ytCoXmv.exe
  C:\Windows\System\ytCoXmv.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\ZdAKHwT.exe
  C:\Windows\System\ZdAKHwT.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\pNhQcpZ.exe
  C:\Windows\System\pNhQcpZ.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\DFIuCBH.exe
  C:\Windows\System\DFIuCBH.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\KWZwEoh.exe
  C:\Windows\System\KWZwEoh.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\CMbXiML.exe
  C:\Windows\System\CMbXiML.exe
  2⤵
  - Executes dropped EXE
  PID:3948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CMbXiML.exe

Path C:\Windows\System\CMbXiML.exe
Size 5.9MB
SHA256 3108d61a701d0c3575c5b474c4d9d92719dd13859bdb81f5414738a8d310910e
MD5 4544d18ac0a3754bdac6f74e02db7ddc
SHA1 3ebdf0c81fcf7a8f8fee4631e3189cdfa5766aad
SHA512 f86e32fb6a92eb9a118b1c2113e60d6e84b1e3fd0a5c23035243d4bed6dc38c4f12ac4531240f11f7366fa05ca8912d84b0fd2334361107069403206964a5fa2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

DFIuCBH.exe

Path C:\Windows\System\DFIuCBH.exe
Size 5.9MB
SHA256 ac0bce2373144542196a3fd57a34ffe6a7dd95f140d1f0b5eed04b002b466d7f
MD5 666b10ae040e2fc840c0c79e40079ea3
SHA1 7439fdc5015a118023ab3eaf351f39d3dda6ea2c
SHA512 c9ef8071012b5b25c72c67d383484409137f08ad6b333e745879a295bcc055169ceeb23235a04e1bc9cdb72ba74fa1e7c651b81eea84652a502538d5d41eb1d8
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

KWZwEoh.exe

Path C:\Windows\System\KWZwEoh.exe
Size 5.9MB
SHA256 347db79a9a964ceda0eb098dcfff0cb944a1911b4931cbc3170d3dd8b9c0d6a0
MD5 46005f27db5f5d4c9b8ba7744cf97de1
SHA1 41dba6eb7a43edd339e103b5cf48cf165002df1a
SHA512 5ebb9e27e24a9986a4775c39d03c8a41c822c3e8a482c4d7120d63a1f3e284e698bdaa072b90b855fd0118d50c6524bb1eb88e29571b4f542c2619aa8b6686a1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

QoszihL.exe

Path C:\Windows\System\QoszihL.exe
Size 5.9MB
SHA256 79eb820c017c9113864c7ecf9c729535c1cc077208bf560be237c9cdd5f2a89e
MD5 383320d26906bc6bf89ca0c59c44830c
SHA1 b7cadf8faa88d099cc7a2f98096db959d863ac5f
SHA512 2004cb5b3c7caf0852af8d9e7d1275b605a32756df5c4d32a902690661c163e527640bfe8da4549f1e96e8b788e85534789f522c554194cc7924ddec4834da82
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

SEcanHo.exe

Path C:\Windows\System\SEcanHo.exe
Size 5.9MB
SHA256 444d2cc49eca65f0727b26a6c8a2c2273479c12ff7a53fdbe5d6e69b05bfe211
MD5 23e13dcb33f33544dc3626c0ba0ffbae
SHA1 daf5910d1c04c0cff501225384746e50d5c756d5
SHA512 d30d9fadcb0012d0c96557b0af52174f2d88b1c4887255180a1c1aca07a9da097f725378a7dbf9efeddbaed4ccbc19cedf098514bb52fb4b1d26b01bb40d60da
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

XGyxgZm.exe

Path C:\Windows\System\XGyxgZm.exe
Size 5.9MB
SHA256 e620f337a07bd05568a61510ab67f19c1b6b84d241e4ed3fb88b6c624d956ede
MD5 1e75202bde1b2da8964f3a0f4bee0d20
SHA1 01c10ab63963257b6eef8526dbffef67330a20b5
SHA512 75e5440c53ae4b45e3333032e6a7cb7f33e7d14aeb86a4b0ba5e7d6361e904ab11384cad3b1cf7ffa93b205961bd6cc66e1f35a5361f3ea657fafbcb20e76e7c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUd:Q+856utgpPF8u/7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

YBunsxq.exe

Path C:\Windows\System\YBunsxq.exe
Size 5.9MB
SHA256 c56289d65b6fc7f0e1e94d9b6065f92594456132b677169f459976bb803ec5e0
MD5 6a19d0acc037324bc067b0e50988f223
SHA1 87e0879df912f8859a3ad311109867ec56837d64
SHA512 cb8776b1cc2ecd602037c75dca5f66eb51e18e9bb1e5ee2c4bf044c99071174ff71e2ac17e664d06838354fa07817b00020940b921a29e945f79b23380b0c803
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZdAKHwT.exe

Path C:\Windows\System\ZdAKHwT.exe
Size 5.9MB
SHA256 a24887632c64fe6aab2011fc33b2cb6b2e321d40b1feea2e69992bb16259df35
MD5 e4c8961f8c22bf4ef76732641be63b0f
SHA1 c61205e3dbaed8cfdd7dd5c3c526fdddfceb2194
SHA512 a1321819d4e96ef54a5b9ce2c21756ac604df1cba7304fb5b411270c946ddc23773ca4408c986f05a5fb6490a10f322e6d65b9e38b842f131c3dd1e87eb2fd10
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

dJEHhBn.exe

Path C:\Windows\System\dJEHhBn.exe
Size 5.9MB
SHA256 b376ba7682e6ecc2b3e780d53f0a29a0e25927ee187141ce9610c55f8d152cc0
MD5 b3060b47dfd2cd3888461987f30a29cf
SHA1 36a5f876cd5e163924f37afea47f5e89fc3971f7
SHA512 9f148b2c9d9f751141ed91f4b403c2a663824ebb9d2022a3210f3c5902efe8bda1d25cf9ffdc01bf99c8e735b10700d029b4e08e8eea79f0d9e2c083d48a8102
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

fcsAIGa.exe

Path C:\Windows\System\fcsAIGa.exe
Size 5.9MB
SHA256 ed78acc1339153ef3d104d90d99d4cf091bd4a2a956fa2b0bf573c09278aa42f
MD5 82478fa92285450308f79d7543aed660
SHA1 e122572726349fc971c5828f9ff35c1edee571a0
SHA512 7aa918dd971e22a91be5ed915f9cd9c6a6eba67a5c8cd2ebfc741781e1536c5795fa68a57d1eeadb80ab9d6a5fb06108fc6ded744871fd0c450c77ac4d612aa4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

gZWIWIU.exe

Path C:\Windows\System\gZWIWIU.exe
Size 5.9MB
SHA256 3038eaeaafbfd9d62d584065cd2d22d74770418126fc7fe7eeca38b07eec25f8
MD5 d52316bce07d5dae579b6c773a4839a5
SHA1 52e79ac97d98d4dd4a4dc22acdbe65bc1304d4df
SHA512 d78abb6cf143ddffe21b9e62e3646203b112fe9fc0a862071202dec358caac83491dbc0625b27dfd0af39fd35619ac320269171771d5f6c504513f5b6159f679
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

jotXVKU.exe

Path C:\Windows\System\jotXVKU.exe
Size 5.9MB
SHA256 c0b01a2fa70f74e0636c905830fb9fc0095ec47d959ed19b8a6e0d458520b0a5
MD5 6433c8c181ea7f4dcaf0dfd18166a52b
SHA1 68159ecf3eb3a7a16ba3b7941cc2067ec62da1b5
SHA512 8334e9aa8407f976e6bb086835de6e406d4fc10136a8749788cbd80c5f7fa30b4bd4bef9088c3a5c54c72ddc049143414fda36fd55bf2d4541c7750ccf3213fa
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUz:Q+856utgpPF8u/7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

jtIUNxq.exe

Path C:\Windows\System\jtIUNxq.exe
Size 5.9MB
SHA256 4de461f2a81728de27d98448bfbf2b74c30f2b1ba2b7f0a5378820f3bb884d77
MD5 d3c85769aa8b4f9722da0c0bee079280
SHA1 34139849152658a5980b03b407cf71aefdf55a7a
SHA512 5846f7ef3a0b5c449177e13a09495d27a55cdb49a64da4617d350e5e5fb127e3020dc057ee613dc21aba65524ccd0eb87993b3bfc66245bb5dd1c7080f02275e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

lUxXuol.exe

Path C:\Windows\System\lUxXuol.exe
Size 5.9MB
SHA256 da91f30fbd5c964d75ecdb523b6556a62c02283540fab5e70e432ffba9d27a21
MD5 6279182b6bc72dc3d337447b04c0d1eb
SHA1 f73f5b48a2ce65294f288a66f028440dcaecf185
SHA512 d81bc20e15e7255f508aae052ade670ec8ca4be413f6cdea85ea03bf2b5ea6913013c5b3280f7da4f33ca18c350466f6ab62949c2c7f0f4e4985297938d03433
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUq:Q+856utgpPF8u/7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

ljXKBgJ.exe

Path C:\Windows\System\ljXKBgJ.exe
Size 5.9MB
SHA256 fcd20c51688bdc9e6766d5dab5a65e83f357780526055738ab70da8205a71189
MD5 3aa53d0f9b459f3e1660c9cba258a119
SHA1 3ca5772c8eff8b44e1d925cc03c519e706adf470
SHA512 dd7c08b1f6bb927c0e10b12bb39c6df0b10fa0356eb774405c2ca7d219f3d0aea8f370df6053234869ca680714ccf4c7ed773eb3384f6627a7db977e0f56dbd2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

mzrWiRJ.exe

Path C:\Windows\System\mzrWiRJ.exe
Size 5.9MB
SHA256 5bf52bfbdbda88d3673b4c4ff2f6c1418e9f2f6cffa0e3939efe1baa1ba5f72d
MD5 cf1230b52d43e812214a025a646e7f36
SHA1 03be1d46a1c933852f11b437ec8b55e595e705e2
SHA512 d89b8216e4abd642264cd5848ad25bc32e199d85eae5be85c12cec7ecb9a13c8586f636fbc542d87223d55ff109b95baadfe263381b29de1da1889bf52487bdd
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

pNhQcpZ.exe

Path C:\Windows\System\pNhQcpZ.exe
Size 5.9MB
SHA256 7a83173d3ba3d2727cf9b5ac7ca646347f3782bbc19286b691fd3c0ef6a19cc5
MD5 d940c2a5ba8c9e2ee4a337ec9e210a65
SHA1 49fbb9493d2d561a762a4def2ca218989c6b1043
SHA512 d1b395b6a012eda3406af9244ce18d99f22c0ca0a4181be941b1fcecb99535c121fdb62ae68531d277427c9e744557605ddb48afe0c16030c5e7557d1bd9d6a7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

shnlJok.exe

Path C:\Windows\System\shnlJok.exe
Size 5.9MB
SHA256 cbfe4ec6a2f54120e097a9b6f5f47e88a4073256be00a57367e57aee9d2870ec
MD5 a97d48b7de5f62ce7c7ce4f451e1d16f
SHA1 51b9eeee364b6a4dadcdf86f43165b3d4a54b7e4
SHA512 52a36c89fc0f3ecfcbda5c2c118d614ef78bca0c8e427443617e18a2f5f1133c9e41fdc5af172a62560abca64b5ca27f7a4bb30034fbd25bf4bcb3d14bdba812
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

tPEDdOy.exe

Path C:\Windows\System\tPEDdOy.exe
Size 5.9MB
SHA256 7b2123dd1fdc4d9da2aa91053dc50a3cfa9da9d05f98d30d4bc7d4d863ad7b88
MD5 c3c493ee937fc4eab7672a9e621fccfc
SHA1 7d4a4c4ed53cfa8df753e0d908a35b45d2ec8d93
SHA512 c9a9c11ea6fe990f4ed076350be3296d4ca96666830ea0ecd02adc752a2d2110d9fdbbd55d95d442af4937df7671df03c3b8ecf26a75ffc37d43200bbfcaa091
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

vMkKetx.exe

Path C:\Windows\System\vMkKetx.exe
Size 5.9MB
SHA256 4da2e5bfffcd7b46ff8f2deb51b469a4c82b5864222f2367981e6a1e0915d6c4
MD5 b2cb4cd51f9d7b01daef0f05c5c77a95
SHA1 4d970e11d1acdf7baee211423df6c0ca516dd940
SHA512 18d9b6d5729fdc54669effd2871dd0d52d05f31fdba83327d1cc0164179f599539dada1d57657a5d258df49bb6224aab65c3d1aae5f08c8e701cb3ec8fc51969
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

ytCoXmv.exe

Path C:\Windows\System\ytCoXmv.exe
Size 5.9MB
SHA256 e5625f633100be0d5a29943b79cf849bb8b80e0dc6f32748988e939c96ed046b
MD5 b3e20c9a4613e61abe92aced890cec13
SHA1 878ef5d4a8d1e35d2a22651643d912a9c4d64226
SHA512 ffa8972735a89b0dac31c5261e73191c09c0bc612d5c9d379e4b1f25ad63687e40339343735e898962e6478433651044948598cc7e07ac1e81731acedfdadf6c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1112-119-0x00007FF70AC80000-0x00007FF70AFD4000-memory.dmp

Download

memory/1112-149-0x00007FF70AC80000-0x00007FF70AFD4000-memory.dmp

Download

memory/1372-125-0x00007FF74BA80000-0x00007FF74BDD4000-memory.dmp

Download

memory/1372-154-0x00007FF74BA80000-0x00007FF74BDD4000-memory.dmp

Download

memory/1640-10-0x00007FF76D760000-0x00007FF76DAB4000-memory.dmp

Download

memory/1640-135-0x00007FF76D760000-0x00007FF76DAB4000-memory.dmp

Download

memory/1708-122-0x00007FF693FE0000-0x00007FF694334000-memory.dmp

Download

memory/1708-151-0x00007FF693FE0000-0x00007FF694334000-memory.dmp

Download

memory/1812-43-0x00007FF637420000-0x00007FF637774000-memory.dmp

Download

memory/1812-140-0x00007FF637420000-0x00007FF637774000-memory.dmp

Download

memory/1812-132-0x00007FF637420000-0x00007FF637774000-memory.dmp

Download

memory/2224-117-0x00007FF7C1490000-0x00007FF7C17E4000-memory.dmp

Download

memory/2224-145-0x00007FF7C1490000-0x00007FF7C17E4000-memory.dmp

Download

memory/2436-129-0x00007FF662F20000-0x00007FF663274000-memory.dmp

Download

memory/2436-136-0x00007FF662F20000-0x00007FF663274000-memory.dmp

Download

memory/2436-16-0x00007FF662F20000-0x00007FF663274000-memory.dmp

Download

memory/2444-155-0x00007FF7FF360000-0x00007FF7FF6B4000-memory.dmp

Download

memory/2444-124-0x00007FF7FF360000-0x00007FF7FF6B4000-memory.dmp

Download

memory/2772-138-0x00007FF736310000-0x00007FF736664000-memory.dmp

Download

memory/2772-26-0x00007FF736310000-0x00007FF736664000-memory.dmp

Download

memory/2964-144-0x00007FF676FE0000-0x00007FF677334000-memory.dmp

Download

memory/2964-51-0x00007FF676FE0000-0x00007FF677334000-memory.dmp

Download

memory/2964-133-0x00007FF676FE0000-0x00007FF677334000-memory.dmp

Download

memory/3044-147-0x00007FF71AE20000-0x00007FF71B174000-memory.dmp

Download

memory/3044-118-0x00007FF71AE20000-0x00007FF71B174000-memory.dmp

Download

memory/3064-128-0x00007FF684170000-0x00007FF6844C4000-memory.dmp

Download

memory/3064-146-0x00007FF684170000-0x00007FF6844C4000-memory.dmp

Download

memory/3096-120-0x00007FF744390000-0x00007FF7446E4000-memory.dmp

Download

memory/3096-148-0x00007FF744390000-0x00007FF7446E4000-memory.dmp

Download

memory/3116-32-0x00007FF646850000-0x00007FF646BA4000-memory.dmp

Download

memory/3116-131-0x00007FF646850000-0x00007FF646BA4000-memory.dmp

Download

memory/3116-139-0x00007FF646850000-0x00007FF646BA4000-memory.dmp

Download

memory/3312-134-0x00007FF6C8160000-0x00007FF6C84B4000-memory.dmp

Download

memory/3312-57-0x00007FF6C8160000-0x00007FF6C84B4000-memory.dmp

Download

memory/3312-143-0x00007FF6C8160000-0x00007FF6C84B4000-memory.dmp

Download

memory/3436-142-0x00007FF7F0460000-0x00007FF7F07B4000-memory.dmp

Download

memory/3436-116-0x00007FF7F0460000-0x00007FF7F07B4000-memory.dmp

Download

memory/3500-1-0x00000248C8200000-0x00000248C8210000-memory.dmp

Download

memory/3500-127-0x00007FF603180000-0x00007FF6034D4000-memory.dmp

Download

memory/3500-0-0x00007FF603180000-0x00007FF6034D4000-memory.dmp

Download

memory/3504-25-0x00007FF706F50000-0x00007FF7072A4000-memory.dmp

Download

memory/3504-137-0x00007FF706F50000-0x00007FF7072A4000-memory.dmp

Download

memory/3504-130-0x00007FF706F50000-0x00007FF7072A4000-memory.dmp

Download

memory/3888-152-0x00007FF67D5D0000-0x00007FF67D924000-memory.dmp

Download

memory/3888-121-0x00007FF67D5D0000-0x00007FF67D924000-memory.dmp

Download

memory/3948-153-0x00007FF7022F0000-0x00007FF702644000-memory.dmp

Download

memory/3948-126-0x00007FF7022F0000-0x00007FF702644000-memory.dmp

Download

memory/4776-150-0x00007FF7E1900000-0x00007FF7E1C54000-memory.dmp

Download

memory/4776-123-0x00007FF7E1900000-0x00007FF7E1C54000-memory.dmp

Download

memory/5040-50-0x00007FF75B750000-0x00007FF75BAA4000-memory.dmp

Download

memory/5040-141-0x00007FF75B750000-0x00007FF75BAA4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads