cobaltstrike | 2812b83df1c5b798e27f6b502d6f56e7b2dcc5c92681ffadd04022d5b7ecc1f6

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 07:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-jhedmsec4z
SHA256 2812b83df1c5b798e27f6b502d6f56e7b2dcc5c92681ffadd04022d5b7ecc1f6
MD5 84b13258b241ffb19d2c3228b9d2ded6
SHA1 c5d20a5eed7e14dff0a5bab125849e9046f54d91
SHA512 89ce2644d0fee20fab89b3ed2fedd43c3b53cb8ffbf5e136a9bccf90f6006993f4fd06f30e27175b7e655aafacd438d4f6d00c5352131d53b0242ab4ed0c55d4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023402-5.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023407-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023406-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023408-23.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023409-29.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340a-36.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023403-44.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340d-50.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340e-55.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023410-66.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023414-86.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-100.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023419-110.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023418-108.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023416-98.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023415-94.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023413-82.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023412-77.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023411-72.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340f-63.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340c-48.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023402-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023407-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023406-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023408-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023409-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340a-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023403-44.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340d-50.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340e-55.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023410-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023414-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-100.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023419-110.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023418-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023416-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023415-94.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023413-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023412-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023411-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340f-63.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002340c-48.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3592-0-0x00007FF67B4C0000-0x00007FF67B814000-memory.dmp	UPX
behavioral2/files/0x0008000000023402-5.dat	UPX
behavioral2/memory/2380-8-0x00007FF7DF000000-0x00007FF7DF354000-memory.dmp	UPX
behavioral2/files/0x0007000000023407-10.dat	UPX
behavioral2/files/0x0007000000023406-11.dat	UPX
behavioral2/memory/1268-14-0x00007FF7E6A70000-0x00007FF7E6DC4000-memory.dmp	UPX
behavioral2/files/0x0007000000023408-23.dat	UPX
behavioral2/memory/1560-21-0x00007FF775BE0000-0x00007FF775F34000-memory.dmp	UPX
behavioral2/files/0x0007000000023409-29.dat	UPX
behavioral2/memory/3368-32-0x00007FF6442E0000-0x00007FF644634000-memory.dmp	UPX
behavioral2/memory/1528-26-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp	UPX
behavioral2/files/0x000700000002340a-36.dat	UPX
behavioral2/files/0x0008000000023403-44.dat	UPX
behavioral2/files/0x000700000002340d-50.dat	UPX
behavioral2/files/0x000700000002340e-55.dat	UPX
behavioral2/files/0x0007000000023410-66.dat	UPX
behavioral2/files/0x0007000000023414-86.dat	UPX
behavioral2/files/0x0007000000023417-100.dat	UPX
behavioral2/files/0x0007000000023419-110.dat	UPX
behavioral2/files/0x0007000000023418-108.dat	UPX
behavioral2/files/0x0007000000023416-98.dat	UPX
behavioral2/files/0x0007000000023415-94.dat	UPX
behavioral2/files/0x0007000000023413-82.dat	UPX
behavioral2/files/0x0007000000023412-77.dat	UPX
behavioral2/files/0x0007000000023411-72.dat	UPX
behavioral2/files/0x000700000002340f-63.dat	UPX
behavioral2/files/0x000700000002340c-48.dat	UPX
behavioral2/memory/512-112-0x00007FF7E96E0000-0x00007FF7E9A34000-memory.dmp	UPX
behavioral2/memory/1472-113-0x00007FF69BB00000-0x00007FF69BE54000-memory.dmp	UPX
behavioral2/memory/1236-114-0x00007FF704FD0000-0x00007FF705324000-memory.dmp	UPX
behavioral2/memory/1068-115-0x00007FF64FB10000-0x00007FF64FE64000-memory.dmp	UPX
behavioral2/memory/864-117-0x00007FF78DD00000-0x00007FF78E054000-memory.dmp	UPX
behavioral2/memory/2624-118-0x00007FF76F830000-0x00007FF76FB84000-memory.dmp	UPX
behavioral2/memory/4184-119-0x00007FF71E000000-0x00007FF71E354000-memory.dmp	UPX
behavioral2/memory/2240-116-0x00007FF730120000-0x00007FF730474000-memory.dmp	UPX
behavioral2/memory/4984-120-0x00007FF6580C0000-0x00007FF658414000-memory.dmp	UPX
behavioral2/memory/2252-121-0x00007FF7C7AB0000-0x00007FF7C7E04000-memory.dmp	UPX
behavioral2/memory/2180-122-0x00007FF67A9D0000-0x00007FF67AD24000-memory.dmp	UPX
behavioral2/memory/3700-123-0x00007FF628A40000-0x00007FF628D94000-memory.dmp	UPX
behavioral2/memory/3744-124-0x00007FF636BD0000-0x00007FF636F24000-memory.dmp	UPX
behavioral2/memory/2528-125-0x00007FF7D14F0000-0x00007FF7D1844000-memory.dmp	UPX
behavioral2/memory/3616-126-0x00007FF7C9890000-0x00007FF7C9BE4000-memory.dmp	UPX
behavioral2/memory/2456-127-0x00007FF69AC90000-0x00007FF69AFE4000-memory.dmp	UPX
behavioral2/memory/3592-128-0x00007FF67B4C0000-0x00007FF67B814000-memory.dmp	UPX
behavioral2/memory/2380-129-0x00007FF7DF000000-0x00007FF7DF354000-memory.dmp	UPX
behavioral2/memory/2380-130-0x00007FF7DF000000-0x00007FF7DF354000-memory.dmp	UPX
behavioral2/memory/1268-131-0x00007FF7E6A70000-0x00007FF7E6DC4000-memory.dmp	UPX
behavioral2/memory/1560-132-0x00007FF775BE0000-0x00007FF775F34000-memory.dmp	UPX
behavioral2/memory/1528-133-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp	UPX
behavioral2/memory/3368-134-0x00007FF6442E0000-0x00007FF644634000-memory.dmp	UPX
behavioral2/memory/512-135-0x00007FF7E96E0000-0x00007FF7E9A34000-memory.dmp	UPX
behavioral2/memory/1472-136-0x00007FF69BB00000-0x00007FF69BE54000-memory.dmp	UPX
behavioral2/memory/1236-137-0x00007FF704FD0000-0x00007FF705324000-memory.dmp	UPX
behavioral2/memory/1068-138-0x00007FF64FB10000-0x00007FF64FE64000-memory.dmp	UPX
behavioral2/memory/2240-140-0x00007FF730120000-0x00007FF730474000-memory.dmp	UPX
behavioral2/memory/864-139-0x00007FF78DD00000-0x00007FF78E054000-memory.dmp	UPX
behavioral2/memory/2252-142-0x00007FF7C7AB0000-0x00007FF7C7E04000-memory.dmp	UPX
behavioral2/memory/2624-141-0x00007FF76F830000-0x00007FF76FB84000-memory.dmp	UPX
behavioral2/memory/4184-145-0x00007FF71E000000-0x00007FF71E354000-memory.dmp	UPX
behavioral2/memory/4984-144-0x00007FF6580C0000-0x00007FF658414000-memory.dmp	UPX
behavioral2/memory/2180-143-0x00007FF67A9D0000-0x00007FF67AD24000-memory.dmp	UPX
behavioral2/memory/2528-146-0x00007FF7D14F0000-0x00007FF7D1844000-memory.dmp	UPX
behavioral2/memory/3744-148-0x00007FF636BD0000-0x00007FF636F24000-memory.dmp	UPX
behavioral2/memory/3700-150-0x00007FF628A40000-0x00007FF628D94000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3592-0-0x00007FF67B4C0000-0x00007FF67B814000-memory.dmp	xmrig
behavioral2/files/0x0008000000023402-5.dat	xmrig
behavioral2/memory/2380-8-0x00007FF7DF000000-0x00007FF7DF354000-memory.dmp	xmrig
behavioral2/files/0x0007000000023407-10.dat	xmrig
behavioral2/files/0x0007000000023406-11.dat	xmrig
behavioral2/memory/1268-14-0x00007FF7E6A70000-0x00007FF7E6DC4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023408-23.dat	xmrig
behavioral2/memory/1560-21-0x00007FF775BE0000-0x00007FF775F34000-memory.dmp	xmrig
behavioral2/files/0x0007000000023409-29.dat	xmrig
behavioral2/memory/3368-32-0x00007FF6442E0000-0x00007FF644634000-memory.dmp	xmrig
behavioral2/memory/1528-26-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp	xmrig
behavioral2/files/0x000700000002340a-36.dat	xmrig
behavioral2/files/0x0008000000023403-44.dat	xmrig
behavioral2/files/0x000700000002340d-50.dat	xmrig
behavioral2/files/0x000700000002340e-55.dat	xmrig
behavioral2/files/0x0007000000023410-66.dat	xmrig
behavioral2/files/0x0007000000023414-86.dat	xmrig
behavioral2/files/0x0007000000023417-100.dat	xmrig
behavioral2/files/0x0007000000023419-110.dat	xmrig
behavioral2/files/0x0007000000023418-108.dat	xmrig
behavioral2/files/0x0007000000023416-98.dat	xmrig
behavioral2/files/0x0007000000023415-94.dat	xmrig
behavioral2/files/0x0007000000023413-82.dat	xmrig
behavioral2/files/0x0007000000023412-77.dat	xmrig
behavioral2/files/0x0007000000023411-72.dat	xmrig
behavioral2/files/0x000700000002340f-63.dat	xmrig
behavioral2/files/0x000700000002340c-48.dat	xmrig
behavioral2/memory/512-112-0x00007FF7E96E0000-0x00007FF7E9A34000-memory.dmp	xmrig
behavioral2/memory/1472-113-0x00007FF69BB00000-0x00007FF69BE54000-memory.dmp	xmrig
behavioral2/memory/1236-114-0x00007FF704FD0000-0x00007FF705324000-memory.dmp	xmrig
behavioral2/memory/1068-115-0x00007FF64FB10000-0x00007FF64FE64000-memory.dmp	xmrig
behavioral2/memory/864-117-0x00007FF78DD00000-0x00007FF78E054000-memory.dmp	xmrig
behavioral2/memory/2624-118-0x00007FF76F830000-0x00007FF76FB84000-memory.dmp	xmrig
behavioral2/memory/4184-119-0x00007FF71E000000-0x00007FF71E354000-memory.dmp	xmrig
behavioral2/memory/2240-116-0x00007FF730120000-0x00007FF730474000-memory.dmp	xmrig
behavioral2/memory/4984-120-0x00007FF6580C0000-0x00007FF658414000-memory.dmp	xmrig
behavioral2/memory/2252-121-0x00007FF7C7AB0000-0x00007FF7C7E04000-memory.dmp	xmrig
behavioral2/memory/2180-122-0x00007FF67A9D0000-0x00007FF67AD24000-memory.dmp	xmrig
behavioral2/memory/3700-123-0x00007FF628A40000-0x00007FF628D94000-memory.dmp	xmrig
behavioral2/memory/3744-124-0x00007FF636BD0000-0x00007FF636F24000-memory.dmp	xmrig
behavioral2/memory/2528-125-0x00007FF7D14F0000-0x00007FF7D1844000-memory.dmp	xmrig
behavioral2/memory/3616-126-0x00007FF7C9890000-0x00007FF7C9BE4000-memory.dmp	xmrig
behavioral2/memory/2456-127-0x00007FF69AC90000-0x00007FF69AFE4000-memory.dmp	xmrig
behavioral2/memory/3592-128-0x00007FF67B4C0000-0x00007FF67B814000-memory.dmp	xmrig
behavioral2/memory/2380-129-0x00007FF7DF000000-0x00007FF7DF354000-memory.dmp	xmrig
behavioral2/memory/2380-130-0x00007FF7DF000000-0x00007FF7DF354000-memory.dmp	xmrig
behavioral2/memory/1268-131-0x00007FF7E6A70000-0x00007FF7E6DC4000-memory.dmp	xmrig
behavioral2/memory/1560-132-0x00007FF775BE0000-0x00007FF775F34000-memory.dmp	xmrig
behavioral2/memory/1528-133-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp	xmrig
behavioral2/memory/3368-134-0x00007FF6442E0000-0x00007FF644634000-memory.dmp	xmrig
behavioral2/memory/512-135-0x00007FF7E96E0000-0x00007FF7E9A34000-memory.dmp	xmrig
behavioral2/memory/1472-136-0x00007FF69BB00000-0x00007FF69BE54000-memory.dmp	xmrig
behavioral2/memory/1236-137-0x00007FF704FD0000-0x00007FF705324000-memory.dmp	xmrig
behavioral2/memory/1068-138-0x00007FF64FB10000-0x00007FF64FE64000-memory.dmp	xmrig
behavioral2/memory/2240-140-0x00007FF730120000-0x00007FF730474000-memory.dmp	xmrig
behavioral2/memory/864-139-0x00007FF78DD00000-0x00007FF78E054000-memory.dmp	xmrig
behavioral2/memory/2252-142-0x00007FF7C7AB0000-0x00007FF7C7E04000-memory.dmp	xmrig
behavioral2/memory/2624-141-0x00007FF76F830000-0x00007FF76FB84000-memory.dmp	xmrig
behavioral2/memory/4184-145-0x00007FF71E000000-0x00007FF71E354000-memory.dmp	xmrig
behavioral2/memory/4984-144-0x00007FF6580C0000-0x00007FF658414000-memory.dmp	xmrig
behavioral2/memory/2180-143-0x00007FF67A9D0000-0x00007FF67AD24000-memory.dmp	xmrig
behavioral2/memory/2528-146-0x00007FF7D14F0000-0x00007FF7D1844000-memory.dmp	xmrig
behavioral2/memory/3744-148-0x00007FF636BD0000-0x00007FF636F24000-memory.dmp	xmrig
behavioral2/memory/3700-150-0x00007FF628A40000-0x00007FF628D94000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2380	FjKcTIo.exe
1268	wmtwiAs.exe
1560	xagkThT.exe
1528	ZHofxwX.exe
3368	xnRvASr.exe
512	oSIAFPb.exe
1472	XxAWNWl.exe
1236	XRZitva.exe
1068	opjZznO.exe
2240	KrmITbE.exe
864	bHMNfco.exe
2624	FBZXodq.exe
4184	sHCPDPv.exe
4984	ttFlTeb.exe
2252	hjQHIfY.exe
2180	TIvrXUm.exe
3700	LpHwkyn.exe
3744	FOVURqb.exe
2528	lrPGQLW.exe
3616	AVuegPc.exe
2456	cAKeYbV.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3592-0-0x00007FF67B4C0000-0x00007FF67B814000-memory.dmp	upx
behavioral2/files/0x0008000000023402-5.dat	upx
behavioral2/memory/2380-8-0x00007FF7DF000000-0x00007FF7DF354000-memory.dmp	upx
behavioral2/files/0x0007000000023407-10.dat	upx
behavioral2/files/0x0007000000023406-11.dat	upx
behavioral2/memory/1268-14-0x00007FF7E6A70000-0x00007FF7E6DC4000-memory.dmp	upx
behavioral2/files/0x0007000000023408-23.dat	upx
behavioral2/memory/1560-21-0x00007FF775BE0000-0x00007FF775F34000-memory.dmp	upx
behavioral2/files/0x0007000000023409-29.dat	upx
behavioral2/memory/3368-32-0x00007FF6442E0000-0x00007FF644634000-memory.dmp	upx
behavioral2/memory/1528-26-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp	upx
behavioral2/files/0x000700000002340a-36.dat	upx
behavioral2/files/0x0008000000023403-44.dat	upx
behavioral2/files/0x000700000002340d-50.dat	upx
behavioral2/files/0x000700000002340e-55.dat	upx
behavioral2/files/0x0007000000023410-66.dat	upx
behavioral2/files/0x0007000000023414-86.dat	upx
behavioral2/files/0x0007000000023417-100.dat	upx
behavioral2/files/0x0007000000023419-110.dat	upx
behavioral2/files/0x0007000000023418-108.dat	upx
behavioral2/files/0x0007000000023416-98.dat	upx
behavioral2/files/0x0007000000023415-94.dat	upx
behavioral2/files/0x0007000000023413-82.dat	upx
behavioral2/files/0x0007000000023412-77.dat	upx
behavioral2/files/0x0007000000023411-72.dat	upx
behavioral2/files/0x000700000002340f-63.dat	upx
behavioral2/files/0x000700000002340c-48.dat	upx
behavioral2/memory/512-112-0x00007FF7E96E0000-0x00007FF7E9A34000-memory.dmp	upx
behavioral2/memory/1472-113-0x00007FF69BB00000-0x00007FF69BE54000-memory.dmp	upx
behavioral2/memory/1236-114-0x00007FF704FD0000-0x00007FF705324000-memory.dmp	upx
behavioral2/memory/1068-115-0x00007FF64FB10000-0x00007FF64FE64000-memory.dmp	upx
behavioral2/memory/864-117-0x00007FF78DD00000-0x00007FF78E054000-memory.dmp	upx
behavioral2/memory/2624-118-0x00007FF76F830000-0x00007FF76FB84000-memory.dmp	upx
behavioral2/memory/4184-119-0x00007FF71E000000-0x00007FF71E354000-memory.dmp	upx
behavioral2/memory/2240-116-0x00007FF730120000-0x00007FF730474000-memory.dmp	upx
behavioral2/memory/4984-120-0x00007FF6580C0000-0x00007FF658414000-memory.dmp	upx
behavioral2/memory/2252-121-0x00007FF7C7AB0000-0x00007FF7C7E04000-memory.dmp	upx
behavioral2/memory/2180-122-0x00007FF67A9D0000-0x00007FF67AD24000-memory.dmp	upx
behavioral2/memory/3700-123-0x00007FF628A40000-0x00007FF628D94000-memory.dmp	upx
behavioral2/memory/3744-124-0x00007FF636BD0000-0x00007FF636F24000-memory.dmp	upx
behavioral2/memory/2528-125-0x00007FF7D14F0000-0x00007FF7D1844000-memory.dmp	upx
behavioral2/memory/3616-126-0x00007FF7C9890000-0x00007FF7C9BE4000-memory.dmp	upx
behavioral2/memory/2456-127-0x00007FF69AC90000-0x00007FF69AFE4000-memory.dmp	upx
behavioral2/memory/3592-128-0x00007FF67B4C0000-0x00007FF67B814000-memory.dmp	upx
behavioral2/memory/2380-129-0x00007FF7DF000000-0x00007FF7DF354000-memory.dmp	upx
behavioral2/memory/2380-130-0x00007FF7DF000000-0x00007FF7DF354000-memory.dmp	upx
behavioral2/memory/1268-131-0x00007FF7E6A70000-0x00007FF7E6DC4000-memory.dmp	upx
behavioral2/memory/1560-132-0x00007FF775BE0000-0x00007FF775F34000-memory.dmp	upx
behavioral2/memory/1528-133-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp	upx
behavioral2/memory/3368-134-0x00007FF6442E0000-0x00007FF644634000-memory.dmp	upx
behavioral2/memory/512-135-0x00007FF7E96E0000-0x00007FF7E9A34000-memory.dmp	upx
behavioral2/memory/1472-136-0x00007FF69BB00000-0x00007FF69BE54000-memory.dmp	upx
behavioral2/memory/1236-137-0x00007FF704FD0000-0x00007FF705324000-memory.dmp	upx
behavioral2/memory/1068-138-0x00007FF64FB10000-0x00007FF64FE64000-memory.dmp	upx
behavioral2/memory/2240-140-0x00007FF730120000-0x00007FF730474000-memory.dmp	upx
behavioral2/memory/864-139-0x00007FF78DD00000-0x00007FF78E054000-memory.dmp	upx
behavioral2/memory/2252-142-0x00007FF7C7AB0000-0x00007FF7C7E04000-memory.dmp	upx
behavioral2/memory/2624-141-0x00007FF76F830000-0x00007FF76FB84000-memory.dmp	upx
behavioral2/memory/4184-145-0x00007FF71E000000-0x00007FF71E354000-memory.dmp	upx
behavioral2/memory/4984-144-0x00007FF6580C0000-0x00007FF658414000-memory.dmp	upx
behavioral2/memory/2180-143-0x00007FF67A9D0000-0x00007FF67AD24000-memory.dmp	upx
behavioral2/memory/2528-146-0x00007FF7D14F0000-0x00007FF7D1844000-memory.dmp	upx
behavioral2/memory/3744-148-0x00007FF636BD0000-0x00007FF636F24000-memory.dmp	upx
behavioral2/memory/3700-150-0x00007FF628A40000-0x00007FF628D94000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\AVuegPc.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\cAKeYbV.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZHofxwX.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XRZitva.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KrmITbE.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bHMNfco.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\oSIAFPb.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\TIvrXUm.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FOVURqb.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lrPGQLW.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FjKcTIo.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\wmtwiAs.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xnRvASr.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\sHCPDPv.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ttFlTeb.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hjQHIfY.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LpHwkyn.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\xagkThT.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\XxAWNWl.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\opjZznO.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FBZXodq.exe	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 2380	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	84
PID 3592 wrote to memory of 2380	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	84
PID 3592 wrote to memory of 1268	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	85
PID 3592 wrote to memory of 1268	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	85
PID 3592 wrote to memory of 1560	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	86
PID 3592 wrote to memory of 1560	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	86
PID 3592 wrote to memory of 1528	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	87
PID 3592 wrote to memory of 1528	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	87
PID 3592 wrote to memory of 3368	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	88
PID 3592 wrote to memory of 3368	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	88
PID 3592 wrote to memory of 512	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	89
PID 3592 wrote to memory of 512	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	89
PID 3592 wrote to memory of 1472	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	90
PID 3592 wrote to memory of 1472	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	90
PID 3592 wrote to memory of 1236	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	91
PID 3592 wrote to memory of 1236	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	91
PID 3592 wrote to memory of 1068	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	92
PID 3592 wrote to memory of 1068	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	92
PID 3592 wrote to memory of 2240	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	93
PID 3592 wrote to memory of 2240	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	93
PID 3592 wrote to memory of 864	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	94
PID 3592 wrote to memory of 864	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	94
PID 3592 wrote to memory of 2624	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	95
PID 3592 wrote to memory of 2624	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	95
PID 3592 wrote to memory of 4184	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	96
PID 3592 wrote to memory of 4184	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	96
PID 3592 wrote to memory of 4984	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	97
PID 3592 wrote to memory of 4984	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	97
PID 3592 wrote to memory of 2252	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	98
PID 3592 wrote to memory of 2252	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	98
PID 3592 wrote to memory of 2180	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	99
PID 3592 wrote to memory of 2180	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	99
PID 3592 wrote to memory of 3700	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	100
PID 3592 wrote to memory of 3700	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	100
PID 3592 wrote to memory of 3744	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	101
PID 3592 wrote to memory of 3744	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	101
PID 3592 wrote to memory of 2528	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	102
PID 3592 wrote to memory of 2528	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	102
PID 3592 wrote to memory of 3616	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	103
PID 3592 wrote to memory of 3616	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	103
PID 3592 wrote to memory of 2456	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	104
PID 3592 wrote to memory of 2456	3592	2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe	104

C:\Users\Admin\AppData\Local\Temp\2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_84b13258b241ffb19d2c3228b9d2ded6_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\System\FjKcTIo.exe
  C:\Windows\System\FjKcTIo.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\wmtwiAs.exe
  C:\Windows\System\wmtwiAs.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\xagkThT.exe
  C:\Windows\System\xagkThT.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\ZHofxwX.exe
  C:\Windows\System\ZHofxwX.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\xnRvASr.exe
  C:\Windows\System\xnRvASr.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\oSIAFPb.exe
  C:\Windows\System\oSIAFPb.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\XxAWNWl.exe
  C:\Windows\System\XxAWNWl.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\XRZitva.exe
  C:\Windows\System\XRZitva.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\opjZznO.exe
  C:\Windows\System\opjZznO.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\KrmITbE.exe
  C:\Windows\System\KrmITbE.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\bHMNfco.exe
  C:\Windows\System\bHMNfco.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\FBZXodq.exe
  C:\Windows\System\FBZXodq.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\sHCPDPv.exe
  C:\Windows\System\sHCPDPv.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\ttFlTeb.exe
  C:\Windows\System\ttFlTeb.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\hjQHIfY.exe
  C:\Windows\System\hjQHIfY.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\TIvrXUm.exe
  C:\Windows\System\TIvrXUm.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\LpHwkyn.exe
  C:\Windows\System\LpHwkyn.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\FOVURqb.exe
  C:\Windows\System\FOVURqb.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\lrPGQLW.exe
  C:\Windows\System\lrPGQLW.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\AVuegPc.exe
  C:\Windows\System\AVuegPc.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\cAKeYbV.exe
  C:\Windows\System\cAKeYbV.exe
  2⤵
  - Executes dropped EXE
  PID:2456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AVuegPc.exe

Path C:\Windows\System\AVuegPc.exe
Size 5.9MB
SHA256 0c5fdb3db89cae5e9e7c5829d3ae42f69e6b5cef6c08f88b19cd901a7eaf715b
MD5 c126bac5482d89be9a77428a9a6e7ee0
SHA1 616283037b01d19b0c5ea8cf6219adfa83c54eec
SHA512 a793c718fe22cb50620f21ee4ebb5ad268276188980ee0c5712edfcbbe9d6e5d4984e581e4a30916571392d3842d0d194e2658f84ae8956647640f1cbc6b820a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

FBZXodq.exe

Path C:\Windows\System\FBZXodq.exe
Size 5.9MB
SHA256 eccbfdad486aa3906f97ddbda036bf41b61bf614ea66bbb022a5fd52be9757f3
MD5 1cafdc295896839c80faa838f0aec496
SHA1 6025b272ade99fd57328d1c632b86561aa5e0198
SHA512 2cfdd87baf22d233729607f7b9373d408efd77b35d577a81f219a578719d653b79ec73694f979d906e520b077c550fda8dd86d12f735c5cda528122c8c83447d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

FOVURqb.exe

Path C:\Windows\System\FOVURqb.exe
Size 5.9MB
SHA256 d958a3aadcd036eb930481d511c65f117676132632190e9afde7866b17bf4a98
MD5 18eab07e5b385b1a3e9c58d8a27ab528
SHA1 8149415d58d32f6f2b32a38ce18343290afe3d59
SHA512 3d6f56aafcb15bcf6573fc83520e05a84499e14c58a014285a7258a3b52c0f609ee1027050175803ed8929053447de6b968f415691e5bff092e6f74732f4f142
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

FjKcTIo.exe

Path C:\Windows\System\FjKcTIo.exe
Size 5.9MB
SHA256 3aaf97731117a58cc131d38f118d6260a3980fad09e50e58eaa0592d02cbf573
MD5 79201edd9bb31d514e5bf245ef7e078e
SHA1 0f12df8c5ff3419408f2830cc9150908a055a74b
SHA512 b1f97826711f5fc2d3b106b5b9dc8300ed8c4641b79f5f1bd043381b4b9587bfad0a4fbec43d7056dc9dbd4fb6257e20677b4d296e2024b78924b7736e4b685f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

KrmITbE.exe

Path C:\Windows\System\KrmITbE.exe
Size 5.9MB
SHA256 1e313461b66ab658143bb7ac8bd7783924b86f18a422f53ce36251d048b1d2ea
MD5 bc5c99d3213e25acdd5a2eee20535f8a
SHA1 cfad284c54343c5cb5c6c1a06b0e3cd1c8979dc4
SHA512 85b49ce498af576408511f366e2a991fbd0e7171728115167d07a63822f11c810b5e155d63738873c8a4230e95a56d7258c7a435573c818517d97eb2b99b913f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

LpHwkyn.exe

Path C:\Windows\System\LpHwkyn.exe
Size 5.9MB
SHA256 e880a123fedd9f607e15def0705f9d6667932467f8e965aab6ce7a88a1f6848c
MD5 6cb6adeac73f4ac1df4d04361fc6e9dd
SHA1 47bf099939669df73c5b18c72cc00cc7de1c095f
SHA512 021e9de2035d0ad9b55a6dc6126f5b4455b10eba85038dd4c784f753dfbdb81e96ff580051be1ae3d1f129da255d407e2c7c3620e5d11aa2daa8eec8a529a2c0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

TIvrXUm.exe

Path C:\Windows\System\TIvrXUm.exe
Size 5.9MB
SHA256 3b90585bf1970bf620ab4bc9b9deb61e4f236764c629739f4bc806fa2df78906
MD5 7d2b745776c48c9f1b5bc32262cd25c2
SHA1 dfb0871405c45bc0e6afcf53bf05cd257b2cb887
SHA512 c852bec3ec00f334923405d7509d2b3799c9a6323e5ff634004df084a0a074ca0e3a29d52c1550ac866cbfc9580a821bcdab4ab74e892db80b3c856b55336de6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

XRZitva.exe

Path C:\Windows\System\XRZitva.exe
Size 5.9MB
SHA256 bd7de0d5a2121cd49e71e5759af182218ace813f065ccd1bff25ac53f5dc9cc9
MD5 ec9e6eb731f6b28bc7f843e5c7576066
SHA1 4028e252c1ef8478b7ff26c749cdfc62ae51228f
SHA512 3c9da812aeecc2b0c04e856c33e1f4d508f93db4fcbf02c715e77cb0008ecc5598a5ff2295e0c3066dd1e90fc474e936c4b3f568810735e0544a2a8e792e82a5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:Q+856utgpPF8u/7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

XxAWNWl.exe

Path C:\Windows\System\XxAWNWl.exe
Size 5.9MB
SHA256 3d16e0f70b1498159a5232b5d406fd0c233655c7f801eed5fa203ca34a349475
MD5 673d0d3adfacebf9559908cebb6bb420
SHA1 de68d279f4036145d885197633c02303b237154d
SHA512 af325975da19b771353e12e248da10a084d0fa72078a4fca31cffb298630be0ba0280513b53aae28eb664944c2a6dd67e5adcd7c0dac985b39479c57dd3f8c29
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZHofxwX.exe

Path C:\Windows\System\ZHofxwX.exe
Size 5.9MB
SHA256 d29d8a281cf8da1615fc195bf773fbd3f328020d59abbbb5e45ab8dec8fbdb93
MD5 46d5604c6ba4b9947969c379e49c4908
SHA1 e2acaea09b8856bf35bd65eceb6b3b2bd11d85a1
SHA512 053a2fa7c8c53efd3cefd4ebf7e83604c21c0858a52b8045e49cbc6f13ee1d33c5666ead3515de3836c3b6c3478fabd882da4566ead55888751679f52478c97f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

bHMNfco.exe

Path C:\Windows\System\bHMNfco.exe
Size 5.9MB
SHA256 0872d529132a46cbbf0fc5737df432567eb6cdfdcce8a733222ee6d45ce9de93
MD5 b86a2cfed7c882ef0ddbc473967757a8
SHA1 b999628df11a90223c8a568ea188c9ffab55fb48
SHA512 feb65e9f59bf08f6cec43754d4772171b774743c0f1ef7f756cd31f7657fb88c1cb6869a5fc74c0d3eea0f0edd0869a1076eaa31a9f6cc2af30b4720779a421c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:Q+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

cAKeYbV.exe

Path C:\Windows\System\cAKeYbV.exe
Size 5.9MB
SHA256 32c3906d0d865cdad49d2271c5e7ebc4337409ef511ee140ed39faca0ad19976
MD5 f51674e16afb6ed451661041f67d135d
SHA1 cbd6311438e7877712bcc71202c562c93ad02dec
SHA512 afa5590730c4fed328296826e4ca1b329f88a948bd5cf156962bf68248791d74df4bfd78b2fca57267d43d2b54360b97ce77d3eceb631e08ab6916a1e9461cc7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

hjQHIfY.exe

Path C:\Windows\System\hjQHIfY.exe
Size 5.9MB
SHA256 8d830f3d63e37eb80e6c49c4aed67b24589ee37d3957ad1b9e9d6d6842c603f8
MD5 70933f4de15414688b8317fe6ad1ad77
SHA1 b54657364d55ff31c8930c230489c88d077ba783
SHA512 3c63ab3c38648d787c24d9e13b35e1da50c590dfb9a4d3eb3cf6492fdab5f82c52133db1f3cd00e7e203b52bc7b4641d2397945d7cb1f884479cfbc198a1a458
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUp:Q+856utgpPF8u/7p
MD5 SHA1 SHA512 SSDEEP

Submit Download

lrPGQLW.exe

Path C:\Windows\System\lrPGQLW.exe
Size 5.9MB
SHA256 e1d04be41fe08ab5c4b08d13cbcd52d9e42bfe4a8c03dc2eb0826cde39dbf7db
MD5 5348e765325f7eee44fc471f9bc249aa
SHA1 830d74898c817fe85f479b12e0329db2e3a407d6
SHA512 8e3d67c54adbd5fac2c923a7273ee31326de0c4a819d286f2d3188fd2c4d362c1173803b77660ceeb4e080eefa4141963caeaf5caeadd74ec4e36a83a358eca3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

oSIAFPb.exe

Path C:\Windows\System\oSIAFPb.exe
Size 5.9MB
SHA256 565d6bf565e0de0f621e788611f1daf60f1ea2b3a97301666f95451e344f5997
MD5 f2c6d7b6b8b242e96e36c751a404a387
SHA1 1e2c9fa117577b27a8c4c5f2dd94400aae75c322
SHA512 81000b2fa8de455a668bda413c4c63c67195dd1553f5fc44f8921aa290a9c3ac988d0f24323ec214434412849ff173e52959dc613d24be9a3d3081ebe6eb80cc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUZ:Q+856utgpPF8u/7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

opjZznO.exe

Path C:\Windows\System\opjZznO.exe
Size 5.9MB
SHA256 d515432a8d11c1260defc46b1e1940aa0ac8cabe62807ab6b961e96fe48074df
MD5 1d24676f10e1127891d8abaf4f6ac336
SHA1 78b62dc1ecfbe629f09ab079c62f889976ace995
SHA512 7a1701be3d9a4bc934681bfbc062ac360cf9b2bf6ffeb182f6e4a5a653958abca1b06c53bc3f365f045e45cccc27c4c9b34c8af855b85c8bc29226e43616930f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

sHCPDPv.exe

Path C:\Windows\System\sHCPDPv.exe
Size 5.9MB
SHA256 6dda2d24df1fdfd1727f9bddfcc2b5e4f58ac9d5f9c73318228f881151a882a9
MD5 3eb5d9c771f189088abc387318211a69
SHA1 6cf27541727166ef383ae9289e69b3b28d4ed8cb
SHA512 cc5c64b00c7bca61dd61f129cb3225d8c825fede16e289841011260a84ea13685f0ccd33dad3b1264ffcdeda40988e9aee84b3e8375558fe6b4e8019a390f9dc
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

ttFlTeb.exe

Path C:\Windows\System\ttFlTeb.exe
Size 5.9MB
SHA256 faf75aa3b640f8b845bcb799a19a8d12b1a83066f4f3c8802f8c52e1239f2c60
MD5 1ed65d5cd5c697e8f8a9987576f15898
SHA1 fc9946ab103845614dbf0c8ad5d7ad7d3766613a
SHA512 fa1e220bb22a822885eed6479233702d9785c6c2b988ff2860e30b164b5fac9fc7157e5eca6f6c1e128fb16595532a47518d185935e14215579d828c13e391fe
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmtwiAs.exe

Path C:\Windows\System\wmtwiAs.exe
Size 5.9MB
SHA256 7f0c73d1efac9b114f104bdceb9c8a96e40af4d17ea2d886448c2e94dec44c5f
MD5 0b71bc8b98f00c1f87cb54bee2fc6fb2
SHA1 d2abf92e2771a232d9aa1a8fcadfdb0ff4b0f635
SHA512 bcf95bb444947228df6499462ff4d2be267e3dc598ab84b02416d867240961f4ad036ae045c1b28ada30d5a8304f9b1fa9b5c736885862f575421ec53ff1c044
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

xagkThT.exe

Path C:\Windows\System\xagkThT.exe
Size 5.9MB
SHA256 1122c5ddab0d0ed857c49eec6baf488c1d2fb20fb5b526b9c15ef7c4b7537e37
MD5 9e2be0c0601bd00d4fc6d14c40f17ab0
SHA1 a76a7ef98aa0db2aa44f73319fc55f78c5b41fd0
SHA512 7bb0e8d2a8793538fc4bb0d587bc4cefb81a3510ad07450038f91cbfbddab02c067f7497bb8acdbadf4fb201b2da12f8af3c29425a81169f6285e54f01e63498
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

xnRvASr.exe

Path C:\Windows\System\xnRvASr.exe
Size 5.9MB
SHA256 1e4cec97ef1bfcc64d306f67ad45e41c770fcdcdb16d48e427fe6bc20fe3f16e
MD5 2dfd79b5b526baacceab6970dfb06d20
SHA1 56f12c126a077b5dbd49c241bca038aae17f74d9
SHA512 26689f98884ce30b27503cdd11073900992a82a71509f9bac55f12612f757af49c19f3330a222a21dde41b7e9aec0ad47a06f897cf78c0584f5b1cc710c93b65
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUe:Q+856utgpPF8u/7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/512-112-0x00007FF7E96E0000-0x00007FF7E9A34000-memory.dmp

Download

memory/512-135-0x00007FF7E96E0000-0x00007FF7E9A34000-memory.dmp

Download

memory/864-117-0x00007FF78DD00000-0x00007FF78E054000-memory.dmp

Download

memory/864-139-0x00007FF78DD00000-0x00007FF78E054000-memory.dmp

Download

memory/1068-115-0x00007FF64FB10000-0x00007FF64FE64000-memory.dmp

Download

memory/1068-138-0x00007FF64FB10000-0x00007FF64FE64000-memory.dmp

Download

memory/1236-137-0x00007FF704FD0000-0x00007FF705324000-memory.dmp

Download

memory/1236-114-0x00007FF704FD0000-0x00007FF705324000-memory.dmp

Download

memory/1268-14-0x00007FF7E6A70000-0x00007FF7E6DC4000-memory.dmp

Download

memory/1268-131-0x00007FF7E6A70000-0x00007FF7E6DC4000-memory.dmp

Download

memory/1472-113-0x00007FF69BB00000-0x00007FF69BE54000-memory.dmp

Download

memory/1472-136-0x00007FF69BB00000-0x00007FF69BE54000-memory.dmp

Download

memory/1528-133-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp

Download

memory/1528-26-0x00007FF7A3DC0000-0x00007FF7A4114000-memory.dmp

Download

memory/1560-132-0x00007FF775BE0000-0x00007FF775F34000-memory.dmp

Download

memory/1560-21-0x00007FF775BE0000-0x00007FF775F34000-memory.dmp

Download

memory/2180-143-0x00007FF67A9D0000-0x00007FF67AD24000-memory.dmp

Download

memory/2180-122-0x00007FF67A9D0000-0x00007FF67AD24000-memory.dmp

Download

memory/2240-116-0x00007FF730120000-0x00007FF730474000-memory.dmp

Download

memory/2240-140-0x00007FF730120000-0x00007FF730474000-memory.dmp

Download

memory/2252-142-0x00007FF7C7AB0000-0x00007FF7C7E04000-memory.dmp

Download

memory/2252-121-0x00007FF7C7AB0000-0x00007FF7C7E04000-memory.dmp

Download

memory/2380-129-0x00007FF7DF000000-0x00007FF7DF354000-memory.dmp

Download

memory/2380-130-0x00007FF7DF000000-0x00007FF7DF354000-memory.dmp

Download

memory/2380-8-0x00007FF7DF000000-0x00007FF7DF354000-memory.dmp

Download

memory/2456-127-0x00007FF69AC90000-0x00007FF69AFE4000-memory.dmp

Download

memory/2456-149-0x00007FF69AC90000-0x00007FF69AFE4000-memory.dmp

Download

memory/2528-125-0x00007FF7D14F0000-0x00007FF7D1844000-memory.dmp

Download

memory/2528-146-0x00007FF7D14F0000-0x00007FF7D1844000-memory.dmp

Download

memory/2624-141-0x00007FF76F830000-0x00007FF76FB84000-memory.dmp

Download

memory/2624-118-0x00007FF76F830000-0x00007FF76FB84000-memory.dmp

Download

memory/3368-134-0x00007FF6442E0000-0x00007FF644634000-memory.dmp

Download

memory/3368-32-0x00007FF6442E0000-0x00007FF644634000-memory.dmp

Download

memory/3592-1-0x000001FAA4750000-0x000001FAA4760000-memory.dmp

Download

memory/3592-128-0x00007FF67B4C0000-0x00007FF67B814000-memory.dmp

Download

memory/3592-0-0x00007FF67B4C0000-0x00007FF67B814000-memory.dmp

Download

memory/3616-126-0x00007FF7C9890000-0x00007FF7C9BE4000-memory.dmp

Download

memory/3616-147-0x00007FF7C9890000-0x00007FF7C9BE4000-memory.dmp

Download

memory/3700-123-0x00007FF628A40000-0x00007FF628D94000-memory.dmp

Download

memory/3700-150-0x00007FF628A40000-0x00007FF628D94000-memory.dmp

Download

memory/3744-124-0x00007FF636BD0000-0x00007FF636F24000-memory.dmp

Download

memory/3744-148-0x00007FF636BD0000-0x00007FF636F24000-memory.dmp

Download

memory/4184-145-0x00007FF71E000000-0x00007FF71E354000-memory.dmp

Download

memory/4184-119-0x00007FF71E000000-0x00007FF71E354000-memory.dmp

Download

memory/4984-144-0x00007FF6580C0000-0x00007FF658414000-memory.dmp

Download

memory/4984-120-0x00007FF6580C0000-0x00007FF658414000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads