cobaltstrike | a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
Size 5.9MB
Sample240601-jvaafseg2w
SHA256 a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460
MD5 76afd126978e3bad2a81a8e9c07ebc31
SHA1 0249f915bd52649a2166870e66261ccc13fd0184
SHA512 76d134bb500ae5447955a86a163e8eb345b0d14def6dc4542092611e441ea5f3f6801f4e4b9b79d5b4ea7c2c06180900fd48f353328607aeac7d7b566d9a61c0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000022f51-4.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000233ff-10.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023401-20.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023400-23.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023402-33.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023403-37.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023404-41.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023406-50.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023407-58.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023408-62.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023409-74.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340a-76.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023411-107.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023410-113.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023412-124.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340f-112.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340e-110.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340c-98.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340d-96.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002340b-85.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000233fc-51.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/668-0-0x00007FF722AC0000-0x00007FF722E14000-memory.dmp	xmrig
behavioral2/files/0x0008000000022f51-4.dat	xmrig
behavioral2/memory/3016-8-0x00007FF623E90000-0x00007FF6241E4000-memory.dmp	xmrig
behavioral2/files/0x00070000000233ff-10.dat	xmrig
behavioral2/files/0x0007000000023401-20.dat	xmrig
behavioral2/files/0x0007000000023400-23.dat	xmrig
behavioral2/files/0x0007000000023402-33.dat	xmrig
behavioral2/files/0x0007000000023403-37.dat	xmrig
behavioral2/memory/1484-36-0x00007FF729180000-0x00007FF7294D4000-memory.dmp	xmrig
behavioral2/memory/2324-30-0x00007FF721070000-0x00007FF7213C4000-memory.dmp	xmrig
behavioral2/memory/5064-26-0x00007FF756040000-0x00007FF756394000-memory.dmp	xmrig
behavioral2/memory/4472-21-0x00007FF662010000-0x00007FF662364000-memory.dmp	xmrig
behavioral2/memory/224-19-0x00007FF787AF0000-0x00007FF787E44000-memory.dmp	xmrig
behavioral2/files/0x0007000000023404-41.dat	xmrig
behavioral2/memory/2428-42-0x00007FF62D800000-0x00007FF62DB54000-memory.dmp	xmrig
behavioral2/files/0x0007000000023406-50.dat	xmrig
behavioral2/files/0x0007000000023407-58.dat	xmrig
behavioral2/files/0x0007000000023408-62.dat	xmrig
behavioral2/files/0x0007000000023409-74.dat	xmrig
behavioral2/files/0x000700000002340a-76.dat	xmrig
behavioral2/memory/5044-93-0x00007FF74F2E0000-0x00007FF74F634000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-107.dat	xmrig
behavioral2/files/0x0007000000023410-113.dat	xmrig
behavioral2/memory/668-121-0x00007FF722AC0000-0x00007FF722E14000-memory.dmp	xmrig
behavioral2/memory/1184-127-0x00007FF6F9100000-0x00007FF6F9454000-memory.dmp	xmrig
behavioral2/memory/1956-128-0x00007FF6A0D10000-0x00007FF6A1064000-memory.dmp	xmrig
behavioral2/memory/1036-126-0x00007FF6193B0000-0x00007FF619704000-memory.dmp	xmrig
behavioral2/files/0x0007000000023412-124.dat	xmrig
behavioral2/memory/5092-123-0x00007FF623E20000-0x00007FF624174000-memory.dmp	xmrig
behavioral2/memory/2904-122-0x00007FF61AD40000-0x00007FF61B094000-memory.dmp	xmrig
behavioral2/memory/4868-120-0x00007FF6DD460000-0x00007FF6DD7B4000-memory.dmp	xmrig
behavioral2/memory/1600-119-0x00007FF659770000-0x00007FF659AC4000-memory.dmp	xmrig
behavioral2/memory/2580-114-0x00007FF6788F0000-0x00007FF678C44000-memory.dmp	xmrig
behavioral2/files/0x000700000002340f-112.dat	xmrig
behavioral2/files/0x000700000002340e-110.dat	xmrig
behavioral2/memory/4532-108-0x00007FF7960A0000-0x00007FF7963F4000-memory.dmp	xmrig
behavioral2/memory/4792-105-0x00007FF62A920000-0x00007FF62AC74000-memory.dmp	xmrig
behavioral2/files/0x000700000002340c-98.dat	xmrig
behavioral2/files/0x000700000002340d-96.dat	xmrig
behavioral2/files/0x000700000002340b-85.dat	xmrig
behavioral2/memory/2568-64-0x00007FF764960000-0x00007FF764CB4000-memory.dmp	xmrig
behavioral2/memory/1060-59-0x00007FF6309A0000-0x00007FF630CF4000-memory.dmp	xmrig
behavioral2/memory/4776-57-0x00007FF7423D0000-0x00007FF742724000-memory.dmp	xmrig
behavioral2/files/0x00080000000233fc-51.dat	xmrig
behavioral2/memory/224-129-0x00007FF787AF0000-0x00007FF787E44000-memory.dmp	xmrig
behavioral2/memory/4472-130-0x00007FF662010000-0x00007FF662364000-memory.dmp	xmrig
behavioral2/memory/5064-131-0x00007FF756040000-0x00007FF756394000-memory.dmp	xmrig
behavioral2/memory/2324-132-0x00007FF721070000-0x00007FF7213C4000-memory.dmp	xmrig
behavioral2/memory/1484-133-0x00007FF729180000-0x00007FF7294D4000-memory.dmp	xmrig
behavioral2/memory/2428-134-0x00007FF62D800000-0x00007FF62DB54000-memory.dmp	xmrig
behavioral2/memory/2568-135-0x00007FF764960000-0x00007FF764CB4000-memory.dmp	xmrig
behavioral2/memory/5044-136-0x00007FF74F2E0000-0x00007FF74F634000-memory.dmp	xmrig
behavioral2/memory/1600-137-0x00007FF659770000-0x00007FF659AC4000-memory.dmp	xmrig
behavioral2/memory/3016-138-0x00007FF623E90000-0x00007FF6241E4000-memory.dmp	xmrig
behavioral2/memory/224-139-0x00007FF787AF0000-0x00007FF787E44000-memory.dmp	xmrig
behavioral2/memory/4472-140-0x00007FF662010000-0x00007FF662364000-memory.dmp	xmrig
behavioral2/memory/5064-141-0x00007FF756040000-0x00007FF756394000-memory.dmp	xmrig
behavioral2/memory/2324-142-0x00007FF721070000-0x00007FF7213C4000-memory.dmp	xmrig
behavioral2/memory/1484-143-0x00007FF729180000-0x00007FF7294D4000-memory.dmp	xmrig
behavioral2/memory/2428-144-0x00007FF62D800000-0x00007FF62DB54000-memory.dmp	xmrig
behavioral2/memory/4776-145-0x00007FF7423D0000-0x00007FF742724000-memory.dmp	xmrig
behavioral2/memory/1060-146-0x00007FF6309A0000-0x00007FF630CF4000-memory.dmp	xmrig
behavioral2/memory/2568-147-0x00007FF764960000-0x00007FF764CB4000-memory.dmp	xmrig
behavioral2/memory/2904-148-0x00007FF61AD40000-0x00007FF61B094000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3016	XhMEMJV.exe
224	LynGdmX.exe
4472	CGDpPTk.exe
5064	ZxWEQRG.exe
2324	kGiVVCD.exe
1484	TfoqopQ.exe
2428	oxhFMXU.exe
4776	xUnMnxQ.exe
1060	YCEzDDb.exe
2568	DynDPzK.exe
2904	jMwJUqd.exe
5044	WqmfZcN.exe
5092	cLMbUKI.exe
4792	fCTcsmk.exe
4532	uYTPwmv.exe
2580	fqkorfq.exe
1036	hIcwodA.exe
1600	lUKebSW.exe
4868	zZEjaHp.exe
1184	pSGjtXk.exe
1956	LIrHUfP.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/668-0-0x00007FF722AC0000-0x00007FF722E14000-memory.dmp	upx
behavioral2/files/0x0008000000022f51-4.dat	upx
behavioral2/memory/3016-8-0x00007FF623E90000-0x00007FF6241E4000-memory.dmp	upx
behavioral2/files/0x00070000000233ff-10.dat	upx
behavioral2/files/0x0007000000023401-20.dat	upx
behavioral2/files/0x0007000000023400-23.dat	upx
behavioral2/files/0x0007000000023402-33.dat	upx
behavioral2/files/0x0007000000023403-37.dat	upx
behavioral2/memory/1484-36-0x00007FF729180000-0x00007FF7294D4000-memory.dmp	upx
behavioral2/memory/2324-30-0x00007FF721070000-0x00007FF7213C4000-memory.dmp	upx
behavioral2/memory/5064-26-0x00007FF756040000-0x00007FF756394000-memory.dmp	upx
behavioral2/memory/4472-21-0x00007FF662010000-0x00007FF662364000-memory.dmp	upx
behavioral2/memory/224-19-0x00007FF787AF0000-0x00007FF787E44000-memory.dmp	upx
behavioral2/files/0x0007000000023404-41.dat	upx
behavioral2/memory/2428-42-0x00007FF62D800000-0x00007FF62DB54000-memory.dmp	upx
behavioral2/files/0x0007000000023406-50.dat	upx
behavioral2/files/0x0007000000023407-58.dat	upx
behavioral2/files/0x0007000000023408-62.dat	upx
behavioral2/files/0x0007000000023409-74.dat	upx
behavioral2/files/0x000700000002340a-76.dat	upx
behavioral2/memory/5044-93-0x00007FF74F2E0000-0x00007FF74F634000-memory.dmp	upx
behavioral2/files/0x0007000000023411-107.dat	upx
behavioral2/files/0x0007000000023410-113.dat	upx
behavioral2/memory/668-121-0x00007FF722AC0000-0x00007FF722E14000-memory.dmp	upx
behavioral2/memory/1184-127-0x00007FF6F9100000-0x00007FF6F9454000-memory.dmp	upx
behavioral2/memory/1956-128-0x00007FF6A0D10000-0x00007FF6A1064000-memory.dmp	upx
behavioral2/memory/1036-126-0x00007FF6193B0000-0x00007FF619704000-memory.dmp	upx
behavioral2/files/0x0007000000023412-124.dat	upx
behavioral2/memory/5092-123-0x00007FF623E20000-0x00007FF624174000-memory.dmp	upx
behavioral2/memory/2904-122-0x00007FF61AD40000-0x00007FF61B094000-memory.dmp	upx
behavioral2/memory/4868-120-0x00007FF6DD460000-0x00007FF6DD7B4000-memory.dmp	upx
behavioral2/memory/1600-119-0x00007FF659770000-0x00007FF659AC4000-memory.dmp	upx
behavioral2/memory/2580-114-0x00007FF6788F0000-0x00007FF678C44000-memory.dmp	upx
behavioral2/files/0x000700000002340f-112.dat	upx
behavioral2/files/0x000700000002340e-110.dat	upx
behavioral2/memory/4532-108-0x00007FF7960A0000-0x00007FF7963F4000-memory.dmp	upx
behavioral2/memory/4792-105-0x00007FF62A920000-0x00007FF62AC74000-memory.dmp	upx
behavioral2/files/0x000700000002340c-98.dat	upx
behavioral2/files/0x000700000002340d-96.dat	upx
behavioral2/files/0x000700000002340b-85.dat	upx
behavioral2/memory/2568-64-0x00007FF764960000-0x00007FF764CB4000-memory.dmp	upx
behavioral2/memory/1060-59-0x00007FF6309A0000-0x00007FF630CF4000-memory.dmp	upx
behavioral2/memory/4776-57-0x00007FF7423D0000-0x00007FF742724000-memory.dmp	upx
behavioral2/files/0x00080000000233fc-51.dat	upx
behavioral2/memory/224-129-0x00007FF787AF0000-0x00007FF787E44000-memory.dmp	upx
behavioral2/memory/4472-130-0x00007FF662010000-0x00007FF662364000-memory.dmp	upx
behavioral2/memory/5064-131-0x00007FF756040000-0x00007FF756394000-memory.dmp	upx
behavioral2/memory/2324-132-0x00007FF721070000-0x00007FF7213C4000-memory.dmp	upx
behavioral2/memory/1484-133-0x00007FF729180000-0x00007FF7294D4000-memory.dmp	upx
behavioral2/memory/2428-134-0x00007FF62D800000-0x00007FF62DB54000-memory.dmp	upx
behavioral2/memory/2568-135-0x00007FF764960000-0x00007FF764CB4000-memory.dmp	upx
behavioral2/memory/5044-136-0x00007FF74F2E0000-0x00007FF74F634000-memory.dmp	upx
behavioral2/memory/1600-137-0x00007FF659770000-0x00007FF659AC4000-memory.dmp	upx
behavioral2/memory/3016-138-0x00007FF623E90000-0x00007FF6241E4000-memory.dmp	upx
behavioral2/memory/224-139-0x00007FF787AF0000-0x00007FF787E44000-memory.dmp	upx
behavioral2/memory/4472-140-0x00007FF662010000-0x00007FF662364000-memory.dmp	upx
behavioral2/memory/5064-141-0x00007FF756040000-0x00007FF756394000-memory.dmp	upx
behavioral2/memory/2324-142-0x00007FF721070000-0x00007FF7213C4000-memory.dmp	upx
behavioral2/memory/1484-143-0x00007FF729180000-0x00007FF7294D4000-memory.dmp	upx
behavioral2/memory/2428-144-0x00007FF62D800000-0x00007FF62DB54000-memory.dmp	upx
behavioral2/memory/4776-145-0x00007FF7423D0000-0x00007FF742724000-memory.dmp	upx
behavioral2/memory/1060-146-0x00007FF6309A0000-0x00007FF630CF4000-memory.dmp	upx
behavioral2/memory/2568-147-0x00007FF764960000-0x00007FF764CB4000-memory.dmp	upx
behavioral2/memory/2904-148-0x00007FF61AD40000-0x00007FF61B094000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\uYTPwmv.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\XhMEMJV.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\kGiVVCD.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\TfoqopQ.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\jMwJUqd.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\cLMbUKI.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\zZEjaHp.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\ZxWEQRG.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\oxhFMXU.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\WqmfZcN.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\fqkorfq.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\hIcwodA.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\LynGdmX.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\xUnMnxQ.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\YCEzDDb.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\fCTcsmk.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\LIrHUfP.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\CGDpPTk.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\DynDPzK.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\lUKebSW.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
File created	C:\Windows\System\pSGjtXk.exe	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
Token: SeLockMemoryPrivilege	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 3016	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	84
PID 668 wrote to memory of 3016	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	84
PID 668 wrote to memory of 224	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	85
PID 668 wrote to memory of 224	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	85
PID 668 wrote to memory of 4472	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	86
PID 668 wrote to memory of 4472	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	86
PID 668 wrote to memory of 5064	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	87
PID 668 wrote to memory of 5064	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	87
PID 668 wrote to memory of 2324	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	88
PID 668 wrote to memory of 2324	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	88
PID 668 wrote to memory of 1484	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	89
PID 668 wrote to memory of 1484	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	89
PID 668 wrote to memory of 2428	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	90
PID 668 wrote to memory of 2428	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	90
PID 668 wrote to memory of 4776	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	91
PID 668 wrote to memory of 4776	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	91
PID 668 wrote to memory of 1060	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	92
PID 668 wrote to memory of 1060	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	92
PID 668 wrote to memory of 2568	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	93
PID 668 wrote to memory of 2568	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	93
PID 668 wrote to memory of 2904	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	94
PID 668 wrote to memory of 2904	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	94
PID 668 wrote to memory of 5044	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	95
PID 668 wrote to memory of 5044	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	95
PID 668 wrote to memory of 5092	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	96
PID 668 wrote to memory of 5092	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	96
PID 668 wrote to memory of 4792	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	97
PID 668 wrote to memory of 4792	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	97
PID 668 wrote to memory of 4532	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	98
PID 668 wrote to memory of 4532	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	98
PID 668 wrote to memory of 2580	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	99
PID 668 wrote to memory of 2580	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	99
PID 668 wrote to memory of 1036	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	100
PID 668 wrote to memory of 1036	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	100
PID 668 wrote to memory of 1600	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	101
PID 668 wrote to memory of 1600	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	101
PID 668 wrote to memory of 4868	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	102
PID 668 wrote to memory of 4868	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	102
PID 668 wrote to memory of 1184	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	103
PID 668 wrote to memory of 1184	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	103
PID 668 wrote to memory of 1956	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	104
PID 668 wrote to memory of 1956	668	a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe	104

C:\Users\Admin\AppData\Local\Temp\a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe
"C:\Users\Admin\AppData\Local\Temp\a1ea4248d6ec9c946b53c6976251423e398f6577839f86a1f52e5b765699b460.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:668
- C:\Windows\System\XhMEMJV.exe
  C:\Windows\System\XhMEMJV.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\LynGdmX.exe
  C:\Windows\System\LynGdmX.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\CGDpPTk.exe
  C:\Windows\System\CGDpPTk.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\ZxWEQRG.exe
  C:\Windows\System\ZxWEQRG.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\kGiVVCD.exe
  C:\Windows\System\kGiVVCD.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\TfoqopQ.exe
  C:\Windows\System\TfoqopQ.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\oxhFMXU.exe
  C:\Windows\System\oxhFMXU.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\xUnMnxQ.exe
  C:\Windows\System\xUnMnxQ.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\YCEzDDb.exe
  C:\Windows\System\YCEzDDb.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\DynDPzK.exe
  C:\Windows\System\DynDPzK.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\jMwJUqd.exe
  C:\Windows\System\jMwJUqd.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\WqmfZcN.exe
  C:\Windows\System\WqmfZcN.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\cLMbUKI.exe
  C:\Windows\System\cLMbUKI.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\fCTcsmk.exe
  C:\Windows\System\fCTcsmk.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\uYTPwmv.exe
  C:\Windows\System\uYTPwmv.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\fqkorfq.exe
  C:\Windows\System\fqkorfq.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\hIcwodA.exe
  C:\Windows\System\hIcwodA.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\lUKebSW.exe
  C:\Windows\System\lUKebSW.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\zZEjaHp.exe
  C:\Windows\System\zZEjaHp.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\pSGjtXk.exe
  C:\Windows\System\pSGjtXk.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\LIrHUfP.exe
  C:\Windows\System\LIrHUfP.exe
  2⤵
  - Executes dropped EXE
  PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CGDpPTk.exe

Path C:\Windows\System\CGDpPTk.exe
Size 5.9MB
SHA256 e8cf8ab5a07a28da8bd64bb88c95b20fa8cafa9f340ce0e53dcaeb438ab9dae2
MD5 ec455ec3b40e55f3d70d4942674bd6d8
SHA1 3c1e8c13cb1807620efb1c23b9c8208919fbe211
SHA512 40ce553526e46dcff0d7ea0e685ae5d98370662c39ce30b74423b0eae2f1ef7383dc2f45202d3d05cb201ecc431c92f59b8b4bcb9f5edfc8eb391b50db673b28
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUw:Q+856utgpPF8u/7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

DynDPzK.exe

Path C:\Windows\System\DynDPzK.exe
Size 5.9MB
SHA256 798a9a0ab38d38b431d9a35b3f9adac36b13df43f33c7550002de94b59cbfad9
MD5 24ce87b5923640e79dbcd4b8aa7dc379
SHA1 855c0373a285b148cb755998983894c7927a3a0d
SHA512 4141efccc0d173a27bba5db8373da0c8bb929a778e7f08da9a8ee761784e53842a30b76c397f75013bf604830435c4fe2885f90dd5e20e02931151cf104bad05
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

LIrHUfP.exe

Path C:\Windows\System\LIrHUfP.exe
Size 5.9MB
SHA256 764f6b3aa7f7278f1e0b9b532261221c770834be1729c1e73d5e39abb100e655
MD5 24e2159a1eef3e310502ae3b89b6dd7c
SHA1 de8d78d51c3a882bf430ef33c4a2237efa2000e8
SHA512 f58e392fd1ea29625766b731508b534eabec4640358c17e760107633941ffaddcc204d806a6de897b1aaf5e8ff5c9649dd1a66d693801273ead70b501effe69e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUF:Q+856utgpPF8u/7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

LynGdmX.exe

Path C:\Windows\System\LynGdmX.exe
Size 5.9MB
SHA256 fcbd5f34186b6f419b64f6eeedf3d375edd41760b5cce1f5c0687b58c3e51655
MD5 6e98bf200e05462e4fb227966a54ae33
SHA1 2f6e4a5e71caf24cb6d57b7ad9a9f613641411c1
SHA512 6fc1019df906e5103b1b54c1d1bd29110675891e72dc08f74dbb771e035ada355b8e807aa3de5ea467ce222d7e1a4f57d99671798825ca61dd03c6b438601af2
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

TfoqopQ.exe

Path C:\Windows\System\TfoqopQ.exe
Size 5.9MB
SHA256 48655dc68912813f7a378ebfcf131e3517383ee845fb9b228b1fc7b0eac3d5c7
MD5 fe026ddb0b7fb81db7711c607c432017
SHA1 8785c191f6573542bef299ea6f6048c61996847b
SHA512 436c1913eb4a677aedfa6a1c8305191ec516468eefaa840a1f02bc69b4f995ae6294f4093cb7b8140e1d722aa1ceb9b8db3c57b2ef1d99aa60e240ca1614c835
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

WqmfZcN.exe

Path C:\Windows\System\WqmfZcN.exe
Size 5.9MB
SHA256 5f83f7ac9998012d5b59d574b213c8ea9528428361e969d6570b8f1c56a5c6a8
MD5 ef6e82236ef21f40ba20666d1070d608
SHA1 e1ec607b93707573e20393d419e83aad020c90b5
SHA512 c66dca47943b7b3a85551b80612339493865c9ce01eb3dea6120466e330508746616af40be161c204e6e4747db6f4d69d0f14599a210db3b5040474aa6e542b5
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

XhMEMJV.exe

Path C:\Windows\System\XhMEMJV.exe
Size 5.9MB
SHA256 a1a3ba87266187c08e13c09b3fea11186f6d615c09d02a06b2f592bcb92e22f2
MD5 4428f349f3bcfedd5c226f186649c0a4
SHA1 0ea3ceacd4f4bb562d756ef160593b0780cf2b3a
SHA512 d6d4ff8168089ad223845247f618902c18d2dcf653673b433ad4fdc9ac7cfd0528568dc3e1fd461741dc087023b7a55d226df9154b744efe36bd83f50ce99d65
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

YCEzDDb.exe

Path C:\Windows\System\YCEzDDb.exe
Size 5.9MB
SHA256 0ea5b35dbd7bc5e1d9ab62fdb20a6a72dd62c054071a74b9ed28455a4d18b1bf
MD5 b62914619d5ab29baf65e2a1212538d1
SHA1 3e68e7161288bac100ed9ec31884e55e19a8ef72
SHA512 62cf7edaba0432c4fc0a6a8a3b88fcb09eac56a728307d4f99e194daa93dfd93b71e003b21df460708bf3d63f92bc22cb15c7643ffbacf4723f1ff5ae311de39
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZxWEQRG.exe

Path C:\Windows\System\ZxWEQRG.exe
Size 5.9MB
SHA256 72e0bc9e0c92813164a7c19049a986ce4ead1fd4b45f5b3345ac7913034c5ead
MD5 666f1d6fc6dda484be31704c47c36377
SHA1 95a6f93e57befbab3c5440f7586a61def51e7458
SHA512 b3078d7979a8ade5bca8385c676b5e52e84e5903c984a382028b1b2fd4eb07b461fc13a3980062c01290d16c1c91b09d2282f0e316b7e721bbe31294a7d00486
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

cLMbUKI.exe

Path C:\Windows\System\cLMbUKI.exe
Size 5.9MB
SHA256 bc79a5759be2392229febd8103faa3f37926d59973c1fea028c737cd02dfcf4e
MD5 0db7ef6680f114486bf65c650935b849
SHA1 c7a2018863d03bea1b8cdb81e1501c8b842269a6
SHA512 f5dcc2346d89748b67b15f76a50f0cfb0276038b53bb7bb1b465852f2f8de27843420ce8e6a5a1495a24f1e4c441a918b73aff3f46818db5da83d98dd602879e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

fCTcsmk.exe

Path C:\Windows\System\fCTcsmk.exe
Size 5.9MB
SHA256 657d2e359936495484b39285123555f2201ca04bd0f0a9a4cbde6500cd6e2d70
MD5 f04ba567b1415b9dbdec3800233092df
SHA1 aee37f14150d3c35b04b2381f64527562da79a9c
SHA512 c33e81becac34347f628eb6b83246af9bd29b0992cfc7bad975ca62fd471bbad52bb99f086423ce2b5ff5db2805cd6c98da627d36958ac79aa39cb2d5654500f
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

fqkorfq.exe

Path C:\Windows\System\fqkorfq.exe
Size 5.9MB
SHA256 6176682cf03468860e96b52b72dfd69654f680809cbc851fb25419531ccaf358
MD5 6bd4d13159c29a7faa0c2359ab927a6b
SHA1 e0428936b74d28e56d5d707d174601675815c2b7
SHA512 9f81a3f989087396f7135dba0d23352cf8dd1a2061a568c414d159e43ba0af159990611762520363f92a11b58bed2564c6028b7711264b4be34c66825af9b109
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:Q+856utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

hIcwodA.exe

Path C:\Windows\System\hIcwodA.exe
Size 5.9MB
SHA256 80fe67420ab8ec0ea3e1b659e67e43be1584771d1ea8cd2542b49b052d88e811
MD5 c27d55378fc58597e9acb56da42de778
SHA1 6881944afebec77921f574ef62d04c6bad085446
SHA512 73fba597ab599176604b62a16fafd447af505b991c783506b16d88facf652876e82cf5c49a93241908be3e96ad61e8fac53d7442346a0aaf1231bdf469c2f962
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:Q+856utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

jMwJUqd.exe

Path C:\Windows\System\jMwJUqd.exe
Size 5.9MB
SHA256 7399a16ad6cf5666ba3791105ad0c8c9fa5c5795522eb71d490e6d9016239417
MD5 6aceb2771342f021992ca96096ab92f2
SHA1 32081b5960cd8b909be9b419f869a30815de79dc
SHA512 a62a933de21126d4a9ed4088f95707735ac5b3ba8a62fa9567fdecf4b8ca5b72e30e366d2e18a92be0cb1d21d7b9ad400af4fad6310de273bfb7a03902003288
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

kGiVVCD.exe

Path C:\Windows\System\kGiVVCD.exe
Size 5.9MB
SHA256 359d63827d05bbd34e46b5c281c3112dfcc59818c84f9b0c11f2116b69eee76e
MD5 cdb4080aaf9494288fee03408a925579
SHA1 b6c13b6911822e46db15998984d2644ce0e9f167
SHA512 f0f06e1923fa01e9f3e136937c50f606fd3d723b83b859b0940ad41172d715198d72e4aeb4b31f2c84fb49cd92fbbb1eae68c4f2bc5622b8f5205cff5260a0e3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

lUKebSW.exe

Path C:\Windows\System\lUKebSW.exe
Size 5.9MB
SHA256 43938a27c3b94497444f7375360d96e76d7fca4933280757f1727c83f53e2581
MD5 19fc56cef76b96919e1e12a7ec97f7a5
SHA1 b3ac2cf72bc3d6d260ad21dde57e87e6dde70975
SHA512 cfa5f3d972f916a77959e7ef14724d4bf3e4cdb1e170191e958b65765bf78f8c1a9576b391597f04b167280762dfb4383ad02d34166b2fe1ccca87e0b6a57feb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

oxhFMXU.exe

Path C:\Windows\System\oxhFMXU.exe
Size 5.9MB
SHA256 24c844ffa9d7e1e252da1d3abffc8722093c57c00dd98df166bc24ed174150f2
MD5 02bb371e4611d92839ba11bbc71fa784
SHA1 80940dec226b824384d1eac61dd3530e863079a2
SHA512 e72e6168fcba211a35b6215686d329779e45d38e3d39ae98ee0be276c0939a6627b7562faf93d1563840ce9528823104197463baf67074198cefbdeef8fcf680
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

pSGjtXk.exe

Path C:\Windows\System\pSGjtXk.exe
Size 5.9MB
SHA256 2083af36f9e1b0ebbb40c87f679cd6e9c8a9f314a0a83528909e7aa05560e402
MD5 7a7334045611d10b5fce873a5c3bba3e
SHA1 b4556c66abf9164730920950378de11fd5b21b7c
SHA512 6de66b8f3668afd543c3d4d865fb884543926860a8b6aa441c723f767bffb1fb3cdc33801f8404e4fd46b1058e380a550aae3afe95feeb626f1f757c42467337
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:Q+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

uYTPwmv.exe

Path C:\Windows\System\uYTPwmv.exe
Size 5.9MB
SHA256 9abbcb4d80a907d4c5b8830234be778081a7051c8f7f6a1c1566206a525d263a
MD5 060c9fa9836472850a909aff1d76dde1
SHA1 8e1203ccf6096e6130cf1d83238fc863af42757a
SHA512 836a60c75bca3094b7a2d93c1d4efa3d77c7ffb5899a85cae3b58d16a608d4bfaa414e4732138c361852b20ac1242809f87b7e61a7f992917b8fa3c0113d396a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:Q+856utgpPF8u/7R
MD5 SHA1 SHA512 SSDEEP

Submit Download

xUnMnxQ.exe

Path C:\Windows\System\xUnMnxQ.exe
Size 5.9MB
SHA256 7bdc1ba3103eab5d39c17d5d18edb9dee1d93e5fe18ba1230857b6cafe23a2b3
MD5 136b53e90352f9ec74d1bf6dd7fb053f
SHA1 b38a5e587afc62c387de4280c19a6d8447c40aad
SHA512 fee5df384e77d78fe9f9998b38f3f7a2c83dc60aabf7053ed468e6548c570b880651d15ed10e6989c0d5381a7b15ab85281eb7ae36de76732461e194477798ad
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUu:Q+856utgpPF8u/7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

zZEjaHp.exe

Path C:\Windows\System\zZEjaHp.exe
Size 5.9MB
SHA256 0a30bb4363276ab4c49aaf577b3cf82f06e9235ef4789c66386f9dc65c15028f
MD5 a05194d4cfcf7d4a611424f66040f8f4
SHA1 783c42097e7da37e428045712378b1bf1e62c566
SHA512 c4e7ba1424a54a7718f6a858ee0ad8eb02ac10aadd3e33b88bd3a2496129ca665a696e3054d0c5de37af449b5cd7e2dee16c337f9c3011716ae96a0af06a8e3a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUS:Q+856utgpPF8u/7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-19-0x00007FF787AF0000-0x00007FF787E44000-memory.dmp

Download

memory/224-139-0x00007FF787AF0000-0x00007FF787E44000-memory.dmp

Download

memory/224-129-0x00007FF787AF0000-0x00007FF787E44000-memory.dmp

Download

memory/668-0-0x00007FF722AC0000-0x00007FF722E14000-memory.dmp

Download

memory/668-121-0x00007FF722AC0000-0x00007FF722E14000-memory.dmp

Download

memory/668-1-0x000001EE271E0000-0x000001EE271F0000-memory.dmp

Download

memory/1036-126-0x00007FF6193B0000-0x00007FF619704000-memory.dmp

Download

memory/1036-155-0x00007FF6193B0000-0x00007FF619704000-memory.dmp

Download

memory/1060-59-0x00007FF6309A0000-0x00007FF630CF4000-memory.dmp

Download

memory/1060-146-0x00007FF6309A0000-0x00007FF630CF4000-memory.dmp

Download

memory/1184-127-0x00007FF6F9100000-0x00007FF6F9454000-memory.dmp

Download

memory/1184-157-0x00007FF6F9100000-0x00007FF6F9454000-memory.dmp

Download

memory/1484-133-0x00007FF729180000-0x00007FF7294D4000-memory.dmp

Download

memory/1484-143-0x00007FF729180000-0x00007FF7294D4000-memory.dmp

Download

memory/1484-36-0x00007FF729180000-0x00007FF7294D4000-memory.dmp

Download

memory/1600-137-0x00007FF659770000-0x00007FF659AC4000-memory.dmp

Download

memory/1600-154-0x00007FF659770000-0x00007FF659AC4000-memory.dmp

Download

memory/1600-119-0x00007FF659770000-0x00007FF659AC4000-memory.dmp

Download

memory/1956-158-0x00007FF6A0D10000-0x00007FF6A1064000-memory.dmp

Download

memory/1956-128-0x00007FF6A0D10000-0x00007FF6A1064000-memory.dmp

Download

memory/2324-30-0x00007FF721070000-0x00007FF7213C4000-memory.dmp

Download

memory/2324-142-0x00007FF721070000-0x00007FF7213C4000-memory.dmp

Download

memory/2324-132-0x00007FF721070000-0x00007FF7213C4000-memory.dmp

Download

memory/2428-42-0x00007FF62D800000-0x00007FF62DB54000-memory.dmp

Download

memory/2428-144-0x00007FF62D800000-0x00007FF62DB54000-memory.dmp

Download

memory/2428-134-0x00007FF62D800000-0x00007FF62DB54000-memory.dmp

Download

memory/2568-64-0x00007FF764960000-0x00007FF764CB4000-memory.dmp

Download

memory/2568-147-0x00007FF764960000-0x00007FF764CB4000-memory.dmp

Download

memory/2568-135-0x00007FF764960000-0x00007FF764CB4000-memory.dmp

Download

memory/2580-153-0x00007FF6788F0000-0x00007FF678C44000-memory.dmp

Download

memory/2580-114-0x00007FF6788F0000-0x00007FF678C44000-memory.dmp

Download

memory/2904-148-0x00007FF61AD40000-0x00007FF61B094000-memory.dmp

Download

memory/2904-122-0x00007FF61AD40000-0x00007FF61B094000-memory.dmp

Download

memory/3016-8-0x00007FF623E90000-0x00007FF6241E4000-memory.dmp

Download

memory/3016-138-0x00007FF623E90000-0x00007FF6241E4000-memory.dmp

Download

memory/4472-140-0x00007FF662010000-0x00007FF662364000-memory.dmp

Download

memory/4472-21-0x00007FF662010000-0x00007FF662364000-memory.dmp

Download

memory/4472-130-0x00007FF662010000-0x00007FF662364000-memory.dmp

Download

memory/4532-152-0x00007FF7960A0000-0x00007FF7963F4000-memory.dmp

Download

memory/4532-108-0x00007FF7960A0000-0x00007FF7963F4000-memory.dmp

Download

memory/4776-145-0x00007FF7423D0000-0x00007FF742724000-memory.dmp

Download

memory/4776-57-0x00007FF7423D0000-0x00007FF742724000-memory.dmp

Download

memory/4792-105-0x00007FF62A920000-0x00007FF62AC74000-memory.dmp

Download

memory/4792-151-0x00007FF62A920000-0x00007FF62AC74000-memory.dmp

Download

memory/4868-120-0x00007FF6DD460000-0x00007FF6DD7B4000-memory.dmp

Download

memory/4868-156-0x00007FF6DD460000-0x00007FF6DD7B4000-memory.dmp

Download

memory/5044-149-0x00007FF74F2E0000-0x00007FF74F634000-memory.dmp

Download

memory/5044-93-0x00007FF74F2E0000-0x00007FF74F634000-memory.dmp

Download

memory/5044-136-0x00007FF74F2E0000-0x00007FF74F634000-memory.dmp

Download

memory/5064-131-0x00007FF756040000-0x00007FF756394000-memory.dmp

Download

memory/5064-26-0x00007FF756040000-0x00007FF756394000-memory.dmp

Download

memory/5064-141-0x00007FF756040000-0x00007FF756394000-memory.dmp

Download

memory/5092-150-0x00007FF623E20000-0x00007FF624174000-memory.dmp

Download

memory/5092-123-0x00007FF623E20000-0x00007FF624174000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads