cobaltstrike | ec6a7e7199b886763c8cd0e06570dfd130b8a80087d2d76ed9590b3209f2b1ec

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-kc94ssfd4v
SHA256 ec6a7e7199b886763c8cd0e06570dfd130b8a80087d2d76ed9590b3209f2b1ec
MD5 b1ad8f3ab7a101dbeea8736cb7eafb6c
SHA1 28893da12138d6ccb76894530f91c23d155ad896
SHA512 e82f9f64d8794ffb93bb6758f3cbc0ebbfecb638c32e9a5e223fac2c6d253502f5aeb6c14ef117cacbbe492b1ca1cb03a732c0669a4ffd9e32b3761f322d956e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023262-4.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023269-10.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023266-11.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326a-23.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326b-28.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326c-36.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326d-41.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002326f-47.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023271-51.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023272-58.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023273-66.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023274-77.dat	cobalt_reflective_dll
behavioral2/files/0x000a00000001ea83-72.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023275-82.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023276-88.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023277-93.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023278-98.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023279-103.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002327a-108.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002327c-114.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002327b-115.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023262-4.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023269-10.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023266-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326a-23.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326b-28.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326c-36.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326d-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002326f-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023271-51.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023272-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023273-66.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023274-77.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a00000001ea83-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023275-82.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023276-88.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023277-93.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023278-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023279-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002327a-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002327c-114.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002327b-115.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2260-0-0x00007FF6E0910000-0x00007FF6E0C64000-memory.dmp	UPX
behavioral2/files/0x0008000000023262-4.dat	UPX
behavioral2/memory/2056-7-0x00007FF72CA50000-0x00007FF72CDA4000-memory.dmp	UPX
behavioral2/files/0x0007000000023269-10.dat	UPX
behavioral2/files/0x0008000000023266-11.dat	UPX
behavioral2/memory/532-16-0x00007FF78E810000-0x00007FF78EB64000-memory.dmp	UPX
behavioral2/memory/4972-20-0x00007FF77C5A0000-0x00007FF77C8F4000-memory.dmp	UPX
behavioral2/files/0x000700000002326a-23.dat	UPX
behavioral2/memory/4148-26-0x00007FF775480000-0x00007FF7757D4000-memory.dmp	UPX
behavioral2/files/0x000700000002326b-28.dat	UPX
behavioral2/files/0x000700000002326c-36.dat	UPX
behavioral2/memory/2016-38-0x00007FF6432B0000-0x00007FF643604000-memory.dmp	UPX
behavioral2/memory/1204-34-0x00007FF66B720000-0x00007FF66BA74000-memory.dmp	UPX
behavioral2/files/0x000700000002326d-41.dat	UPX
behavioral2/files/0x000700000002326f-47.dat	UPX
behavioral2/memory/5152-46-0x00007FF797190000-0x00007FF7974E4000-memory.dmp	UPX
behavioral2/files/0x0007000000023271-51.dat	UPX
behavioral2/memory/5452-49-0x00007FF69A380000-0x00007FF69A6D4000-memory.dmp	UPX
behavioral2/memory/5756-56-0x00007FF6CE860000-0x00007FF6CEBB4000-memory.dmp	UPX
behavioral2/files/0x0007000000023272-58.dat	UPX
behavioral2/memory/2260-60-0x00007FF6E0910000-0x00007FF6E0C64000-memory.dmp	UPX
behavioral2/memory/5352-62-0x00007FF6B6F80000-0x00007FF6B72D4000-memory.dmp	UPX
behavioral2/files/0x0007000000023273-66.dat	UPX
behavioral2/memory/2056-73-0x00007FF72CA50000-0x00007FF72CDA4000-memory.dmp	UPX
behavioral2/files/0x0008000000023274-77.dat	UPX
behavioral2/files/0x000a00000001ea83-72.dat	UPX
behavioral2/files/0x0007000000023275-82.dat	UPX
behavioral2/files/0x0007000000023276-88.dat	UPX
behavioral2/files/0x0007000000023277-93.dat	UPX
behavioral2/files/0x0007000000023278-98.dat	UPX
behavioral2/files/0x0007000000023279-103.dat	UPX
behavioral2/files/0x000700000002327a-108.dat	UPX
behavioral2/files/0x000700000002327c-114.dat	UPX
behavioral2/files/0x000700000002327b-115.dat	UPX
behavioral2/memory/5376-119-0x00007FF605690000-0x00007FF6059E4000-memory.dmp	UPX
behavioral2/memory/1716-120-0x00007FF676380000-0x00007FF6766D4000-memory.dmp	UPX
behavioral2/memory/4640-121-0x00007FF7CD800000-0x00007FF7CDB54000-memory.dmp	UPX
behavioral2/memory/5924-122-0x00007FF7A0DB0000-0x00007FF7A1104000-memory.dmp	UPX
behavioral2/memory/5928-123-0x00007FF6A1A70000-0x00007FF6A1DC4000-memory.dmp	UPX
behavioral2/memory/5976-124-0x00007FF7384C0000-0x00007FF738814000-memory.dmp	UPX
behavioral2/memory/4956-125-0x00007FF672BB0000-0x00007FF672F04000-memory.dmp	UPX
behavioral2/memory/5484-126-0x00007FF770700000-0x00007FF770A54000-memory.dmp	UPX
behavioral2/memory/5520-127-0x00007FF6EA0C0000-0x00007FF6EA414000-memory.dmp	UPX
behavioral2/memory/5324-128-0x00007FF66E9F0000-0x00007FF66ED44000-memory.dmp	UPX
behavioral2/memory/532-129-0x00007FF78E810000-0x00007FF78EB64000-memory.dmp	UPX
behavioral2/memory/4676-130-0x00007FF7B1F70000-0x00007FF7B22C4000-memory.dmp	UPX
behavioral2/memory/4972-131-0x00007FF77C5A0000-0x00007FF77C8F4000-memory.dmp	UPX
behavioral2/memory/4148-132-0x00007FF775480000-0x00007FF7757D4000-memory.dmp	UPX
behavioral2/memory/5452-133-0x00007FF69A380000-0x00007FF69A6D4000-memory.dmp	UPX
behavioral2/memory/5352-134-0x00007FF6B6F80000-0x00007FF6B72D4000-memory.dmp	UPX
behavioral2/memory/2056-135-0x00007FF72CA50000-0x00007FF72CDA4000-memory.dmp	UPX
behavioral2/memory/532-136-0x00007FF78E810000-0x00007FF78EB64000-memory.dmp	UPX
behavioral2/memory/4972-137-0x00007FF77C5A0000-0x00007FF77C8F4000-memory.dmp	UPX
behavioral2/memory/1204-138-0x00007FF66B720000-0x00007FF66BA74000-memory.dmp	UPX
behavioral2/memory/4148-139-0x00007FF775480000-0x00007FF7757D4000-memory.dmp	UPX
behavioral2/memory/2016-140-0x00007FF6432B0000-0x00007FF643604000-memory.dmp	UPX
behavioral2/memory/5152-141-0x00007FF797190000-0x00007FF7974E4000-memory.dmp	UPX
behavioral2/memory/5452-142-0x00007FF69A380000-0x00007FF69A6D4000-memory.dmp	UPX
behavioral2/memory/5756-143-0x00007FF6CE860000-0x00007FF6CEBB4000-memory.dmp	UPX
behavioral2/memory/5352-144-0x00007FF6B6F80000-0x00007FF6B72D4000-memory.dmp	UPX
behavioral2/memory/5376-145-0x00007FF605690000-0x00007FF6059E4000-memory.dmp	UPX
behavioral2/memory/5324-146-0x00007FF66E9F0000-0x00007FF66ED44000-memory.dmp	UPX
behavioral2/memory/4676-147-0x00007FF7B1F70000-0x00007FF7B22C4000-memory.dmp	UPX
behavioral2/memory/1716-148-0x00007FF676380000-0x00007FF6766D4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2260-0-0x00007FF6E0910000-0x00007FF6E0C64000-memory.dmp	xmrig
behavioral2/files/0x0008000000023262-4.dat	xmrig
behavioral2/memory/2056-7-0x00007FF72CA50000-0x00007FF72CDA4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023269-10.dat	xmrig
behavioral2/files/0x0008000000023266-11.dat	xmrig
behavioral2/memory/532-16-0x00007FF78E810000-0x00007FF78EB64000-memory.dmp	xmrig
behavioral2/memory/4972-20-0x00007FF77C5A0000-0x00007FF77C8F4000-memory.dmp	xmrig
behavioral2/files/0x000700000002326a-23.dat	xmrig
behavioral2/memory/4148-26-0x00007FF775480000-0x00007FF7757D4000-memory.dmp	xmrig
behavioral2/files/0x000700000002326b-28.dat	xmrig
behavioral2/files/0x000700000002326c-36.dat	xmrig
behavioral2/memory/2016-38-0x00007FF6432B0000-0x00007FF643604000-memory.dmp	xmrig
behavioral2/memory/1204-34-0x00007FF66B720000-0x00007FF66BA74000-memory.dmp	xmrig
behavioral2/files/0x000700000002326d-41.dat	xmrig
behavioral2/files/0x000700000002326f-47.dat	xmrig
behavioral2/memory/5152-46-0x00007FF797190000-0x00007FF7974E4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023271-51.dat	xmrig
behavioral2/memory/5452-49-0x00007FF69A380000-0x00007FF69A6D4000-memory.dmp	xmrig
behavioral2/memory/5756-56-0x00007FF6CE860000-0x00007FF6CEBB4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023272-58.dat	xmrig
behavioral2/memory/2260-60-0x00007FF6E0910000-0x00007FF6E0C64000-memory.dmp	xmrig
behavioral2/memory/5352-62-0x00007FF6B6F80000-0x00007FF6B72D4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023273-66.dat	xmrig
behavioral2/memory/2056-73-0x00007FF72CA50000-0x00007FF72CDA4000-memory.dmp	xmrig
behavioral2/files/0x0008000000023274-77.dat	xmrig
behavioral2/files/0x000a00000001ea83-72.dat	xmrig
behavioral2/files/0x0007000000023275-82.dat	xmrig
behavioral2/files/0x0007000000023276-88.dat	xmrig
behavioral2/files/0x0007000000023277-93.dat	xmrig
behavioral2/files/0x0007000000023278-98.dat	xmrig
behavioral2/files/0x0007000000023279-103.dat	xmrig
behavioral2/files/0x000700000002327a-108.dat	xmrig
behavioral2/files/0x000700000002327c-114.dat	xmrig
behavioral2/files/0x000700000002327b-115.dat	xmrig
behavioral2/memory/5376-119-0x00007FF605690000-0x00007FF6059E4000-memory.dmp	xmrig
behavioral2/memory/1716-120-0x00007FF676380000-0x00007FF6766D4000-memory.dmp	xmrig
behavioral2/memory/4640-121-0x00007FF7CD800000-0x00007FF7CDB54000-memory.dmp	xmrig
behavioral2/memory/5924-122-0x00007FF7A0DB0000-0x00007FF7A1104000-memory.dmp	xmrig
behavioral2/memory/5928-123-0x00007FF6A1A70000-0x00007FF6A1DC4000-memory.dmp	xmrig
behavioral2/memory/5976-124-0x00007FF7384C0000-0x00007FF738814000-memory.dmp	xmrig
behavioral2/memory/4956-125-0x00007FF672BB0000-0x00007FF672F04000-memory.dmp	xmrig
behavioral2/memory/5484-126-0x00007FF770700000-0x00007FF770A54000-memory.dmp	xmrig
behavioral2/memory/5520-127-0x00007FF6EA0C0000-0x00007FF6EA414000-memory.dmp	xmrig
behavioral2/memory/5324-128-0x00007FF66E9F0000-0x00007FF66ED44000-memory.dmp	xmrig
behavioral2/memory/532-129-0x00007FF78E810000-0x00007FF78EB64000-memory.dmp	xmrig
behavioral2/memory/4676-130-0x00007FF7B1F70000-0x00007FF7B22C4000-memory.dmp	xmrig
behavioral2/memory/4972-131-0x00007FF77C5A0000-0x00007FF77C8F4000-memory.dmp	xmrig
behavioral2/memory/4148-132-0x00007FF775480000-0x00007FF7757D4000-memory.dmp	xmrig
behavioral2/memory/5452-133-0x00007FF69A380000-0x00007FF69A6D4000-memory.dmp	xmrig
behavioral2/memory/5352-134-0x00007FF6B6F80000-0x00007FF6B72D4000-memory.dmp	xmrig
behavioral2/memory/2056-135-0x00007FF72CA50000-0x00007FF72CDA4000-memory.dmp	xmrig
behavioral2/memory/532-136-0x00007FF78E810000-0x00007FF78EB64000-memory.dmp	xmrig
behavioral2/memory/4972-137-0x00007FF77C5A0000-0x00007FF77C8F4000-memory.dmp	xmrig
behavioral2/memory/1204-138-0x00007FF66B720000-0x00007FF66BA74000-memory.dmp	xmrig
behavioral2/memory/4148-139-0x00007FF775480000-0x00007FF7757D4000-memory.dmp	xmrig
behavioral2/memory/2016-140-0x00007FF6432B0000-0x00007FF643604000-memory.dmp	xmrig
behavioral2/memory/5152-141-0x00007FF797190000-0x00007FF7974E4000-memory.dmp	xmrig
behavioral2/memory/5452-142-0x00007FF69A380000-0x00007FF69A6D4000-memory.dmp	xmrig
behavioral2/memory/5756-143-0x00007FF6CE860000-0x00007FF6CEBB4000-memory.dmp	xmrig
behavioral2/memory/5352-144-0x00007FF6B6F80000-0x00007FF6B72D4000-memory.dmp	xmrig
behavioral2/memory/5376-145-0x00007FF605690000-0x00007FF6059E4000-memory.dmp	xmrig
behavioral2/memory/5324-146-0x00007FF66E9F0000-0x00007FF66ED44000-memory.dmp	xmrig
behavioral2/memory/4676-147-0x00007FF7B1F70000-0x00007FF7B22C4000-memory.dmp	xmrig
behavioral2/memory/1716-148-0x00007FF676380000-0x00007FF6766D4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2056	hsXYZsb.exe
532	MSCWeen.exe
4972	PEZpzpd.exe
4148	vuAnCaG.exe
1204	uWIDuBu.exe
2016	ctAoZjk.exe
5152	trMmJOL.exe
5452	YFihuSa.exe
5756	RSeSNle.exe
5352	mkYQUhA.exe
5376	EIunccn.exe
5324	mRvyfzD.exe
4676	lKCEVgq.exe
1716	ZiJfRDm.exe
4640	MlTrQQx.exe
5924	dyUbsRU.exe
5928	GZogxuy.exe
5976	KyBFCpF.exe
4956	DwVLNVH.exe
5484	JmqBQEu.exe
5520	EuBGlmf.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2260-0-0x00007FF6E0910000-0x00007FF6E0C64000-memory.dmp	upx
behavioral2/files/0x0008000000023262-4.dat	upx
behavioral2/memory/2056-7-0x00007FF72CA50000-0x00007FF72CDA4000-memory.dmp	upx
behavioral2/files/0x0007000000023269-10.dat	upx
behavioral2/files/0x0008000000023266-11.dat	upx
behavioral2/memory/532-16-0x00007FF78E810000-0x00007FF78EB64000-memory.dmp	upx
behavioral2/memory/4972-20-0x00007FF77C5A0000-0x00007FF77C8F4000-memory.dmp	upx
behavioral2/files/0x000700000002326a-23.dat	upx
behavioral2/memory/4148-26-0x00007FF775480000-0x00007FF7757D4000-memory.dmp	upx
behavioral2/files/0x000700000002326b-28.dat	upx
behavioral2/files/0x000700000002326c-36.dat	upx
behavioral2/memory/2016-38-0x00007FF6432B0000-0x00007FF643604000-memory.dmp	upx
behavioral2/memory/1204-34-0x00007FF66B720000-0x00007FF66BA74000-memory.dmp	upx
behavioral2/files/0x000700000002326d-41.dat	upx
behavioral2/files/0x000700000002326f-47.dat	upx
behavioral2/memory/5152-46-0x00007FF797190000-0x00007FF7974E4000-memory.dmp	upx
behavioral2/files/0x0007000000023271-51.dat	upx
behavioral2/memory/5452-49-0x00007FF69A380000-0x00007FF69A6D4000-memory.dmp	upx
behavioral2/memory/5756-56-0x00007FF6CE860000-0x00007FF6CEBB4000-memory.dmp	upx
behavioral2/files/0x0007000000023272-58.dat	upx
behavioral2/memory/2260-60-0x00007FF6E0910000-0x00007FF6E0C64000-memory.dmp	upx
behavioral2/memory/5352-62-0x00007FF6B6F80000-0x00007FF6B72D4000-memory.dmp	upx
behavioral2/files/0x0007000000023273-66.dat	upx
behavioral2/memory/2056-73-0x00007FF72CA50000-0x00007FF72CDA4000-memory.dmp	upx
behavioral2/files/0x0008000000023274-77.dat	upx
behavioral2/files/0x000a00000001ea83-72.dat	upx
behavioral2/files/0x0007000000023275-82.dat	upx
behavioral2/files/0x0007000000023276-88.dat	upx
behavioral2/files/0x0007000000023277-93.dat	upx
behavioral2/files/0x0007000000023278-98.dat	upx
behavioral2/files/0x0007000000023279-103.dat	upx
behavioral2/files/0x000700000002327a-108.dat	upx
behavioral2/files/0x000700000002327c-114.dat	upx
behavioral2/files/0x000700000002327b-115.dat	upx
behavioral2/memory/5376-119-0x00007FF605690000-0x00007FF6059E4000-memory.dmp	upx
behavioral2/memory/1716-120-0x00007FF676380000-0x00007FF6766D4000-memory.dmp	upx
behavioral2/memory/4640-121-0x00007FF7CD800000-0x00007FF7CDB54000-memory.dmp	upx
behavioral2/memory/5924-122-0x00007FF7A0DB0000-0x00007FF7A1104000-memory.dmp	upx
behavioral2/memory/5928-123-0x00007FF6A1A70000-0x00007FF6A1DC4000-memory.dmp	upx
behavioral2/memory/5976-124-0x00007FF7384C0000-0x00007FF738814000-memory.dmp	upx
behavioral2/memory/4956-125-0x00007FF672BB0000-0x00007FF672F04000-memory.dmp	upx
behavioral2/memory/5484-126-0x00007FF770700000-0x00007FF770A54000-memory.dmp	upx
behavioral2/memory/5520-127-0x00007FF6EA0C0000-0x00007FF6EA414000-memory.dmp	upx
behavioral2/memory/5324-128-0x00007FF66E9F0000-0x00007FF66ED44000-memory.dmp	upx
behavioral2/memory/532-129-0x00007FF78E810000-0x00007FF78EB64000-memory.dmp	upx
behavioral2/memory/4676-130-0x00007FF7B1F70000-0x00007FF7B22C4000-memory.dmp	upx
behavioral2/memory/4972-131-0x00007FF77C5A0000-0x00007FF77C8F4000-memory.dmp	upx
behavioral2/memory/4148-132-0x00007FF775480000-0x00007FF7757D4000-memory.dmp	upx
behavioral2/memory/5452-133-0x00007FF69A380000-0x00007FF69A6D4000-memory.dmp	upx
behavioral2/memory/5352-134-0x00007FF6B6F80000-0x00007FF6B72D4000-memory.dmp	upx
behavioral2/memory/2056-135-0x00007FF72CA50000-0x00007FF72CDA4000-memory.dmp	upx
behavioral2/memory/532-136-0x00007FF78E810000-0x00007FF78EB64000-memory.dmp	upx
behavioral2/memory/4972-137-0x00007FF77C5A0000-0x00007FF77C8F4000-memory.dmp	upx
behavioral2/memory/1204-138-0x00007FF66B720000-0x00007FF66BA74000-memory.dmp	upx
behavioral2/memory/4148-139-0x00007FF775480000-0x00007FF7757D4000-memory.dmp	upx
behavioral2/memory/2016-140-0x00007FF6432B0000-0x00007FF643604000-memory.dmp	upx
behavioral2/memory/5152-141-0x00007FF797190000-0x00007FF7974E4000-memory.dmp	upx
behavioral2/memory/5452-142-0x00007FF69A380000-0x00007FF69A6D4000-memory.dmp	upx
behavioral2/memory/5756-143-0x00007FF6CE860000-0x00007FF6CEBB4000-memory.dmp	upx
behavioral2/memory/5352-144-0x00007FF6B6F80000-0x00007FF6B72D4000-memory.dmp	upx
behavioral2/memory/5376-145-0x00007FF605690000-0x00007FF6059E4000-memory.dmp	upx
behavioral2/memory/5324-146-0x00007FF66E9F0000-0x00007FF66ED44000-memory.dmp	upx
behavioral2/memory/4676-147-0x00007FF7B1F70000-0x00007FF7B22C4000-memory.dmp	upx
behavioral2/memory/1716-148-0x00007FF676380000-0x00007FF6766D4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\ctAoZjk.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EIunccn.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\lKCEVgq.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZiJfRDm.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dyUbsRU.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KyBFCpF.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\PEZpzpd.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\uWIDuBu.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\JmqBQEu.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DwVLNVH.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\vuAnCaG.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\trMmJOL.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MlTrQQx.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EuBGlmf.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MSCWeen.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mRvyfzD.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\RSeSNle.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mkYQUhA.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\GZogxuy.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hsXYZsb.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\YFihuSa.exe	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2056	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	92
PID 2260 wrote to memory of 2056	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	92
PID 2260 wrote to memory of 532	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	93
PID 2260 wrote to memory of 532	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	93
PID 2260 wrote to memory of 4972	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	94
PID 2260 wrote to memory of 4972	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	94
PID 2260 wrote to memory of 4148	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	95
PID 2260 wrote to memory of 4148	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	95
PID 2260 wrote to memory of 1204	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	96
PID 2260 wrote to memory of 1204	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	96
PID 2260 wrote to memory of 2016	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	97
PID 2260 wrote to memory of 2016	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	97
PID 2260 wrote to memory of 5152	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	98
PID 2260 wrote to memory of 5152	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	98
PID 2260 wrote to memory of 5452	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	99
PID 2260 wrote to memory of 5452	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	99
PID 2260 wrote to memory of 5756	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	100
PID 2260 wrote to memory of 5756	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	100
PID 2260 wrote to memory of 5352	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	101
PID 2260 wrote to memory of 5352	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	101
PID 2260 wrote to memory of 5376	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	102
PID 2260 wrote to memory of 5376	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	102
PID 2260 wrote to memory of 5324	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	103
PID 2260 wrote to memory of 5324	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	103
PID 2260 wrote to memory of 4676	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	104
PID 2260 wrote to memory of 4676	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	104
PID 2260 wrote to memory of 1716	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	105
PID 2260 wrote to memory of 1716	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	105
PID 2260 wrote to memory of 4640	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	106
PID 2260 wrote to memory of 4640	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	106
PID 2260 wrote to memory of 5924	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	107
PID 2260 wrote to memory of 5924	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	107
PID 2260 wrote to memory of 5928	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	108
PID 2260 wrote to memory of 5928	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	108
PID 2260 wrote to memory of 5976	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	109
PID 2260 wrote to memory of 5976	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	109
PID 2260 wrote to memory of 4956	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	110
PID 2260 wrote to memory of 4956	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	110
PID 2260 wrote to memory of 5484	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	111
PID 2260 wrote to memory of 5484	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	111
PID 2260 wrote to memory of 5520	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	112
PID 2260 wrote to memory of 5520	2260	2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe	112

C:\Users\Admin\AppData\Local\Temp\2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_b1ad8f3ab7a101dbeea8736cb7eafb6c_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\System\hsXYZsb.exe
  C:\Windows\System\hsXYZsb.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\MSCWeen.exe
  C:\Windows\System\MSCWeen.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\PEZpzpd.exe
  C:\Windows\System\PEZpzpd.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\vuAnCaG.exe
  C:\Windows\System\vuAnCaG.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\uWIDuBu.exe
  C:\Windows\System\uWIDuBu.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\ctAoZjk.exe
  C:\Windows\System\ctAoZjk.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\trMmJOL.exe
  C:\Windows\System\trMmJOL.exe
  2⤵
  - Executes dropped EXE
  PID:5152
- C:\Windows\System\YFihuSa.exe
  C:\Windows\System\YFihuSa.exe
  2⤵
  - Executes dropped EXE
  PID:5452
- C:\Windows\System\RSeSNle.exe
  C:\Windows\System\RSeSNle.exe
  2⤵
  - Executes dropped EXE
  PID:5756
- C:\Windows\System\mkYQUhA.exe
  C:\Windows\System\mkYQUhA.exe
  2⤵
  - Executes dropped EXE
  PID:5352
- C:\Windows\System\EIunccn.exe
  C:\Windows\System\EIunccn.exe
  2⤵
  - Executes dropped EXE
  PID:5376
- C:\Windows\System\mRvyfzD.exe
  C:\Windows\System\mRvyfzD.exe
  2⤵
  - Executes dropped EXE
  PID:5324
- C:\Windows\System\lKCEVgq.exe
  C:\Windows\System\lKCEVgq.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\ZiJfRDm.exe
  C:\Windows\System\ZiJfRDm.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\MlTrQQx.exe
  C:\Windows\System\MlTrQQx.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\dyUbsRU.exe
  C:\Windows\System\dyUbsRU.exe
  2⤵
  - Executes dropped EXE
  PID:5924
- C:\Windows\System\GZogxuy.exe
  C:\Windows\System\GZogxuy.exe
  2⤵
  - Executes dropped EXE
  PID:5928
- C:\Windows\System\KyBFCpF.exe
  C:\Windows\System\KyBFCpF.exe
  2⤵
  - Executes dropped EXE
  PID:5976
- C:\Windows\System\DwVLNVH.exe
  C:\Windows\System\DwVLNVH.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\JmqBQEu.exe
  C:\Windows\System\JmqBQEu.exe
  2⤵
  - Executes dropped EXE
  PID:5484
- C:\Windows\System\EuBGlmf.exe
  C:\Windows\System\EuBGlmf.exe
  2⤵
  - Executes dropped EXE
  PID:5520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3876 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:4764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DwVLNVH.exe

Path C:\Windows\System\DwVLNVH.exe
Size 5.9MB
SHA256 6c54b0e0e19e52c36fc222a3b5479b909f1648483833802655feee02eef534c8
MD5 b7e4f6a37431a8de8a8b126b3651b6fb
SHA1 7efc3658513201bf7418e00276263d37bed49ecc
SHA512 3f89bb91d8bdece7df5758f7c6e9bf875dd0847718766ececf5aa022a1e7bc10ea8a7dd4de27ec83c1c47fc3977dda411488545fc0563d919ef6e0f9bef3d10c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

EIunccn.exe

Path C:\Windows\System\EIunccn.exe
Size 5.9MB
SHA256 c3efd9886c54ca294bf8812db52937080fbeba12986f2a24fafab70ee753bbfd
MD5 d91f5758684814e85524be26f9422353
SHA1 9bb7c92f8a8f3399fa15646a30d54d9770c49d40
SHA512 f7bab13a31069adcb66d105d9e2a201c43fd1cda10fc6c1a568025b81b37af11c23d45ac60c9d0302e616bae9309b0f182e9e48d358def0c1ebf45dab5827ab6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

EuBGlmf.exe

Path C:\Windows\System\EuBGlmf.exe
Size 5.9MB
SHA256 f2856b5af3d96b5405ac90d0fa2fffecedf8bf798e40bb82d100edcaced64e7c
MD5 6e6ece0e77cad9daa558aa48a638d24b
SHA1 709f619a670940a3dfacc7f0d8e92f7a8e4ce6c6
SHA512 907db96f36b6e88d486aaff1d99e19fecdc718b5e5b05bdce54635b7658f4516a60e45b70b5b53e97c6b3f541a9f00041a1ba0d4e7f644f5b049a899c3e34b0a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

GZogxuy.exe

Path C:\Windows\System\GZogxuy.exe
Size 5.9MB
SHA256 9cfbc5854a2b99e1f67e1c3c76322decb75d9f3db2e73d8442f6055a396fa6b8
MD5 2c4382d51a5f9b34473a01775d605bfc
SHA1 47ec08b4b10fb15b01074860727ca3c06441fed7
SHA512 a82664776588cdc87e6d710bb43c6d1be4b279a5d62cfc849b931036a3007ffdab4f5e56bb39792286d3610f7d0787a445172a66a6c13c3e8b5374c5f04ee74d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUN:Q+856utgpPF8u/7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

JmqBQEu.exe

Path C:\Windows\System\JmqBQEu.exe
Size 5.9MB
SHA256 a96c4c110302a4b464415afb5797f314ff434f3dd0cbeca033fcf3b559d9aab2
MD5 0be961e677d072b6b611113e696b8045
SHA1 dbd07af5ffda0dc4cf6da4c6b1c289ec765f4eee
SHA512 b0c8c5e57275efb26f14378ecc68fc7aa78f8e8623aad2447950544495737f450c70d68f79428abac9b03a8372dd26f86b80866c47cc19fbfd2505a985ad48df
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

KyBFCpF.exe

Path C:\Windows\System\KyBFCpF.exe
Size 5.9MB
SHA256 a662c592cea0c5e538f26c60882311c5526142d37c5c7bded4118969468defdc
MD5 233e4c99d42e42bfa94652a3674f3f37
SHA1 1969ed93c25b37ea7eda7895e2d9b3c6021797ab
SHA512 31d5dc3f2aa39d955493d35cd3b643c88511d1b74e8ee8dffb1491a1a8ff8e7434c191b53d0a67067afa069b32618d0bc89656343f0a163e3938ee382ebb2826
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSCWeen.exe

Path C:\Windows\System\MSCWeen.exe
Size 5.9MB
SHA256 d473ba5cd86a8b7080238d659f136ab7535616ace0f53366ecc1b7f57910eb19
MD5 49206c8c8da5729d462e87039e50c803
SHA1 cc29a15219efca84917d61b01deece64a5889267
SHA512 d86c2bb9dfcb5fa556a7093979cb4009b90fdcda21e7eae39211bfde62ac4f5bccfbfa6a4c3981398ec3f1c970ad83f0eeb852e215e4ca8ba37a05838e0abc20
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUc:Q+856utgpPF8u/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

MlTrQQx.exe

Path C:\Windows\System\MlTrQQx.exe
Size 5.9MB
SHA256 7c8ede9e7ca493b8fe2a6485fddd58874942a292b63eadb7263dc586d2747c42
MD5 00149eec631e9f45176f3ba791c88620
SHA1 fbaf6e7b255a4620323f45169fe19103c85f3b7c
SHA512 6a23a2f813f6bc51fef7d2c9be331fad4c63f6956b0dd7232893adaf0c3d3d0d0cd92fc016bb45ecda2aa102b8cf9c8a2c77e69cc7c3d28d033adf0db2340538
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU6:Q+856utgpPF8u/76
MD5 SHA1 SHA512 SSDEEP

Submit Download

PEZpzpd.exe

Path C:\Windows\System\PEZpzpd.exe
Size 5.9MB
SHA256 d3fe55f1b8f9a2e040985b283efc6658912382adafff0fb0f2cf2a588c5e6577
MD5 a679b8d3b1b8afa449b13b7989f687c2
SHA1 5bc52607f764cdbeb4923351fa2774a68836b6dc
SHA512 b1e19784a9643deba641ce8602cdcef59cdfecdb662f9299483c612512546961b2bd9b20090d55c9e13b26dfbce0ae01fd8a040b20bd6c92a75aa4b6737c6925
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
MD5 SHA1 SHA512 SSDEEP

Submit Download

RSeSNle.exe

Path C:\Windows\System\RSeSNle.exe
Size 5.9MB
SHA256 46029e57b149651a2c01e230829141fd40459f79efc6d756a0e594c264e7c971
MD5 f19b43a5eb0efada14a3e87db7ae90d4
SHA1 a2d6a04a5c26b31d6e7e44849f58ffd0b9daf976
SHA512 57265ad72fcca6dceadd00625ef4f60e8209e83ac6cb03d63fb2d5cc630694cccba3078971afe57c490a4000d9ce3c9f8becf605fc44399df39a747b1c63dfae
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUy:Q+856utgpPF8u/7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

YFihuSa.exe

Path C:\Windows\System\YFihuSa.exe
Size 5.9MB
SHA256 dc8e89d9e726218c028c54d34dc9f1cb666ef66484450f00f219c95089e3253f
MD5 9f6dea95c3ba863606a600620fa180bd
SHA1 bb17752af32d3cc45c5d281a7749e3d9276caaff
SHA512 223f5b8c4c85b456fe9b4c59f1f90299f32c177656be53056b7080e4427767229bb6ac863213924435cd245b9387429a5d839b7d2531f4cf1ef0ac12a7270b09
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZiJfRDm.exe

Path C:\Windows\System\ZiJfRDm.exe
Size 5.9MB
SHA256 0a46ea57fe8c91c7d5fa2260f39fae2118a3b08f79a4d95d8f1073dae0b7acb5
MD5 591a8a6f5d79bc519587bdd6f75e6888
SHA1 99be38489401fae1a842c2e9e3cb57dcca9d5ca1
SHA512 30860950718e6f16fdf804e8d4690487c2022d9b6c753ce70e2fbae76d0ffa65483e6b929e5017905e7a1e27cecd43395acb183375168a3e828e7c040150e607
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUg:Q+856utgpPF8u/7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

ctAoZjk.exe

Path C:\Windows\System\ctAoZjk.exe
Size 5.9MB
SHA256 e89c5da9c70dc9528e1241f363dab8d028e9a46bff6363df3ab52977998048c7
MD5 fab7ee471010ca83bf504a65cbf5e261
SHA1 52c8d5d232c8f9bdd2c25ef0c2e73d9ed9358dee
SHA512 5b84c5a3dc48e97d00799f6e0fbe578765a924c410067b9e9ee61af00da1d70b751e47b83303f9df6cbdec9c9ca3020cc1bfb9988bf4cce1f1aa01c997de4beb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

dyUbsRU.exe

Path C:\Windows\System\dyUbsRU.exe
Size 5.9MB
SHA256 4ba9894d386cbdd262617edfc9c45877c4e60ec182a8804ef6d7b8f4c774e47e
MD5 72e6d22bd94ae075129e192c0defa1d5
SHA1 b2d9c6dfa8a9865096adf344353e8935b671b11a
SHA512 4ad963ef50496cb479aac5d2fe3fdc1c8a607e0d4bb46f6982b3ffe112b370be4d9f395570d786a9fb5928494f922fd8683bc10e80f25707ff8c4f8ae1a2d746
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

hsXYZsb.exe

Path C:\Windows\System\hsXYZsb.exe
Size 5.9MB
SHA256 f55a10e1cf5f17bb0dbb3abba1a8fd85428c0dcab4da0b658e37d4b984ba8035
MD5 56dc83ae4858ffcc36adb7ab21131052
SHA1 f977c211774626bb24ef11018a96af3c59b774a6
SHA512 cc05da3f99443027e124e58899ab3e6695481f3d52f0ee62d5ab552474fa2a83e738a2b99b793f6f650975d9693281e0c0e2ef240212fd4ec229def64b12fd02
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
MD5 SHA1 SHA512 SSDEEP

Submit Download

lKCEVgq.exe

Path C:\Windows\System\lKCEVgq.exe
Size 5.9MB
SHA256 985d94294e6200dce4577f14842b75dea7ca933e638e5eda7240bb4ddbd2a814
MD5 40e7d49fdbcdc24181c16e3f56df09f2
SHA1 f7ab5354a0a7e5a990aa9b18aa70198a17bc7b64
SHA512 ff60fb7c5cdf187bf9382980e04fa8583a3936b09d36369e81fc0e32ab395db7eb8b58522c1427264af42542659f6a008f65addef6db73b044bc28076ac1cfdb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

mRvyfzD.exe

Path C:\Windows\System\mRvyfzD.exe
Size 5.9MB
SHA256 3166bd688def2fd43e02395762228ab7b1721b7042c2f10232e46a85e2fec99a
MD5 416b41033ffa76ee038c226e0310edf8
SHA1 cc8aacc2de2e4e03ff90920f012a244129692f7b
SHA512 63408e938113e785f5f7e0dfa2632ef826d1253c1ac9a43850a00b2d23f8421eac961854e042ecbbba5a197236fa91b5dee6268871f4e614a6c439e677f4a661
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

mkYQUhA.exe

Path C:\Windows\System\mkYQUhA.exe
Size 5.9MB
SHA256 59f97b291a7574487501093f22d11d8ada5e687ea76dac621d59991e56742f60
MD5 c90497eaec691fa5b51010f6c26af189
SHA1 4889b0bd649b0e63c775216ff98c0cb868452229
SHA512 b94551755c5bbf96b1174f8fc5a40069917a299db547dacff5631f53efd3aa5533987c4438c325b2864eeef67ceb1d3f233e7391d48b87e73bc9da5b14ccadad
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

trMmJOL.exe

Path C:\Windows\System\trMmJOL.exe
Size 5.9MB
SHA256 e35440003b07502816bca07c47b96ba96a611ac76b8f8d346837d8e4d7bdcf7a
MD5 906eeb99cb8d6f2b08ee1085bfbb63ce
SHA1 7bee22c8d5ab65a769b82cef32f1c57d05534dda
SHA512 c30e343cab624265a7cead411fd4991703583f3dc414d627fe7f29c20220fb26119325fdfce7145274720df93c9a583de9e3f4ec5ecce7d688a96193656acf84
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

uWIDuBu.exe

Path C:\Windows\System\uWIDuBu.exe
Size 5.9MB
SHA256 e41a33734d0a7e5f60269cb3f9d935aa7425fc88377f78a81c8ccbcceeb2ef08
MD5 0a305d61bd5c7fe8324260ce4aaff5ea
SHA1 c0c18d19cbb8faa421e1f8e3a5d36f74af3a0ba2
SHA512 8caf7c969732427bbd9cf3302fbda97aabe5cddbe12ada71c115cfbcbb5206ec70d122374b8fec1778d64ab7b38ca6cefd773810a5db6228985388470a5e259c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

vuAnCaG.exe

Path C:\Windows\System\vuAnCaG.exe
Size 5.9MB
SHA256 66ec85494b9ddf113e7937211ebdf56d92fcbd09d3288d54ba6cf53282bdba3e
MD5 913cbbca1a207a61b2924a2149651946
SHA1 c0511861e16b8fbef33ba7b0658ce45a44b74d33
SHA512 90553c4e77ac871fc76e06825b02463e16972315531aadcfff17e0603ab59e36fa50ad1f00d8592f4be04a5fb2dcf28806a9d5b786b662471b2b4169d50a387e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/532-129-0x00007FF78E810000-0x00007FF78EB64000-memory.dmp

Download

memory/532-136-0x00007FF78E810000-0x00007FF78EB64000-memory.dmp

Download

memory/532-16-0x00007FF78E810000-0x00007FF78EB64000-memory.dmp

Download

memory/1204-34-0x00007FF66B720000-0x00007FF66BA74000-memory.dmp

Download

memory/1204-138-0x00007FF66B720000-0x00007FF66BA74000-memory.dmp

Download

memory/1716-120-0x00007FF676380000-0x00007FF6766D4000-memory.dmp

Download

memory/1716-148-0x00007FF676380000-0x00007FF6766D4000-memory.dmp

Download

memory/2016-140-0x00007FF6432B0000-0x00007FF643604000-memory.dmp

Download

memory/2016-38-0x00007FF6432B0000-0x00007FF643604000-memory.dmp

Download

memory/2056-73-0x00007FF72CA50000-0x00007FF72CDA4000-memory.dmp

Download

memory/2056-7-0x00007FF72CA50000-0x00007FF72CDA4000-memory.dmp

Download

memory/2056-135-0x00007FF72CA50000-0x00007FF72CDA4000-memory.dmp

Download

memory/2260-0-0x00007FF6E0910000-0x00007FF6E0C64000-memory.dmp

Download

memory/2260-60-0x00007FF6E0910000-0x00007FF6E0C64000-memory.dmp

Download

memory/2260-1-0x000002467FFB0000-0x000002467FFC0000-memory.dmp

Download

memory/4148-26-0x00007FF775480000-0x00007FF7757D4000-memory.dmp

Download

memory/4148-139-0x00007FF775480000-0x00007FF7757D4000-memory.dmp

Download

memory/4148-132-0x00007FF775480000-0x00007FF7757D4000-memory.dmp

Download

memory/4640-121-0x00007FF7CD800000-0x00007FF7CDB54000-memory.dmp

Download

memory/4640-149-0x00007FF7CD800000-0x00007FF7CDB54000-memory.dmp

Download

memory/4676-147-0x00007FF7B1F70000-0x00007FF7B22C4000-memory.dmp

Download

memory/4676-130-0x00007FF7B1F70000-0x00007FF7B22C4000-memory.dmp

Download

memory/4956-125-0x00007FF672BB0000-0x00007FF672F04000-memory.dmp

Download

memory/4956-153-0x00007FF672BB0000-0x00007FF672F04000-memory.dmp

Download

memory/4972-137-0x00007FF77C5A0000-0x00007FF77C8F4000-memory.dmp

Download

memory/4972-20-0x00007FF77C5A0000-0x00007FF77C8F4000-memory.dmp

Download

memory/4972-131-0x00007FF77C5A0000-0x00007FF77C8F4000-memory.dmp

Download

memory/5152-46-0x00007FF797190000-0x00007FF7974E4000-memory.dmp

Download

memory/5152-141-0x00007FF797190000-0x00007FF7974E4000-memory.dmp

Download

memory/5324-146-0x00007FF66E9F0000-0x00007FF66ED44000-memory.dmp

Download

memory/5324-128-0x00007FF66E9F0000-0x00007FF66ED44000-memory.dmp

Download

memory/5352-134-0x00007FF6B6F80000-0x00007FF6B72D4000-memory.dmp

Download

memory/5352-62-0x00007FF6B6F80000-0x00007FF6B72D4000-memory.dmp

Download

memory/5352-144-0x00007FF6B6F80000-0x00007FF6B72D4000-memory.dmp

Download

memory/5376-119-0x00007FF605690000-0x00007FF6059E4000-memory.dmp

Download

memory/5376-145-0x00007FF605690000-0x00007FF6059E4000-memory.dmp

Download

memory/5452-49-0x00007FF69A380000-0x00007FF69A6D4000-memory.dmp

Download

memory/5452-142-0x00007FF69A380000-0x00007FF69A6D4000-memory.dmp

Download

memory/5452-133-0x00007FF69A380000-0x00007FF69A6D4000-memory.dmp

Download

memory/5484-126-0x00007FF770700000-0x00007FF770A54000-memory.dmp

Download

memory/5484-154-0x00007FF770700000-0x00007FF770A54000-memory.dmp

Download

memory/5520-155-0x00007FF6EA0C0000-0x00007FF6EA414000-memory.dmp

Download

memory/5520-127-0x00007FF6EA0C0000-0x00007FF6EA414000-memory.dmp

Download

memory/5756-56-0x00007FF6CE860000-0x00007FF6CEBB4000-memory.dmp

Download

memory/5756-143-0x00007FF6CE860000-0x00007FF6CEBB4000-memory.dmp

Download

memory/5924-150-0x00007FF7A0DB0000-0x00007FF7A1104000-memory.dmp

Download

memory/5924-122-0x00007FF7A0DB0000-0x00007FF7A1104000-memory.dmp

Download

memory/5928-123-0x00007FF6A1A70000-0x00007FF6A1DC4000-memory.dmp

Download

memory/5928-151-0x00007FF6A1A70000-0x00007FF6A1DC4000-memory.dmp

Download

memory/5976-152-0x00007FF7384C0000-0x00007FF738814000-memory.dmp

Download

memory/5976-124-0x00007FF7384C0000-0x00007FF738814000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads