cobaltstrike | 87d52aecda249b0b73ffa720744ed84ba74e8538505d38dcd613566f084c1ee6

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-lrvhbsaa46
SHA256 87d52aecda249b0b73ffa720744ed84ba74e8538505d38dcd613566f084c1ee6
MD5 f5396637e6906a6e49ce4253ab8c5d75
SHA1 087f608f498d9697821508b1bdcc1a4963c6d4fd
SHA512 f8dcc9d6692244e1fa8d2f73976c956c42c0cf245d95724d2984e82541ac904a0121bf5d3130b2899cd99ba18aaad7c88b39a9b0240ce7f2c46d8a1aef637731
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000700000002343a-11.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023439-12.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023435-6.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343b-24.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343c-31.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343d-35.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023394-41.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023436-47.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343e-51.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002343f-60.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023440-71.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023441-76.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023443-81.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023444-98.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023446-108.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023447-117.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002344a-128.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023449-125.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023448-121.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023445-103.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023442-86.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x000700000002343a-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023439-12.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0009000000023435-6.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343b-24.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343c-31.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343d-35.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a000000023394-41.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023436-47.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343e-51.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002343f-60.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023440-71.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023441-76.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023443-81.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023444-98.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023446-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023447-117.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002344a-128.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023449-125.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023448-121.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023445-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023442-86.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2272-0-0x00007FF6FFF70000-0x00007FF7002C4000-memory.dmp	UPX
behavioral2/memory/3096-7-0x00007FF7B7C20000-0x00007FF7B7F74000-memory.dmp	UPX
behavioral2/files/0x000700000002343a-11.dat	UPX
behavioral2/files/0x0007000000023439-12.dat	UPX
behavioral2/memory/1900-14-0x00007FF67C6A0000-0x00007FF67C9F4000-memory.dmp	UPX
behavioral2/files/0x0009000000023435-6.dat	UPX
behavioral2/memory/3404-19-0x00007FF774E90000-0x00007FF7751E4000-memory.dmp	UPX
behavioral2/files/0x000700000002343b-24.dat	UPX
behavioral2/memory/960-29-0x00007FF778490000-0x00007FF7787E4000-memory.dmp	UPX
behavioral2/memory/3764-30-0x00007FF7B70D0000-0x00007FF7B7424000-memory.dmp	UPX
behavioral2/files/0x000700000002343c-31.dat	UPX
behavioral2/files/0x000700000002343d-35.dat	UPX
behavioral2/memory/4452-38-0x00007FF7144A0000-0x00007FF7147F4000-memory.dmp	UPX
behavioral2/files/0x000a000000023394-41.dat	UPX
behavioral2/files/0x0008000000023436-47.dat	UPX
behavioral2/files/0x000700000002343e-51.dat	UPX
behavioral2/memory/1964-54-0x00007FF638F10000-0x00007FF639264000-memory.dmp	UPX
behavioral2/memory/1384-52-0x00007FF695270000-0x00007FF6955C4000-memory.dmp	UPX
behavioral2/files/0x000700000002343f-60.dat	UPX
behavioral2/files/0x0007000000023440-71.dat	UPX
behavioral2/memory/2272-68-0x00007FF6FFF70000-0x00007FF7002C4000-memory.dmp	UPX
behavioral2/files/0x0007000000023441-76.dat	UPX
behavioral2/files/0x0007000000023443-81.dat	UPX
behavioral2/memory/2444-88-0x00007FF694AF0000-0x00007FF694E44000-memory.dmp	UPX
behavioral2/files/0x0007000000023444-98.dat	UPX
behavioral2/files/0x0007000000023446-108.dat	UPX
behavioral2/memory/3388-114-0x00007FF7F95B0000-0x00007FF7F9904000-memory.dmp	UPX
behavioral2/files/0x0007000000023447-117.dat	UPX
behavioral2/files/0x000700000002344a-128.dat	UPX
behavioral2/files/0x0007000000023449-125.dat	UPX
behavioral2/files/0x0007000000023448-121.dat	UPX
behavioral2/memory/2412-120-0x00007FF648360000-0x00007FF6486B4000-memory.dmp	UPX
behavioral2/memory/856-116-0x00007FF786FC0000-0x00007FF787314000-memory.dmp	UPX
behavioral2/memory/4960-113-0x00007FF72E670000-0x00007FF72E9C4000-memory.dmp	UPX
behavioral2/memory/4536-107-0x00007FF671C80000-0x00007FF671FD4000-memory.dmp	UPX
behavioral2/memory/960-106-0x00007FF778490000-0x00007FF7787E4000-memory.dmp	UPX
behavioral2/memory/3404-105-0x00007FF774E90000-0x00007FF7751E4000-memory.dmp	UPX
behavioral2/files/0x0007000000023445-103.dat	UPX
behavioral2/memory/1900-89-0x00007FF67C6A0000-0x00007FF67C9F4000-memory.dmp	UPX
behavioral2/files/0x0007000000023442-86.dat	UPX
behavioral2/memory/3752-83-0x00007FF6E2CF0000-0x00007FF6E3044000-memory.dmp	UPX
behavioral2/memory/3096-82-0x00007FF7B7C20000-0x00007FF7B7F74000-memory.dmp	UPX
behavioral2/memory/5004-79-0x00007FF797CD0000-0x00007FF798024000-memory.dmp	UPX
behavioral2/memory/2376-75-0x00007FF6F2B10000-0x00007FF6F2E64000-memory.dmp	UPX
behavioral2/memory/4512-74-0x00007FF6C4580000-0x00007FF6C48D4000-memory.dmp	UPX
behavioral2/memory/4088-49-0x00007FF7C18E0000-0x00007FF7C1C34000-memory.dmp	UPX
behavioral2/memory/3764-131-0x00007FF7B70D0000-0x00007FF7B7424000-memory.dmp	UPX
behavioral2/memory/3960-133-0x00007FF6297F0000-0x00007FF629B44000-memory.dmp	UPX
behavioral2/memory/912-132-0x00007FF682BA0000-0x00007FF682EF4000-memory.dmp	UPX
behavioral2/memory/1964-134-0x00007FF638F10000-0x00007FF639264000-memory.dmp	UPX
behavioral2/memory/2376-135-0x00007FF6F2B10000-0x00007FF6F2E64000-memory.dmp	UPX
behavioral2/memory/3752-136-0x00007FF6E2CF0000-0x00007FF6E3044000-memory.dmp	UPX
behavioral2/memory/2444-137-0x00007FF694AF0000-0x00007FF694E44000-memory.dmp	UPX
behavioral2/memory/4960-138-0x00007FF72E670000-0x00007FF72E9C4000-memory.dmp	UPX
behavioral2/memory/856-139-0x00007FF786FC0000-0x00007FF787314000-memory.dmp	UPX
behavioral2/memory/2412-140-0x00007FF648360000-0x00007FF6486B4000-memory.dmp	UPX
behavioral2/memory/3096-141-0x00007FF7B7C20000-0x00007FF7B7F74000-memory.dmp	UPX
behavioral2/memory/1900-142-0x00007FF67C6A0000-0x00007FF67C9F4000-memory.dmp	UPX
behavioral2/memory/3404-143-0x00007FF774E90000-0x00007FF7751E4000-memory.dmp	UPX
behavioral2/memory/960-144-0x00007FF778490000-0x00007FF7787E4000-memory.dmp	UPX
behavioral2/memory/3764-145-0x00007FF7B70D0000-0x00007FF7B7424000-memory.dmp	UPX
behavioral2/memory/4452-146-0x00007FF7144A0000-0x00007FF7147F4000-memory.dmp	UPX
behavioral2/memory/4088-147-0x00007FF7C18E0000-0x00007FF7C1C34000-memory.dmp	UPX
behavioral2/memory/1384-148-0x00007FF695270000-0x00007FF6955C4000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2272-0-0x00007FF6FFF70000-0x00007FF7002C4000-memory.dmp	xmrig
behavioral2/memory/3096-7-0x00007FF7B7C20000-0x00007FF7B7F74000-memory.dmp	xmrig
behavioral2/files/0x000700000002343a-11.dat	xmrig
behavioral2/files/0x0007000000023439-12.dat	xmrig
behavioral2/memory/1900-14-0x00007FF67C6A0000-0x00007FF67C9F4000-memory.dmp	xmrig
behavioral2/files/0x0009000000023435-6.dat	xmrig
behavioral2/memory/3404-19-0x00007FF774E90000-0x00007FF7751E4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343b-24.dat	xmrig
behavioral2/memory/960-29-0x00007FF778490000-0x00007FF7787E4000-memory.dmp	xmrig
behavioral2/memory/3764-30-0x00007FF7B70D0000-0x00007FF7B7424000-memory.dmp	xmrig
behavioral2/files/0x000700000002343c-31.dat	xmrig
behavioral2/files/0x000700000002343d-35.dat	xmrig
behavioral2/memory/4452-38-0x00007FF7144A0000-0x00007FF7147F4000-memory.dmp	xmrig
behavioral2/files/0x000a000000023394-41.dat	xmrig
behavioral2/files/0x0008000000023436-47.dat	xmrig
behavioral2/files/0x000700000002343e-51.dat	xmrig
behavioral2/memory/1964-54-0x00007FF638F10000-0x00007FF639264000-memory.dmp	xmrig
behavioral2/memory/1384-52-0x00007FF695270000-0x00007FF6955C4000-memory.dmp	xmrig
behavioral2/files/0x000700000002343f-60.dat	xmrig
behavioral2/files/0x0007000000023440-71.dat	xmrig
behavioral2/memory/2272-68-0x00007FF6FFF70000-0x00007FF7002C4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023441-76.dat	xmrig
behavioral2/files/0x0007000000023443-81.dat	xmrig
behavioral2/memory/2444-88-0x00007FF694AF0000-0x00007FF694E44000-memory.dmp	xmrig
behavioral2/files/0x0007000000023444-98.dat	xmrig
behavioral2/files/0x0007000000023446-108.dat	xmrig
behavioral2/memory/3388-114-0x00007FF7F95B0000-0x00007FF7F9904000-memory.dmp	xmrig
behavioral2/files/0x0007000000023447-117.dat	xmrig
behavioral2/files/0x000700000002344a-128.dat	xmrig
behavioral2/files/0x0007000000023449-125.dat	xmrig
behavioral2/files/0x0007000000023448-121.dat	xmrig
behavioral2/memory/2412-120-0x00007FF648360000-0x00007FF6486B4000-memory.dmp	xmrig
behavioral2/memory/856-116-0x00007FF786FC0000-0x00007FF787314000-memory.dmp	xmrig
behavioral2/memory/4960-113-0x00007FF72E670000-0x00007FF72E9C4000-memory.dmp	xmrig
behavioral2/memory/4536-107-0x00007FF671C80000-0x00007FF671FD4000-memory.dmp	xmrig
behavioral2/memory/960-106-0x00007FF778490000-0x00007FF7787E4000-memory.dmp	xmrig
behavioral2/memory/3404-105-0x00007FF774E90000-0x00007FF7751E4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023445-103.dat	xmrig
behavioral2/memory/1900-89-0x00007FF67C6A0000-0x00007FF67C9F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023442-86.dat	xmrig
behavioral2/memory/3752-83-0x00007FF6E2CF0000-0x00007FF6E3044000-memory.dmp	xmrig
behavioral2/memory/3096-82-0x00007FF7B7C20000-0x00007FF7B7F74000-memory.dmp	xmrig
behavioral2/memory/5004-79-0x00007FF797CD0000-0x00007FF798024000-memory.dmp	xmrig
behavioral2/memory/2376-75-0x00007FF6F2B10000-0x00007FF6F2E64000-memory.dmp	xmrig
behavioral2/memory/4512-74-0x00007FF6C4580000-0x00007FF6C48D4000-memory.dmp	xmrig
behavioral2/memory/4088-49-0x00007FF7C18E0000-0x00007FF7C1C34000-memory.dmp	xmrig
behavioral2/memory/3764-131-0x00007FF7B70D0000-0x00007FF7B7424000-memory.dmp	xmrig
behavioral2/memory/3960-133-0x00007FF6297F0000-0x00007FF629B44000-memory.dmp	xmrig
behavioral2/memory/912-132-0x00007FF682BA0000-0x00007FF682EF4000-memory.dmp	xmrig
behavioral2/memory/1964-134-0x00007FF638F10000-0x00007FF639264000-memory.dmp	xmrig
behavioral2/memory/2376-135-0x00007FF6F2B10000-0x00007FF6F2E64000-memory.dmp	xmrig
behavioral2/memory/3752-136-0x00007FF6E2CF0000-0x00007FF6E3044000-memory.dmp	xmrig
behavioral2/memory/2444-137-0x00007FF694AF0000-0x00007FF694E44000-memory.dmp	xmrig
behavioral2/memory/4960-138-0x00007FF72E670000-0x00007FF72E9C4000-memory.dmp	xmrig
behavioral2/memory/856-139-0x00007FF786FC0000-0x00007FF787314000-memory.dmp	xmrig
behavioral2/memory/2412-140-0x00007FF648360000-0x00007FF6486B4000-memory.dmp	xmrig
behavioral2/memory/3096-141-0x00007FF7B7C20000-0x00007FF7B7F74000-memory.dmp	xmrig
behavioral2/memory/1900-142-0x00007FF67C6A0000-0x00007FF67C9F4000-memory.dmp	xmrig
behavioral2/memory/3404-143-0x00007FF774E90000-0x00007FF7751E4000-memory.dmp	xmrig
behavioral2/memory/960-144-0x00007FF778490000-0x00007FF7787E4000-memory.dmp	xmrig
behavioral2/memory/3764-145-0x00007FF7B70D0000-0x00007FF7B7424000-memory.dmp	xmrig
behavioral2/memory/4452-146-0x00007FF7144A0000-0x00007FF7147F4000-memory.dmp	xmrig
behavioral2/memory/4088-147-0x00007FF7C18E0000-0x00007FF7C1C34000-memory.dmp	xmrig
behavioral2/memory/1384-148-0x00007FF695270000-0x00007FF6955C4000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3096	loXhctk.exe
1900	gkRHMRe.exe
3404	ysGklhs.exe
960	LjimnIb.exe
3764	VoWoeoI.exe
4452	zmmcNYg.exe
4088	DdiqcCp.exe
1384	UaaivLM.exe
1964	OrFARHA.exe
4512	iBHxLQD.exe
5004	bmCZaAa.exe
2376	woShJul.exe
3752	BfOSoXK.exe
2444	ioRxTwf.exe
4536	CwlMxcO.exe
4960	gfIHphm.exe
3388	MJjcdbp.exe
856	ClibrvC.exe
2412	wALaYLV.exe
912	WWkQXXM.exe
3960	EsBqSas.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2272-0-0x00007FF6FFF70000-0x00007FF7002C4000-memory.dmp	upx
behavioral2/memory/3096-7-0x00007FF7B7C20000-0x00007FF7B7F74000-memory.dmp	upx
behavioral2/files/0x000700000002343a-11.dat	upx
behavioral2/files/0x0007000000023439-12.dat	upx
behavioral2/memory/1900-14-0x00007FF67C6A0000-0x00007FF67C9F4000-memory.dmp	upx
behavioral2/files/0x0009000000023435-6.dat	upx
behavioral2/memory/3404-19-0x00007FF774E90000-0x00007FF7751E4000-memory.dmp	upx
behavioral2/files/0x000700000002343b-24.dat	upx
behavioral2/memory/960-29-0x00007FF778490000-0x00007FF7787E4000-memory.dmp	upx
behavioral2/memory/3764-30-0x00007FF7B70D0000-0x00007FF7B7424000-memory.dmp	upx
behavioral2/files/0x000700000002343c-31.dat	upx
behavioral2/files/0x000700000002343d-35.dat	upx
behavioral2/memory/4452-38-0x00007FF7144A0000-0x00007FF7147F4000-memory.dmp	upx
behavioral2/files/0x000a000000023394-41.dat	upx
behavioral2/files/0x0008000000023436-47.dat	upx
behavioral2/files/0x000700000002343e-51.dat	upx
behavioral2/memory/1964-54-0x00007FF638F10000-0x00007FF639264000-memory.dmp	upx
behavioral2/memory/1384-52-0x00007FF695270000-0x00007FF6955C4000-memory.dmp	upx
behavioral2/files/0x000700000002343f-60.dat	upx
behavioral2/files/0x0007000000023440-71.dat	upx
behavioral2/memory/2272-68-0x00007FF6FFF70000-0x00007FF7002C4000-memory.dmp	upx
behavioral2/files/0x0007000000023441-76.dat	upx
behavioral2/files/0x0007000000023443-81.dat	upx
behavioral2/memory/2444-88-0x00007FF694AF0000-0x00007FF694E44000-memory.dmp	upx
behavioral2/files/0x0007000000023444-98.dat	upx
behavioral2/files/0x0007000000023446-108.dat	upx
behavioral2/memory/3388-114-0x00007FF7F95B0000-0x00007FF7F9904000-memory.dmp	upx
behavioral2/files/0x0007000000023447-117.dat	upx
behavioral2/files/0x000700000002344a-128.dat	upx
behavioral2/files/0x0007000000023449-125.dat	upx
behavioral2/files/0x0007000000023448-121.dat	upx
behavioral2/memory/2412-120-0x00007FF648360000-0x00007FF6486B4000-memory.dmp	upx
behavioral2/memory/856-116-0x00007FF786FC0000-0x00007FF787314000-memory.dmp	upx
behavioral2/memory/4960-113-0x00007FF72E670000-0x00007FF72E9C4000-memory.dmp	upx
behavioral2/memory/4536-107-0x00007FF671C80000-0x00007FF671FD4000-memory.dmp	upx
behavioral2/memory/960-106-0x00007FF778490000-0x00007FF7787E4000-memory.dmp	upx
behavioral2/memory/3404-105-0x00007FF774E90000-0x00007FF7751E4000-memory.dmp	upx
behavioral2/files/0x0007000000023445-103.dat	upx
behavioral2/memory/1900-89-0x00007FF67C6A0000-0x00007FF67C9F4000-memory.dmp	upx
behavioral2/files/0x0007000000023442-86.dat	upx
behavioral2/memory/3752-83-0x00007FF6E2CF0000-0x00007FF6E3044000-memory.dmp	upx
behavioral2/memory/3096-82-0x00007FF7B7C20000-0x00007FF7B7F74000-memory.dmp	upx
behavioral2/memory/5004-79-0x00007FF797CD0000-0x00007FF798024000-memory.dmp	upx
behavioral2/memory/2376-75-0x00007FF6F2B10000-0x00007FF6F2E64000-memory.dmp	upx
behavioral2/memory/4512-74-0x00007FF6C4580000-0x00007FF6C48D4000-memory.dmp	upx
behavioral2/memory/4088-49-0x00007FF7C18E0000-0x00007FF7C1C34000-memory.dmp	upx
behavioral2/memory/3764-131-0x00007FF7B70D0000-0x00007FF7B7424000-memory.dmp	upx
behavioral2/memory/3960-133-0x00007FF6297F0000-0x00007FF629B44000-memory.dmp	upx
behavioral2/memory/912-132-0x00007FF682BA0000-0x00007FF682EF4000-memory.dmp	upx
behavioral2/memory/1964-134-0x00007FF638F10000-0x00007FF639264000-memory.dmp	upx
behavioral2/memory/2376-135-0x00007FF6F2B10000-0x00007FF6F2E64000-memory.dmp	upx
behavioral2/memory/3752-136-0x00007FF6E2CF0000-0x00007FF6E3044000-memory.dmp	upx
behavioral2/memory/2444-137-0x00007FF694AF0000-0x00007FF694E44000-memory.dmp	upx
behavioral2/memory/4960-138-0x00007FF72E670000-0x00007FF72E9C4000-memory.dmp	upx
behavioral2/memory/856-139-0x00007FF786FC0000-0x00007FF787314000-memory.dmp	upx
behavioral2/memory/2412-140-0x00007FF648360000-0x00007FF6486B4000-memory.dmp	upx
behavioral2/memory/3096-141-0x00007FF7B7C20000-0x00007FF7B7F74000-memory.dmp	upx
behavioral2/memory/1900-142-0x00007FF67C6A0000-0x00007FF67C9F4000-memory.dmp	upx
behavioral2/memory/3404-143-0x00007FF774E90000-0x00007FF7751E4000-memory.dmp	upx
behavioral2/memory/960-144-0x00007FF778490000-0x00007FF7787E4000-memory.dmp	upx
behavioral2/memory/3764-145-0x00007FF7B70D0000-0x00007FF7B7424000-memory.dmp	upx
behavioral2/memory/4452-146-0x00007FF7144A0000-0x00007FF7147F4000-memory.dmp	upx
behavioral2/memory/4088-147-0x00007FF7C18E0000-0x00007FF7C1C34000-memory.dmp	upx
behavioral2/memory/1384-148-0x00007FF695270000-0x00007FF6955C4000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\wALaYLV.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\WWkQXXM.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\LjimnIb.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\DdiqcCp.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\UaaivLM.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bmCZaAa.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\woShJul.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gfIHphm.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\MJjcdbp.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gkRHMRe.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ysGklhs.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\VoWoeoI.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\zmmcNYg.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\BfOSoXK.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OrFARHA.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\iBHxLQD.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CwlMxcO.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\loXhctk.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ioRxTwf.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ClibrvC.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\EsBqSas.exe	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 3096	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	82
PID 2272 wrote to memory of 3096	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	82
PID 2272 wrote to memory of 1900	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	84
PID 2272 wrote to memory of 1900	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	84
PID 2272 wrote to memory of 3404	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	85
PID 2272 wrote to memory of 3404	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	85
PID 2272 wrote to memory of 960	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	88
PID 2272 wrote to memory of 960	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	88
PID 2272 wrote to memory of 3764	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	89
PID 2272 wrote to memory of 3764	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	89
PID 2272 wrote to memory of 4452	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	90
PID 2272 wrote to memory of 4452	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	90
PID 2272 wrote to memory of 4088	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	91
PID 2272 wrote to memory of 4088	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	91
PID 2272 wrote to memory of 1384	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	92
PID 2272 wrote to memory of 1384	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	92
PID 2272 wrote to memory of 1964	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	93
PID 2272 wrote to memory of 1964	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	93
PID 2272 wrote to memory of 4512	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	94
PID 2272 wrote to memory of 4512	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	94
PID 2272 wrote to memory of 5004	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	95
PID 2272 wrote to memory of 5004	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	95
PID 2272 wrote to memory of 2376	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	96
PID 2272 wrote to memory of 2376	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	96
PID 2272 wrote to memory of 3752	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	97
PID 2272 wrote to memory of 3752	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	97
PID 2272 wrote to memory of 2444	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	98
PID 2272 wrote to memory of 2444	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	98
PID 2272 wrote to memory of 4536	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	99
PID 2272 wrote to memory of 4536	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	99
PID 2272 wrote to memory of 4960	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	100
PID 2272 wrote to memory of 4960	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	100
PID 2272 wrote to memory of 3388	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	101
PID 2272 wrote to memory of 3388	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	101
PID 2272 wrote to memory of 856	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	102
PID 2272 wrote to memory of 856	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	102
PID 2272 wrote to memory of 2412	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	103
PID 2272 wrote to memory of 2412	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	103
PID 2272 wrote to memory of 912	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	104
PID 2272 wrote to memory of 912	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	104
PID 2272 wrote to memory of 3960	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	105
PID 2272 wrote to memory of 3960	2272	2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe	105

C:\Users\Admin\AppData\Local\Temp\2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_f5396637e6906a6e49ce4253ab8c5d75_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\System\loXhctk.exe
  C:\Windows\System\loXhctk.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\gkRHMRe.exe
  C:\Windows\System\gkRHMRe.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\ysGklhs.exe
  C:\Windows\System\ysGklhs.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\LjimnIb.exe
  C:\Windows\System\LjimnIb.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\VoWoeoI.exe
  C:\Windows\System\VoWoeoI.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\zmmcNYg.exe
  C:\Windows\System\zmmcNYg.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\DdiqcCp.exe
  C:\Windows\System\DdiqcCp.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\UaaivLM.exe
  C:\Windows\System\UaaivLM.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\OrFARHA.exe
  C:\Windows\System\OrFARHA.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\iBHxLQD.exe
  C:\Windows\System\iBHxLQD.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\bmCZaAa.exe
  C:\Windows\System\bmCZaAa.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\woShJul.exe
  C:\Windows\System\woShJul.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\BfOSoXK.exe
  C:\Windows\System\BfOSoXK.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\ioRxTwf.exe
  C:\Windows\System\ioRxTwf.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\CwlMxcO.exe
  C:\Windows\System\CwlMxcO.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\gfIHphm.exe
  C:\Windows\System\gfIHphm.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\MJjcdbp.exe
  C:\Windows\System\MJjcdbp.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\ClibrvC.exe
  C:\Windows\System\ClibrvC.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\wALaYLV.exe
  C:\Windows\System\wALaYLV.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\WWkQXXM.exe
  C:\Windows\System\WWkQXXM.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\EsBqSas.exe
  C:\Windows\System\EsBqSas.exe
  2⤵
  - Executes dropped EXE
  PID:3960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BfOSoXK.exe

Path C:\Windows\System\BfOSoXK.exe
Size 5.9MB
SHA256 676f731645d2085b74d60b6b5fc41cb7d7e4bbf8d45e14f556bb2cbcb2f3f53e
MD5 9a7798c6cd3f6748866a4d5f8eec8697
SHA1 345d2a4c8201ba69d2d07852e6addd5184198027
SHA512 4960ab4a7a39874a4e46685adbed6dd00a9d4d6bb585cfdcb0c98e6f990604353ae660fce73f691570de1c39e311a7eebb1fb0f06c5188a0481dbd0cdbad9510
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU9:Q+856utgpPF8u/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClibrvC.exe

Path C:\Windows\System\ClibrvC.exe
Size 5.9MB
SHA256 e85e72b733135ddbe7b0a7cda780159a2618a768e7b2d383cadd88ea252c722f
MD5 5b2d99d139c2dbdbb5d5bb7b3e3eacd1
SHA1 bd9b1250fd33757233e6e5b2c714426cd096b29c
SHA512 7bfd2a1bed3c1d0067bb839e4ca301b355e0b8f6b0b296c2d22aa9f48cef3ca54294eeaea34e1ae1a5daf2bf85bab5bf0e68e93242dacce1e5a0bea29f913f6e
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
MD5 SHA1 SHA512 SSDEEP

Submit Download

CwlMxcO.exe

Path C:\Windows\System\CwlMxcO.exe
Size 5.9MB
SHA256 c4704ad20d7443c048b7c6948afe48eb10c90ce4fc6b83ed0379ca71a43b5391
MD5 5a7d3be1f92efc75a880d3e83edf179b
SHA1 8b2247a3ad3c873d1a08784875d953e4fabf929a
SHA512 044b4f046bceda8768d8d4a69871e68096dca1f38a0c7daa9bd3ecc0d5737cc258ecfe1772893d029a8ad42fe7872ac32b558aad6b3821c618f8293dba0e9276
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

DdiqcCp.exe

Path C:\Windows\System\DdiqcCp.exe
Size 5.9MB
SHA256 be1fad3430f14435db155b50ab0aae4038513fff073da11c8250437d2b80f3fa
MD5 7ab3f32de408a1b39385ab0d99e9fd19
SHA1 8ff90caed40cbf3bc9a5708c5a99f737603d1e14
SHA512 2593e240ad48e3bf5370482eb3757f6ee4a6c6b4e05778bfefc3111d080cedb4d5430be42dc87211c674b2e2c9adb87aee7446deddda21ec272ff0561b89bb07
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUE:Q+856utgpPF8u/7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

EsBqSas.exe

Path C:\Windows\System\EsBqSas.exe
Size 5.9MB
SHA256 7327a7330eb5c9ccb946e101f18b9c42dd3f4eb20e76c3e5095d5959d7d2e72a
MD5 58d932336afa4e5d324fff675db7e10c
SHA1 a94ec144cad38fe189845d76d565a8a9a0d24f79
SHA512 6d58127b67725aaaeb9c906d48de569b4bf31ed2333844269978a64d4dd5ebb836642d7b0218d1af7758eeff638ea961671095d7393cd1792a4091487da10762
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

LjimnIb.exe

Path C:\Windows\System\LjimnIb.exe
Size 5.9MB
SHA256 a349ea71a423fddf4fa7f2183293c991baf7536e60fefbca35b4a19c55916274
MD5 8528d2b5efa45e013a6d2dfdf2fcd009
SHA1 580a0f2b039ca7098179223baecb157ba6f3b46e
SHA512 b74c1afd0f28b212c7e2d973422d13a5f383467a008335f8de0803d2f4dd1c86446151ba3f0b32e7ee89b51ac5e64e92b94ac93cef8e871625eb986bd45de476
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUv:Q+856utgpPF8u/7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

MJjcdbp.exe

Path C:\Windows\System\MJjcdbp.exe
Size 5.9MB
SHA256 7c79c68bf8cf7477e756cc50851dba886e6748919cfc48c99fc454b74c217387
MD5 73c70c2f70f98881457bab6681792525
SHA1 52b57d23b85df24e99c0f06067abcd1043808eb2
SHA512 bb64c007664fe925b3bf7fbc36c3879ecf0a4bd3859ae605d39f0926a477f044ef437e59627f77f16cf969016b8df728673cc0190fc741ba4959730295313767
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUV:Q+856utgpPF8u/7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

OrFARHA.exe

Path C:\Windows\System\OrFARHA.exe
Size 5.9MB
SHA256 41754ffa8fbddf1c5659fa555096832cd7e1af54a133dcbd10203593c0a91482
MD5 9fc1367aba04c3c63e22b289116619c4
SHA1 b7ba66dda342c8f815617ce42a452b73247b90e4
SHA512 d8aca89f40a7e7857e3796c598f55a0e26ec84e0a924ddf7a48ca267fe3e7f3e321272ae93e53c8a1a11c5b11d8f4b3bc29a47fa3961c2336d881bca88e07024
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUl:Q+856utgpPF8u/7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

UaaivLM.exe

Path C:\Windows\System\UaaivLM.exe
Size 5.9MB
SHA256 79dace9c2dc61a1e7e0c318f9d597d3b7cddef4f47c4f6000aa3804edd7485b6
MD5 2a8ce3081584ed45a18411ccfbea9753
SHA1 9fba70c734463034394b45dfbbdc6be59029d630
SHA512 d288985306d6e7db482d11ef99a911e74558527f86b252b599bb0e5dfc799bf5e953376284fd73bf19ff1e25ec70d3bd26267283675fcf1191e11e0551412ac7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

VoWoeoI.exe

Path C:\Windows\System\VoWoeoI.exe
Size 5.9MB
SHA256 13863399a8221ca82c59fed8e8800cc3f9eb004e153db1d9ef3bb320acb44225
MD5 f40ec010c81ee45a3dc1f4797702efe2
SHA1 a3c843696ec54ed56004bd34bdaa0fee2c155c99
SHA512 786c4cee21cccc4979110b9f42cc6023fed8474b25859a3bf464bdbf2e22a07d9541a4e99475d7e436e00f28f7b8c12d76d9ec3a69a483ed0be4d113551201f0
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUb:Q+856utgpPF8u/7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

WWkQXXM.exe

Path C:\Windows\System\WWkQXXM.exe
Size 5.9MB
SHA256 a7e4e65c209d7fc493474b7712b35117b51e8231bc86ae13b26a4a76a9a01a2f
MD5 42e7f11c6c0c640df8dc9f8636d0d554
SHA1 a10ded5b307cda772effb694d229e6086f78bae9
SHA512 5433e506faa4470460b176b99da65faf4f05d94d6e7d00a115780d0d39ac4bed67bcc75a820db095143bcd34f4909352308361ddc328d66758ea3514ad83a607
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUW:Q+856utgpPF8u/7W
MD5 SHA1 SHA512 SSDEEP

Submit Download

bmCZaAa.exe

Path C:\Windows\System\bmCZaAa.exe
Size 5.9MB
SHA256 5994457233cba1352b639297a7c909aec0f19ddf8f88642a79f9c854df483461
MD5 2dd09cf538324dff44b91f379985303d
SHA1 b00754bc689e5059adc5c4ab44ee7a85c7a03ee3
SHA512 a497022374214de69e4dea25da1c7262655a20e09bfdc7d4c5b38c27b54f4ae434d72c81b32ef62b52e738b0bd452e169948e3ea66899a14fa676a8d2596fbdb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

gfIHphm.exe

Path C:\Windows\System\gfIHphm.exe
Size 5.9MB
SHA256 5340a50d9c00690c5e6ad7df7acfd3733eb3e5a687820daf45eef8834ebf282e
MD5 a1fff3881cb7e7f6827503b244cb29b5
SHA1 4b93185cce71b35f4b77f7f97954c9ac5267c2a4
SHA512 109d9622f350ef7f1be5e4ae4338d7e0341896fb0561a00bb0faa16753c38c969371dff6d5b15f659a34bb69f44cc2b29dc4c8f6384d69f818de2d6feee11d83
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:Q+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

gkRHMRe.exe

Path C:\Windows\System\gkRHMRe.exe
Size 5.9MB
SHA256 6953566d2176f70d7b62606a45a8be2720e82375655bb6ac91ae751fefbaf216
MD5 095c6de0d8b4be1001fcb97c2cd01606
SHA1 22dd12ea0f7ca6b3c54098d85d30e1d071e91fd0
SHA512 6335d5ca45d839d66aa467615c15f8ca7b352708364242f9ea8e6b7474f6a652d5cdf236142f6ca2694ce3d58f8ebb7cf10453149c3318d54af04aa86ebceba3
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

iBHxLQD.exe

Path C:\Windows\System\iBHxLQD.exe
Size 5.9MB
SHA256 c984ac65192a9281b14092346838418a7c56ac05219fe8a4aadd497ac121d748
MD5 7925cd127cb3bf263612f89dea4ce82b
SHA1 e0e1bd382f3e552b4f3976c626f22e5e2d85a23e
SHA512 efff861d7fee2ce127fa1ae08a58f1971c4c2e66894123334eefea3073b4d7eda0527390bbe52492ae20c44c8e179adaf4242b7bd514b940b5e5fe19b1d632dd
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUD:Q+856utgpPF8u/7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioRxTwf.exe

Path C:\Windows\System\ioRxTwf.exe
Size 5.9MB
SHA256 17b02e6a51ba077ec044522fd276e684bb08e74060481b32e693c848b4851aff
MD5 7186724f22f58a3f58f47ac62349c2f0
SHA1 e183c61cae538bb841ed7aff9856e014d9bfe00f
SHA512 cd2eb903826a204125e9ccc723d8369b1ab7e11e1f5addb7a9046a0986472d6185a8944e1b2fb8cffe92f0e6c61aaa750c572ec62ec496ed24affe3f7a00f322
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUo:Q+856utgpPF8u/7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

loXhctk.exe

Path C:\Windows\System\loXhctk.exe
Size 5.9MB
SHA256 7b5aa091c64a72b68c9a094fddfb6591aae4e498cae8a99439f0eb145ad8b85a
MD5 886a2d457d8c84986b8f8f7d11fa7278
SHA1 d867c7bc314043505c59f6d2fb41be061899dbaa
SHA512 4cab71f9f63ed41647e161bc32f4b7a88b19021bd64af851764777692ad353bc5467bec15281f0d74b34ebdb45e4c2fae5c08b587bac8ad9b81be4686e695be4
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

wALaYLV.exe

Path C:\Windows\System\wALaYLV.exe
Size 5.9MB
SHA256 fa252e6b1b6d2b895e01be663316942166b7e031877c1811870738e9c5d9800b
MD5 09569293d65357d74d0840b941ba079f
SHA1 64fae1f05c1320680971a5eaae769d1bf065b613
SHA512 135b9bcb3fdf6577940416adf2f6931f4e7c0659dc5ad44e43856154cda60ccd82e6d640c3155072d29328de6f791ec48186f485a37e4aed3fcd71afa7c7e3c1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUr:Q+856utgpPF8u/7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

woShJul.exe

Path C:\Windows\System\woShJul.exe
Size 5.9MB
SHA256 0350219996b077cfdd5a8e254793bbcb4c549a23319a4c59ffabd61fcbe05525
MD5 43669dc6baddccb87419cdc6f899ef23
SHA1 ffc40cc2072f8704d98c4beee80a65bec586c406
SHA512 64f610ed8fc3dd3e50deebd254c3522a0c726674079b2dc80b18178b35613932e5c73b0d1863d802f569d04f7ffde22e10a3764f9b4f9d510cd8d5140c96b125
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

ysGklhs.exe

Path C:\Windows\System\ysGklhs.exe
Size 5.9MB
SHA256 775223e108f7f73afef03f483d5208633d7e2fc9030b74a3507b5478d45c7014
MD5 afa1abd9c827fe9a048073c15cba9a11
SHA1 4a44cc158549d890e0cdd44471557d7bd22e4b2c
SHA512 7a16ffc74f98287f7b1a92db1a329bf8249b569178483e7f94c69942c2c93c235edf34233d4d99eb76fe1cf5bd935b3d125ee2f8c750e862abb0720fbc9bd3db
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUi:Q+856utgpPF8u/7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

zmmcNYg.exe

Path C:\Windows\System\zmmcNYg.exe
Size 5.9MB
SHA256 482077c23207d762580ed9819331281efc67ae74479b97198f3b695ecceae488
MD5 9d0a5104b38ef32e7345dd79014563dc
SHA1 f05c61402280ac6ce40ab015f3404631aefd09f8
SHA512 6107dddf882d15b4b33dc72ebd89c0fb06cb9ac65f6e743addf26d4415a3139b27ff66cd2fe590a654be63a90fc20c95af0c8efecca98944915102440edc1f5c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUX:Q+856utgpPF8u/7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/856-158-0x00007FF786FC0000-0x00007FF787314000-memory.dmp

Download

memory/856-139-0x00007FF786FC0000-0x00007FF787314000-memory.dmp

Download

memory/856-116-0x00007FF786FC0000-0x00007FF787314000-memory.dmp

Download

memory/912-132-0x00007FF682BA0000-0x00007FF682EF4000-memory.dmp

Download

memory/912-161-0x00007FF682BA0000-0x00007FF682EF4000-memory.dmp

Download

memory/960-144-0x00007FF778490000-0x00007FF7787E4000-memory.dmp

Download

memory/960-106-0x00007FF778490000-0x00007FF7787E4000-memory.dmp

Download

memory/960-29-0x00007FF778490000-0x00007FF7787E4000-memory.dmp

Download

memory/1384-148-0x00007FF695270000-0x00007FF6955C4000-memory.dmp

Download

memory/1384-52-0x00007FF695270000-0x00007FF6955C4000-memory.dmp

Download

memory/1900-89-0x00007FF67C6A0000-0x00007FF67C9F4000-memory.dmp

Download

memory/1900-142-0x00007FF67C6A0000-0x00007FF67C9F4000-memory.dmp

Download

memory/1900-14-0x00007FF67C6A0000-0x00007FF67C9F4000-memory.dmp

Download

memory/1964-54-0x00007FF638F10000-0x00007FF639264000-memory.dmp

Download

memory/1964-134-0x00007FF638F10000-0x00007FF639264000-memory.dmp

Download

memory/1964-149-0x00007FF638F10000-0x00007FF639264000-memory.dmp

Download

memory/2272-68-0x00007FF6FFF70000-0x00007FF7002C4000-memory.dmp

Download

memory/2272-1-0x000001B1406B0000-0x000001B1406C0000-memory.dmp

Download

memory/2272-0-0x00007FF6FFF70000-0x00007FF7002C4000-memory.dmp

Download

memory/2376-135-0x00007FF6F2B10000-0x00007FF6F2E64000-memory.dmp

Download

memory/2376-152-0x00007FF6F2B10000-0x00007FF6F2E64000-memory.dmp

Download

memory/2376-75-0x00007FF6F2B10000-0x00007FF6F2E64000-memory.dmp

Download

memory/2412-140-0x00007FF648360000-0x00007FF6486B4000-memory.dmp

Download

memory/2412-120-0x00007FF648360000-0x00007FF6486B4000-memory.dmp

Download

memory/2412-159-0x00007FF648360000-0x00007FF6486B4000-memory.dmp

Download

memory/2444-88-0x00007FF694AF0000-0x00007FF694E44000-memory.dmp

Download

memory/2444-137-0x00007FF694AF0000-0x00007FF694E44000-memory.dmp

Download

memory/2444-154-0x00007FF694AF0000-0x00007FF694E44000-memory.dmp

Download

memory/3096-141-0x00007FF7B7C20000-0x00007FF7B7F74000-memory.dmp

Download

memory/3096-82-0x00007FF7B7C20000-0x00007FF7B7F74000-memory.dmp

Download

memory/3096-7-0x00007FF7B7C20000-0x00007FF7B7F74000-memory.dmp

Download

memory/3388-156-0x00007FF7F95B0000-0x00007FF7F9904000-memory.dmp

Download

memory/3388-114-0x00007FF7F95B0000-0x00007FF7F9904000-memory.dmp

Download

memory/3404-19-0x00007FF774E90000-0x00007FF7751E4000-memory.dmp

Download

memory/3404-143-0x00007FF774E90000-0x00007FF7751E4000-memory.dmp

Download

memory/3404-105-0x00007FF774E90000-0x00007FF7751E4000-memory.dmp

Download

memory/3752-136-0x00007FF6E2CF0000-0x00007FF6E3044000-memory.dmp

Download

memory/3752-153-0x00007FF6E2CF0000-0x00007FF6E3044000-memory.dmp

Download

memory/3752-83-0x00007FF6E2CF0000-0x00007FF6E3044000-memory.dmp

Download

memory/3764-131-0x00007FF7B70D0000-0x00007FF7B7424000-memory.dmp

Download

memory/3764-145-0x00007FF7B70D0000-0x00007FF7B7424000-memory.dmp

Download

memory/3764-30-0x00007FF7B70D0000-0x00007FF7B7424000-memory.dmp

Download

memory/3960-160-0x00007FF6297F0000-0x00007FF629B44000-memory.dmp

Download

memory/3960-133-0x00007FF6297F0000-0x00007FF629B44000-memory.dmp

Download

memory/4088-147-0x00007FF7C18E0000-0x00007FF7C1C34000-memory.dmp

Download

memory/4088-49-0x00007FF7C18E0000-0x00007FF7C1C34000-memory.dmp

Download

memory/4452-146-0x00007FF7144A0000-0x00007FF7147F4000-memory.dmp

Download

memory/4452-38-0x00007FF7144A0000-0x00007FF7147F4000-memory.dmp

Download

memory/4512-150-0x00007FF6C4580000-0x00007FF6C48D4000-memory.dmp

Download

memory/4512-74-0x00007FF6C4580000-0x00007FF6C48D4000-memory.dmp

Download

memory/4536-155-0x00007FF671C80000-0x00007FF671FD4000-memory.dmp

Download

memory/4536-107-0x00007FF671C80000-0x00007FF671FD4000-memory.dmp

Download

memory/4960-138-0x00007FF72E670000-0x00007FF72E9C4000-memory.dmp

Download

memory/4960-157-0x00007FF72E670000-0x00007FF72E9C4000-memory.dmp

Download

memory/4960-113-0x00007FF72E670000-0x00007FF72E9C4000-memory.dmp

Download

memory/5004-151-0x00007FF797CD0000-0x00007FF798024000-memory.dmp

Download

memory/5004-79-0x00007FF797CD0000-0x00007FF798024000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads