cobaltstrike | 38beffdd41fb0f6ed2eea60298f5775fedb455ca3340e8b91edc1e593b9468e7

Analysis

max time kernel
137s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
Size 5.9MB
Sample240601-mc7psaaf88
SHA256 38beffdd41fb0f6ed2eea60298f5775fedb455ca3340e8b91edc1e593b9468e7
MD5 c4a10f915ec41f9da525e3d30e0f015c
SHA1 20c158a3713e4c072714ef4d1a79e8ea3cc132d3
SHA512 3c15072af79e45c10b19c71856d27ee647c13e8466cbe287a83aaaf4bcfa592a12a24a160f8cee49f00f757606a4caaf80079e2d2d3e221c7dabe5045f05d6e1
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUG:Q+856utgpPF8u/7G
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023413-5.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023419-21.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023418-22.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023417-11.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341a-29.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341b-34.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341c-40.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341e-54.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002341d-52.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023414-58.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023420-67.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023379-72.dat	cobalt_reflective_dll
behavioral2/files/0x000a00000002337c-81.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023422-91.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023421-89.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023423-96.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002297d-103.dat	cobalt_reflective_dll
behavioral2/files/0x000d000000023378-108.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023424-118.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023425-124.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023426-130.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Reflective DLL injection artifacts 21 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023413-5.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023419-21.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023418-22.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023417-11.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341a-29.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341b-34.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341c-40.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341e-54.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002341d-52.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0008000000023414-58.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023420-67.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0009000000023379-72.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000a00000002337c-81.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023422-91.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023421-89.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023423-96.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000700000002297d-103.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x000d000000023378-108.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023424-118.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023425-124.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/files/0x0007000000023426-130.dat	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/2028-0-0x00007FF6DFC10000-0x00007FF6DFF64000-memory.dmp	UPX
behavioral2/files/0x0008000000023413-5.dat	UPX
behavioral2/memory/852-13-0x00007FF77C930000-0x00007FF77CC84000-memory.dmp	UPX
behavioral2/files/0x0007000000023419-21.dat	UPX
behavioral2/files/0x0007000000023418-22.dat	UPX
behavioral2/memory/2860-20-0x00007FF75BD60000-0x00007FF75C0B4000-memory.dmp	UPX
behavioral2/memory/5004-19-0x00007FF7F1F90000-0x00007FF7F22E4000-memory.dmp	UPX
behavioral2/files/0x0007000000023417-11.dat	UPX
behavioral2/memory/4616-26-0x00007FF7D8C20000-0x00007FF7D8F74000-memory.dmp	UPX
behavioral2/files/0x000700000002341a-29.dat	UPX
behavioral2/files/0x000700000002341b-34.dat	UPX
behavioral2/files/0x000700000002341c-40.dat	UPX
behavioral2/memory/3492-42-0x00007FF64D2C0000-0x00007FF64D614000-memory.dmp	UPX
behavioral2/memory/4920-47-0x00007FF7213C0000-0x00007FF721714000-memory.dmp	UPX
behavioral2/memory/1200-51-0x00007FF681FD0000-0x00007FF682324000-memory.dmp	UPX
behavioral2/memory/4568-53-0x00007FF72E9E0000-0x00007FF72ED34000-memory.dmp	UPX
behavioral2/files/0x000700000002341e-54.dat	UPX
behavioral2/files/0x000700000002341d-52.dat	UPX
behavioral2/memory/2428-32-0x00007FF7711E0000-0x00007FF771534000-memory.dmp	UPX
behavioral2/files/0x0008000000023414-58.dat	UPX
behavioral2/memory/3652-63-0x00007FF731510000-0x00007FF731864000-memory.dmp	UPX
behavioral2/memory/2028-60-0x00007FF6DFC10000-0x00007FF6DFF64000-memory.dmp	UPX
behavioral2/files/0x0007000000023420-67.dat	UPX
behavioral2/files/0x0009000000023379-72.dat	UPX
behavioral2/memory/3540-69-0x00007FF6A27F0000-0x00007FF6A2B44000-memory.dmp	UPX
behavioral2/files/0x000a00000002337c-81.dat	UPX
behavioral2/files/0x0007000000023422-91.dat	UPX
behavioral2/files/0x0007000000023421-89.dat	UPX
behavioral2/memory/3836-84-0x00007FF7F9290000-0x00007FF7F95E4000-memory.dmp	UPX
behavioral2/memory/2180-76-0x00007FF70EBA0000-0x00007FF70EEF4000-memory.dmp	UPX
behavioral2/memory/2860-75-0x00007FF75BD60000-0x00007FF75C0B4000-memory.dmp	UPX
behavioral2/files/0x0007000000023423-96.dat	UPX
behavioral2/files/0x000700000002297d-103.dat	UPX
behavioral2/files/0x000d000000023378-108.dat	UPX
behavioral2/memory/676-111-0x00007FF6E0530000-0x00007FF6E0884000-memory.dmp	UPX
behavioral2/files/0x0007000000023424-118.dat	UPX
behavioral2/files/0x0007000000023425-124.dat	UPX
behavioral2/memory/4632-123-0x00007FF7F9FA0000-0x00007FF7FA2F4000-memory.dmp	UPX
behavioral2/files/0x0007000000023426-130.dat	UPX
behavioral2/memory/3180-126-0x00007FF677850000-0x00007FF677BA4000-memory.dmp	UPX
behavioral2/memory/1200-121-0x00007FF681FD0000-0x00007FF682324000-memory.dmp	UPX
behavioral2/memory/4920-114-0x00007FF7213C0000-0x00007FF721714000-memory.dmp	UPX
behavioral2/memory/3492-113-0x00007FF64D2C0000-0x00007FF64D614000-memory.dmp	UPX
behavioral2/memory/2220-112-0x00007FF7F1460000-0x00007FF7F17B4000-memory.dmp	UPX
behavioral2/memory/4636-101-0x00007FF765980000-0x00007FF765CD4000-memory.dmp	UPX
behavioral2/memory/4444-100-0x00007FF792180000-0x00007FF7924D4000-memory.dmp	UPX
behavioral2/memory/2440-95-0x00007FF7253A0000-0x00007FF7256F4000-memory.dmp	UPX
behavioral2/memory/4568-132-0x00007FF72E9E0000-0x00007FF72ED34000-memory.dmp	UPX
behavioral2/memory/3708-133-0x00007FF6F4D20000-0x00007FF6F5074000-memory.dmp	UPX
behavioral2/memory/3652-134-0x00007FF731510000-0x00007FF731864000-memory.dmp	UPX
behavioral2/memory/3836-135-0x00007FF7F9290000-0x00007FF7F95E4000-memory.dmp	UPX
behavioral2/memory/4636-136-0x00007FF765980000-0x00007FF765CD4000-memory.dmp	UPX
behavioral2/memory/3180-137-0x00007FF677850000-0x00007FF677BA4000-memory.dmp	UPX
behavioral2/memory/852-138-0x00007FF77C930000-0x00007FF77CC84000-memory.dmp	UPX
behavioral2/memory/5004-139-0x00007FF7F1F90000-0x00007FF7F22E4000-memory.dmp	UPX
behavioral2/memory/2860-140-0x00007FF75BD60000-0x00007FF75C0B4000-memory.dmp	UPX
behavioral2/memory/4616-141-0x00007FF7D8C20000-0x00007FF7D8F74000-memory.dmp	UPX
behavioral2/memory/2428-142-0x00007FF7711E0000-0x00007FF771534000-memory.dmp	UPX
behavioral2/memory/4920-143-0x00007FF7213C0000-0x00007FF721714000-memory.dmp	UPX
behavioral2/memory/3492-144-0x00007FF64D2C0000-0x00007FF64D614000-memory.dmp	UPX
behavioral2/memory/4568-145-0x00007FF72E9E0000-0x00007FF72ED34000-memory.dmp	UPX
behavioral2/memory/1200-146-0x00007FF681FD0000-0x00007FF682324000-memory.dmp	UPX
behavioral2/memory/3652-147-0x00007FF731510000-0x00007FF731864000-memory.dmp	UPX
behavioral2/memory/3540-148-0x00007FF6A27F0000-0x00007FF6A2B44000-memory.dmp	UPX

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2028-0-0x00007FF6DFC10000-0x00007FF6DFF64000-memory.dmp	xmrig
behavioral2/files/0x0008000000023413-5.dat	xmrig
behavioral2/memory/852-13-0x00007FF77C930000-0x00007FF77CC84000-memory.dmp	xmrig
behavioral2/files/0x0007000000023419-21.dat	xmrig
behavioral2/files/0x0007000000023418-22.dat	xmrig
behavioral2/memory/2860-20-0x00007FF75BD60000-0x00007FF75C0B4000-memory.dmp	xmrig
behavioral2/memory/5004-19-0x00007FF7F1F90000-0x00007FF7F22E4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023417-11.dat	xmrig
behavioral2/memory/4616-26-0x00007FF7D8C20000-0x00007FF7D8F74000-memory.dmp	xmrig
behavioral2/files/0x000700000002341a-29.dat	xmrig
behavioral2/files/0x000700000002341b-34.dat	xmrig
behavioral2/files/0x000700000002341c-40.dat	xmrig
behavioral2/memory/3492-42-0x00007FF64D2C0000-0x00007FF64D614000-memory.dmp	xmrig
behavioral2/memory/4920-47-0x00007FF7213C0000-0x00007FF721714000-memory.dmp	xmrig
behavioral2/memory/1200-51-0x00007FF681FD0000-0x00007FF682324000-memory.dmp	xmrig
behavioral2/memory/4568-53-0x00007FF72E9E0000-0x00007FF72ED34000-memory.dmp	xmrig
behavioral2/files/0x000700000002341e-54.dat	xmrig
behavioral2/files/0x000700000002341d-52.dat	xmrig
behavioral2/memory/2428-32-0x00007FF7711E0000-0x00007FF771534000-memory.dmp	xmrig
behavioral2/files/0x0008000000023414-58.dat	xmrig
behavioral2/memory/3652-63-0x00007FF731510000-0x00007FF731864000-memory.dmp	xmrig
behavioral2/memory/2028-60-0x00007FF6DFC10000-0x00007FF6DFF64000-memory.dmp	xmrig
behavioral2/files/0x0007000000023420-67.dat	xmrig
behavioral2/files/0x0009000000023379-72.dat	xmrig
behavioral2/memory/3540-69-0x00007FF6A27F0000-0x00007FF6A2B44000-memory.dmp	xmrig
behavioral2/files/0x000a00000002337c-81.dat	xmrig
behavioral2/files/0x0007000000023422-91.dat	xmrig
behavioral2/files/0x0007000000023421-89.dat	xmrig
behavioral2/memory/3836-84-0x00007FF7F9290000-0x00007FF7F95E4000-memory.dmp	xmrig
behavioral2/memory/2180-76-0x00007FF70EBA0000-0x00007FF70EEF4000-memory.dmp	xmrig
behavioral2/memory/2860-75-0x00007FF75BD60000-0x00007FF75C0B4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023423-96.dat	xmrig
behavioral2/files/0x000700000002297d-103.dat	xmrig
behavioral2/files/0x000d000000023378-108.dat	xmrig
behavioral2/memory/676-111-0x00007FF6E0530000-0x00007FF6E0884000-memory.dmp	xmrig
behavioral2/files/0x0007000000023424-118.dat	xmrig
behavioral2/files/0x0007000000023425-124.dat	xmrig
behavioral2/memory/4632-123-0x00007FF7F9FA0000-0x00007FF7FA2F4000-memory.dmp	xmrig
behavioral2/files/0x0007000000023426-130.dat	xmrig
behavioral2/memory/3180-126-0x00007FF677850000-0x00007FF677BA4000-memory.dmp	xmrig
behavioral2/memory/1200-121-0x00007FF681FD0000-0x00007FF682324000-memory.dmp	xmrig
behavioral2/memory/4920-114-0x00007FF7213C0000-0x00007FF721714000-memory.dmp	xmrig
behavioral2/memory/3492-113-0x00007FF64D2C0000-0x00007FF64D614000-memory.dmp	xmrig
behavioral2/memory/2220-112-0x00007FF7F1460000-0x00007FF7F17B4000-memory.dmp	xmrig
behavioral2/memory/4636-101-0x00007FF765980000-0x00007FF765CD4000-memory.dmp	xmrig
behavioral2/memory/4444-100-0x00007FF792180000-0x00007FF7924D4000-memory.dmp	xmrig
behavioral2/memory/2440-95-0x00007FF7253A0000-0x00007FF7256F4000-memory.dmp	xmrig
behavioral2/memory/4568-132-0x00007FF72E9E0000-0x00007FF72ED34000-memory.dmp	xmrig
behavioral2/memory/3708-133-0x00007FF6F4D20000-0x00007FF6F5074000-memory.dmp	xmrig
behavioral2/memory/3652-134-0x00007FF731510000-0x00007FF731864000-memory.dmp	xmrig
behavioral2/memory/3836-135-0x00007FF7F9290000-0x00007FF7F95E4000-memory.dmp	xmrig
behavioral2/memory/4636-136-0x00007FF765980000-0x00007FF765CD4000-memory.dmp	xmrig
behavioral2/memory/3180-137-0x00007FF677850000-0x00007FF677BA4000-memory.dmp	xmrig
behavioral2/memory/852-138-0x00007FF77C930000-0x00007FF77CC84000-memory.dmp	xmrig
behavioral2/memory/5004-139-0x00007FF7F1F90000-0x00007FF7F22E4000-memory.dmp	xmrig
behavioral2/memory/2860-140-0x00007FF75BD60000-0x00007FF75C0B4000-memory.dmp	xmrig
behavioral2/memory/4616-141-0x00007FF7D8C20000-0x00007FF7D8F74000-memory.dmp	xmrig
behavioral2/memory/2428-142-0x00007FF7711E0000-0x00007FF771534000-memory.dmp	xmrig
behavioral2/memory/4920-143-0x00007FF7213C0000-0x00007FF721714000-memory.dmp	xmrig
behavioral2/memory/3492-144-0x00007FF64D2C0000-0x00007FF64D614000-memory.dmp	xmrig
behavioral2/memory/4568-145-0x00007FF72E9E0000-0x00007FF72ED34000-memory.dmp	xmrig
behavioral2/memory/1200-146-0x00007FF681FD0000-0x00007FF682324000-memory.dmp	xmrig
behavioral2/memory/3652-147-0x00007FF731510000-0x00007FF731864000-memory.dmp	xmrig
behavioral2/memory/3540-148-0x00007FF6A27F0000-0x00007FF6A2B44000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
852	HBbVIQf.exe
5004	dgCrDcJ.exe
2860	NJwqZPx.exe
4616	fyMMGoF.exe
2428	psjebCt.exe
3492	FomKXXr.exe
4920	mbEnQSN.exe
1200	gllyxnw.exe
4568	sjvRijT.exe
3652	bBFIXDj.exe
3540	fflhrTY.exe
2180	ZdqjynD.exe
3836	KEnfBQG.exe
2440	fBoVwsQ.exe
4444	evPtqKp.exe
676	ieGNVtM.exe
4636	AJtubec.exe
2220	hgzRhfK.exe
4632	arIumhp.exe
3180	CbPOFIS.exe
3708	OdBsLnV.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2028-0-0x00007FF6DFC10000-0x00007FF6DFF64000-memory.dmp	upx
behavioral2/files/0x0008000000023413-5.dat	upx
behavioral2/memory/852-13-0x00007FF77C930000-0x00007FF77CC84000-memory.dmp	upx
behavioral2/files/0x0007000000023419-21.dat	upx
behavioral2/files/0x0007000000023418-22.dat	upx
behavioral2/memory/2860-20-0x00007FF75BD60000-0x00007FF75C0B4000-memory.dmp	upx
behavioral2/memory/5004-19-0x00007FF7F1F90000-0x00007FF7F22E4000-memory.dmp	upx
behavioral2/files/0x0007000000023417-11.dat	upx
behavioral2/memory/4616-26-0x00007FF7D8C20000-0x00007FF7D8F74000-memory.dmp	upx
behavioral2/files/0x000700000002341a-29.dat	upx
behavioral2/files/0x000700000002341b-34.dat	upx
behavioral2/files/0x000700000002341c-40.dat	upx
behavioral2/memory/3492-42-0x00007FF64D2C0000-0x00007FF64D614000-memory.dmp	upx
behavioral2/memory/4920-47-0x00007FF7213C0000-0x00007FF721714000-memory.dmp	upx
behavioral2/memory/1200-51-0x00007FF681FD0000-0x00007FF682324000-memory.dmp	upx
behavioral2/memory/4568-53-0x00007FF72E9E0000-0x00007FF72ED34000-memory.dmp	upx
behavioral2/files/0x000700000002341e-54.dat	upx
behavioral2/files/0x000700000002341d-52.dat	upx
behavioral2/memory/2428-32-0x00007FF7711E0000-0x00007FF771534000-memory.dmp	upx
behavioral2/files/0x0008000000023414-58.dat	upx
behavioral2/memory/3652-63-0x00007FF731510000-0x00007FF731864000-memory.dmp	upx
behavioral2/memory/2028-60-0x00007FF6DFC10000-0x00007FF6DFF64000-memory.dmp	upx
behavioral2/files/0x0007000000023420-67.dat	upx
behavioral2/files/0x0009000000023379-72.dat	upx
behavioral2/memory/3540-69-0x00007FF6A27F0000-0x00007FF6A2B44000-memory.dmp	upx
behavioral2/files/0x000a00000002337c-81.dat	upx
behavioral2/files/0x0007000000023422-91.dat	upx
behavioral2/files/0x0007000000023421-89.dat	upx
behavioral2/memory/3836-84-0x00007FF7F9290000-0x00007FF7F95E4000-memory.dmp	upx
behavioral2/memory/2180-76-0x00007FF70EBA0000-0x00007FF70EEF4000-memory.dmp	upx
behavioral2/memory/2860-75-0x00007FF75BD60000-0x00007FF75C0B4000-memory.dmp	upx
behavioral2/files/0x0007000000023423-96.dat	upx
behavioral2/files/0x000700000002297d-103.dat	upx
behavioral2/files/0x000d000000023378-108.dat	upx
behavioral2/memory/676-111-0x00007FF6E0530000-0x00007FF6E0884000-memory.dmp	upx
behavioral2/files/0x0007000000023424-118.dat	upx
behavioral2/files/0x0007000000023425-124.dat	upx
behavioral2/memory/4632-123-0x00007FF7F9FA0000-0x00007FF7FA2F4000-memory.dmp	upx
behavioral2/files/0x0007000000023426-130.dat	upx
behavioral2/memory/3180-126-0x00007FF677850000-0x00007FF677BA4000-memory.dmp	upx
behavioral2/memory/1200-121-0x00007FF681FD0000-0x00007FF682324000-memory.dmp	upx
behavioral2/memory/4920-114-0x00007FF7213C0000-0x00007FF721714000-memory.dmp	upx
behavioral2/memory/3492-113-0x00007FF64D2C0000-0x00007FF64D614000-memory.dmp	upx
behavioral2/memory/2220-112-0x00007FF7F1460000-0x00007FF7F17B4000-memory.dmp	upx
behavioral2/memory/4636-101-0x00007FF765980000-0x00007FF765CD4000-memory.dmp	upx
behavioral2/memory/4444-100-0x00007FF792180000-0x00007FF7924D4000-memory.dmp	upx
behavioral2/memory/2440-95-0x00007FF7253A0000-0x00007FF7256F4000-memory.dmp	upx
behavioral2/memory/4568-132-0x00007FF72E9E0000-0x00007FF72ED34000-memory.dmp	upx
behavioral2/memory/3708-133-0x00007FF6F4D20000-0x00007FF6F5074000-memory.dmp	upx
behavioral2/memory/3652-134-0x00007FF731510000-0x00007FF731864000-memory.dmp	upx
behavioral2/memory/3836-135-0x00007FF7F9290000-0x00007FF7F95E4000-memory.dmp	upx
behavioral2/memory/4636-136-0x00007FF765980000-0x00007FF765CD4000-memory.dmp	upx
behavioral2/memory/3180-137-0x00007FF677850000-0x00007FF677BA4000-memory.dmp	upx
behavioral2/memory/852-138-0x00007FF77C930000-0x00007FF77CC84000-memory.dmp	upx
behavioral2/memory/5004-139-0x00007FF7F1F90000-0x00007FF7F22E4000-memory.dmp	upx
behavioral2/memory/2860-140-0x00007FF75BD60000-0x00007FF75C0B4000-memory.dmp	upx
behavioral2/memory/4616-141-0x00007FF7D8C20000-0x00007FF7D8F74000-memory.dmp	upx
behavioral2/memory/2428-142-0x00007FF7711E0000-0x00007FF771534000-memory.dmp	upx
behavioral2/memory/4920-143-0x00007FF7213C0000-0x00007FF721714000-memory.dmp	upx
behavioral2/memory/3492-144-0x00007FF64D2C0000-0x00007FF64D614000-memory.dmp	upx
behavioral2/memory/4568-145-0x00007FF72E9E0000-0x00007FF72ED34000-memory.dmp	upx
behavioral2/memory/1200-146-0x00007FF681FD0000-0x00007FF682324000-memory.dmp	upx
behavioral2/memory/3652-147-0x00007FF731510000-0x00007FF731864000-memory.dmp	upx
behavioral2/memory/3540-148-0x00007FF6A27F0000-0x00007FF6A2B44000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\ieGNVtM.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\CbPOFIS.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\dgCrDcJ.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\FomKXXr.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\KEnfBQG.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\evPtqKp.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\OdBsLnV.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\NJwqZPx.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\mbEnQSN.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\sjvRijT.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\AJtubec.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fflhrTY.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\ZdqjynD.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\hgzRhfK.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fyMMGoF.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\psjebCt.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\gllyxnw.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\bBFIXDj.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\HBbVIQf.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\fBoVwsQ.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
File created	C:\Windows\System\arIumhp.exe	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
Token: SeLockMemoryPrivilege	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 852	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	84
PID 2028 wrote to memory of 852	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	84
PID 2028 wrote to memory of 5004	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	85
PID 2028 wrote to memory of 5004	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	85
PID 2028 wrote to memory of 2860	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	86
PID 2028 wrote to memory of 2860	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	86
PID 2028 wrote to memory of 4616	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	87
PID 2028 wrote to memory of 4616	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	87
PID 2028 wrote to memory of 2428	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	88
PID 2028 wrote to memory of 2428	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	88
PID 2028 wrote to memory of 3492	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	90
PID 2028 wrote to memory of 3492	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	90
PID 2028 wrote to memory of 4920	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	91
PID 2028 wrote to memory of 4920	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	91
PID 2028 wrote to memory of 1200	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	92
PID 2028 wrote to memory of 1200	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	92
PID 2028 wrote to memory of 4568	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	93
PID 2028 wrote to memory of 4568	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	93
PID 2028 wrote to memory of 3652	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	94
PID 2028 wrote to memory of 3652	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	94
PID 2028 wrote to memory of 3540	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	96
PID 2028 wrote to memory of 3540	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	96
PID 2028 wrote to memory of 2180	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	97
PID 2028 wrote to memory of 2180	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	97
PID 2028 wrote to memory of 3836	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	98
PID 2028 wrote to memory of 3836	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	98
PID 2028 wrote to memory of 2440	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	99
PID 2028 wrote to memory of 2440	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	99
PID 2028 wrote to memory of 4444	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	100
PID 2028 wrote to memory of 4444	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	100
PID 2028 wrote to memory of 676	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	101
PID 2028 wrote to memory of 676	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	101
PID 2028 wrote to memory of 4636	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	102
PID 2028 wrote to memory of 4636	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	102
PID 2028 wrote to memory of 2220	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	103
PID 2028 wrote to memory of 2220	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	103
PID 2028 wrote to memory of 4632	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	104
PID 2028 wrote to memory of 4632	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	104
PID 2028 wrote to memory of 3180	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	105
PID 2028 wrote to memory of 3180	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	105
PID 2028 wrote to memory of 3708	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	106
PID 2028 wrote to memory of 3708	2028	2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe	106

C:\Users\Admin\AppData\Local\Temp\2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-01_c4a10f915ec41f9da525e3d30e0f015c_cobalt-strike_cobaltstrike.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\System\HBbVIQf.exe
  C:\Windows\System\HBbVIQf.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\dgCrDcJ.exe
  C:\Windows\System\dgCrDcJ.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\NJwqZPx.exe
  C:\Windows\System\NJwqZPx.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\fyMMGoF.exe
  C:\Windows\System\fyMMGoF.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\psjebCt.exe
  C:\Windows\System\psjebCt.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\FomKXXr.exe
  C:\Windows\System\FomKXXr.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\mbEnQSN.exe
  C:\Windows\System\mbEnQSN.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\gllyxnw.exe
  C:\Windows\System\gllyxnw.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\sjvRijT.exe
  C:\Windows\System\sjvRijT.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\bBFIXDj.exe
  C:\Windows\System\bBFIXDj.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\fflhrTY.exe
  C:\Windows\System\fflhrTY.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\ZdqjynD.exe
  C:\Windows\System\ZdqjynD.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\KEnfBQG.exe
  C:\Windows\System\KEnfBQG.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\fBoVwsQ.exe
  C:\Windows\System\fBoVwsQ.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\evPtqKp.exe
  C:\Windows\System\evPtqKp.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\ieGNVtM.exe
  C:\Windows\System\ieGNVtM.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\AJtubec.exe
  C:\Windows\System\AJtubec.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\hgzRhfK.exe
  C:\Windows\System\hgzRhfK.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\arIumhp.exe
  C:\Windows\System\arIumhp.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\CbPOFIS.exe
  C:\Windows\System\CbPOFIS.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\OdBsLnV.exe
  C:\Windows\System\OdBsLnV.exe
  2⤵
  - Executes dropped EXE
  PID:3708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AJtubec.exe

Path C:\Windows\System\AJtubec.exe
Size 5.9MB
SHA256 f3bc95c70e472d16329978230f74b3aa7224335a7eb8fff513198b61d6cbd895
MD5 219658d720bd3873ff207478d2c57b36
SHA1 4afe758a745d77834804494aa530b7ad5165eaa5
SHA512 72368d13a27aef31bcd29b740155eb6d429d1cbbe53ce8d80ce8c14aeeead4af769030491ecb3c1d9bbd15a9c4b0d5616f6909b730ce3b129cbfcb475e9f4724
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

CbPOFIS.exe

Path C:\Windows\System\CbPOFIS.exe
Size 5.9MB
SHA256 cc9b170d36fecee07bcd68823a20acc7976d43bc95f18e825cd5081b751c15cb
MD5 493883e1408a6e0acafea85deea09a71
SHA1 7e923f42fbc069cba992bdcdf4aa0d7bf8e332ce
SHA512 ecf8e5611a2cd0f8c77f82bcc7a74ab45962ea5dca7ad9c821ffe70084b7cdd89ae38ce3cd0d60d0786eca7a462fb09eeaf1692a4d6655b516565bd591eeb76c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

FomKXXr.exe

Path C:\Windows\System\FomKXXr.exe
Size 5.9MB
SHA256 8aba98fdd44f08b3ee0b009c1389bcad827623d96e32cc6a9e3a27f1c405d938
MD5 651e3f920b1ff142180ef17eb53f7276
SHA1 884e3421d0fcbc29ceba083e8001e3b3791f1d76
SHA512 1052148f8231e0e4e7409d5331a4afb537fd0fa7393d81e31edc5f1c97be7d0e8e6b6a963db7a208257990cd20eebfd9482393ee01524c80b3f4626374a1c369
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUC:Q+856utgpPF8u/7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

HBbVIQf.exe

Path C:\Windows\System\HBbVIQf.exe
Size 5.9MB
SHA256 e43759dbee1c4ca0b2422d6b21590240edb3bae747ee52450bc23798973d19b4
MD5 7c7bdb2de47bd8d9797917175e2b422c
SHA1 95ebfe4bcad068c36345ed36ec796f2e39b514cd
SHA512 51a99c342adcad9c7e910b978f5fbd60813bb275d6e7200f17690dc412ca3293a4365c8c1174eec764148886abdc7dc57da52be5e1fbcb255349dbb712fa2f2d
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

KEnfBQG.exe

Path C:\Windows\System\KEnfBQG.exe
Size 5.9MB
SHA256 5b70a7fe5f457c4707266e22732bf8fe236b97530c9f38bba99a3d773efcb797
MD5 a1b18113481e5f5481fa871bc4420916
SHA1 d0c48e7c815090294e57ce4f79a0bf79a06a5d8e
SHA512 e13870ecfa97041f5ece19b6806d590ba0e644638e8de52d12164a01c8bc9ff91569f77faf45912b9977566105da9d77748cd19287588afe22200aa7457ba963
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU3:Q+856utgpPF8u/73
MD5 SHA1 SHA512 SSDEEP

Submit Download

NJwqZPx.exe

Path C:\Windows\System\NJwqZPx.exe
Size 5.9MB
SHA256 2dbbbcc6cc62b0414f6ad42ed500fd2a9b405304d923745ee6ba52569a401dc5
MD5 8010bdf0b0cb8c7132c5ea7ef8ccff34
SHA1 2de9823265e369c20f6268255e5b49f62c391f7d
SHA512 6d9fa2a881a052e9db78f88a7c64837cd361ff8317ccd571b2bda2b644e905abf6689372483b4cb27f6d221bd99bad6154e38563da5ba8256847ceb4bae8f182
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUx:Q+856utgpPF8u/7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

OdBsLnV.exe

Path C:\Windows\System\OdBsLnV.exe
Size 5.9MB
SHA256 d3a1f2f9c21e7111834d4e3b747af6a7490de4f88e35e7d116963be2aee91db4
MD5 a3a72cfb92941e30ea0d57cceee58b86
SHA1 d62501da4d3783897bab6a85c51bc21a90ca3828
SHA512 dfff99c18031540a3aa1004108ef3e6ae438591f5702da7dd848bb5bc0aafb2c9b84b7d90debb9fbdbe2e195f32ca08dad3eebcd0995fc676228f0751213e33b
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZdqjynD.exe

Path C:\Windows\System\ZdqjynD.exe
Size 5.9MB
SHA256 2cdb5d81828c541788b0fdaffb6aabf51d5e5fc8a931126abb4551b5aa60cbce
MD5 9c21653489655c8a10a43a7dc9bbc7c9
SHA1 50ab66cd672645612798b4ef9437e4dc58b02a8c
SHA512 04d8708165c129f338083a845f9375359aa0a90c78f769c2c67314a5ad6ade521a51abfa5708fad57980dac174e745d0749f8a18bdc50fc532274fbfd484d4a9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUB:Q+856utgpPF8u/7B
MD5 SHA1 SHA512 SSDEEP

Submit Download

arIumhp.exe

Path C:\Windows\System\arIumhp.exe
Size 5.9MB
SHA256 fb7a15de12deca0296c421bbeac2491e9de3f6ad82ce239bd5b1f57e75a07628
MD5 34a686e6dd07811b1044642cae3af03e
SHA1 66011d0c1d2b5b58bf703459e5687cadc93481e1
SHA512 1ed5e53467be9795c2531ad276726ca2a342bcb3f97ee89b20dfe9093b55268c4903bb242513f586aaea41ed74bfae46df77bb0b087001ec1e46e55c5d0ed203
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
MD5 SHA1 SHA512 SSDEEP

Submit Download

bBFIXDj.exe

Path C:\Windows\System\bBFIXDj.exe
Size 5.9MB
SHA256 e1a9520fafb70631fd3fa52beeee08016a65be875f94784a9d525b2f034552a4
MD5 4336fe7bb1922874c84e1ede1cf4b457
SHA1 87c97dd0ff4eaaf8c7574e7c4cc06058cee3782a
SHA512 38198ae5f94047e242e962643959dfc91c300de560014ef342e6c3e4e6f36b30090f1c5782b17d8579a601e5340450179803bbe5233514e966a44481a9e9036a
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUt:Q+856utgpPF8u/7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

dgCrDcJ.exe

Path C:\Windows\System\dgCrDcJ.exe
Size 5.9MB
SHA256 414728b57041f68d78bacf211b7f783c87f3a856d5a860f23c24b1d2eaf38225
MD5 6057db207a2bc302f8f13c5fed1867bc
SHA1 d7b796a4c4ccf94abc1afc0c85935b5ba70b4ece
SHA512 2441001fdbe5473bc18773a7fc9a026660d12fdfbd53c3473b9884e2d21d311511f2137a2e416dfad9ddf5a916b4ee0fa3b2c2e99b8788cad1f0cdd96bd728fb
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU2:Q+856utgpPF8u/72
MD5 SHA1 SHA512 SSDEEP

Submit Download

evPtqKp.exe

Path C:\Windows\System\evPtqKp.exe
Size 5.9MB
SHA256 c1dd4e2a1f718cc3461f36f7d5ade10cd41dafcb9d7fc81e4e0a8e195b439f1a
MD5 86e559905d9e4acc4c915812811285ca
SHA1 49ad9e08ca9ff04ecb726732925db353ee03f44c
SHA512 f7801b653fd40dd7e039b0a6f3fbe32051ac4ae32dcbd6559ffad98e8e2cfab8a7b6f19b6d83eda910224c09d1ea6380e62897503953cefb4bfde1b039ee3727
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

fBoVwsQ.exe

Path C:\Windows\System\fBoVwsQ.exe
Size 5.9MB
SHA256 2c51fea8900261592e66626013a8fd7b8bbf184ed899f43ee0480a3c6b9d88bc
MD5 a65f3b2e3fd79ed7354b41afefa8d602
SHA1 e5666f77628f47be738109251aaaefd68cc6211b
SHA512 f0b75fb4e96d11006cd382704666c05d25d8199f08c7b7e092915f08c9a6cc60bc5b3fb20cfb0b2d35408c37b8ea1c28c1eaaef9abd0a9cc1d9c6b7448772f62
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUk:Q+856utgpPF8u/7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

fflhrTY.exe

Path C:\Windows\System\fflhrTY.exe
Size 5.9MB
SHA256 a63d3149bde38f58e1bc5a7b2f8ee93e81c1cbf4347be509787f79420e289a01
MD5 78e312a4512e3fa5d2443f8b46563b52
SHA1 814acd66726d9ac9c592ce0d07b153cf13af8cbc
SHA512 d36774433b9bb03f8db80b12311b4cf6ec4fe2540f18a912f9ddb1674ebb8e37da8684e1dad1f7675a6de76be8529893a9e5a0f2ba1416ad25486e529c0f8709
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUP:Q+856utgpPF8u/7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

fyMMGoF.exe

Path C:\Windows\System\fyMMGoF.exe
Size 5.9MB
SHA256 59c5b04832d4ac9fc227e804210fa9b13fab63ed757df88458d94cf8035fbde7
MD5 a92b151a2a25c6336e53150ba41fcb12
SHA1 b1c38a4e65dcfbd65c5f5e9db6d091cbfd1eaffb
SHA512 54ad7168cdbe376f13ba91ac7ecc62cacc7f4ffa742d16a95ee2889bde0f720b33d969afb08f118079305c30b04713c2bfad70cec9ee06a6cc9614e9b0c572c7
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUM:Q+856utgpPF8u/7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

gllyxnw.exe

Path C:\Windows\System\gllyxnw.exe
Size 5.9MB
SHA256 a9aa99cdd15fe6ca750f33b20b9691e0288dd05f9ebd0406785b78605a53780d
MD5 591712f31f904675d232a8924dae8a40
SHA1 4a7245240a30fd1caad465f88cb82efc9b7611d8
SHA512 4c75148c0c3f16699e544dc4f5ef0a4d2260dccbc16d60d37fc0c74a93c920ef12f4bd0bedb2de9ed8d9e71392a12583ac4deda6a7528ae6f1c5289e7e0e60a9
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:Q+856utgpPF8u/7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

hgzRhfK.exe

Path C:\Windows\System\hgzRhfK.exe
Size 5.9MB
SHA256 4b1ff101b95b58062b0b9b6fb22bdafc5aa9c55a57abe6a2bf66fd739891a1b6
MD5 93808e1994d09cf495909b4fd9e99431
SHA1 ab2db54bdcef32469ece0355a339726e13750af2
SHA512 d2b5833fba34a0c8476b7e0e3fddbefb9223324198932eeffacd953b7c35d17cb5c17b82a8c7e9f215e2536dcc76f09bd597d9d069726f3e62678e39b3a58f2c
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU4:Q+856utgpPF8u/74
MD5 SHA1 SHA512 SSDEEP

Submit Download

ieGNVtM.exe

Path C:\Windows\System\ieGNVtM.exe
Size 5.9MB
SHA256 d174e6b5259b7ecc4b69fdd99be32e2191d987e6f76e8751afaafe7a8f5c9ea7
MD5 c71c8437f2faa1ac5420fdd7222c98c3
SHA1 708ad03cb9e1fd10f315b08b6d301bd01bb6477b
SHA512 2551706f18437bfd762d116ca9d23b3ca037a0d9919df24998b0074cecb6986482c3933d49722c7ef037779a43304339126b7c708405e039e59e471a122c05d6
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

mbEnQSN.exe

Path C:\Windows\System\mbEnQSN.exe
Size 5.9MB
SHA256 1b3a28df678dde93b6a1c424a9866ee9bb306bfd26bf1cf1c474b01a1dcd2de4
MD5 30bf939b0badac4a795f6f33c2213afc
SHA1 147c5a5d3984e8590f2dab5c547d4a74be2f4e41
SHA512 7a1c330300dd10b076a4ae5d5a683bdfd4ed41ebcf7fbdab39e8889196049e585ca96887a29baa6c64d89c6b30f3fc8e96c78c8f40740e38937afeb6eb622fbf
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUf:Q+856utgpPF8u/7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

psjebCt.exe

Path C:\Windows\System\psjebCt.exe
Size 5.9MB
SHA256 c376bcbb0f58a2fe9b4b14719e9abe53bd133d5ec2b2b01d55acffd1aa661c3e
MD5 2ddf977fec6d82dbe5dd30ffab28a8f0
SHA1 e32856350a3392eac404059464b2760998891a25
SHA512 b7f85d00ab765466fc17c389f88fe21756077ccfcb603b08bb89834a53deed528ac4970ab8ec7c49f9f8da75e752bb7c94601bb6384420b59909ce1675bed2de
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUY:Q+856utgpPF8u/7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

sjvRijT.exe

Path C:\Windows\System\sjvRijT.exe
Size 5.9MB
SHA256 d80e1a99ddbbb2bfac8692d7d6337b0ab25744961457e0cc2f09ccfe0a8503ed
MD5 cdd9d24d78d552866c972bfc37d71d23
SHA1 9824718c767c612e0cdcd07443dda15f72e3f22a
SHA512 3c8677c7699142a15ca892fc5c56ce6fe8f816ccfd44f79b5e7b13f86c7d4d80caca7cd2c4c5921696cc6df3980a16c81afd7a2f3eacd364c5e9cb9343a31c81
SSDEEP 98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUK:Q+856utgpPF8u/7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/676-154-0x00007FF6E0530000-0x00007FF6E0884000-memory.dmp

Download

memory/676-111-0x00007FF6E0530000-0x00007FF6E0884000-memory.dmp

Download

memory/852-138-0x00007FF77C930000-0x00007FF77CC84000-memory.dmp

Download

memory/852-13-0x00007FF77C930000-0x00007FF77CC84000-memory.dmp

Download

memory/1200-146-0x00007FF681FD0000-0x00007FF682324000-memory.dmp

Download

memory/1200-121-0x00007FF681FD0000-0x00007FF682324000-memory.dmp

Download

memory/1200-51-0x00007FF681FD0000-0x00007FF682324000-memory.dmp

Download

memory/2028-60-0x00007FF6DFC10000-0x00007FF6DFF64000-memory.dmp

Download

memory/2028-0-0x00007FF6DFC10000-0x00007FF6DFF64000-memory.dmp

Download

memory/2028-1-0x00000175FD010000-0x00000175FD020000-memory.dmp

Download

memory/2180-76-0x00007FF70EBA0000-0x00007FF70EEF4000-memory.dmp

Download

memory/2180-149-0x00007FF70EBA0000-0x00007FF70EEF4000-memory.dmp

Download

memory/2220-155-0x00007FF7F1460000-0x00007FF7F17B4000-memory.dmp

Download

memory/2220-112-0x00007FF7F1460000-0x00007FF7F17B4000-memory.dmp

Download

memory/2428-142-0x00007FF7711E0000-0x00007FF771534000-memory.dmp

Download

memory/2428-32-0x00007FF7711E0000-0x00007FF771534000-memory.dmp

Download

memory/2440-95-0x00007FF7253A0000-0x00007FF7256F4000-memory.dmp

Download

memory/2440-151-0x00007FF7253A0000-0x00007FF7256F4000-memory.dmp

Download

memory/2860-75-0x00007FF75BD60000-0x00007FF75C0B4000-memory.dmp

Download

memory/2860-140-0x00007FF75BD60000-0x00007FF75C0B4000-memory.dmp

Download

memory/2860-20-0x00007FF75BD60000-0x00007FF75C0B4000-memory.dmp

Download

memory/3180-157-0x00007FF677850000-0x00007FF677BA4000-memory.dmp

Download

memory/3180-126-0x00007FF677850000-0x00007FF677BA4000-memory.dmp

Download

memory/3180-137-0x00007FF677850000-0x00007FF677BA4000-memory.dmp

Download

memory/3492-113-0x00007FF64D2C0000-0x00007FF64D614000-memory.dmp

Download

memory/3492-144-0x00007FF64D2C0000-0x00007FF64D614000-memory.dmp

Download

memory/3492-42-0x00007FF64D2C0000-0x00007FF64D614000-memory.dmp

Download

memory/3540-69-0x00007FF6A27F0000-0x00007FF6A2B44000-memory.dmp

Download

memory/3540-148-0x00007FF6A27F0000-0x00007FF6A2B44000-memory.dmp

Download

memory/3652-63-0x00007FF731510000-0x00007FF731864000-memory.dmp

Download

memory/3652-147-0x00007FF731510000-0x00007FF731864000-memory.dmp

Download

memory/3652-134-0x00007FF731510000-0x00007FF731864000-memory.dmp

Download

memory/3708-158-0x00007FF6F4D20000-0x00007FF6F5074000-memory.dmp

Download

memory/3708-133-0x00007FF6F4D20000-0x00007FF6F5074000-memory.dmp

Download

memory/3836-135-0x00007FF7F9290000-0x00007FF7F95E4000-memory.dmp

Download

memory/3836-150-0x00007FF7F9290000-0x00007FF7F95E4000-memory.dmp

Download

memory/3836-84-0x00007FF7F9290000-0x00007FF7F95E4000-memory.dmp

Download

memory/4444-100-0x00007FF792180000-0x00007FF7924D4000-memory.dmp

Download

memory/4444-152-0x00007FF792180000-0x00007FF7924D4000-memory.dmp

Download

memory/4568-145-0x00007FF72E9E0000-0x00007FF72ED34000-memory.dmp

Download

memory/4568-53-0x00007FF72E9E0000-0x00007FF72ED34000-memory.dmp

Download

memory/4568-132-0x00007FF72E9E0000-0x00007FF72ED34000-memory.dmp

Download

memory/4616-26-0x00007FF7D8C20000-0x00007FF7D8F74000-memory.dmp

Download

memory/4616-141-0x00007FF7D8C20000-0x00007FF7D8F74000-memory.dmp

Download

memory/4632-156-0x00007FF7F9FA0000-0x00007FF7FA2F4000-memory.dmp

Download

memory/4632-123-0x00007FF7F9FA0000-0x00007FF7FA2F4000-memory.dmp

Download

memory/4636-136-0x00007FF765980000-0x00007FF765CD4000-memory.dmp

Download

memory/4636-101-0x00007FF765980000-0x00007FF765CD4000-memory.dmp

Download

memory/4636-153-0x00007FF765980000-0x00007FF765CD4000-memory.dmp

Download

memory/4920-114-0x00007FF7213C0000-0x00007FF721714000-memory.dmp

Download

memory/4920-143-0x00007FF7213C0000-0x00007FF721714000-memory.dmp

Download

memory/4920-47-0x00007FF7213C0000-0x00007FF721714000-memory.dmp

Download

memory/5004-19-0x00007FF7F1F90000-0x00007FF7F22E4000-memory.dmp

Download

memory/5004-139-0x00007FF7F1F90000-0x00007FF7F22E4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads